1. Who we are
Frontier Performance is a research platform operated in connection with Leeds Beckett University. This platform supports the IHT Twin Study and other physiological research projects. The principal investigator is Prof. Barney Wainwright.
2. What data we collect
We collect and store the following categories of personal data from study participants:
- Oura Ring data: daily sleep metrics, readiness scores, heart rate variability (HRV), SpO₂ levels, body temperature deviations
- Polar H10 data: workout sessions, heart rate traces, HR zone distributions, exercise duration and calories
- CPET baseline data: VO₂max, ventilatory thresholds (VT1, RC), metabolic zone tables from cardiopulmonary exercise testing
- Blood test results: haematological markers relevant to the study
- Hypoxic session data: SpO₂ traces during intermittent hypoxic training sessions
- Acute Mountain Sickness assessments: Lake Louise questionnaire scores
- Account data: username and hashed password (we never store plaintext passwords)
3. How we collect data
Data is collected via:
- OAuth connections to your Oura and Polar accounts (you authorise access and can revoke it at any time)
- Manual data entry by researchers (CPET results, blood tests, session observations)
- OxiWear finger pulse oximeters during hypoxic sessions
4. Lawful basis for processing
We process your health data under UK GDPR Article 6(1)(a) (consent) and Article 9(2)(a) (explicit consent for special category data). Your participation is voluntary and you may withdraw consent at any time.
5. How we store and protect your data
- Infrastructure: Google Cloud Platform (Firestore database), hosted in the UK (europe-west2, London)
- Encryption at rest: AES-256 encryption (managed by Google Cloud)
- Encryption in transit: TLS/HTTPS for all data transfers
- Certifications: Google Cloud holds SOC 2, ISO 27001, ISO 27017, and ISO 27018 certifications
- Access control: Authentication required via username/password with JWT session tokens; httponly secure cookies
- Pseudonymisation: Participant data is stored under study identifiers (e.g. twin_a, twin_b) rather than real names
6. Who has access
Access to your data is restricted to:
- The research team (principal investigator and authorised researchers)
- Platform administrators (for technical maintenance only)
We do not sell, share, or transfer your data to any third parties. Google Cloud processes data on our behalf under their standard GDPR Data Processing Addendum.
7. Data retention
Your data will be retained for the duration of the research study and for a reasonable period afterwards as required by academic publication and research integrity standards. After this period, data will be anonymised or deleted.
8. Your rights
Under UK GDPR, you have the right to:
- Access your personal data (data export is available via the platform)
- Rectification of inaccurate data
- Erasure of your data ("right to be forgotten")
- Restrict processing of your data
- Data portability (receive your data in a structured format)
- Withdraw consent at any time without affecting the lawfulness of prior processing
To exercise any of these rights, contact the research team or disconnect your device accounts via the Admin page.
9. Contact
For questions about this privacy policy or your personal data, contact:
Prof. Barney Wainwright, Leeds Beckett University
Email: b.wainwright@leedsbeckett.ac.uk