Invictus Performance Lab
Effective 25 September 2026
Invictus Performance Lab (“Invictus”, “we”) runs a training and performance service, and an app that athletes and their care teams use to run it. This page says in plain language what we hold about you, why we hold it, who can see it, and how to have it deleted. No legalese, no surprises.
You, if you are a client of Invictus Performance Lab or you use the Invictus app. It also covers the practitioner console our own staff use, because the same records are on both sides of it.
Your account and profile. Your name, email address, phone number, date of birth and the profile your lab sets up for you — pathway, discipline, training phase and the practitioners on your care team. We use it to run your account and to know whose training is whose. We do not use it for advertising.
Your training. Programmes, sessions, logged sets, attendance, personal bests and your coach’s notes on them. This is the service: without it there is no programme to follow and no progress to show you.
Your health data. Assessments and reassessments, movement and posture screening, pain and injury notes, biomarkers and lab results, readiness and recovery check-ins, sleep summaries, and nutrition and hydration logs. Your care team uses it to decide what you should be doing and to keep you from being hurt by it. This is sensitive personal data and we treat it that way.
Photographs and video. Posture photographs, movement video and body measurements, taken during an assessment or uploaded by you. They are stored in Invictus’s own private cloud storage, never on a public URL, and they are reachable only through a short-lived signed link issued to someone who is already allowed to see them.
Messages. Messages between you and your care team, kept so that both sides keep their history.
Billing. Packages, invoices, payments and refunds — required to run the business and to satisfy tax law.
Apple Health (HealthKit), on iPhone only and only if you connect it. The app reads, read-only: heart-rate variability, resting heart rate, sleep, and — across a session you log — heart rate and active energy. We use them to compute recovery and readiness. We never write to HealthKit, we never sell HealthKit data, we never share it with advertisers or data brokers, and we never use it for marketing, insurance or credit decisions. You can withdraw the app’s access at any time in iOS Settings and the app keeps working without it.
Crash reports. When the app crashes it sends us a technical report so we can fix it. It is scrubbed before it leaves your phone and IP addresses are not stored.
In Invictus’s own PostgreSQL database on Google Cloud SQL, and in Invictus’s own private Google Cloud Storage bucket for files, both in Google’s Mumbai region (asia-south1). Your records stay in the region they were created in; the software enforces that on the way in and on the way out, not only by policy.
You, and the practitioners on your care team — your coach, physiotherapist, nutritionist, the sports scientist running your assessment, and the people who supervise them. Access is enforced inside the database itself, not only in the app: a practitioner who is not on your care team gets no rows, not a hidden button.
Changes to a client record are written to an append-only audit log, so there is always an answer to “who did this, and when”. Nobody can edit that log, including us.
We do not sell your data. We do not show ads. We do not share your health or training data with anyone outside Invictus, except the cloud infrastructure that hosts it (Google Cloud), the messaging and email services that deliver a notification you asked for, and — on iPhone — Apple’s HealthKit framework, which runs on your own device.
Consent here is a ledger, not a setting. Every grant and every withdrawal is recorded with its date and the version of the notice it was given against, and the app shows you your own record under Privacy. To change any of it, speak to your care team or write to us at info@invictusone.com.
For as long as you are a client, and afterwards for as long as we are required to. If you ask us to delete your account we do, subject to the short list of records that law and safety require us to keep — set out in full on the deletion page.
You can delete your account yourself, from inside the app: Settings → Delete my account. It shows you exactly what is erased and what we have to keep, and asks for a six-digit code we email to your account address. Nothing is erased for 14 days — sign in again at any point in that window and the request is cancelled and your account comes back as it was. After that the erasure runs and cannot be undone.
If you cannot get into the app, email info@invictusone.com from your account address and we will do the same thing for you.
The full account-deletion instructions, and the list of what is erased and what is kept, are here: Delete your Invictus account.
Under India’s Digital Personal Data Protection Act you can ask us what we hold about you, ask us to correct it, ask us to delete it, and withdraw a consent you gave. Write to info@invictusone.com from your account address and we will answer. If you are not satisfied with how we handled it, you may complain to the Data Protection Board of India.
Where a client is under 18, the account is set up at the lab with a parent or guardian present, and it is the guardian who gives consent and who can ask us to delete it. The app is not offered to anyone who is not a client of the lab, and it is not directed at children generally.
Invictus is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. The assessments, scores, readings and recommendations in this app — including VO2 max, pain and movement scores, injury notes, biomarkers and readiness — are provided for training and performance purposes only, and are not medical advice, diagnosis or treatment. Always consult a qualified healthcare professional before starting or changing an exercise programme, and about any medical condition, symptom or injury. Never disregard professional medical advice, or delay seeking it, because of something you have read in this app. If you think you may be having a medical emergency, call your local emergency number immediately.