Privacy Policy for Athletes

Version: 2026-08-24
Effective Date: August 24, 2026

The German version of this document is the authoritative version; this English translation is provided for convenience.

1. Introduction and scope

(1) Gain. Fitness GmbH, Kelchweg 3, 8048 Zurich, Switzerland ("Gain", "we", "us" or "our") operates the "Gain" coaching platform including the associated mobile application (the "Platform" or the "App").

(2) This privacy policy is addressed to you as an athlete, that is, as a person who uses the Platform for their own training and nutrition support — whether you are supported by a coach (your "Coach") or use the Platform without a coach (solo use).

(3) It explains which personal data we process, for which purposes and on which legal basis, who receives that data, how long it is stored and which rights you have.

(4) We comply in particular with:

• the EU General Data Protection Regulation (GDPR) — for athletes in the EU/EEA pursuant to Art. 3(2) GDPR;
• the Swiss Federal Act on Data Protection (revFADP);
• the California Consumer Privacy Act (CCPA/CPRA), where applicable (section 14).

(5) Note on the structure of this document. The Platform has two modes of use. Sections expressly marked "Only where you are supported by a coach" apply only if your account is linked to a coach account. All other sections apply to all users.

(6) A separate privacy policy applies to coaches: https://gain-app.com/en/privacy/coach.

2. Controllers — who is responsible for what?

There are three distinct spheres of responsibility on the Platform.

2.1 Gain as sole controller

Gain. Fitness GmbH is the sole controller within the meaning of Art. 4(7) GDPR for:

• your account, registration and authentication data (section 4.1);
• technical and diagnostic data (section 4.5);
• billing and payment data in the relationship between you and Gain, and compliance with commercial and tax retention obligations (section 4.6);
• audience measurement and conversion tracking on our website (section 4.7);
• security, abuse and fraud prevention for the Platform;
• all of your data for as long as you use the Platform without a coach (solo use) — including your health data.

Contact: privacy@gain-app.com.

2.2 Gain and your Coach as joint controllers

Only where you are supported by a coach. As soon as your account is linked to a coach account, Gain and your Coach are joint controllers within the meaning of Art. 26 GDPR for your coaching data. These are the following eight categories of data:

This data is predominantly health data and therefore constitutes special categories of personal data under Art. 9(1) GDPR.

The allocation of obligations between Gain and your Coach is described in section 3.

2.3 Your Coach as sole controller

Only where you are supported by a coach. For everything your Coach processes outside the Platform, your Coach alone is the controller. This includes in particular:

• your Coach's own notes, spreadsheets, previous tools and other records held outside the Platform;
• communication with you outside the Platform (e.g. email, messenger, telephone, in-person conversations);
• your Coach's contract initiation, invoicing and accounting towards you;
• your Coach's marketing and advertising activities.

Gain is neither controller nor processor for that processing. This privacy policy does not apply to it. Please contact your Coach directly in this respect; your Coach must inform you about their own processing separately.

Where data from your Coach's sole sphere of responsibility is carried over into the Platform (data import, section 5), it becomes subject to joint controllership under section 2.2 from the moment of import. The lawfulness of its collection before the import remains the sole responsibility of your Coach.

2.4 Overview: with a coach / without a coach

3. Essence of the joint controller arrangement (Art. 26(2) GDPR)

Only where you are supported by a coach.

(1) Gain and your Coach have entered into a joint controller agreement under Art. 26 GDPR (the "Agreement"). Every coach accepts it expressly during onboarding; the acceptance is logged with a version identifier and a timestamp. The full text of the Agreement is publicly available at https://gain-app.com/en/legal/joint-controller-agreement.

(2) The essence of the Agreement, in plain language:

(3) Gain is your point of contact. You can reach us at privacy@gain-app.com. If you address a request concerning processing on the Platform to your Coach, your Coach will forward it to us without undue delay and in any event within three business days, and will inform you that it has been forwarded.

(4) You may exercise your rights against either of us (Art. 26(3) GDPR). Irrespective of the allocation above, you may exercise your rights under the GDPR in respect of and against Gain as well as against your Coach. Neither of us may turn you away solely by reference to the Agreement. For practical reasons we recommend going through Gain, because that is where the data is held and where requests are handled.

(5) Joint responsibility and liability. Joint controllership does not mean that responsibility is split up and thereby reduced. Under Art. 82(4) GDPR each joint controller is liable for the entire damage, so that you receive effective compensation. Between themselves, Gain and your Coach settle the damage according to their respective shares of responsibility (Art. 82(5) GDPR). The allocation of obligations in paragraph 2 is without prejudice to the statutory responsibility of both parties.

(6) Start and end. Joint controllership begins when your account is linked to the coach account (accepted invitation); historical data imported by your Coach is subject to it from the moment of import (section 5). It ends when that link is removed. When the coaching relationship ends, your former Coach's access to your data is revoked; your relationship with Gain and your rights in your data remain unaffected.

4. Categories of data we process

4.1 Account data

When you register via our authentication provider (Auth0) we process:

• name
• email address
• profile picture
• pseudonymous user identifier (Auth0 ID)

4.2 Fitness and health data you provide

To deliver the coaching service we process:

• body weight measurements
• nutrition tracking data (protein, carbohydrates, fat, fibre)
• barcode scans (product barcode only)
• step counts
• sleep data
• training logs (exercises, weight, repetitions, RIR)
• form check photos and videos
• messages between you and your Coach
• diet phase data
• nutrition targets
• rate of weight change
• notes from your Coach
• custom tracking fields defined by your Coach
• anamnesis information (pre-existing conditions, injuries, complaints, medication, intolerances)
• check-in responses

Some of this data qualifies as health data under Art. 9 GDPR, as it relates to your physical health and fitness condition. We process it on the basis of your explicit consent (section 6).

Only where you are supported by a coach: your Coach can access this data strictly within the functionality of the Platform and solely for the purpose of providing coaching services. Without a coach (solo use), no one but you has access to this data; Gain accesses it only to the extent technically required (e.g. operations, support at your request, security).

4.3 Health data from your device (optional — separate permission)

With your explicit permission, the App may read health data from:

• Apple HealthKit (iOS)
• Google Health Connect (Android)

Data types accessed:

• steps
• weight
• sleep
• nutrition (macronutrients)

Health data accessed via device integrations:

• is accessed only after explicit permission;
• is used exclusively to provide the core coaching functionality;
• is never used for advertising, marketing, profiling or data brokerage;
• is never sold;
• is never shared with advertisers;
• is not used for unrelated analytics or data mining.

You can revoke this permission at any time in your device's health settings.

4.4 Push notification data (optional)

If you enable push notifications, we process:

• device token (via Apple Push Notification Service (APNs) or Firebase Cloud Messaging (FCM))
• device platform identifier

Push notification tokens are used solely to deliver coaching-related notifications.

4.5 Technical and diagnostic data

We collect limited technical data via Sentry:

• exception class names
• stack traces
• performance traces
• allowlisted breadcrumb messages
• device type
• OS version
• pseudonymous user identifier (Auth0 ID)

No name, email address or IP address is intentionally stored in diagnostic logs.

Crash logs are retained for a maximum of 90 days unless required for security investigations.

Gain is the sole controller for this data; it is not made accessible to your Coach.

4.6 Billing and payment data

Insofar as you enter into a paid contractual relationship directly with Gain, we process the contract, billing and payment data required to perform it (e.g. booking data, invoice details, payment status). Gain is the sole controller for this data. It is not made accessible to your Coach and is subject to statutory commercial and tax retention periods (section 11).

If your Coach invoices you directly for their services, your Coach alone is responsible for that (section 2.3).

4.7 Website, audience measurement and conversion tracking

On our website (https://gain-app.com) we use — where you have consented — analytics and conversion tracking services in order to measure reach and the effectiveness of our own advertising campaigns. Gain is the sole controller for that processing. Details of the cookies and services used, of consent and of its withdrawal are set out in our cookie policy at https://gain-app.com/en/cookies.

We do not use advertising or tracking cookies within the App itself. Your coaching and health data does not feed into audience measurement or conversion tracking.

5. Data from previous tools — information under Art. 14 GDPR

Only where you are supported by a coach.

(1) Some data about you may have been provided to us not by you but by your Coach. This concerns in particular your existing history from one of your Coach's previous tools (e.g. a Google Sheets spreadsheet) which your Coach imports when moving to the Platform.

(2) Categories of data concerned: your existing training, nutrition, check-in and anamnesis history as well as progress records — that is, the categories listed in section 2.2. This is predominantly health data (Art. 9(1) GDPR).

(3) Source: your Coach, from their own records or from the previous tool they used until now. The data does not originate from publicly accessible sources.

(4) Purpose and legal bases: continuing your coaching without loss of data; the legal bases are Art. 6(1)(b) GDPR and — for the health data — your explicit consent under Art. 9(2)(a) GDPR (section 6).

(5) Information before the import. Your Coach is obliged to inform you about the transfer before the import. Gain provides a template notice for this purpose: https://gain-app.com/en/legal/migration-notice.

(6) Rules for the import — only after your consent. An import takes place only after you have activated your account, completed onboarding and given your consent under section 6. No historical data is transferred to the Platform before you have given your consent; importing "in advance" is not permitted. Each spreadsheet submitted may contain the data of exactly one person and no personal data of third parties. Your Coach warrants to Gain that they collected and hold the data lawfully and that they informed you before the import. Gain deletes the source file submitted for import once the import is complete.

(7) Your rights. You have the same rights in respect of imported data as in respect of all other data (section 13), in particular access, rectification, erasure and objection. Please contact privacy@gain-app.com.

6. Your consent to the processing of health data (Art. 9(2)(a) GDPR)

(1) Why consent? Coaching data is predominantly health data and therefore a special category of personal data (Art. 9(1) GDPR). Processing it is prohibited in principle and permitted only where — in addition to the general legal basis — an exception under Art. 9(2) GDPR applies. The general legal basis is Art. 6(1)(b) GDPR (performance of the user and coaching relationship); the required exception is your explicit consent under Art. 9(2)(a) GDPR. Without that consent we do not process your health data (section 7); historical data provided by your Coach is likewise imported only after you have given your consent (section 5).

(2) What the consent covers:

• the processing of your health data (sections 2.2 and 4.2, including data taken from device integrations under section 4.3) for the purpose of training and nutrition support;
• conditionally — only where you are supported by a coach: access by the coach linked to you to that data — exclusively within the features of the Platform and solely for coaching purposes (section 9.1). If you use the Platform without a coach, this part of the consent does not apply;
• historical data provided by your Coach, including data imported from previous tools (e.g. Google Sheets) under section 5.

(3) How the consent is obtained. Gain obtains the consent in the App during onboarding — as a separate, unbundled step, separate from acceptance of the terms of use and separate from any other declaration. The consent is freely given, worded in plain language, and documented in a demonstrable manner with the wording of the consent text, a version identifier and a timestamp (Art. 7(1) GDPR). We publish the verbatim text of the consent declaration at https://gain-app.com/en/legal/art9-consent, where you will find the version currently in force. We will provide you with the wording of the version your own consent relates to on request to privacy@gain-app.com. Your Coach does not obtain consent on Gain's behalf; your Coach can only view the consent status in the Platform.

(3a) Necessity — what happens without consent? Without processing your health data we objectively cannot provide the training and nutrition coaching — this processing is the core of the App's features, not an add-on. If you do not give the consent, or withdraw it, the coaching-related features are therefore unavailable or cease to be available (paragraph 5). Unaffected: your account, your right to erasure (sections 6(6) and 13), and the lawfulness of the processing carried out up to the withdrawal.

(4) Withdrawal at any time. You may withdraw your consent at any time with effect for the future — in the App under Account or by email to privacy@gain-app.com. The lawfulness of processing carried out before the withdrawal remains unaffected. Withdrawing is as easy as giving consent.

(5) Consequences of withdrawal. If you withdraw your consent:

• the health data concerned is frozen and hidden; it is no longer processed for coaching purposes;
• your Coach's access to that data is revoked (only where you are supported by a coach);
• your Coach is notified of the withdrawal and is contractually obliged to cease any further processing of that data without undue delay — including copies and extracts held outside the Platform;
• the App is available to you only to a limited extent: your account and support remain reachable, the coaching-related features do not, because they cannot be provided without processing health data;
• if you pay your coach through the Platform, you can still view and cancel that payment arrangement — the withdrawal freezes your health data, not the management of your payments.

(6) Erasure. Withdrawal initially results in the data being frozen, not yet permanently erased. Permanent erasure follows the standard account deletion route at https://gain-app.com/en/account-deletion or the expiry of the retention periods set out in section 11. You may of course also request erasure directly (section 13).

(7) Other consents. This consent must be distinguished from the separate permission for device health data in your device's system settings (section 4.3), the consent to push notifications (section 4.4) and the cookie consent on our website (section 4.7). Each of these consents can be withdrawn independently of the others.

7. Legal bases for processing

Health-related data is a special category of personal data. The legal basis under Art. 6(1)(b) GDPR is not sufficient on its own for processing it; an exception under Art. 9(2) GDPR must apply in addition. As that exception we rely exclusively on your explicit consent under Art. 9(2)(a) GDPR. Without that consent, no processing of your health data takes place — whether you enter it yourself or import it from a device integration; historical data is imported by your Coach only after you have given your consent (section 5).

You may withdraw any consent at any time with effect for the future; the lawfulness of processing carried out up to that point remains unaffected (section 6).

8. Purposes of processing

We process your data in order to:

• provide and operate the Platform and the coaching features;
• only where you are supported by a coach: enable collaboration and communication with your Coach;
• synchronise your data across devices;
• authenticate you;
• maintain system security;
• detect and fix technical issues;
• protect against unauthorised access;
• deliver notifications (if enabled);
• comply with legal obligations (e.g. retention obligations).

We do not:

• sell personal data;
• use personal data for personalised advertising;
• engage in profiling;
• conduct automated decision-making with legal or similarly significant effects.

9. Recipients of your data

9.1 Your Coach as joint controller

Only where you are supported by a coach. Your Coach receives access to the coaching data listed in section 2.2 — strictly within the functionality of the Platform and solely for coaching purposes. Your Coach is contractually obliged to treat that data as strictly confidential, not to use it for any other purpose (in particular not for advertising, profiling, disclosure to third parties or sale) and not to create bulk exports. Coaches see only the data of the athletes linked to them.

9.2 Processors (Art. 28 GDPR)

We use carefully selected processors under data processing agreements (Art. 28 GDPR):

All processors act solely on our behalf and under contractual safeguards.

9.3 Independent controllers

The App may display embedded exercise videos via YouTube (Google LLC). When you interact with embedded YouTube content, Google may process certain data (such as IP address or usage data) in accordance with its own privacy policy. YouTube acts as an independent controller for its own processing activities.

9.4 Other recipients

We disclose data to authorities, courts or legal advisers only where we are legally obliged to do so or where this is necessary to establish, exercise or defend legal claims.

10. International data transfers

(1) Your data is stored on servers in the United States. Personal data is therefore transferred from the EEA and Switzerland to a third country.

(2) Primary safeguard: Data Privacy Framework. The US processors we use — Amazon Web Services (Amazon.com, Inc.) including Amazon SES, Auth0 LLC / Okta, Inc. and Functional Software, Inc. (Sentry) — are active participants in the EU–U.S. Data Privacy Framework (DPF) and in the Swiss–U.S. Data Privacy Framework. The transfer therefore takes place on the basis of the European Commission's adequacy decision (Art. 45 GDPR) and the recognition by the Swiss Federal Council respectively.

(3) Fallback safeguard: Standard Contractual Clauses. Should the relevant Data Privacy Framework cease to apply, be suspended or be inapplicable to a transfer, the transfer takes place on the basis of the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) — for transfers from Switzerland in the version recognised by the FDPIC — together with supplementary technical and organisational measures (section 15).

(4) You may obtain a copy of the applicable safeguards on request at privacy@gain-app.com.

11. Retention periods

Data stored locally on your device is removed when you uninstall the App.

Only where you are supported by a coach: when the coaching relationship ends, your former Coach's access to your data is revoked. Your data remains in your account unless you request otherwise.

12. Account deletion

You can have your account and the associated data deleted at any time. The procedure is described at https://gain-app.com/en/account-deletion; alternatively, a message to privacy@gain-app.com is sufficient. Data subject to a statutory retention obligation (in particular billing data), or required to establish, exercise or defend legal claims, is excluded from deletion; it is blocked and erased once the relevant period expires.

13. Your rights

(1) Under the GDPR and the revFADP you have the following rights:

• access to the personal data we process about you (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• objection to processing based on legitimate interests (Art. 21 GDPR);
• withdrawal of consent with effect for the future (Art. 7(3) GDPR, section 6).

(2) Point of contact: privacy@gain-app.com. We answer your request within the one-month time limit under Art. 12(3) GDPR; for complex requests the period may be extended by up to two further months, of which we will inform you.

(3) Only where you are supported by a coach: under Art. 26(3) GDPR you may exercise your rights against Gain as well as against your Coach (section 3(4)). If you address your request to your Coach, they will forward it to us without undue delay and in any event within three business days.

(4) Right to lodge a complaint (Art. 77 GDPR). You have the right to lodge a complaint with a data protection supervisory authority — in the EU/EEA with the authority of your place of residence, place of work or the place of the alleged infringement; in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.

14. California privacy rights (CCPA/CPRA)

If you are a California resident, you may have the following rights:

• Right to know what personal information we collect and how we use it;
• Right to delete personal information, subject to legal exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of sale or sharing (we do not sell personal data and do not share it for cross-context behavioural advertising);
• Right to non-discrimination for exercising these rights.

To exercise your rights, contact us at privacy@gain-app.com.

15. Data security

We implement the technical and organisational measures required under Art. 32 GDPR, in particular:

• encryption in transit (TLS 1.2 or higher);
• encryption at rest (server-side AES-256 at AWS);
• secure storage of authentication tokens (iOS Keychain / Android Keystore);
• strict role-based access controls;
• time-limited, presigned upload and access URLs for media (form check photos and videos);
• logging of access to athlete data for security and compliance purposes;
• tenant separation at the application logic level;
• confidentiality undertakings and regular data protection training for the personnel involved;
• regular backups and recovery procedures.

Within the Platform, your coaching data is accessible only to you and — where applicable — to your linked Coach.

16. Children's privacy

The App is not intended for individuals under 16. We do not knowingly collect data from children under 16. If we become aware that data of a person under 16 is being processed without the required basis, we will delete it without undue delay.

17. No automated decision-making

We do not carry out automated decision-making, including profiling, with legal or similarly significant effects within the meaning of Art. 22 GDPR.

18. Changes to this privacy policy

We may update this privacy policy, for example when the Platform or the legal situation changes. We will inform you of material changes in the App or by email. The version in force is available at https://gain-app.com/en/privacy/athlete; the version identifier is shown in the header of this document and in the changelog.

If a change requires new or extended consent under Art. 9(2)(a) GDPR, we will obtain that consent separately before the processing begins.

19. Contact

Gain. Fitness GmbH
Kelchweg 3
8048 Zurich
Switzerland

privacy@gain-app.com

EU representative (Art. 27 GDPR): We have appointed Prighter EU Rep GmbH, Schellinggasse 3, 1010 Vienna, Austria, as our representative in the European Union pursuant to Art. 27 GDPR. Data subjects and supervisory authorities in the EU may contact our representative regarding any matter related to the processing of personal data: https://prighter.com/q/14301940924 (or by post to the address above, marked "attn: Gain. Fitness GmbH").

Related documents: Joint Controller Agreement (Art. 26 GDPR) · Template data migration notice · Terms of Use for Athletes · Cookie Policy · Account deletion

Changelog