Privacy policy

1. Who we are

Gym DESTINATION is an app by [RECHTSPERSOON NOG TE KIEZEN], [ADRES NOG TE KIEZEN], [POSTCODE EN PLAATS NOG TE KIEZEN], registered with the Dutch Chamber of Commerce under number [KVK-NUMMER NOG TE KIEZEN]. We are responsible for processing your personal data. Send privacy questions to hello@gymdestination.com.

This policy applies to the Gym DESTINATION app on iPhone and Android, the web dashboard at app.gymdestination.com and this website.

2. What data we process

Your account

• Your email address and first name, and the language you choose.
• If you sign in with Apple or Google, they give us your email address and a fixed code for your account. Apple may give us a forwarding address instead of your own.

Your profile

• Your gender (you can also choose ‘prefer not to say’) and your date of birth.
• Your training level, how active you are, your goal, how often and where you want to train, and which program you choose.

Health data

Some data says something about your health. The GDPR calls this special category data, and we protect it extra carefully. It concerns:

• injuries or physical limitations you report, and anything you add in the notes field;
• your body weight;
• sleep, resting heart rate, heart rate variability (HRV) and your recovery score — only if you connect Apple Health, Health Connect or a Garmin, Fitbit, Oura or WHOOP wearable.

Training and nutrition

• Your workouts: exercises, sets, reps, weights, rest times and your plans.
• What follows from them: records, ranks, badges and your streak.
• What you eat and drink, with calories and macros.

Meal photos

If you take a photo of your meal to have it recognised, we use the photo only for that recognition. We do not keep the photo. What we do keep is what you save afterwards: the meal with its calories and macros.

Payments

If you buy Premium on our website, Stripe handles the payment; we never see your full card details. We keep which subscription you have, the payment status and your invoices. If you buy through the App Store or Google Play, Apple or Google handles the payment and we only learn whether your subscription is active.

Technical data and contact

To run and secure the app and the website, we process technical data such as your IP address, device type, app version, and logs of errors and sign-in attempts. If you email us, we keep your message and our reply.

3. Why we use your data

• To provide your account and the app: this is necessary for our agreement with you.
• To process health data: your explicit consent. You give it when you enter this data or turn on a connection, and you can withdraw it at any time.
• To process payments and invoices: the agreement, and our legal duty to keep invoices.
• To prevent abuse, keep the service secure and answer your questions: our legitimate interest.

We do not use your data for advertising and we do not sell it.

4. AI features

Some features use artificial intelligence (AI), such as recognising a meal from a description or a photo, or creating a training plan for you. For this, we send the data that feature needs to Anthropic, the maker of the AI model. This always goes through our own server, never directly from the app. What the AI suggests is an estimate: check it yourself.

5. Who else processes your data

We work with a few service providers. They only receive what they need for their task and may not use it for anything else; we have processing agreements with each of them.

• Cloudflare: hosting of the app server, the database and this website, and protection against attacks. Your account data is stored in databases in the European Union.
• Resend: sends our email, such as your sign-in code.
• Stripe: processes payments and subscriptions on our website.
• Anthropic: provides the AI model behind the AI features.

If you sign in with Apple or Google, or connect Apple Health, Health Connect, Garmin, Fitbit, Oura or WHOOP, their own privacy terms apply to what they process themselves.

Some service providers are (also) based outside the European Economic Area, mainly in the United States. In that case we rely on the safeguards the GDPR requires, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

6. How long we keep data

• Your account and everything you track in the app: as long as your account exists. If you ask us to delete it, we erase it within [PERIOD TO BE DECIDED].
• Meal photos: not at all. We only use them for the recognition.
• Invoices and payment data: seven years, because Dutch law requires it.
• Security logs: [PERIOD TO BE DECIDED].
• Backups: erased data disappears from them within [PERIOD TO BE DECIDED].
• Emails with questions: [PERIOD TO BE DECIDED].

7. Security

We protect your data with appropriate technical and organisational measures. Connections are encrypted, only people who need it for their work can access data, and access to connected wearables is stored on our server, not on your phone.

8. Your rights

You may access, correct or delete your data. You may also ask us to restrict processing, object, receive your data in a common file format and withdraw your consent. Email hello@gymdestination.com from your account's email address. We reply within one month.

Want to delete your account? See Delete your account.

Not happy with how we handle your data? Please tell us first. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.

9. Age

The app is intended for people aged [MINIMUM AGE TO BE DECIDED] and older.

10. This website

This website uses no analytics, no ads and no trackers. Cloudflare delivers the website and processes your IP address to do so.

11. Changes

We may update this policy. The date at the top shows when that last happened. We will tell you about important changes in advance.