App privacy policy

Version 2026-10-09.2

Draft: the owner's details must be completed before publishing.

Active Coach is an application that personal trainers use to follow their clients: workouts, diet, measurements, progress photos, technique videos and check-ins. Here we explain what data is processed, who processes it and what your rights are. The website has its own privacy policy.

1. Who processes your data

If you are a trainer, the controller of your account data is [TITULAR], tax ID [NIF], address [DIRECCIÓN], email [CORREO DE CONTACTO] ("Active Coach").
If you are a client of a trainer, the controller of your data is your trainer: they invite you, decide which data to ask for and use it to follow your progress. Active Coach processes that data only on your trainer's behalf and following their instructions, as a processor, under a data processing agreement (included in the terms of service).

2. What data is processed

Clients

Account: name, email, password (stored only as a hash, never in plain text) and language.
Onboarding form: your answers to your trainer's questions (for example, goal, injuries or allergies).
Tracking: body measurements (weight, body fat, girths and any your trainer defines), progress photos, technique videos, workouts (sets, weights, reps and effort), logged meals and foods, daily goals (steps, sleep, water…), check-ins (answers and voice notes) and your trainer's replies.
Consent: date, version of the accepted text, IP address and browser from which you gave or withdrew it.
Access log: who opens your photos, videos and audio, when and from which IP address.
Technical data: IP address in server logs and security controls (for example, the sign-in attempt limit).

Much of this is health data (measurements, body photos, injuries, allergies, sleep…), a special category of data (art. 9 GDPR) processed with the safeguards described below.

Trainers

Name, email, password (as a hash), language and preferences.
Templates, exercise and dish catalogs, and any other content you create.
Acceptance of the terms: date, version, IP address and browser.

3. Purposes and legal bases

Client tracking by their trainer (plans, progress, check-ins): based on the client's explicit consent (art. 6.1.a and 9.2.a GDPR), requested when the account is created, in a separate unticked box, and withdrawable at any time from the profile. Non-health data (name, email) is also processed to provide the service agreed with your trainer (art. 6.1.b).
Providing the service to trainers (account, templates, client management): performance of the contract (art. 6.1.b).
Security (file access log, attempt limits, server logs): legitimate interest in protecting the data and the security obligation (art. 6.1.f and 32 GDPR).
Being able to prove consent and acceptance of the terms: legal obligation (art. 6.1.c and 7.1 GDPR).

Data is not used for advertising, not sold, not profiled for commercial purposes, and no automated decisions with legal effects are made.

4. Who else sees it

A client's data is only seen by the client and their trainer, with one exception: the foods you create (name and nutritional values per 100 g) may, after a review, move to the common food base that all users see. They carry neither your name nor any other data about you. While under review, the platform's administrators see your name and your trainer's name next to them.
It is not shared with third parties unless required by law.
The application runs on its own server in Spain. Backups are stored encrypted with a storage provider in the European Union, which cannot read them.
The catalog's exercise animations are loaded from GitHub (raw.githubusercontent.com): when you view them, your browser connects to that service, which receives your IP address but no other data about you.
There are no international transfers of application data.

5. How long it is kept

For as long as the account exists. When it is deleted (from the profile or, for a client, if their trainer deletes their profile) data and files are erased immediately. Backups rotate automatically: deleted data disappears from them within 6 months at most.
The file access log is kept for 12 months.
Consent records are kept for as long as the account exists.
Foods you created that are pending or rejected are deleted with your account; those already approved stay in the common base with no reference to you.

6. Your rights

You can request access, rectification, erasure, objection, restriction and portability of your data, and withdraw your consent at any time without affecting prior processing. Many can be exercised directly in the app:

Download your data (portability): Profile → Your data.
Delete your account and everything recorded: Profile → Danger zone.
Withdraw consent (clients): Profile → Privacy. Your trainer is notified and no more health data of yours can be recorded until you give it again.
Delete a specific entry (measurements, photos, videos, check-ins or workouts): from your progress.

If you are a client, for anything else contact your trainer, who is the controller; you can also write to [CORREO DE CONTACTO] and we will pass it on. If you are a trainer, write to [CORREO DE CONTACTO]. If you believe your rights have not been respected, you can lodge a complaint with your data protection authority (in Spain, the AEPD, aepd.es).

7. How it is protected

Encrypted connection (HTTPS with TLS 1.2 or higher).
Passwords stored only as hashes, with a sign-in attempt limit.
Photos, videos and audio are not public: they only open through signed links that expire, and every access is logged.
Metadata that can reveal location (GPS), device or date is removed from photos and videos.
Encrypted backups outside the server.

8. Minors

The application is not intended for and does not admit children under 14: when creating the account, the client confirms they are at least 14 (art. 7 of the Spanish data protection act, LOPDGDD). Trainers must be of legal age.

9. Changes to this policy

If this policy changes significantly, a new version will be published here and the application will ask for consent again before continuing.