Privacy Policy

Introduction

Welcome to Gymlab (“we,” “our,” or “us”). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered fitness application.

By using Gymlab, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our service.

Information We Collect

Personal Information

We collect information that you provide directly to us, including:

• Account Information: Email address, name, password (encrypted)
• Profile Information: Fitness goals, experience level, equipment availability, workout preferences, injuries or limitations you disclose, and optional demographic information (age, biological sex, date of birth)
• Workout Data: Exercise history, sets, reps, weight, RPE (Rate of Perceived Exertion), workout completion data, and any free-text notes you add
• Voice & Audio Data: Microphone audio captured during voice coaching sessions and short voice-input recordings. Audio is transmitted in real time to our AI providers (Google Gemini for live coaching, OpenAI Whisper for one-shot transcription) and is not retained in raw form on our servers.
• Photo Attachments: Images you choose to attach in chat (e.g. photos of equipment or exercises), which are sent to our AI provider so it can reference them in its response.
• Health Data: Optional Apple Health or Health Connect data you choose to sync, including steps, distance, active calories, exercise minutes, heart rate, resting heart rate, heart rate variability, VO2 max, sleep duration, body weight, height, body fat percentage, lean body mass, waist circumference, biological sex, date of birth, and related permission and sync status details.
• Subscription & Purchase Data: Subscription status, entitlements, and transaction identifiers received from Apple In-App Purchase via our subscription provider (RevenueCat). We do not receive or store your payment-card details.

Automatically Collected Information

• Usage Data: Features used, time spent in app, workout generation requests
• Device Information: Browser type, operating system, device identifiers
• Analytics Data: Page views, interactions, performance metrics via PostHog
• Diagnostics Data: Crash logs, error stack traces, and request context captured by Sentry to help us diagnose and fix issues.
• AI Quality Telemetry: Copies of prompts sent to and responses received from our AI providers, recorded via Langfuse so we can monitor and improve AI quality.

AI Processing & Third-Party AI Services

Gymlab is an AI-powered fitness application. To generate your workouts and provide coaching, we share certain personal data with the AI providers listed below.

• OpenAI: Receives your fitness profile, optional Health summary, exercise history, and onboarding transcript so it can generate workout plans and coaching responses, and short audio recordings when you use voice input so it can transcribe them via Whisper.
• Google (Gemini): Receives a real-time stream of your microphone audio during voice coaching sessions, the resulting transcripts, and any photos you attach in chat, in order to provide conversational voice and chat coaching.
• Langfuse: Receives copies of the prompts we send to OpenAI and Google and the responses we receive, plus your Gymlab user identifier, so we can monitor and improve AI quality.

These providers act as data processors under contractual terms that require security and confidentiality protections at least equivalent to those described in this Privacy Policy. We do not sell your personal information.

Your Choices

• Voice features: Decline microphone access on your device to disable voice coaching and voice input.
• Health data: Apple Health and Health Connect access is optional. Revoke it at any time from device settings, or delete synced data from Settings → Data Management.
• Photo attachments: Only sent when you choose to attach a photo in chat.
• Account deletion: Removes your data from our systems within 30 days and triggers deletion requests to the providers above to the extent their terms allow.

Gymlab's core features depend on these AI providers. If you are not comfortable with the data sharing described above, please do not use Gymlab.

Data Controller

Gymlab (Dutch Chamber of Commerce registration: 66494834) is the data controller responsible for your personal information. Our Data Protection Officer can be contacted at [email protected] for any privacy-related questions or concerns.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our fitness coaching services
• Generate personalized workout plans by sending your fitness profile, exercise history, optional Health summary, and onboarding transcript to OpenAI for AI-based plan generation
• Provide live voice coaching by streaming microphone audio to Google Gemini in real time and converting your speech into text and spoken responses
• Transcribe short voice-input recordings via OpenAI Whisper when you use the voice-input feature
• Track your fitness progress and workout history
• Personalize coaching and workout recommendations with optional Health data such as activity, sleep, heart rate, and body metrics
• Send you workout reminders and progress updates
• Monitor and debug the quality of AI responses via Langfuse, which receives copies of prompts and AI responses
• Analyze usage patterns to improve our AI prompts and user experience
• Diagnose and fix crashes and errors via Sentry
• Manage subscriptions and entitlements via RevenueCat and Apple In-App Purchase
• Protect against fraud and ensure platform security
• Comply with legal obligations

Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your personal data based on the following lawful grounds:

• Contract Performance: Processing necessary to provide our fitness coaching services that you have requested
• Legitimate Interests: Improving our services, preventing fraud, and ensuring platform security
• Consent: For voice recordings and optional marketing communications, and for optional Health data access through Apple Health or Health Connect (you may withdraw consent at any time)
• Legal Obligation: Complying with applicable laws and regulations

Other Third-Party Services

In addition to the AI providers above, we use the following infrastructure providers to operate Gymlab:

• Supabase — authentication and database storage.
• Google Cloud Storage — storage for files and media you upload.
• Apple Health and Health Connect — read approved Health categories you grant access to on your device. We do not write data back.
• RevenueCat — manages subscriptions and entitlements from Apple In-App Purchase. Does not receive payment-card data.
• Sentry — crash and error reporting.
• PostHog — product and usage analytics.
• SerpAPI — finds exercise demonstration videos on YouTube. Only the exercise name is sent; no personal data.

Data Storage and Security

We implement industry-standard security measures to protect your personal information:

• All data transmitted between your device and our servers, and between our servers and our AI providers, is encrypted using HTTPS/TLS
• Passwords are hashed using secure cryptographic algorithms
• Database access is restricted and monitored
• Regular security audits and updates
• Live voice audio is streamed directly to our AI provider and is not stored on our servers in raw form. Conversation transcripts are stored in your account so you can review past sessions.
• Synced Health data is stored in your Gymlab account database and scoped to your authenticated user account

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

Cookies and Tracking

We use cookies and similar tracking technologies to:

• Maintain your login session
• Remember your preferences and settings
• Analyze application usage with PostHog
• Improve performance and user experience

You can control cookie settings through your browser, but disabling cookies may limit functionality.

Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and associated data
• Data Portability: Receive your data in a machine-readable format
• Opt-Out: Unsubscribe from marketing communications
• Restrict Processing: Limit how we use your data

GDPR Rights (European Users)

If you are in the European Economic Area (EEA), you have specific rights under GDPR, including the right to lodge a complaint with your local data protection authority.

CCPA Rights (California Users)

California residents have specific rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information (subject to certain exceptions)
• Right to Opt-Out: Opt-out of the “sale” or “sharing” of personal information
• Right to Non-Discrimination: Exercise your rights without discriminatory treatment

Do Not Sell or Share My Personal Information: We do not sell or share your personal information for monetary value. We do share data with third-party AI service providers (OpenAI, Google) strictly to provide our fitness coaching services. If you wish to opt-out of this data sharing, please contact [email protected], noting that this may limit service functionality.

Data Retention

We retain your personal information for as long as necessary to:

• Provide our services to you
• Comply with legal obligations
• Resolve disputes and enforce our agreements

When you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it by law.

You can delete stored Health data separately in Settings under Data Management. This removes Health connection details, body metrics, daily summaries, and sync history stored by Gymlab. It does not delete information from Apple Health or Health Connect on your device.

AI service providers (such as OpenAI and Google) retain prompts, responses, and related data according to their own retention policies, which are linked from the “AI Processing & Third-Party AI Services” section above. Where supported by the provider, we have configured our integrations so that your data is not used to train their models. Deleting your Gymlab account triggers a deletion request to these providers to the extent their terms allow.

Children's Privacy

Gymlab is rated 17+ on the Apple App Store and is not intended for users under the age of 17. We do not knowingly collect personal information from minors below this age. If you believe we have collected information from a child below this age, please contact us immediately at [email protected], and we will take steps to delete such information.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from those in your country.

For transfers from the European Economic Area, the United Kingdom, or Switzerland to providers located outside those regions (notably OpenAI and Google in the United States), we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with supplementary technical and organisational measures. By using Gymlab, you consent to the transfer of your information to our facilities and to the third-party service providers described in this policy.

AI Limitations and Safety

Workout plans, coaching responses, and any health-related guidance produced by Gymlab are generated by AI and may be inaccurate, incomplete, or unsuitable for your individual circumstances. Gymlab is not a medical device and is not a substitute for professional medical, fitness, or nutritional advice. Consult a qualified healthcare or fitness professional before starting any new exercise programme, especially if you have an injury, medical condition, are pregnant, or are recovering from illness. Stop exercising and seek medical attention if you experience pain, dizziness, or any other concerning symptom.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or our data practices, or if you wish to exercise your privacy rights, please contact us: