Privacy Policy
Gymstr Operated by JDL Solutions for Design & Programming W.L.L.
Effective Date: April 15, 2026 Last Updated: August 15, 2026
1. Introduction
JDL Solutions for Design & Programming W.L.L. ("we", "us", "our") operates Gymstr ("Platform"): gym management software for gym operators (gym-admin web panel and gym staff app), member and trainer mobile applications, optional gym discovery on gymstr.app, and the public marketing website. We are committed to protecting your personal data and respecting your privacy.
This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and what rights you have in relation to it.
This Policy applies to all users of the Platform, including visitors to the marketing website, Trainers, Clients, Gym Admins, gym staff, and Gym Members worldwide.
2. Roles: Controller and Processor
JDL Solutions for Design & Programming W.L.L. (State of Qatar) operates Gymstr. Our role depends on the data.
JDL as controller. JDL is the data controller for:
- Gymstr user accounts (Trainers, Clients, Gym Admins / staff) and authentication
- Marketing-website visitors, cookies described in Section 13, and gym-enquiry forms submitted to JDL
- Trainer in-app subscriptions billed through the Apple App Store or Google Play (and RevenueCat)
- Platform security, abuse prevention, and support tickets you send to JDL
- JDL’s own business records (including gym SaaS invoices JDL issues to gym operators)
JDL as processor; the gym as controller. When a gym uses Gymstr gym-admin to run its facility, that gym is the controller of gym-managed member data, and JDL processes it on the gym’s instructions as a processor. That gym-managed data typically includes membership records, identity-verification files the gym collects, signed gym contracts, membership periods, in-gym payment receipts and ledger entries, personal-training and class bookings recorded by the gym, and member onboarding submissions. Processing of that data is also described in the gym’s written SaaS agreement (including its processor schedule) where one is in place, under Qatar’s Personal Data Privacy Protection Law (Law No. 13 of 2016).
If you are a gym member and your request is about gym-held membership, ID, contract, or in-gym payment records, you may contact your gym (the controller) or us at [email protected]. We will route controller requests to the relevant gym where appropriate.
Privacy contact (JDL): [email protected]
3. Data We Collect
We collect different categories of personal data depending on your role on the Platform.
3.1 Account and Identity Data
- Full name (first and last name)
- Email address
- Phone number
- Username (Gym Trainer accounts)
- Profile photo
- Date of birth (Clients)
- Gender (Male, Female, Non-Binary, or Prefer Not to Say)
3.2 Health and Fitness Data (Special Category)
We collect the following health and fitness data, which constitutes special category personal data under applicable data protection laws:
- Height and weight
- Body measurements (neck, chest, waist, hips, arms, thighs, calves, body fat percentage)
- Progress photos (front, back, side)
- Fitness goals and activity level
- Injuries and physical limitations
- Dietary restrictions and preferences
- Water intake logs
- Workout performance logs (sets, reps, weights, duration, effort ratings)
- Weekly check-in data (energy level, sleep quality, stress levels, workout completion, nutrition adherence)
- Check-in photos
3.3 Professional Data (Trainers)
- Specializations and certifications
- Years of experience
- Country and timezone
3.4 Communication Data
- Messages exchanged between Trainers and Clients (end-to-end encrypted so message content is accessible to the sender and recipient, not to JDL for moderation of the body)
- Message attachments
- Gym-to-member messages stored on the Platform so authorised gym staff can operate the gym account (these threads are not end-to-end encrypted)
3.5 Usage and Technical Data
- IP address
- Device type and user agent (browser/app information)
- Last login timestamps
- Push notification tokens (per device, per platform)
- Audit logs of administrative actions
3.6 Payment and Subscription Data
Payment data depends on which product you use:
- Trainer subscriptions (JDL / App Store billing): plan and status; transaction records (amount, currency, billing period); payment method details (card type, last 4 digits, expiry) held by Apple, Google, and/or RevenueCat — not a gym SaaS fee.
- Gym SaaS fee (gym operators pay JDL): billed offline (invoice and bank transfer). JDL does not collect the gym’s card details for this fee through the apps.
- Members paying the gym (current launch path): the gym records in-gym payments (cash, POS, bank transfer, complimentary) in the gym ledger. Members pay the gym, not JDL. Receipts and ledger rows are gym-managed member data (gym = controller; JDL = processor).
- Optional online member checkout (Tap Payments): product support exists but is off unless JDL enables it for a gym. If enabled, Tap processes card/QPay-style checkout; JDL does not store full card numbers. Marketplace commission, if any, would be agreed in the gym’s written SaaS terms — not in this Policy.
3.7 Gym-managed data (gym = controller; JDL = processor)
Where you are a member or staff of a gym on Gymstr, the gym may process:
- Gym name, logo, and profile information
- Membership status, plan, start/end dates, membership number, and membership periods
- Identity verification files the gym collects (for example ID or passport images) and signed gym contracts
- Onboarding checklist answers and verification photos the gym requires
- In-gym payment receipts, refunds, and ledger entries
- Personal-training packages and class bookings recorded at the gym
- Assigned trainer information and gym–member messages (see §3.4)
4. How We Collect Your Data
We collect your data in the following ways:
- Directly from you — when you register an account, complete your profile, log workouts, submit check-ins, send messages, upload photos, join a gym, complete onboarding, or interact with the Platform.
- From Trainers or Gym Admins — when a Trainer creates or assigns plans to you, or when a Gym Admin accepts or renews your membership, records an in-gym payment, or collects ID / contract / onboarding items the gym requires.
- Automatically — when you use the Platform, we automatically collect technical data such as your IP address, device information, and usage logs.
- From third-party services — such as App Store / Play / RevenueCat (trainer subscriptions), Tap Payments if online member checkout is enabled for your gym, and notification services (push token data).
5. Legal Bases for Processing
We process your personal data on the following legal bases:
| Purpose | Legal Basis |
|---|---|
| Providing the core Platform services | Performance of a contract |
| Account registration and authentication | Performance of a contract |
| Processing trainer subscriptions (App Store / Play) | Performance of a contract |
| Processing gym SaaS invoices JDL issues to gym operators | Performance of a contract |
| Processing gym-managed member data as processor | Gym’s instructions / gym’s contract with its members; JDL’s processor terms with the gym |
| Processing health and fitness data | Explicit consent |
| Sending service notifications and messages | Legitimate interests / contract performance |
| Security, fraud prevention, and abuse detection | Legitimate interests |
| Complying with legal obligations | Legal obligation |
| Improving the Platform | Legitimate interests |
5.1 Special Category Data (Health Data)
Because health and fitness data (including body measurements, progress photos, medical conditions, and dietary restrictions) constitutes special category data, we process it only on the basis of your explicit consent, which you provide when you create your account and submit this information to the Platform. You may withdraw your consent at any time by deleting your account or contacting us at [email protected]. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.
6. How We Use Your Data
We use your personal data to:
- Register and manage your account.
- Enable Trainers to create and assign workout and nutrition plans to their clients.
- Enable Clients to log progress, track metrics, and communicate with their Trainer.
- Enable gym management features for Gym Admins (members, plans, PT/classes, in-gym ledger, onboarding, discovery listing).
- Process Trainer App Store / Play subscriptions; process gym SaaS invoices JDL issues to gym operators (offline).
- Send push notifications, in-app messages, and service emails.
- Provide end-to-end encrypted messaging between Trainers and Clients, and gym–member messaging for authorised gym staff.
- Monitor Platform security, detect and prevent fraud and abuse.
- Respond to customer support and privacy enquiries.
- Comply with applicable legal obligations.
- Improve and develop the Platform.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
7. Sharing Your Data
We do not sell your personal data. We share your data only in the following limited circumstances:
7.1 Between Trainers and Clients
When you establish a coaching relationship on the Platform, the Trainer can see your profile, fitness data, progress logs, check-ins, and messages you share with them. This is the core function of the Platform and is necessary for the service.
7.2 Gym Context
Authorised gym staff can see, to the extent their gym-admin permissions allow: member profiles, membership and period data, identity and contract files the gym collected, onboarding submissions, in-gym receipts, PT/class bookings, and gym–member messages. The gym decides which staff roles can view or export that data.
7.3 Service Providers
We share data with trusted third-party service providers who process data on our behalf:
| Service Provider | Purpose | Data Shared |
|---|---|---|
| RevenueCat | Trainer in-app subscription management (App Store / Play) | Subscription status, transaction records |
| Tap Payments | Member online checkout — only if enabled for that gym | Payment method details, billing information |
| Cloudflare R2 | File storage (photos, ID/contract files, attachments) | Uploaded files and media |
| Resend / SMTP | Email delivery | Email address, email content |
| Expo Push Notifications | Push notification delivery | Device push token, notification content |
All service providers are bound by data processing agreements and may only use your data as directed by us.
7.4 Legal Requirements
We may disclose your data if required to do so by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Gymstr, our users, or others.
7.5 Business Transfers
In the event of a merger, acquisition, or sale of all or a portion of our assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.
8. International Data Transfers
Gymstr is operated from Qatar and we serve users worldwide. Your personal data may be transferred to and processed in countries outside your country of residence, including countries that may not have the same level of data protection as your home country.
When we transfer data internationally, we implement appropriate safeguards in accordance with applicable data protection laws, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission, for transfers involving EEA/UK residents.
- Ensuring our service providers maintain appropriate security and contractual obligations.
By using the Platform, you acknowledge that your data may be transferred internationally as described in this Policy.
9. Data Retention
We retain your personal data for as long as your account is active and as necessary to provide the Platform services.
- Active accounts: Data is retained for the duration of your account's existence.
- Deleted accounts: When you delete your account, we immediately remove access and anonymise personal profile data so you can no longer sign in. Residual records needed for disputes, security, and legal compliance may be retained for up to 12 months, after which they are permanently deleted or further anonymised.
- Payment records: Trainer store transactions, gym SaaS invoices JDL issues, and gym ledger / receipt records may be retained for longer periods where required by tax or financial regulations, even after account deletion. Gym ledger rows remain the gym’s records while the gym’s account is active.
- Anonymised data: We may retain anonymised, aggregated data (which cannot identify you) indefinitely for analytics and Platform improvement purposes.
10. Data Security
We take the security of your personal data seriously and implement technical and organisational measures to protect it, including:
- End-to-end encryption for messages between Trainers and Clients. Gym–member messages are stored so authorised gym staff can operate the gym account; they are protected in transit (HTTPS/TLS) and at rest with the same Platform controls as other gym records, but they are not end-to-end encrypted.
- Encrypted storage of sensitive credentials (tokens stored in iOS Keychain / Android Keystore).
- HTTPS/TLS for all data in transit.
- Signed, expiring URLs for file access (photos and media).
- Role-based access controls limiting data access to authorised parties only.
- Rate limiting and abuse detection to prevent unauthorized access.
- Audit logging of administrative actions.
- HttpOnly cookies for web session management.
Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
11. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
11.1 Rights for All Users
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you. |
| Rectification | Request correction of inaccurate or incomplete data. |
| Erasure | Delete your account and associated personal data ("right to be forgotten") in the app or via the web form below. |
| Restriction | Request that we restrict processing of your data in certain circumstances. |
| Portability | Request your data in a structured, machine-readable format. |
| Withdraw Consent | Where processing is based on consent, withdraw it at any time. |
11.2 Additional Rights for EU/UK Residents (GDPR / UK GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR:
- Right to Object — You have the right to object to processing of your personal data based on legitimate interests.
- Rights related to Automated Decision-Making — We do not currently use automated decision-making that produces legal or significant effects.
- Right to Lodge a Complaint — You have the right to lodge a complaint with your local data protection supervisory authority. For EU residents, this is the supervisory authority in your EU member state. For UK residents, this is the Information Commissioner's Office (ICO).
11.3 How to Delete Your Account
Client and Trainer accounts that can be created in the Gymstr apps can be deleted as follows:
- In the app: Profile → Account → Delete Account (multi-step confirmation; irreversible).
- On the web: https://gymstr.app/delete-account (identity verification required; usable without reinstalling the app).
After deletion is confirmed, we send a confirmation email to the address associated with the account. Payment and transaction records may be retained as described in Section 9.
11.4 How to Exercise Your Other Rights
To exercise any of your other rights (access, rectification, portability, etc.), please submit a request to [email protected]. We will respond within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing your request.
Some rights may be limited where we have a legitimate reason to retain data (such as a legal obligation or the resolution of a dispute).
12. Children's Privacy
The Platform is not intended for users under the age of 16 years. We do not knowingly collect personal data from individuals under 16. If you believe a person under 16 has provided us with their personal data, please contact us at [email protected] and we will promptly delete that data.
13. Cookies and Tracking Technologies
We use cookies where needed for the Platform to work. On the marketing website (gymstr.app), we also use Google Analytics 4 to measure aggregated site usage. We do not use advertising cookies or behavioural advertising networks on the Platform.
13.1 Marketing Website (gymstr.app)
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
NEXT_LOCALE | Remembers your language preference (English or Arabic) after you select it in the language switcher | 1 year | Strictly necessary / functional |
_ga | Google Analytics — distinguishes unique visitors | up to 2 years | Analytics |
_ga_* | Google Analytics — maintains session/state for the measurement ID | up to 2 years | Analytics |
NEXT_LOCALE is set only when you choose a language. It does not track you across sites and is not used for advertising. Because it is required to provide the language preference you requested, it does not require a separate consent banner under typical EU/UK ePrivacy guidance for strictly necessary cookies. You can clear it at any time via your browser settings; the site will then use the default language until you choose again.
Google Analytics (provided by Google LLC) collects aggregated usage data such as pages viewed, approximate location (country/city level), device and browser type, and referral source. We use this solely to understand and improve the marketing website. We do not use Google Analytics for advertising or to sell personal data.
Analytics cookies are loaded only after you choose Accept analytics in the cookie banner on gymstr.app. If you choose Essential only, we do not load Google Analytics. Your choice is stored in your browser’s local storage (gymstr_cookie_consent) so we remember it on later visits. You can also opt out via the Google Analytics Opt-out Browser Add-on or by clearing site data in your browser settings.
13.2 Web Applications (Admin Dashboard and Gym Admin Dashboard)
Our admin web applications use HttpOnly cookies to manage authentication sessions securely. These are strictly necessary for the operation of the web applications and cannot be disabled without impairing functionality.
13.3 Mobile Applications
Our mobile applications use secure local storage (iOS Keychain / Android Keystore) to store authentication tokens. We do not use advertising or tracking cookies in our mobile applications.
13.4 Third-Party Tracking
We do not integrate third-party advertising trackers or behavioural advertising networks on the Platform. The marketing website uses Google Analytics solely for aggregated site usage measurement, as described in §13.1.
14. Links to Third-Party Services
The Platform may contain links to or integrations with third-party services (such as App Store or Google Play). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before interacting with them.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. We will notify you of material changes by updating the "Last Updated" date at the top of this document and, where appropriate, through in-app notification or email.
Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree to the updated Policy, you must stop using the Platform and delete your account.
16. Contact Us
For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us:
JDL Solutions for Design & Programming W.L.L. State of Qatar
Privacy Email: [email protected]
We aim to respond to all privacy-related enquiries within 30 days.
© 2026 JDL Solutions for Design & Programming W.L.L. All rights reserved.