Privacy Policy
How GymBear handles personal information, including health information, under South Africa's Protection of Personal Information Act (POPIA).
Version 2026-10-01 · Effective 1 October 2026
1. Who we are
GymBear is operated by Luigi Lottino, trading as GymBear, a sole proprietor in South Africa (“GymBear”, “we”, “us”). Our Information Officer is Luigi Lottino, registered with the Information Regulator under number 2026-067687. Contact: privacy@gymbear.app. Our physical address is available on request from that address.
2. The short version
- If a trainer manages you in GymBear, your trainer decides what is recorded about you and we look after it for them.
- Health and injury information is recorded with your agreement, and only your trainer can see it.
- We store data in the European Union, we don’t sell it, we don’t use it for advertising, and we don’t use it to train AI.
- You can ask to see, correct or delete your information at any time.
3. Two kinds of information
Information your trainer keeps about you. If a personal trainer or gym uses GymBear to manage you as a client, they are the “responsible party” for that information under POPIA and GymBear is their “operator”: we store and process it on their behalf and on their instructions. This includes what you add in your trainer’s client portal. For questions or requests about it, contact your trainer first. We will help them respond, and if they can’t be reached you can contact us.
Information GymBear is responsible for. Your login account, trainer business accounts, how the app is used, and, once it launches, anything you log in GymBear’s direct app without a trainer. For these, GymBear is the responsible party.
4. What we collect and why
| Information | Why | Legal basis |
|---|---|---|
| Account details: name, email, password (stored only as a secure hash), or your Google name and email if you sign in with Google | To create and secure your account and let you sign in | Needed to provide the service you asked for |
| Trainer business details: business name, team members and their roles | To run the trainer's account | Needed to provide the service |
| Client records a trainer keeps: contact details, goals, measurements (weight, body fat, body measurements), programmes, workouts, sessions, schedules, invoices, notes | So the trainer can manage your training | The trainer's basis (usually your agreement to be trained by them), handled by us as operator |
| Health and injury information: health notes, injury notes, injury and rehab logs | So your training can be planned safely | Your consent (section 27): given to your trainer through their client agreement, and when you set up your portal |
| What you log: completed workouts, sets and weights, feedback, meal and general logs | To track progress and share it with your trainer | Needed to provide the service |
| Club activity feed posts: your name, a short message, any caption you add, and any new personal record (exercise and weight) | To share progress with your trainer's other clients | Only if you switch sharing on. It is off by default. |
| Agreement records: when you accepted the Terms and Privacy Policy, and which version | To show what you agreed to | Our legal duty to be able to prove consent |
| Usage events: which screens are opened and which steps are started or finished, linked to your account, with no content | To find where people get stuck and improve GymBear | Our legitimate interest in a working product |
| Error reports: technical details of a crash, browser and device type | To find and fix bugs | Our legitimate interest in a working, secure product |
| Security records: sign-in and invitation attempts, for rate limiting | To protect accounts from abuse | Our legitimate interest and legal duty to keep data secure |
We only use information for the purposes above or closely related ones you would reasonably expect. We ask before using it for anything new.
5. What we don't collect
We don’t collect your ID number, bank or card details, precise location, contacts, photos, or biometric information. GymBear doesn’t ask for race, religion, political views, sex life or criminal history, and trainers are not allowed to record them.
6. Health information
Health and injury information is special personal information under POPIA and gets extra protection. Your trainer records it with your consent, usually through their client agreement or intake form, and you agree to it when you set up your portal. Health notes written by your trainer are visible only to your trainer’s business. Logs you add are visible to you and your trainer. Health information is never shown in the activity feed, never used for marketing, never sold, never used to train AI, and is excluded from our usage events and error reports. GymBear is not a medical service.
You can withdraw that consent at any time by telling your trainer or emailing privacy@gymbear.app. Your trainer then removes your health notes and stops recording health information, and we help them do it.
7. Who can see your information
- Your trainer’s business: your client record, including health notes and your logs.
- Other clients of the same trainer: only your activity feed posts, and only while sharing is switched on.
- GymBear: only our owner, only when needed to maintain the service, fix a problem, or handle a request.
- Our service providers: listed in section 10, only as needed to run GymBear.
- Authorities: only when the law requires it, and we will tell you unless we are legally prevented.
We never sell or rent personal information.
8. Children
Anyone under 18 is a child under POPIA. A trainer may only add a client under 18 with the consent of their parent or guardian, and trainers confirm they do this when they accept GymBear’s terms. The parent or guardian can exercise the child’s privacy rights on their behalf. If we offer GymBear directly to individuals, you must be 18 or older to sign up yourself. If we learn that a child’s information is in GymBear without the required consent, we will ask the trainer to obtain it or we will delete it.
9. How long we keep information
| Information | Kept for |
|---|---|
| Active accounts and client records | While the account is active |
| A client their trainer archives | Kept, so the trainer can restore them, until the trainer deletes them |
| A client their trainer deletes | Straight away, their contact details, health information, logs, measurements, programmes, workouts, sessions, feed posts and portal login are permanently deleted. Only their name is kept, alongside the trainer's invoices. |
| A trainer account the trainer asks us to close (email privacy@gymbear.app) | Permanently deleted within 90 days of closure. An export can be requested within 30 days. |
| Activity feed posts | Until you switch sharing off, which removes your past posts too |
| Usage events | 90 days |
| Error reports | Up to 90 days |
| Agreement records | As long as the related information is kept, plus up to 1 year to show what was agreed |
| Backup copies | Overwritten on a rolling basis |
Trainers decide how long to keep archived clients, as the responsible party for them, and should delete clients they no longer need. Invoices a trainer creates in GymBear are the trainer’s business records. Trainers are responsible for keeping them for tax purposes, can download them before deleting a client or closing their account, and can ask us for a copy afterwards.
When a trainer sends an invoice, the client gets a private link to view it. GymBear records when that link is first opened, so the trainer can see the invoice has been seen. Nothing else about the visit is recorded.
GymBear also records whether the last email to a client’s address was delivered or bounced, as reported by Resend, so the trainer can fix a wrong address.
10. Service providers and where your information goes
Your information is stored in the European Union. We use these providers. Supabase, Sentry, Resend and Cloudflare are each bound by a data processing agreement with us.
- Supabase (database, sign-in and server functions): Stockholm, Sweden.
- Sentry (error monitoring): Germany, without client identities or health information.
- Resend (sends invitation, account and invoice emails): your name and email address, and for an invoice its number, amount, due date and a link to view it, sent through Amazon’s Ireland region.
- Vercel (delivers the app to your browser, under its standard terms): served from Cape Town. It doesn’t receive or store your client data. Like any website host, it sees your IP address and basic request details when you load the app.
- Cloudflare (domain and email forwarding): handles emails you send to gymbear.app addresses.
- Google (only if you choose “Continue with Google”): Google tells us your name and email address. We don’t send Google any GymBear data.
The EU’s General Data Protection Regulation gives protection substantially similar to POPIA. Where a provider is based outside South Africa, including in the United States, the transfer is necessary to provide the service you asked for and, for Supabase, Sentry, Resend and Cloudflare, is also protected by their binding data processing agreement, as allowed by section 72 of POPIA.
11. Your rights
Under POPIA you can:
- ask whether we hold information about you and get a copy of it;
- ask us to correct information that is wrong, out of date or incomplete;
- ask us to delete information we no longer have a right to keep;
- object to us using your information for our legitimate interests;
- withdraw consent, including for health information and the activity feed, at any time (this doesn’t affect what was done before);
- refuse direct marketing;
- complain to the Information Regulator.
Email privacy@gymbear.app. We may ask you to confirm your identity first. We respond within 30 days and there is no charge for reasonable requests. For information your trainer keeps, we pass your request to them within 5 business days and help them respond. Formal requests for records can also be made under our PAIA manual.
12. Security
We protect information with encryption in transit and at rest, database rules that keep each trainer’s data separate and each client’s view limited to their own records, trainer-only health notes, rate limiting, error reports without identities, and regular security reviews. No system is perfectly secure. If a breach puts your information at risk, we will notify the Information Regulator and the affected people (or the trainer, who will notify their clients) as soon as reasonably possible.
13. Browser storage, marketing and automated decisions
GymBear stores small items in your browser only to keep you signed in, remember preferences such as appearance or a half-finished form, and protect your session. We don’t use advertising cookies or third-party tracking.
We only send service emails, such as invitations and password links. If we ever send marketing, it will be only with your permission or, for existing users, about similar GymBear services, with an unsubscribe link in every message.
GymBear makes no decisions about you based solely on automated processing. Features like personal record detection are informational only.
14. GymBear's direct app (coming soon)
We plan to offer GymBear directly to individuals as a workout tracker, without needing a trainer. When it launches:
- GymBear will be the responsible party for what you log there.
- You must be 18 or older to sign up.
- Health and injury tracking will be optional and need your separate agreement.
- Connecting to a trainer will be your choice and you will see exactly what they can view. If you disconnect, the trainer can no longer see new information, but keeps the records they created while you were connected, and your own logs stay with you.
- You will be able to delete your account from inside the app.
We will update this policy and tell users before the direct app goes live.
15. Changes to this policy
We will post updates here with a new version and date, and tell account holders about material changes by email or in the app before they take effect.
16. Complaints
Please contact us first at privacy@gymbear.app so we can put things right. You also have the right to complain to the Information Regulator (South Africa) at inforegulator.org.za or through its eServices portal at eservices.inforegulator.org.za.