Questo documento è disponibile in lingua inglese. / This document is provided in English.
Privacy Policy
Information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) — last updated: August 2026
This notice explains how Feel Good Plus S.r.l. processes personal data through the website mypowerset.com and the Powerset platform. It is addressed to visitors of this website, to the professionals and organisations that use the platform, and to the athletes and patients whose data is recorded in it.
Who processes your data
Feel Good Plus S.r.l., Via delle Alghe 70, 00126 Rome (RM), Italy — VAT and Companies’ Register number 15741991002 — certified e-mail feelgoodplussrl@legalmail.it, in the person of its legal representative pro tempore.
For any request concerning personal data, including the exercise of the rights described below, write to info@mypowerset.com.
Two different roles, depending on the data
The role of Feel Good Plus S.r.l. is not the same for every processing operation, and this determines whom you should address:
- Data controller for the data processed through this website, for the contact form, for the creation and administration of professional accounts, for billing and for the security of the service.
- Data processor, pursuant to Article 28 GDPR, for the data that a professional, a club, a federation or a healthcare organisation records in the platform about their own athletes or patients. In that case the controller is the professional or the organisation, who determines the purposes of the processing and to whom the data subject may address requests in the first instance; Feel Good Plus S.r.l. acts on their documented instructions under a data processing agreement.
If you are an athlete or a patient and you are unsure whom to address, you may write to us in any case: we will forward your request to the controller and support them in handling it.
What data is processed
Depending on how you interact with us, the following categories may be processed:
- Contact data submitted through the contact form on this website: name, e-mail address, organisation and the content of the message.
- Account and identification data of professionals and staff: identification and contact details, credentials and access logs, role and organisation.
- Billing and administrative data, where a paid service is provided.
- Data recorded in the platform about athletes and patients: identification data, sporting profile, training calendar and activities, questionnaire answers, physical tests and measurements, data from wearable devices and other connected equipment, and — where the professional records them — health data such as injuries, medical visits, clinical documents, medical fitness certificates and their expiry.
- Technical data generated by the mere use of the website and of the platform: IP address, date and time of the request, requested resource, browser and device type, contained in the standard access logs of the infrastructure.
Health data and biometric data are special categories of personal data under Article 9 GDPR, and are processed only where a professional records them in the platform for the purposes described below.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Replying to a request sent through the contact form | Steps taken at the request of the data subject prior to entering into a contract, and the legitimate interest in answering whoever contacts us (Art. 6(1)(b) and (f)) |
| Providing the platform and the agreed services, managing accounts and support | Performance of a contract (Art. 6(1)(b)) |
| Recording and consulting health data of athletes and patients, for prevention, monitoring, treatment and management of sporting fitness | Explicit consent of the data subject pursuant to Art. 9(2)(a), collected before access to the service and recorded together with the version of the policy accepted. Where the controller relies instead on another condition of Art. 9(2) — such as preventive medicine and health care under Art. 9(2)(h), where the processing is carried out under the responsibility of a professional bound by professional secrecy — that condition is identified by the controller, who is the professional or the organisation |
| Billing, accounting and tax obligations | Legal obligation (Art. 6(1)(c)) |
| Security of the service, prevention of abuse and fraud, technical logs | Legitimate interest in keeping the service safe and available (Art. 6(1)(f)) |
| Service communications and, where applicable, information on product developments | Legitimate interest, or consent where required (Art. 6(1)(f) or (a)) |
Where processing is based on consent, that consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Automated processing and scores
The platform computes, from the data recorded in it, indicators and forecasts describing an athlete’s condition — for example training load, readiness and risk indicators, projections over the following days, and alerts drawing the staff’s attention to a situation. This constitutes profiling within the meaning of Article 4(4) GDPR, and we state it plainly rather than describe the service as free of it.
Those indicators are decision-support tools addressed to the professional, who evaluates them together with everything else they know about the athlete: they do not produce automated decisions producing legal effects or similarly significantly affecting the data subject within the meaning of Article 22 GDPR. No automated decision is taken on access to services, on eligibility to compete, or on any other individual position.
Some functions of the platform use automated language-model services to draft training proposals. Where they do, only the information strictly necessary to generate the proposal is transmitted — such as discipline, training prescription and recent activity indicators — without direct identifiers of the data subject; the service is configured to process that information within the European Union and not to use it to train third-party models. The proposal generated always remains subject to the professional’s review.
Recipients
Personal data may be made known to, or processed on our behalf by, the following categories of recipients:
- providers of cloud infrastructure, hosting, storage, e-mail delivery, authentication, error monitoring and other technical services, appointed as data processors;
- providers of payment and billing services;
- manufacturers and providers of wearable devices and sports equipment, limited to the integrations activated by the user;
- professionals and organisations that use the platform, in respect of the data of their own athletes or patients;
- consultants, accountants and lawyers, and banking or insurance institutions, where necessary for the purposes above;
- public authorities and supervisory bodies, where required by law.
Personal data is not sold, and is not disclosed to third parties for their own marketing purposes. An updated list of the data processors appointed is available on request at info@mypowerset.com.
Transfers outside the European Union
Personal data is processed within the European Union. Where a service provider makes a transfer to a country outside the European Economic Area necessary, the transfer takes place only in the presence of one of the guarantees provided by Chapter V GDPR — an adequacy decision of the European Commission, standard contractual clauses, or another lawful instrument — together with the additional measures required by the circumstances. Information on the guarantees applied to a specific transfer may be requested at info@mypowerset.com.
How long data is kept
Data is kept for the time necessary to the purpose for which it was collected, according to the following criteria:
- Contact requests: for the time needed to handle the request, and for a limited period afterwards to keep evidence of the exchange.
- Account and platform data: for the duration of the contractual relationship with the professional or the organisation. Afterwards data is kept for a limited period, to allow its retrieval or export, and is then deleted or anonymised.
- Data of athletes and patients: the retention period is determined by the controller — the professional or the organisation — also in the light of the retention obligations applicable to health documentation.
- Billing and accounting data: for the period prescribed by tax and civil law.
- Technical and security logs: for a short period, proportionate to the security purpose, after which they are automatically deleted.
Data may be kept beyond these terms where necessary to establish, exercise or defend a legal claim, or to comply with a legal obligation.
Data from wearable devices
Where the user activates an integration with a wearable device or a connected platform, Powerset may collect the data that integration makes available — such as activity, heart rate, sleep and other wellbeing parameters — only after the user has authorised it through the authentication procedure of the relevant provider, and uses it solely to monitor training and wellbeing on behalf of the authorised professional or technical staff.
The authorisation may be revoked at any time from the settings of the provider’s account, or by writing to info@mypowerset.com. Following revocation, data already synchronised is deleted within a reasonable period, save where its retention is necessary to comply with a legal obligation or is required by the controller of the clinical record.
Minors
The platform is used by clubs and federations whose athletes may be minors. Where the athlete is under 14 years of age — the age set by Italian law implementing Article 8 GDPR — the consent is given by the holder of parental responsibility, who also exercises the data subject’s rights on their behalf. From that age the athlete may give consent directly.
The consent of the holder of parental responsibility is collected by the club, the federation or the professional outside the platform, in their capacity as controller: it is they who verify the identity of the person giving it and keep the documentation. The platform records that the consent has been obtained, and on whose declaration, but does not itself collect it from the parent.
This website is not directed at minors and does not knowingly collect their data.
Is providing data mandatory?
Providing data is never a legal obligation, but it may be necessary: without the data marked as required in the contact form we cannot reply, and without the data necessary to operate the platform the service cannot be provided. Refusing to provide optional data has no consequence other than the unavailability of the related function.
Your rights
Under Articles 15 to 22 GDPR you have the right to obtain access to your personal data and information about the processing; to obtain its rectification or erasure, or the restriction of the processing; to receive the data you provided in a structured, commonly used and machine-readable format and to have it transmitted to another controller; to object to processing carried out on the basis of a legitimate interest; and to withdraw consent at any time where the processing is based on it.
To exercise these rights write to info@mypowerset.com. If your data was recorded in the platform by a professional or an organisation, we will forward your request to them, since they are the controller of that processing.
You also have the right to lodge a complaint with a supervisory authority — in Italy the Garante per la protezione dei dati personali (garanteprivacy.it) — or with the authority of the Member State of your habitual residence or place of work.
Cookies and local storage
This website sets no cookies. For the technical local storage used, and for the anti-abuse protection of the contact form, see the cookie policy.
Changes to this notice
This notice may be updated to reflect changes in the service or in applicable law. The date at the top of the page always indicates the current version; substantial changes are brought to the attention of platform users through the service itself.