Privacy policy

Data controller

RungGym is a service of:

Overview

RungGym ("the service") is software coaches use to build workout plans and to coach their clients through a private client portal: nutrition, habits, check-ins, progress photos, messages and session booking. We collect as little personal data as possible to make the service work, and we never sell or rent data to third parties.

What data we collect

• Trainer account data: email address, name and optionally your business name. Needed to log in and to link your plans to your account. We also record which version of the terms of service you accepted and when, as proof of the agreement.
• Client data you enter: your client's name, training goal, level, ticked injuries or limitations, available equipment, number of sessions per week and any notes. You enter this data as the trainer; you are the data controller for it.
• Generated plans: the training blocks and sessions you create, stored so they do not change between two views or printouts.
• What your client fills in: through their private portal link a client can log the weights they lifted, the food they ate (name, amount, calories and macronutrients), daily habit ticks, a daily recovery check (sleep quality, fatigue, stress, muscle soreness, optional sleep hours and a note), check-ins (body weight, body measurements, energy, sleep and a note), progress photos, messages to you and the sessions they book with you. You are the data controller for this data as well; we process it on your behalf.
• Requests through a coach's public page: when you ask a coach for a first session on their RungGym page, we pass your name, email address and, if you give them, your phone number and message to that coach only. The coach is the data controller for that request; we keep it for them until they delete it.
• Payment data: your subscription status, chosen plan and customer ID at our payment provider. Card details never reach our servers. They are processed directly by Stripe.

Health data about your clients

The injury markers you tick per client (low back pain or knee complaints, for example) are health-related data, and so are body measurements, food logs, recovery checks and progress photos. Collect only what you need, and tell your client what you keep and why before you share their portal link. Preferably avoid full names where you do not need them: a first name or initials is enough for the service to work.

Progress photos are stored in a private storage area that is never publicly reachable. They are shown only through links that expire within minutes, to the client through their portal link and to you in your dashboard. Before upload the photo is resized on the client's phone, which also removes the location data a phone camera stores in a photo. Deleting a client deletes their photos.

What we use data for

• To deliver the service: generating, storing and exporting plans.
• To manage your subscription and client limit.
• To contact you about your account or important changes to the service.
• To trace errors and improve the software.
• To measure how the website and the app are used, with our own statistics (see below).
• Only if you ticked the box for it when creating your account: to email you news and offers about RungGym.

We do not use your client data for advertising and we do not build profiles from it for third parties.

Statistics and the e-mails we send

• Website and app. Our own statistics record page views and clicks on links such as “create account”: the page, the site you came from, campaign tags in the link, the rough device type and the country. Never your IP address, never what you type, never the private link of a client portal. Without the statistics cookie this is a bare count. If you accept it, a random number links your page views, and once you create an account those earlier views are linked to it, so we can see how you found us. While you are logged in, your use of the app is linked to your account. Legal basis: your consent for the cookie (article 6(1)(a) GDPR) and our legitimate interest in improving RungGym for the rest (article 6(1)(f)). Kept for 13 months.
• Mails about your account. For the mails we send you ourselves we record whether they were delivered and, where your mail program reports it, opened or clicked, and whether they bounced. That tells us whether our mails arrive. Legal basis: legitimate interest.
• News and offers. Only if you ticked that box when creating your account. We keep when you gave or withdrew that consent as proof. You can withdraw it at any time, as easily as you gave it: on the billing page of your account, with the unsubscribe link in any such mail, or by emailing info@runggym.com.

Security

• All data is stored in a European database (EU-West region) with row-level security: technically, each trainer can only retrieve their own clients and plans.
• Connections are encrypted over HTTPS.
• Passwords are stored hashed and are not readable by us.
• Payment data is processed exclusively by Stripe.

Third-party services

• Supabase: database, authentication and storage (EU region).
• Stripe: payments and subscription management.
• Open Food Facts: the open food database a client searches when logging food. Only the search words or barcode number are sent, from our server, never the client's name or other data.
• Vercel: hosting of the web application.
• Vercel (Web Analytics): visitor statistics for our own website. It records the page visited, the referring site, the rough device type and the country, and it sets no cookies and builds no profile of you across sites. We use it to see which pages people read, not to recognise individuals.
• Resend: sending the e-mails about your account and reporting whether they were delivered, opened or clicked.

Retention

We keep your data for as long as your account is active. If you cancel and request deletion, we erase your account, clients and plans. Billing records are kept for as long as the statutory accounting retention period requires.

Your rights (GDPR)

You have the right to access your data, have it corrected, deleted or transferred, and to object to certain processing. Email info@runggym.com to exercise those rights. Because RungGym is operated from Belgium, the GDPR applies to every user wherever they are based, and you also have the right to lodge a complaint with the Belgian Data Protection Authority or with the supervisory authority in your own country of residence within the EU.

Cookies

RungGym sets necessary cookies that need no consent: one that keeps your session alive after you log in, one that remembers your cookie choice, and one that remembers whether you said you are a personal trainer or training for yourself. With your consent (legal basis: article 6(1)(a) GDPR) we additionally set our own statistics cookie. You can give or withdraw that consent at any time on the cookie policy page.

Contact

Questions about this policy or about your data: info@runggym.com.

Changes

We may update this policy. Changes appear on this page with a new date at the top.