Privacy policy

Every section below describes a service, and applies from the day that service opens. Which ones are open today is a single table: Services open today. Opening one changes that table and changes nothing here.

This policy covers everything GymAI does with personal data, across all of its services: the website gymai.coach, the gym listing and gym accounts, the GymAI app, professional and organisation accounts, paid plans, and the hosted instances we run for our customers. It is written once for the whole platform, so that it does not need rewriting every time a service opens.

Not every service described here is open yet. A section that describes a service applies from the day that service opens to you. The list of services open today is at gymai.coach/legal/services (section 17). Opening a service that this policy already describes does not change the policy. A new kind of processing, a new recipient, or a longer retention period does, and we tell you before it applies (section 16).

Basic information (summary)

1. Who is responsible for your data

The controller is José Conti Calveras, a sole trader established in Spain:

• NIF: ES46745383E
• Address: Avenida República Argentina 190, 4.º 2.ª, 08023 Barcelona, Spain
• Email: j.conti@joseconti.com — for privacy questions and for exercising any of your rights. A person reads it.

We have not appointed a data protection officer, because our processing does not meet the conditions in Article 37 GDPR and Article 34 LOPDGDD. If that changes, we will name the officer here.

We are established in the European Union, so the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Spain's Organic Law 3/2018 on data protection (LOPDGDD) apply to everything we do.

1.1 When we are not the controller

• Instances run for a customer. When a gym, clinic, care home, professional or other organisation pays for its own GymAI instance (for example yourgym.gymai.coach) and enrols its own members, clients or patients, that customer is the controller of their data. We process it only on the customer's instructions, under a data-processing agreement (Article 28 GDPR). Their privacy notice applies, and requests about that data go to them first; we help them answer.
• Professionals' own records. A professional who works with you through GymAI (for example a dietitian or physiotherapist) may have a legal duty to keep their own professional records about you. For those records, the professional is the controller (section 5.6).
• The free, self-hosted version. Anyone may run the free version of GymAI on their own server. Whoever runs that installation is the controller of everything in it. We receive nothing from it and have no access to it.

2. What this policy covers

3. The website and the waiting list

3.1 Visiting the website

We do not use analytics, advertising pixels, tracking or third-party scripts. Our pages load only our own files — except a map, and only when you ask to see one (section 8).

When your browser asks for a page, our server necessarily receives your IP address and the technical details of the request. We use them only to deliver the page and to protect the service (for example, to limit repeated attempts). Rate-limiting keeps your IP address in memory only, for the length of the limit window, and never writes it to our database. Our host's web server and our own application keep technical logs for security and fault-finding: the host's logs contain IP addresses, and our application's log may contain your email address when an email to you could not be sent. They are kept for the period in section 9.

Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).

3.2 The waiting list

If you join the waiting list, we hold:

• your email address (required — it is what we write to);
• which kind of user you are (required — one of the listed roles, so we can open in stages);
• your first name (optional — used only for the greeting);
• your centre and city (optional — offered only if you run a gym, clinic or care home);
• the fact and date of your consent and confirmation, which the GDPR requires us to be able to prove.

Purpose: to tell you that GymAI has launched. Nothing else — no newsletter, no tips, no offers. Legal basis: your consent (Article 6(1)(a) GDPR), given by ticking a box that was not pre-ticked and confirming from your inbox. You can withdraw it at any time with one click in any email we send.

Retention: an address that is never confirmed is deleted when its confirmation link expires (7 days). A confirmed address is kept until you unsubscribe or until the launch message has been sent, and then deleted.

3.3 When you write to us

When you write to us — a question, a request to exercise your rights, a complaint, or a notice that something on GymAI is illegal — we keep your message, your name and email address, and what we did about it. Purpose: to answer you, to decide on notices as the Digital Services Act requires, and to be able to show that we did. Legal basis: our legal obligations (Article 6(1)(c) GDPR; articles 12–22 GDPR; articles 16–17 of Regulation (EU) 2022/2065) and our legitimate interest in defending ourselves against claims (Article 6(1)(f)). Retention: 3 years after the matter is closed. If you report content, we do not tell the person who posted it who you are, unless the law requires it.

4. Gym accounts and the gym listing

4.1 Your gym account

To create an account on gymai.coach we ask for:

• your email address, confirmed by a code we send to it. It is how you sign in, recover access and receive security notices, and it is kept for as long as the account exists;
• a password (we store only a salted scrypt hash, never the password itself), and/or passkeys you register (we store only the public key and a name you give each one);
• where required, a second factor: a second passkey, or an authenticator app (we store the shared secret needed to check its codes);
• where the registration form asks for them, a username, your given name and your surnames. The username is private: only you see it. We check that it is unique across the instances of our platform through an internal service that records the name and which of our instances holds it, never who holds it.

We also keep:

• your sessions (we store only a fingerprint of the session token in your browser's cookie);
• an access log of security events on your account — password set or reset, address confirmed, passkey or authenticator added or removed, sessions ended — with their date. It contains no IP address and no device fingerprint;
• security notices we send you when something changes on your account.

Purposes: creating and running your account, keeping it secure, and letting you recover it. Legal basis: the contract between us (Article 6(1)(b) GDPR) and, for security logging, our legitimate interest in protecting accounts (Article 6(1)(f)).

You must be at least 18 to open a gym, professional or organisation account (see the Terms).

4.2 Gym records and the public listing

The listing describes businesses: a gym's name, its structured address and position on a map, the equipment it has, its services, an optional short note on how to find the door, and — when the gym gives it — its website. A gym record never names, counts or describes a person: it holds no members, staff, photos of people, opening hours, prices, ratings or reviews.

Each fact on a record carries who last changed it and when. That attribution is stored so the record can be corrected and misuse investigated, and it is never published. What is published is the fact and its age.

Some of this may be personal data. If a gym is run by a sole trader, or its name contains a person's name, the gym's name, address and website may relate to an identifiable person. We treat them as personal data in that case.

Purpose: publishing an accurate, up-to-date listing of gyms and their equipment, so people can find where to train and set up their training for the place they are standing in. Legal basis: our legitimate interest, and that of the public, in accurate information about businesses open to the public (Article 6(1)(f) GDPR). The information concerns the business's public-facing activity, is limited to what a customer would see at the door, and never describes a person. You can object at any time (section 12).

Searching the listing. When you search for a gym by your position, your position is used to answer that search and is not stored — not in a log, not against you. We do not keep a history of your searches.

Retention: a gym record is kept while the gym exists. Records are not hard-deleted, so the listing cannot be erased by a false claim; a record that should no longer be public is hidden instead. When the account that made a change is deleted, the attribution stays only as an internal reference that no longer leads to any person.

4.3 If your gym was added by someone else (Article 14 GDPR)

Anyone with an account may add a gym to the listing. If your gym was added by another person, the details came from that person, who described what is visible from the street or inside a public gym. The categories are those in 4.2. We do not publish who added it.

You can claim the record to take charge of it (section 4.4), correct it, or object to it (section 12) — including asking us to hide it where it identifies you as a person. Where we hold your email address (for example because you pre-registered the gym, or claimed it), we tell you about this within one month.

4.4 Pre-registering and claiming a gym

Pre-registration. If you pre-register a gym before the listing opens, we hold your contact email and contact name, the gym's details, and the fact of your consent. Only the owner of GymAI sees your contact details; moderators do not. Purpose: to contact you when the listing opens and to turn your pre-registration into a gym record you can claim. Legal basis: your consent (Article 6(1)(a)). Retention: until the gym has become a record and been offered to you to claim, or 12 months after the listing opens, whichever comes first; then deleted.

Claiming. To prove you control a gym, you give us the gym's website and either an email address at the website's domain (we send a code to it) or, when available, a file placed on the website. We keep who claimed which record, when, how it was proved, and the decision. The email address used to receive the code is erased when the claim is closed; the website and the method remain in the record's history. A claim is always decided by a person, never automatically.

If somebody else claims a gym you already keep, we tell you — the gym, the website domain they proved, and the date by which you can object — and nothing else about them. Likewise, a person whose claim is refused is never told who keeps the gym.

Legal basis: the contract (Article 6(1)(b)) and our legitimate interest in preventing false claims (Article 6(1)(f)).

4.5 Moderation and reports

To keep the listing accurate and lawful, the owner of GymAI and the moderators he appoints review claims, disputes, requests and reports, and may hide a record. We keep:

• the decision: what was decided, the fixed reason, when, and which moderator decided;
• if your record is hidden, the notice we send you and any reply you write to us. Your reply is read only by the moderators and is never published;
• reports made by signed-in users about a record: the reason, an optional comment, and which account reported. The gym is never told who reported it. The comment is erased when the report is closed; the reason, the decision and who decided are kept.

No decision about you or your gym is taken by automated means alone.

Legal basis: our legal obligations as a hosting service under the Digital Services Act (Regulation (EU) 2022/2065) (Article 6(1)(c) GDPR), and our legitimate interest in an accurate and lawful listing (Article 6(1)(f)).

Retention: decisions are kept for as long as the record exists. The text of a gym's replies and of report comments is deleted when the matter is closed, and in any case 12 months after the last message.

4.5a Moderators

People who moderate GymAI on the owner's behalf are added with their email address and sign in with a passkey. We keep their name, the date they were added or removed, and which decisions each one took, so every decision can be accounted for. Legal basis: our legitimate interest in accountable moderation (Article 6(1)(f)). The email address used to invite a moderator is deleted 30 days after the invitation is accepted or cancelled; the record of decisions is kept with the decisions.

4.6 Requests for new equipment or exercises

A gym may ask us to add a machine to the catalogue, with a description and photographs; an app user may ask for a new exercise. Photographs must not show any person: one that does is refused, not blurred. Photographs are never published and are deleted once the request is resolved. The request itself is kept with the catalogue's history; if the requester's account is deleted, the link to them is removed.

5. The GymAI app

This service is not open yet, so nothing here applies to anybody today. It is written so that it is already true on the day it does.

5.1 How the app is built — and why it matters for your privacy

GymAI works on your device first: your workouts are recorded and calculated there, and synchronised with one server copy of your data in the instance your account belongs to (app.gymai.coach for individual users, or your gym's or professional's own instance). There is no second store of your training data anywhere else.

What the server can read. The server can read your training data (workouts, routines, weights, body weight, goals and your profile) in order to synchronise it and, where you allow it, to let a professional work with you. Eight kinds of data are sealed with a key that only you hold: body measurements, pain notes, reasons for missed sessions, custom activities, lift goals, days per week, your health questionnaire (PAR-Q), and activity notes. We cannot read sealed data, and neither can anyone you have not given access to. We never describe your data as "unreadable by anyone" beyond that sealed set, because it would not be true.

5.2 Your account in the app

We ask for a username, your given name and surnames, a confirmed email address, a password or passkeys, and your date of birth. We use the date of birth only to apply the age rules of your country (for example, whether a guardian must be involved) and, in the future, to keep adult-only features for adults. Legal basis: the contract (Article 6(1)(b)) and our legal obligations on minors (Article 6(1)(c); Article 8 GDPR; Article 7 LOPDGDD).

5.3 Your training data

Workouts, sets, weights, routines, endurance and swimming sessions, effort ratings, equipment and places you train (gym, home or outdoors — never a location trace), body weight, goals and profile (birth year, height, sex, activity level). Purpose: to provide the app: prescribing your next session, tracking progress, and syncing across your devices. Legal basis: the contract (Article 6(1)(b)).

5.4 Health data

Some of what you record in the app is health data under Article 9 GDPR: body measurements and body weight, pain notes, reasons for missed sessions, the health questionnaire, and notes you attach to sessions. We process it only with your explicit consent (Article 9(2)(a) GDPR), asked separately and before you first record it. You can withdraw it at any time; withdrawing stops new processing and lets you delete what you recorded, but does not make past processing unlawful.

GymAI is not a medical device. It never diagnoses, and it never draws recommendations about your health from your pain notes, questionnaire, readiness or measurements.

5.5 Children and families

• In Spain, a person aged 14 or over can consent on their own; for anyone younger, a parent or guardian must consent (Article 7 LOPDGDD). Elsewhere we apply the age set by the law that governs the account, from a table we keep. Where an age cannot be established, the features that depend on it stay unavailable until it is — we never assume someone is an adult.
• A minor below the age of consent joins GymAI through a family group administered by a parent or guardian. While the member is under the age of consent, their guardian can see their data, including the sealed set; this is shown on the minor's own access screen. When the minor reaches that age, the guardian's access ends automatically, and both are told in advance.
• Paying for a family plan gives no right to read another adult's data. Adults in a family see each other's data only if they grant it.

5.6 Working with professionals, gyms and clinics

You decide who can see your data. You can grant a trainer, dietitian, physiotherapist, clinic or gym access to the parts you choose, for as long as you choose; you can revoke it at any moment, which also changes the key to your sealed data. Every access by someone else is logged and you can see the log. Legal basis: your consent (Article 6(1)(a) and, for health data, Article 9(2)(a)).

When you stop working with a professional, what they had prescribed stays readable for you, their access to write ends, and you can export everything. A professional who is legally required to keep clinical records about you (for example a dietitian, under Spanish Law 41/2002, for five years) keeps their own copy of those records as controller, even if you delete your GymAI account. We tell you this before you delete.

If you were enrolled by your gym into its own instance, your gym is the controller of that instance (section 1.1): it can read the data it is shown to read, and it must tell you which. You can take your own GymAI identity at any time, which gives you a sealed set only you can open. If you only chose a gym in the app, the gym is never told.

5.7 Optional features that involve other services

Each of these is off until you turn it on, and each tells you, before it is used, exactly what leaves your instance and where it goes:

• Notifications. If you allow notifications, your browser or phone gives us a delivery address run by its vendor (Apple, Google or Mozilla). The message is encrypted end to end to your device, so the vendor sees only ciphertext. Legal basis: consent.
• Recognising a machine from a photo. Only the photo is sent to the recognition service we name on the screen, it must not show people, and it is not kept. Legal basis: consent.
• AI assistance. Where an AI feature is offered, we name the provider and where it runs before you use it, send the minimum needed, and never send pain notes or other sealed data. If you use an AI feature, you will always know you are talking to an AI. Legal basis: consent; for any health data, explicit consent asked specifically for that use.
• Sharing a plan. A shared plan file contains routines and exercises only; nothing personal travels with it.

5.8 Backups, export and leaving the app

You can download a complete backup of your data at any time, in a format you can re-import. Signing out removes your data from that device. Leaving works as described in section 9 and in the Terms (section 16).

6. Professional and organisation accounts

This service is not open yet, so nothing here applies to anybody today. It is written so that it is already true on the day it does.

6.1 Verification

Trainers, dietitians, physiotherapists and other professionals who want professional capabilities may be asked to prove their qualification. For regulated health professions in Spain we check the public register (the Ministry of Health's REPS or the relevant professional college). We record the register, your registration number, the country, the date we checked and who checked it, and re-check once a year. We never keep a scan of your documents unless you choose document review as the way to prove your identity, and then only until it is decided. Legal basis: the contract (Article 6(1)(b)) and our legitimate interest in not presenting unqualified people as professionals (Article 6(1)(f)).

6.2 The professional directory

Being listed in the public directory is your choice and off by default. If you turn it on, we publish the name you choose (it may be a professional name), your areas of work from our fixed list, the venues where you work (the gym's address, never your home — if you work from home we publish an area), your schedule if you switch it on, and, for regulated professions, the register and the fact that you are verified, with a link to the register. We never publish your email, phone, clients, client counts, ratings or testimonials. Turning it off removes your listing immediately. Legal basis: your consent (Article 6(1)(a)).

Search engines may keep a copy of a public page for a while after we remove it; we cannot control that, but we will ask them to refresh it if you ask us.

6.3 Organisation accounts and their instances

When an organisation pays for its own instance, we hold the account and billing data of the organisation and of the people who manage it, as controller. Everything inside the instance about its members, clients or patients is the organisation's, and we are its processor (section 1.1). No clinical records are ever stored on our platform: clinics prescribe exercises and nothing else.

6.4 Integrations and bulk import

An organisation may import its gym records from a file or connect through an API key. Imports carry business data only (name, address, equipment, services); columns about people are ignored and not stored. API access to a member's data is limited to what that member has granted and never reaches the sealed set. Each key is shown once; we keep only its fingerprint and who created it.

7. Paid plans, billing and referrals

This service is not open yet, so nothing here applies to anybody today. It is written so that it is already true on the day it does.

7.1 Payments and billing

When you pay for GymAI we hold your billing details (name or business name, tax number where needed, billing address, email), your plan and its history, and your invoices. We never see or store your card number: payment is handled by the payment service of our bank through Redsys, and we keep only a token that lets the bank charge the card you authorised, treated as a credential. If you subscribe through Apple's App Store or Google Play, the store handles the payment under its own terms and privacy policy, and gives us only what is needed to confirm your subscription.

Legal basis: the contract (Article 6(1)(b)) and our tax and accounting obligations (Article 6(1)(c)). Retention: invoices and accounting records are kept for six years (Spanish Commercial Code, article 30) and tax records for the periods the tax law requires; after that they are deleted.

A lapsed payment never locks you out of your own data: you can always sign in to renew, back up, close or delete your account.

7.2 Referral programme

If you refer someone, we keep an opaque referral code linking the two accounts, to credit the reward and prevent abuse. The person who referred sees a count, never a name. The person referred is told at sign-up. Legal basis: the contract. Retention: while the reward can be earned or reversed, and then as part of billing records if it affected a charge.

8. Who else receives your data

We do not sell your data, rent it, or share it for advertising — to anyone, in any form.

Apart from the map, our site uses fonts, scripts and styles served from our own server only. When we turn an address into a map position, we do it on our own servers: no address you type is sent to a third party.

Transfers outside the EEA. We do not transfer your data outside the European Economic Area. The push services of Apple and Google, which you choose by allowing notifications on their devices or browsers, may operate from outside the EEA under their own terms; they receive only a delivery address and an encrypted message. If another feature you turn on requires a transfer, we will name the recipient and the safeguard before you use it (an adequacy decision or the European Commission's standard contractual clauses).

9. How long we keep data

The retention for each kind of data is stated where it is described. In summary:

Deletion in Spain works in two steps. When data has to be deleted but we might still need to answer for our handling of it, Spanish law (Article 32 LOPDGDD) requires us first to block it: it is set apart and nobody can use or see it, except to make it available to courts, the public prosecutor or the data-protection authority, and only for the time within which a claim could be brought. After that, it is destroyed.

10. How we protect your data

• Everything travels encrypted over HTTPS, and our server hands email to our mail server only over TLS.
• Passwords are stored as salted scrypt hashes; sign-in, reset and claim codes as slow hashes, single use, with a few attempts and a short expiry; session tokens only as fingerprints.
• Passkeys and authenticator apps are supported; a second factor (a second passkey or an authenticator app) is required before a gym record can be edited.
• The administration of GymAI can only be reached with a passkey.
• No IP address or device fingerprint is stored in our databases.
• Sealed app data is encrypted with a key only you hold.
• Every change to your account's security is emailed to you.
• Databases are kept outside the public web space.

No system is perfectly secure. If a breach puts your rights at high risk, we will tell you without undue delay, and we will notify the AEPD within 72 hours where the law requires it.

11. Cookies and similar technologies

We use only cookies that are strictly necessary for a service you asked for:

They are set only after you sign in, belong to our own site, and contain an unguessable token, not your data. Under article 22.2 of Spain's Law 34/2002 (LSSI) they need no consent, which is why we show no cookie banner. We set no analytics, advertising or third-party cookies. If that ever changes, we will ask for your consent before any such cookie is set, not after.

The app also stores your data in your browser's own storage so it works offline; it stays on your device and is removed when you sign out.

12. Your rights

You have the right to:

• access your data and receive a copy;
• rectify inaccurate data;
• erase it ("right to be forgotten");
• restrict how we use it;
• object to processing based on our legitimate interests — including the publication of a gym record that identifies you (section 4.3);
• portability: receive the data you gave us in a structured, machine-readable format;
• withdraw consent at any time, without affecting earlier processing;
• not be subject to decisions based solely on automated processing; we take none.

Much of this you can do yourself, from your account or the app (for example, closing or deleting your account, or downloading a backup of your app data). For anything else, write to j.conti@joseconti.com from the address linked to your account, saying which right you want to exercise. If we cannot confirm it is you, we may ask for something that proves it — never more than needed. It is free, and we answer within one month (extendable by two months for complex requests, in which case we tell you why within the first month).

Parents and guardians exercise these rights for children under 14.

If you believe we have not respected your rights, you can complain to the Agencia Española de Protección de Datos (www.aepd.es, electronic office sede.aepd.gob.es), or to the authority of the country where you live or work. We would appreciate the chance to fix it first, but it is your right either way.

13. Data you give us about other people

If you add a gym, you must describe only the business, never a person. Do not include personal data of anyone else in any field or photograph.

14. Is providing your data required?

The data marked as required when you create an account or pay is needed to provide that service; without it we cannot open the account or take the payment. Everything else is optional, and not giving it costs you nothing except the feature it serves.

15. Automated decisions and profiling

We do not make decisions about you based solely on automated processing, and we do not profile you for marketing. The app calculates your next training session from your own history: that is the service you asked for, it has no legal or similarly significant effect, and you can always change it.

16. Changes to this policy

When we change this policy, we update the date at the top. If the change is significant — a new kind of processing, a new recipient, a longer retention period, or a new purpose — we tell you by email or in your account at least 30 days before it applies, and, where the processing relies on your consent, we ask for it again. Opening a service already described here is not a change to this policy.

17. Services open today

The list of GymAI services that are open, and the date each opened, is at gymai.coach/legal/services.