Privacy Policy
Effective 10 October 2026 · version 2026-10-10
1. Who we are
UrGymCoach is software for personal trainers (a web dashboard) and an app for their clients (iOS and Android). The service is operated by: [Company or sole trader name], [registered address], Croatian personal ID / VAT no. (OIB): [OIB], [registered in the court / trade register under no. …]. Email: [email protected].
For any privacy question or to exercise your rights, email [email protected].
2. Who this policy covers
- Coaches — use the coach dashboard and pay UrGymCoach.
- Clients — coaches’ clients who use the UrGymCoach app and the sign-up and payment web page.
- Visitors to urgymcoach.com.
3. Who is responsible for your data
- Coach data, visitor data and billing of coaches — UrGymCoach is the controller.
- Client data used for coaching (plans, training and nutrition logs, measurements, check-ins, photos, messages with the coach, questionnaire answers) — the controller is your coach. UrGymCoach is the processor: it processes this data on the coach’s behalf and on the coach’s instructions, under the Data Processing Agreement that is part of the Terms of Use. Your coach decides what to ask you and how to use the data for coaching.
- For some client data UrGymCoach is an independent controller: account login and security, abuse prevention, consent records, support we provide directly and legal obligations.
You can send a request about your data to your coach or to us. If it concerns data your coach is responsible for, we will forward it to the coach and help them respond.
4. What data we collect
Clients
- Account and profile: full name, email, date of birth, gender, profile photo (optional), language, units and app appearance.
- Sign-up questionnaire: answers to your coach’s questions, including photos if your coach asks for them.
- Training: programs your coach assigns, logged sets (weights, reps, RPE), notes, your own exercises and set videos you record.
- Nutrition: meal plans, ticked meals and foods, swaps, your own foods, scanned barcodes and meal photos.
- Daily tasks and measurements: body weight, body fat, body measurements, steps, sleep, water, resting heart rate, HRV, readiness, supplements and progress photos.
- Menstrual cycle and symptoms — only if tracking is turned on.
- Check-ins: answers, scores, notes and photos you send your coach, and the coach’s replies.
- Messages: text, images, videos and voice messages with your coach, reactions and read status.
- Health Connect (Android) and Apple Health (iOS) — only if you turn it on and allow it in your system settings: steps, sleep, body weight, resting heart rate and HRV. We only read this data and never write anything to Health Connect or Apple Health.
- Payments: the chosen service, price, subscription status and Stripe customer and subscription IDs. You enter card details directly with Stripe — we never see or store them.
- Device: push notification token and device type. The app keeps a cache on your device (e.g. the exercise and food database) so it runs faster.
- Consent record: which version of the Terms of Use and Privacy Policy you accepted and when.
Coaches
- Account and profile: name, name shown to clients, email, profile photo, colours and settings.
- Business content: services and prices, programs, meal plans, exercise and food library, questionnaires, tasks and notifications to clients.
- Instagram (optional): the connected account ID, access token and your latest posts, which we show to your clients.
- Billing: data needed to charge the UrGymCoach fee and the connected Stripe account where you receive client payments.
- Communication with us: support messages and a log of email notifications we send you.
All users
- Security and technical data: IP address and email at sign-up (to limit repeated attempts and prevent abuse), login data, a log of important actions (e.g. account deletion) and server logs.
Website
We do not use tracking cookies or analytics. Your browser only remembers the page theme you chose (light or dark). Fonts are loaded from Google Fonts, so your browser sends its IP address to Google.
5. Health data
Much of what you log — weight, measurements, progress photos, sleep, heart rate, HRV, menstrual cycle and sometimes questionnaire answers — is health data, a special category of personal data (Art. 9 of the General Data Protection Regulation, GDPR).
- We process it only with your explicit consent, given at sign-up, and only for your coaching.
- You can withdraw consent at any time by deleting your account (in the app: Settings → Delete account) or by telling your coach or us. Withdrawal does not affect processing that took place before.
- Without this consent we cannot provide the service, because coaching is based on exactly this data.
- Data from Health Connect and Apple Health is shown only to you and your coach. It is not used for advertising, not sold and not shared with third parties other than the processors listed below that are needed to run the service.
6. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| The app and coaching: account, plans, logs, check-ins, messages, notifications | Performance of a contract (Art. 6(1)(b) GDPR); for clients on the coach’s behalf |
| Health data | Explicit consent (Art. 9(2)(a) GDPR) |
| Client subscriptions and charging coaches | Performance of a contract; accounting and tax obligations (Art. 6(1)(c)) |
| Security, abuse and fraud prevention, records of consent and important actions | Legitimate interests (Art. 6(1)(f)) and the duty to demonstrate consent |
| Service notifications (email, push) | Performance of a contract; you can turn push notifications off in your device settings |
| Support and answering questions | Performance of a contract and legitimate interests |
| Establishing and defending legal claims | Legitimate interests |
We do not make automated decisions with legal or similarly significant effects on you and do not profile you for advertising.
7. Who can see your data
- Your coach sees what you log and send in the app, except plans you schedule for yourself in your own calendar.
- UrGymCoach accesses data only when needed to run the service, provide support, keep it secure or meet a legal obligation. Administrators cannot see media in coach–client conversations.
- Processors that help us provide the service:
- Supabase Inc. — database, login, file storage and server functions; servers in Frankfurt (EU).
- Stripe (Stripe Payments Europe Ltd., Ireland) — payment processing. For some processing (e.g. fraud prevention and regulatory duties) Stripe is an independent controller.
- Resend Inc. (USA) — sending emails.
- Expo (650 Industries Inc., USA), Google Firebase Cloud Messaging and Apple Push Notification service — delivering push notifications.
- Meta Platforms (Instagram) — only if a coach connects Instagram, to fetch the coach’s posts.
- Open Food Facts — when you scan a barcode, our server sends only the barcode number, without your personal data.
- [hosting provider of the website and web apps].
- Google Fonts (Google Ireland Ltd.) — website fonts.
- Authorities — only when required by law.
We do not sell personal data and do not share it for advertising.
8. Transfers outside the EU
Most data stays in the European Union. Some processors (Resend, Expo and partly Stripe, Google and Meta) may process data in the USA. Such transfers rely on the EU–US Data Privacy Framework (for certified companies) or on the European Commission’s standard contractual clauses.
9. How long we keep data
- While the account is active.
- When a client deletes their account in the app, their profile, logs, photos, videos, sent messages and consent records are deleted immediately and the subscription is cancelled.
- If a coach closes their account or removes a client, the data is deleted within 30 days unless the law requires us to keep it.
- Database backups: at most 30 days after deletion.
- Records used to limit repeated attempts (IP address, email): at most 24 hours.
- Log of important actions (e.g. that an account was deleted, with email and coach): up to 3 years, for security and dispute resolution.
- Invoices and billing data: as long as accounting and tax law requires (in Croatia generally 11 years).
- The app’s cache on your device is removed when you uninstall the app.
10. Your rights
You have the right to access your data, have it corrected or erased, restrict processing, receive it in a portable format, object to processing based on legitimate interests and withdraw consent at any time.
- You can delete your account and data yourself in the app: Settings → Delete account.
- For other requests email [email protected]. We reply within one month and may ask you to confirm your identity.
- You can complain to the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or to the supervisory authority in the country where you live or work.
11. Children and young people
Clients must be at least 16, or the lower age of digital consent in their country (between 13 and 16, Art. 8 GDPR). Younger users can sign up only with the consent of a parent or guardian, confirmed at sign-up. The app is not intended for children under 13. Coaches must be adults.
12. Security
- All communication is encrypted (HTTPS/TLS).
- Access is limited by database-level rules: each user sees only their own data and a coach only their own clients’ data.
- Private files (progress photos, check-ins, message media) are available only through time-limited links.
- Clients log in without a password, with a link sent to their email.
If a personal data breach occurs, we notify the supervisory authority within 72 hours, and you directly if there is a high risk to your rights.
13. Device permissions
The app asks for access to the camera and photo library (photos and videos), the microphone (voice messages), notifications and Health Connect or Apple Health only when you use that feature. You can revoke permissions at any time in your device settings.
14. Changes to this policy
We publish changes on this page with a new date. We will tell you about important changes in advance by email or in the app, and if something changes that needs your consent, we will ask for it again.