Data Handling

Data Collection and Processing

At Trainly, we handle app data with transparency and purpose limitation. This page explains how the current coaching platform processes account, workout, nutrition, measurement, media, message, notification, and optional health-sync data.

1. Types of Data We Handle

1.1 Account Data

• Identity Information: Name, email address, username
• Authentication Data: Encrypted passwords, device tokens
• Profile Information: Profile photos, preferences, tenant or coach association
• Contact Details: Phone number and support contact details where provided

1.2 Health and Fitness Data

• Physical Metrics: Height, weight, body measurements, BMI
• Fitness Goals: Weight loss, muscle gain, endurance targets
• Activity Data: Workout sessions, exercise types, duration, intensity
• Progress Tracking: Weight changes, strength improvements, endurance gains
• Nutrition Data: Assigned nutrition plans, meal details, dietary preferences, notes
• Media Data: Optional progress photos and profile images
• Health Sync Data: Optional steps or activity data if you connect a supported health source

When you join a source-verified step challenge and grant health access, Trainly sends step record identifiers, source identifiers, recording method, start and end times, and step counts to its server to check eligibility, duplicates and overlaps and calculate challenge scores. These records are processed transiently; daily summaries and evidence digests are retained. Manual entries and records with unknown recording methods do not qualify. Source metadata is not proof of physical activity. This source-record processing applies to joined source-verified step challenges, not every health connection or challenge type.

1.3 Technical Data

• Device Information: Device model, OS version, app version
• Optional Analytics: Optional Firebase Analytics collection starts off and is enabled only if you opt in; you can turn it off again in the app. This choice controls optional Analytics, not the separate Crashlytics crash-reporting or Firebase Cloud Messaging notification services.
• Performance Data: App crashes, loading times, error logs
• Notification Data: Push tokens and notification status used to deliver app reminders
• Trainly records your account’s access status — for example whether a trainer or administrator has granted, limited or revoked access to coaching content — together with any access requests you submit to them.

1.4 Tenant Customization Data

• Branding: Tenant logo, primary and secondary colors, cover image, profile picture, intro video URL, and gallery images
• Profile Copy: Tenant name, tagline, welcome message, biography, certifications, website, and social links
• App Experience: Selected dashboard labels, feature availability, and tenant-specific app settings where enabled

2. Data Processing Principles

2.1 Lawful Basis

We process your data based on:

• Consent: Optional permissions such as notifications, photos, camera, and health sync
• Service Delivery: Processing needed to provide workouts, nutrition, coaching, progress tracking, subscriptions, and account access
• Legitimate Interests: Improving app reliability, preventing abuse, and supporting users
• Legal Obligations: Compliance, accounting, fraud prevention, and lawful requests where applicable

2.2 Data Minimization

We only collect and process data that is:

• Necessary for providing our fitness services
• Relevant to your fitness goals and preferences
• Limited to what you explicitly provide or consent to
• Updated regularly to maintain accuracy

3. Data Storage and Security

3.1 Storage Infrastructure

• Cloud Infrastructure: Production backend services, database storage, and media storage
• Backup Systems: Backups and retention controls designed to protect service continuity
• Access Controls: Role-based access for users, coaches, tenants, administrators, and support operators
• Local Storage: Some tokens, preferences, and workout progress may be stored on-device to keep the app responsive

3.2 Encryption Standards

• Data in Transit: HTTPS/TLS for network communication
• Stored Data: Cloud-provider protections and access controls for production data
• On-Device Secrets: Secure storage is used for sensitive session data where supported
• Operational Controls: Limited administrative access and environment-specific credentials

3.3 Security Measures

• Separation of production and staging environments
• Restricted access to production credentials and user data
• Application logging and error monitoring for reliability
• Security review for data-sensitive changes
• Incident response and user notification procedures where required

4. Data Processing Activities

4.1 Personalization

We process your data to:

• Display assigned workout and nutrition plans
• Help coaches and authorized administrators support your program
• Track measurements, progress photos, workout completion, and plan history
• Send reminders and account messages when enabled

4.2 Progress Tracking

Your data helps us:

• Monitor your fitness journey and achievements
• Generate progress reports and analytics
• Identify patterns and trends in your activity
• Provide motivational insights and recommendations

4.3 App Improvement

We may analyze technical and aggregated data to:

• Improve app performance and user experience
• Develop new features based on user needs
• Fix bugs and optimize functionality
• Understand usage patterns and preferences

4.4 Tenant Customization

Tenant branding settings are used to make the app experience feel closer to the coach, trainer, or fitness business a trainee is working with. This can include branded login/profile visuals, app colors, welcome copy, profile media, social links, dashboard labels, and enabled feature areas.

5. Data Sharing and Third Parties

5.1 Service Providers

Trainly uses hosting and infrastructure providers to store and process account data, an email delivery provider to send account-related messages, and Google Firebase for crash reporting and push-notification delivery, as described in the diagnostics and messaging section. This app release does not include in-app purchases or app-store checkout.

5.2 Data Processing Agreements

All third-party providers must:

• Use data only to provide contracted services
• Apply appropriate security and access controls
• Protect data from unauthorized access or disclosure
• Support deletion, security, and compliance workflows where applicable

6. Your Data Rights

6.1 Access and Portability

• View Your Data: Access all personal data we hold about you
• Data Export: Request a copy of your account data by contacting support
• Data History: View available workout, nutrition, and progress history in the app
• Processing Activities: Information about how your data is processed

6.2 Control and Management

• Update Information: Modify or correct your personal data
• Delete Data: Request permanent deletion of your account and data
• Restrict Processing: Limit how we process certain data types
• Object to Processing: Opt out of specific data processing activities

6.3 Communication Controls

• Control push notification permissions from your device settings
• Contact support to update communication preferences
• Disconnect optional health or media permissions through your device or app settings where available

7. Data Retention and Deletion

7.1 Retention Periods

• Active Accounts: Data retained while account is active and for service provision
• Inactive Accounts: Data may be retained while needed for account recovery, subscription, legal, or service records
• Deletion Requests: Operational data, uploaded media and backups are handled in separate tracks. The receipt does not confirm a completion date.
• Legal Requirements: Some data may be retained longer if required by law

7.2 Deletion Process

Once a deletion request is received, account access is restricted; restriction is not erasure. Operational data, uploaded media, records held by processors and backup copies are handled in separate tracks, and each requires its own fulfillment verification. Clearing Trainly’s push tokens does not confirm that Google has deleted its installation data. Completion is confirmed only after the required checks are complete; the receipt does not confirm a completion date. Exceptional legally required retention is documented separately.

When you delete your account:

• Personal data is reviewed and marked for deletion
• Account access is restricted when the request is accepted; restriction is not erasure
• Completion is confirmed only after the required operational, media, backup and processor checks are complete
• Legal, fraud-prevention, subscription, or security records may be retained where required
• Anonymous, aggregated data may be retained for analytics

8. International Data Handling

8.1 Data Transfers

Your data may be processed in different countries to:

• Provide global app functionality and performance
• Ensure data redundancy and disaster recovery
• Optimize app response times worldwide
• Comply with local data residency requirements

8.2 Transfer Safeguards

We ensure international transfers are protected by:

• Standard contractual clauses approved by regulatory authorities
• Adequacy decisions for countries with appropriate protection levels
• Binding corporate rules and privacy frameworks
• Regular assessments of transfer risks and protections

9. Incident Response

9.1 Security Incident Procedures

In case of a data security incident, we will:

• Assess the scope and impact within 24 hours
• Contain and remediate the issue immediately
• Notify regulatory authorities within 72 hours if required
• Inform affected users without undue delay
• Provide support and guidance to affected users

9.2 Communication

We will communicate incidents through:

• In-app notifications for immediate alerts
• Email notifications with detailed information
• Website updates and status pages
• Direct communication for high-risk incidents

10. Contact and Support

10.1 Privacy Requests

For data protection inquiries, account deletion, or privacy questions, contact our privacy team:

• Email: privacy@9xfitness.com
• Subject Line: "Privacy Request - [Your Request]"
• For questions about a deletion request, quote the request reference only. Do not send health data or additional details.

10.2 User Support

For general data questions and account management:

• Email: support@9xfitness.com
• In-App Support: Available through the app settings
• Response Time: Within 24-48 hours