Privacy Policy

Who we are

GyMap is operated by NRGym (The Mill, Greengate Road, Keighley, BD25 1JH). GyMap is a platform that gyms use to run their members' training, classes, shop and events.

Because of how the platform works, there are two roles. For the data you create through the app as a member of a gym, your gym is the data controller and GyMap acts as its processor, handling that data on the gym's behalf. For the things GyMap decides itself, such as running and securing the platform and billing gyms, GyMap is the controller. This policy covers both. We handle personal data in line with the UK GDPR and the Data Protection Act 2018.

The information we collect

Depending on how you use GyMap, we may collect:

• Account and identity: your name, email address, a securely hashed password, and the gym and role your account belongs to.
• Profile: date of birth, sex, height, activity level, training goal, and a profile photo if you add one.
• Health and fitness information: your body weight and measurements, workout logs (exercises, sets, reps, weights and effort), functional session results, athletic test scores, class attendance, and any progress photos you upload. This is health information, which is a special category of data under UK law, and we treat it with extra care.
• Payments: records of your shop orders, event bookings and any Premium subscription, including amounts, dates, status and the reference IDs from our payment provider. We do not store your card number.
• Device and technical: your notification token and device type (iOS or Android), your notification preferences, and limited server log data such as the requests made and, in some cases, an IP address, which we use to run and protect the service.
• Communications: messages your gym sends you, in-app notifications, and any feedback you choose to send us.

Where it comes from

Most of the information comes directly from you: what you enter in your profile and log during your training. Some comes from your gym, such as a plan an admin assigns you, a test score a coach records, or your membership status. A small amount is generated automatically as you use the app, such as your notification token.

How we use it, and our legal basis

We use your information to:

• Provide the app and its features, including plans, progress tracking, tests, classes, the shop, events and notifications. Our basis is performing our contract with you and the legitimate interest of running the service.
• Take payments and manage any Premium subscription. Our basis is performing a contract.
• Keep the service secure, prevent misuse and fix problems. Our basis is our legitimate interests.
• Send you service messages, and reminders or updates where you have allowed them. You control these in your notification settings. Our basis is your consent or our legitimate interests.
• Handle your health and fitness data. Because this is special-category data, we rely on your explicit consent, which you give by choosing to log it. You can withdraw that consent at any time by stopping and asking us to delete it.

We do not sell your data

We do not sell your personal information, and we do not use it for third-party advertising. There are no advertising or analytics trackers in the app.

What your gym can see

GyMap is a tool your gym uses to coach you. Your gym and its admins can see the information you create so they can support your training: your profile, workouts, weight and measurements, test scores, class attendance and orders. Your gym cannot see your private progress photos.

Every gym's data is kept separate. A gym only ever sees its own members, and you only ever see your own gym. For any data your gym controls, you can also contact your gym directly to access or correct it.

Who we share it with

We share data only with the service providers we need to run GyMap, and only with what each provider needs to do its job. They act under contracts that require them to protect your data:

• Supabase provides our database, secure file storage and login system, hosted in the UK and EU.
• Stripe processes payments. Your card details are entered directly into Stripe and never reach us.
• Resend delivers our emails, such as receipts, confirmations and reminders.
• Expo, and through it Apple and Google, deliver push notifications to your device.
• Render hosts the service that connects the app to our database, in the EU.
• We may also share information where we are required to by law, or to protect the rights and safety of people using the platform.

International transfers

Our core data, including the database and file storage, is held in the UK and EU. Some providers such as Stripe, Apple, Google and Expo may process a limited amount of data outside the UK. Where they do, that transfer is covered by appropriate safeguards, such as UK or EU Standard Contractual Clauses.

How we keep it secure

We protect your data with encryption in transit, hashed passwords, and access controls so that members only see their own data and gyms only see their own members. Progress photos are held in a private area that only you can access. No online service can be completely secure, but we take reasonable steps to keep your information safe.

How long we keep it

We keep your data while your account is active, so your history and progress stay available to you. If you close your account or ask us to delete your data, we remove it, other than limited records we may need to keep for legal reasons such as tax and accounting. You can ask us to delete your account and data at any time using the contact details below.

Deleting your account

You can permanently delete your account at any time from the app. When you do, we erase your personal and health data, including your profile, workouts, weight history, progress photos, test scores and class attendance, and this cannot be undone.

If you have an active Premium membership it is cancelled and you are not charged again. Your gym keeps its own sales records for past orders, as it must for tax, but with your name and personal link removed so those records no longer identify you.

Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or incomplete.
• Ask us to delete your data.
• Restrict or object to how we use it.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time, where we rely on consent.
• Complain to the Information Commissioner's Office at ico.org.uk.

Exercising your rights

You can update much of your information directly in the app. For anything else, contact us or your gym using the details below, and we will respond within one month.

Children

GyMap is intended for adults. If you are under 18, you should only use it with the involvement of your gym and, where needed, a parent or guardian. We do not knowingly collect data from children under 16 without appropriate consent.

Changes to this policy

We may update this policy from time to time. If we make a material change we will let you know, and the date at the top always shows when it was last updated.