Terms of Service

1. Who we are

GymBear is operated by Luigi Lottino, trading as GymBear, a sole proprietor in South Africa (“GymBear”, “we”, “us”). Information Regulator registration 2026-067687. Website: https://gymbear.app. Email: support@gymbear.app (general), privacy@gymbear.app (privacy). Physical address and address for legal notices: available on request from support@gymbear.app.

2. What GymBear is

GymBear is software for personal trainers and gyms (“trainers”) to manage their clients, programmes, sessions, schedules and invoices, with a client portal where clients can follow their training, log workouts and stay in touch with their trainer. We provide, host, maintain and update the software. We are not a trainer, gym, medical provider or employer, and we do not provide training or health services ourselves.

3. Who can use GymBear

• Trainers must be 18 or older and running a training business.
• Clients use GymBear because their trainer invited them. A client under 18 may only be added by a trainer who has the consent of the client’s parent or guardian.
• If we offer GymBear directly to individuals (without a trainer), you must be 18 or older to sign up yourself.

4. Early access

GymBear is currently free during early access. Features may change, and occasional bugs or downtime are more likely than in a finished product. We will give at least 30 days’ notice before introducing any fees, and nobody will be charged unless they choose a paid plan.

5. Your account

Give accurate details and keep your login secure. You are responsible for activity on your account, and trainers are responsible for everyone they give access to their business. Tell us at support@gymbear.app if you think your account has been misused.

6. Trainers and their clients' information

For information about their clients, the trainer is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) and GymBear is the trainer’s operator. By using GymBear, trainers agree to the Operator Agreement below. In summary, trainers must have a lawful basis for what they record, get each client’s consent before recording health or injury information, and get a parent or guardian’s consent for clients under 18.

7. Acceptable use

You may not use GymBear to:

• record information that is not needed for training, such as race, religion, political views, sex life, criminal history or financial account numbers;
• post anything unlawful, abusive, discriminatory or harassing, including in the club activity feed;
• access, or try to access, another business’s or person’s data;
• interfere with, overload, reverse-engineer or probe the security of the service, except through responsible disclosure to support@gymbear.app;
• impersonate anyone or create accounts for people without their knowledge.

8. Not medical advice

GymBear is a record-keeping and communication tool. Nothing in GymBear is medical advice. Trainers are responsible for the training they prescribe and for working within their qualifications. Clients should get advice from a doctor or physiotherapist before starting or changing exercise, especially with an injury or health condition. Personal records and other figures in the app are only as accurate as what was entered.

9. Your content and our software

You keep ownership of what you put into GymBear. You give us permission to store, process and display it only as needed to run the service for you. GymBear’s software, design and name belong to us. If you send us feedback, we may use it to improve GymBear without owing you anything.

10. Availability and liability

We work to keep GymBear available, secure and backed up, but we can’t guarantee it will always be uninterrupted or error-free. To the extent the law allows, GymBear is not liable for indirect or consequential loss, or for training outcomes and injuries, which depend on the trainer and client. While GymBear is free, our total liability is limited to R1,000. Once you pay, it is limited to the fees you paid in the previous 12 months. Nothing in these terms limits liability for gross negligence, fraud, or anything that cannot be limited by law.

11. Your consumer rights

If the Consumer Protection Act 68 of 2008 applies to you, nothing in these terms removes or limits your rights under it.

12. Leaving, suspension and termination

You can stop using GymBear at any time. Trainers can close their account by emailing privacy@gymbear.app, and can ask for an export of their business data first. We may suspend or close an account that breaches these terms or puts others at risk, with notice where reasonable. After an account closes, its data is deleted as described in the Privacy Policy.

13. Changes to these terms

We will tell account holders about material changes at least 30 days before they take effect, by email or in the app. If you keep using GymBear after that, the new terms apply. If you don’t agree, you can stop using GymBear.

14. Disputes and law

These terms are governed by the law of South Africa. If something goes wrong, email support@gymbear.app first and we will try to resolve it within 20 business days. Privacy complaints can also go to the Information Regulator.

1. Parties and roles

This agreement is between Luigi Lottino, trading as GymBear (“GymBear”, the operator) and the trainer or gym using GymBear (“Responsible Party”). For all personal information about the Responsible Party’s clients processed in GymBear (“Client Data”), the Responsible Party is the responsible party and GymBear is its operator, as defined in POPIA. Client Data includes special personal information about health, such as health notes, injury notes and injury or rehab logs.

2. What GymBear does with Client Data

GymBear processes Client Data only to provide the GymBear service to the Responsible Party, on its instructions (which include the Responsible Party’s and its clients’ use of the app’s features), and to keep the service secure and working. GymBear does not sell Client Data, use it for advertising, profile clients for its own purposes, or use it to train artificial intelligence models. Usage statistics GymBear keeps for itself contain no Client Data content.

3. Confidentiality and access

GymBear treats Client Data as confidential. Only GymBear’s owner has administrative access, uses it only when needed to maintain the service, fix a problem, or answer a request from the Responsible Party, and is bound by this confidentiality duty.

4. The Responsible Party's duties

The Responsible Party agrees to:

• have a lawful basis for all Client Data it records, and record only what is needed for training;
• get each client’s consent to record their health and injury information in GymBear, for example through its client agreement or intake form;
• get a parent or guardian’s consent before adding a client under 18;
• not record race, religion, political views, sex life, criminal behaviour, or financial account numbers;
• keep Client Data accurate and correct it when asked;
• remove a client’s health notes when the client withdraws health consent;
• answer its clients’ requests to access, correct or delete their information, with GymBear’s help;
• control who in its business has access, and remove people who leave;
• tell GymBear promptly at privacy@gymbear.app if it suspects unauthorised access to its account.

5. Security

GymBear maintains appropriate, reasonable technical and organisational measures as required by section 19 of POPIA, including:

• encryption of data in transit (HTTPS) and at rest;
• database row-level security so that only members of the Responsible Party’s business can read its Client Data, and clients see only their own records;
• health and injury notes visible to the trainer only, never to other clients;
• client write access only through narrow, checked database functions;
• rate limiting on invitations and sign-in;
• error monitoring configured without client identities or note content;
• regular security reviews and prompt updates.

6. Sub-operators

The Responsible Party authorises GymBear to use these sub-operators, each under a data processing agreement:

• Supabase: database, authentication and server functions. Data stored in AWS eu-north-1, Stockholm, Sweden.
• Resend: sends invitation, account and invoice emails (name, email address, and for invoices the invoice number, amount, due date and a link to the invoice), through Amazon’s Ireland region.
• Sentry: error monitoring, EU region (Germany), without client identities.
• Cloudflare: domain and email forwarding for gymbear.app addresses.

GymBear also uses Vercel to deliver the app’s pages to browsers, under Vercel’s standard terms. Vercel is not a sub-operator: Client Data does not pass through or get stored on it.

GymBear will give 30 days’ notice by email before adding or replacing a sub-operator that handles Client Data. The Responsible Party may object and, if the objection can’t be resolved, close its account.

7. Transfers outside South Africa

Client Data is stored in the European Union, whose General Data Protection Regulation gives protection substantially similar to POPIA. Where a sub-operator is based outside South Africa, the transfer is protected by that provider’s binding data processing agreement, as allowed by section 72 of POPIA.

8. Security compromises

If GymBear has reasonable grounds to believe Client Data has been accessed or acquired by an unauthorised person, it will notify the Responsible Party without undue delay, aiming for within 72 hours of confirming it. The notice will describe what happened, what data and clients are involved, what GymBear has done, and what the Responsible Party should do. GymBear will help the Responsible Party notify the Information Regulator and affected clients under section 22.

9. Requests from clients

If a client asks GymBear directly to access, correct or delete Client Data, GymBear will pass the request to the Responsible Party within 5 business days and help it respond. Where the Responsible Party can’t be reached or no longer uses GymBear, GymBear may respond directly to protect the client’s rights.

10. Archived and deleted clients, and end of service

Archiving a client keeps their Client Data so the Responsible Party can restore them. The Responsible Party decides how long to keep archived clients and should delete those it no longer needs. When the Responsible Party deletes a client, GymBear immediately and permanently deletes that client’s contact details, health information, logs, measurements, programmes, workouts, sessions, feed posts and portal login, keeping only the client’s name alongside the Responsible Party’s invoices. When the Responsible Party closes its account, GymBear will provide an export on request made within 30 days, and permanently delete Client Data within 90 days of closure, except where the law requires it to be kept. Backup copies are overwritten on a rolling basis.

11. Cooperation

GymBear will give the Responsible Party information reasonably needed to show that this agreement is being followed, and will cooperate with the Information Regulator.