Terms of service for trainers
Draft: the owner's details must be completed before publishing.
These terms govern the use of Active Coach by trainers. The service is provided by [TITULAR], tax ID [NIF], address [DIRECCIÓN] ("Active Coach"). By creating your account you accept them, together with the data processing agreement in the annex.
1. The service
Active Coach is a tool for personal trainers to build workout and diet plans, assign them to their clients and follow their progress. It is in alpha: access is by invitation, features may change and no particular availability is guaranteed. Pricing, if any, is agreed separately.
2. Your account
- You must be of legal age and use the service as part of your professional activity.
- You are responsible for keeping your password safe and for what is done with your account. If you think someone has accessed it, change your password and close open sessions from your profile.
3. Acceptable use
You may not use the service for unlawful purposes, upload content you have no right to use, try to access other users' data, bypass security measures or deliberately overload the service.
4. Your content
Your templates, catalogs and other content are yours. You allow us to store and display them only as needed to provide the service. You can download them at any time from your profile.
Exception: foods. The foods you create in the catalog (their name and nutritional values per 100 g) are added to a food base shared by all users, after a review by Active Coach. By creating them you allow us to publish them and any user to use them, without your name appearing as the author. While pending, only you and your clients see them; if they are rejected, or you delete your account before they are approved, they are deleted, and those already approved stay in the common base with no reference to you. Your dishes, templates and other content remain yours alone.
5. Your clients' data
For your clients' data you are the controller and Active Coach your processor (annex). In particular, it is your responsibility to:
- Ask only for the data your service needs and use it only for that service.
- Have a legal basis. For health data, the app collects each client's explicit consent when they sign up and lets them withdraw it; if you track a client who doesn't use the app, collecting that consent is up to you.
- Inform your clients (you can refer them to the app privacy policy, adding your contact details as controller).
- Respond to their rights: the app lets you export and delete each client's data, and lets them download it, delete it and withdraw their consent.
- Not record health data for a client who has withdrawn their consent.
6. Closing your account
You can delete your account at any time from your profile: your account, your content and your clients' accounts and data are erased. Download them first if you want to keep them. We may suspend or close an account that breaches these terms, notifying you first unless it is urgent.
7. Liability
We take reasonable measures to keep the service running and the data secure but, being in alpha, we do not guarantee it will be free of errors or interruptions. Active Coach does not provide health or sports advice: the plans and their suitability for each client are the trainer's responsibility. Nothing here limits liability that cannot be limited by law.
8. Changes
If we change these terms significantly, we will publish the new version here and the app will ask you to accept it before continuing. If you don't accept it, you can download your data and close your account.
9. Governing law
These terms are governed by Spanish law.
Annex. Data processing agreement (art. 28 GDPR)
Between the trainer (controller) and Active Coach (processor), forming part of these terms.
1. Subject matter, duration, nature and purpose
The processor processes the controller's clients' data to provide the Active Coach service: hosting and storing it, showing it to the controller and to each client, and the necessary technical operations (backups, photo and video recompression, metadata removal). The agreement lasts as long as the controller's account.
2. Data and data subjects
Data subjects: the controller's clients. Data: identification and contact data (name, email), account data, health data (body measurements, injuries, allergies, sleep, nutrition and workouts), images (body photos and videos), voice (audio notes) and technical and consent records.
3. Processor obligations
- Instructions: process the data only on the controller's documented instructions, which are these terms and what the controller configures in the app, and inform the controller if an instruction infringes the law.
- Confidentiality: only authorised persons bound by confidentiality access the data, and only when needed for the service or to resolve an incident.
- Security (art. 32): encrypted connections; hashed passwords and attempt limits; files only reachable through signed, expiring links; logging of access to photos, videos and audio; removal of location metadata; validation of uploads; encrypted off-site backups; and periodic review of these measures.
- Sub-processors: the service runs on its own infrastructure in Spain, and backups are stored encrypted with an EU storage provider that has no access to their content. The controller gives general authorisation to engage other sub-processors; they will be notified 30 days in advance of any change so they can object, and the same obligations as in this agreement will be imposed.
- Transfers: no data is transferred outside the European Economic Area.
- Data subject rights: help the controller respond to them; the app already allows exporting, rectifying and deleting each client's data, and withdrawing consent. If a client contacts the processor, the request will be passed on to the controller.
- Personal data breaches: notify the controller without undue delay and in any case within 48 hours of becoming aware, with the information available so they can notify the authority within 72 hours and, where appropriate, the people affected.
- Assistance: help the controller with impact assessments and prior consultations, with the information available.
- End of the agreement: when the account is deleted, erase the data and files immediately (the controller can export them first); they disappear from backups within 6 months at most.
- Demonstrating compliance: make the necessary information available to the controller and allow reasonable audits with prior notice.
4. Controller obligations
Have a legal basis for the processing, inform their clients, give the processor lawful instructions and respond to their clients' rights.