Privacy Policy — Coach Web Application
Effective Date: February 14, 2026
Data Controller: Gain. Fitness GmbH, Kelchweg 3, 8048 Zurich, Switzerland
Contact: privacy@gain-app.com
1. Introduction
Gain. Fitness GmbH ("we," "us," or "our") operates the Gain coach web application ("the Platform").
This Privacy Policy explains how we collect, use, store, protect, and transfer personal data when you use the Platform as a coach.
We comply with:
- The EU General Data Protection Regulation (GDPR)
- The Swiss Federal Act on Data Protection (FADP)
- The California Consumer Privacy Act (CCPA/CPRA)
2. Role and Data Protection Responsibilities
Gain. Fitness GmbH acts as the data controller for all personal data processed within the Platform, including client data accessed by coaches.
Coaches are authorized users of the Platform and may access client data solely for the purpose of delivering coaching services within the scope of the Platform functionality.
Coaches are contractually obligated to:
- Access client data only for legitimate coaching purposes
- Maintain strict confidentiality
- Comply with applicable data protection laws
- Not process client data outside the Platform unless independently authorized
Coaches do not acquire independent ownership of client data through use of the Platform.
3. Categories of Data We Collect
3.1 Coach Account Data
When you create a coach account via our authentication provider (Auth0), we collect:
- Name
- Email address
- Profile picture
- Unique user identifier (Auth0 ID)
3.2 Client Data Accessed by Coaches
As a coach, you access and manage client data to deliver coaching services. This includes:
- Body weight measurements
- Nutrition tracking data (protein, carbohydrates, fat, fiber)
- Step counts
- Sleep data
- Training logs (exercises, weight, repetitions, RIR)
- Form check photos and videos
- Check-in data and coach feedback
- Diet phase data
- Nutrition targets
- Rate of weight change
- Coach notes
- Custom tracking fields
- Mesocycle and planning data
This data may qualify as health data under Art. 9 GDPR.
3.3 Technical & Diagnostic Data
We collect limited technical data via Sentry:
- Exception class names
- Stack traces
- Performance traces
- Allowlisted breadcrumb messages
- Browser type and version
- Operating system version
- Anonymous user identifier (Auth0 ID)
No name, email, or IP address is stored in logs.
Crash logs are retained for a maximum of 90 days unless required for security investigations.
Access to client data may be logged for security and compliance purposes.
4. Legal Bases for Processing (GDPR)
| Legal Basis | Data | Purpose |
|---|---|---|
| Art. 6(1)(b) – Contract | Coach account data | Provide access to the Platform |
| Art. 6(1)(b) – Contract | Client data | Provide coaching functionality within the Platform |
| Art. 6(1)(f) – Legitimate Interest | Technical data | Ensure platform stability, security, and fraud prevention |
| Art. 9(2)(a) – Explicit Consent | Client health data | Processing of special category data within the coaching service |
You may withdraw consent where consent is the legal basis. Withdrawal does not affect processing prior to withdrawal.
5. How We Use Data
We use personal data to:
- Provide and maintain the coaching platform
- Enable client management and coaching workflows
- Authenticate users
- Maintain system security
- Diagnose and fix technical issues
- Protect against unauthorized access
We do not:
- Sell personal data
- Use personal data for personalized advertising
- Engage in profiling
- Conduct automated decision-making with legal or similarly significant effects
6. Third-Party Service Providers (Data Processors)
We use carefully selected processors under Data Processing Agreements (Art. 28 GDPR):
| Service | Purpose |
|---|---|
| Auth0 (Okta Inc.) | Authentication |
| AWS (Amazon Web Services) | Secure cloud hosting & storage |
| Sentry | Error monitoring and crash reporting |
All processors act solely on our behalf and under contractual safeguards.
7. International Data Transfers
Data is stored on servers in the United States.
Transfers from the EEA/Switzerland are safeguarded by:
- Standard Contractual Clauses (SCCs)
- Additional technical and organizational safeguards
8. Data Retention
- Active accounts: retained while account is active
- Account deletion: data permanently deleted upon deletion request
- Backup systems: overwritten within 30 days
- Technical logs: deleted after 90 days
- Inactive accounts: may be deleted after 24 months of inactivity
Upon termination of a coach account, access to client data is immediately revoked.
Browser-stored data (localStorage, sessionStorage) is cleared upon logout or when browser storage is cleared.
9. Your Rights
Under GDPR/FADP:
- Access
- Rectification
- Erasure
- Restriction
- Portability
- Objection
Contact: privacy@gain-app.com
You may lodge a complaint with your supervisory authority.
10. Data Security
We implement:
- Encryption in transit (TLS 1.2+)
- Encryption at rest (AWS server-side AES-256)
- HTTPS enforcement
- Content Security Policy (CSP) headers
- X-Frame-Options headers preventing clickjacking
- Strict referrer policy (strict-origin-when-cross-origin)
- Strict role-based access controls
- Time-limited presigned upload URLs
Coaches are contractually bound to maintain strict confidentiality regarding all client data accessed through the Platform.
10.1 Browser Storage
The Platform stores the following data locally in your browser:
- localStorage: Authentication tokens (via Auth0), UI preferences (theme, language, sidebar state), and view settings. This data persists across browser sessions.
- sessionStorage: Temporary authentication redirect paths and onboarding data. This data is cleared when the browser tab is closed.
All browser-stored data is cleared upon logout.
10.2 Cookies
The Platform uses minimal cookies:
- Auth0 authentication cookies
- Language preference detection
No tracking or advertising cookies are used.
11. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you may have the following rights (subject to verification and applicable exceptions):
- Right to know — Request details about the personal information we collect, use, and disclose
- Right to delete — Request deletion of personal information, subject to legal exceptions
- Right to correct — Request correction of inaccurate personal information
- Right to opt-out of sale/share — We do not sell or share personal information for cross-context behavioral advertising
- Right to non-discrimination — We will not discriminate against you for exercising your rights
To exercise your rights, contact us at privacy@gain-app.com.
12. Children’s Privacy
The Platform is not intended for individuals under 16.
We do not knowingly collect data from children under 16.
13. Automated Decision-Making
We do not perform automated decision-making with legal or similarly significant effects.
14. Changes to This Policy
We may update this policy. Material changes will be communicated via the Platform.
15. Contact
Gain. Fitness GmbH
Kelchweg 3
8048 Zurich
Switzerland