Privacy Policy

Gymstr Operated by JDL Solutions for Design & Programming W.L.L.

Effective Date: April 15, 2026 Last Updated: July 17, 2026

1. Introduction

JDL Solutions for Design & Programming W.L.L. ("we", "us", "our") operates the Gymstr fitness coaching platform ("Platform"), available as mobile applications (iOS and Android), web dashboards, and the public marketing website at gymstr.app. We are committed to protecting your personal data and respecting your privacy.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and what rights you have in relation to it.

This Policy applies to all users of the Platform, including visitors to the marketing website, Trainers, Clients, Gym Admins, and Gym Members worldwide.

2. Data Controller

The data controller responsible for your personal data is:

JDL Solutions for Design & Programming W.L.L. State of Qatar Email: [email protected]

For privacy-related enquiries, data subject rights requests, or complaints, please contact us at the address above.

3. Data We Collect

We collect different categories of personal data depending on your role on the Platform.

3.1 Account and Identity Data

• Full name (first and last name)
• Email address
• Phone number
• Username (Gym Trainer accounts)
• Profile photo
• Date of birth (Clients)
• Gender (Male, Female, Non-Binary, or Prefer Not to Say)

3.2 Health and Fitness Data (Special Category)

We collect the following health and fitness data, which constitutes special category personal data under applicable data protection laws:

• Height and weight
• Body measurements (neck, chest, waist, hips, arms, thighs, calves, body fat percentage)
• Progress photos (front, back, side)
• Fitness goals and activity level
• Injuries and physical limitations
• Dietary restrictions and preferences
• Water intake logs
• Workout performance logs (sets, reps, weights, duration, effort ratings)
• Weekly check-in data (energy level, sleep quality, stress levels, workout completion, nutrition adherence)
• Check-in photos

3.3 Professional Data (Trainers)

• Specializations and certifications
• Years of experience
• Country and timezone

3.4 Communication Data

• Messages exchanged between Trainers and Clients (stored encrypted end-to-end)
• Message attachments
• Gym-to-member messages

3.5 Usage and Technical Data

• IP address
• Device type and user agent (browser/app information)
• Last login timestamps
• Push notification tokens (per device, per platform)
• Audit logs of administrative actions

3.6 Payment and Subscription Data (Trainers)

• Subscription plan and status
• Transaction records (amount, currency, billing period)
• Payment method details (card type, last 4 digits, expiry date) — stored by our payment processors
• Billing country code

3.7 Gym Data

• Gym name and logo
• Gym membership status and dates
• Assigned trainer information

4. How We Collect Your Data

We collect your data in the following ways:

• Directly from you — when you register an account, complete your profile, log workouts, submit check-ins, send messages, upload photos, or interact with the Platform.
• From Trainers or Gym Admins — when a Trainer creates or assigns plans to you, or when a Gym Admin adds you to a gym.
• Automatically — when you use the Platform, we automatically collect technical data such as your IP address, device information, and usage logs.
• From third-party services — such as payment processors (subscription and billing information) and notification services (push token data).

5. Legal Bases for Processing

We process your personal data on the following legal bases:

5.1 Special Category Data (Health Data)

Because health and fitness data (including body measurements, progress photos, medical conditions, and dietary restrictions) constitutes special category data, we process it only on the basis of your explicit consent, which you provide when you create your account and submit this information to the Platform. You may withdraw your consent at any time by deleting your account or contacting us at [email protected]. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

6. How We Use Your Data

We use your personal data to:

• Register and manage your account.
• Enable Trainers to create and assign workout and nutrition plans to their clients.
• Enable Clients to log progress, track metrics, and communicate with their Trainer.
• Enable gym management features for Gym Admins.
• Process and manage Trainer subscription payments.
• Send push notifications, in-app messages, and service emails.
• Provide end-to-end encrypted messaging between Trainers and Clients.
• Monitor Platform security, detect and prevent fraud and abuse.
• Respond to customer support and privacy enquiries.
• Comply with applicable legal obligations.
• Improve and develop the Platform.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

7. Sharing Your Data

We do not sell your personal data. We share your data only in the following limited circumstances:

7.1 Between Trainers and Clients

When you establish a coaching relationship on the Platform, the Trainer can see your profile, fitness data, progress logs, check-ins, and messages you share with them. This is the core function of the Platform and is necessary for the service.

7.2 Gym Context

Gym Admins can see the profiles and membership data of their Gym Members and Trainers within the gym's account.

7.3 Service Providers

We share data with trusted third-party service providers who process data on our behalf:

All service providers are bound by data processing agreements and may only use your data as directed by us.

7.4 Legal Requirements

We may disclose your data if required to do so by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Gymstr, our users, or others.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

8. International Data Transfers

Gymstr is operated from Qatar and we serve users worldwide. Your personal data may be transferred to and processed in countries outside your country of residence, including countries that may not have the same level of data protection as your home country.

When we transfer data internationally, we implement appropriate safeguards in accordance with applicable data protection laws, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, for transfers involving EEA/UK residents.
• Ensuring our service providers maintain appropriate security and contractual obligations.

By using the Platform, you acknowledge that your data may be transferred internationally as described in this Policy.

9. Data Retention

We retain your personal data for as long as your account is active and as necessary to provide the Platform services.

• Active accounts: Data is retained for the duration of your account's existence.
• Deleted accounts: When you delete your account, we immediately remove access and anonymise personal profile data so you can no longer sign in. Residual records needed for disputes, security, and legal compliance may be retained for up to 12 months, after which they are permanently deleted or further anonymised.
• Payment records: Transaction and payment records may be retained for longer periods where required by tax or financial regulations, even after account deletion.
• Anonymised data: We may retain anonymised, aggregated data (which cannot identify you) indefinitely for analytics and Platform improvement purposes.

10. Data Security

We take the security of your personal data seriously and implement technical and organisational measures to protect it, including:

• End-to-end encryption for messages between Trainers and Clients.
• Encrypted storage of sensitive credentials (tokens stored in iOS Keychain / Android Keystore).
• HTTPS/TLS for all data in transit.
• Signed, expiring URLs for file access (photos and media).
• Role-based access controls limiting data access to authorised parties only.
• Rate limiting and abuse detection to prevent unauthorized access.
• Audit logging of administrative actions.
• HttpOnly cookies for web session management.

Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

11. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

11.1 Rights for All Users

11.2 Additional Rights for EU/UK Residents (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right to Object — You have the right to object to processing of your personal data based on legitimate interests.
• Rights related to Automated Decision-Making — We do not currently use automated decision-making that produces legal or significant effects.
• Right to Lodge a Complaint — You have the right to lodge a complaint with your local data protection supervisory authority. For EU residents, this is the supervisory authority in your EU member state. For UK residents, this is the Information Commissioner's Office (ICO).

11.3 How to Delete Your Account

Client and Trainer accounts that can be created in the Gymstr apps can be deleted as follows:

• In the app: Profile → Account → Delete Account (multi-step confirmation; irreversible).
• On the web: https://gymstr.app/delete-account (identity verification required; usable without reinstalling the app).

After deletion is confirmed, we send a confirmation email to the address associated with the account. Payment and transaction records may be retained as described in Section 9.

11.4 How to Exercise Your Other Rights

To exercise any of your other rights (access, rectification, portability, etc.), please submit a request to [email protected]. We will respond within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing your request.

Some rights may be limited where we have a legitimate reason to retain data (such as a legal obligation or the resolution of a dispute).

12. Children's Privacy

The Platform is not intended for users under the age of 16 years. We do not knowingly collect personal data from individuals under 16. If you believe a person under 16 has provided us with their personal data, please contact us at [email protected] and we will promptly delete that data.

13. Cookies and Tracking Technologies

We use cookies where needed for the Platform to work. On the marketing website (gymstr.app), we also use Google Analytics 4 to measure aggregated site usage. We do not use advertising cookies or behavioural advertising networks on the Platform.

13.1 Marketing Website (gymstr.app)

NEXT_LOCALE is set only when you choose a language. It does not track you across sites and is not used for advertising. Because it is required to provide the language preference you requested, it does not require a separate consent banner under typical EU/UK ePrivacy guidance for strictly necessary cookies. You can clear it at any time via your browser settings; the site will then use the default language until you choose again.

Google Analytics (provided by Google LLC) collects aggregated usage data such as pages viewed, approximate location (country/city level), device and browser type, and referral source. We use this solely to understand and improve the marketing website. We do not use Google Analytics for advertising or to sell personal data.

Analytics cookies are loaded only after you choose Accept analytics in the cookie banner on gymstr.app. If you choose Essential only, we do not load Google Analytics. Your choice is stored in your browser’s local storage (gymstr_cookie_consent) so we remember it on later visits. You can also opt out via the Google Analytics Opt-out Browser Add-on or by clearing site data in your browser settings.

13.2 Web Applications (Admin Dashboard and Gym Admin Dashboard)

Our admin web applications use HttpOnly cookies to manage authentication sessions securely. These are strictly necessary for the operation of the web applications and cannot be disabled without impairing functionality.

13.3 Mobile Applications

Our mobile applications use secure local storage (iOS Keychain / Android Keystore) to store authentication tokens. We do not use advertising or tracking cookies in our mobile applications.

13.4 Third-Party Tracking

We do not integrate third-party advertising trackers or behavioural advertising networks on the Platform. The marketing website uses Google Analytics solely for aggregated site usage measurement, as described in §13.1.

14. Links to Third-Party Services

The Platform may contain links to or integrations with third-party services (such as App Store or Google Play). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before interacting with them.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. We will notify you of material changes by updating the "Last Updated" date at the top of this document and, where appropriate, through in-app notification or email.

Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree to the updated Policy, you must stop using the Platform and delete your account.

16. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us:

JDL Solutions for Design & Programming W.L.L. State of Qatar

Privacy Email: [email protected]

We aim to respond to all privacy-related enquiries within 30 days.

© 2026 JDL Solutions for Design & Programming W.L.L. All rights reserved.