Privacy Policy

Introduction

Welcome to Gymlab (“we,” “our,” or “us”). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered fitness application on iPhone, Apple Watch, and the web.

By using Gymlab, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our service.

Information We Collect

Personal Information

We collect information that you provide directly to us, including:

• Account Information: Email address, name, and an optional profile photo. Gymlab does not use passwords: you sign in with a one-time code sent to your email, with Sign in with Apple, or with your Google account. If you sign in with an Apple or Google account, we receive your name, email address, and, where available, profile image from that account.
• Profile Information: Year of birth, gender, height, weight, fitness goals, experience level, equipment availability, training schedule, workout preferences, injuries or limitations you disclose, the coach you choose, and optional survey answers about how you found Gymlab and which other fitness apps you use
• Workout Data: Exercise history, sets, reps, weight, RPE (Rate of Perceived Exertion), workout completion data, and any free-text notes you add
• Workout Heart Rate: Heart-rate readings taken during a workout from your Apple Watch, Apple Health, or a Bluetooth heart-rate monitor you connect, with the name and model of the device that recorded them
• Coach Conversations and Memories: Your chat messages with your AI coach and its replies, and memories the coach saves from your conversations (for example an injury, your schedule, or a preference) to personalize future coaching. You can review, edit, and remove memories in the app.
• Voice & Audio Data: Short voice-input recordings you make with the microphone on your iPhone, Apple Watch, or computer. Recordings are sent to our AI service providers for transcription and are not retained in raw form on our servers. The transcribed text becomes part of your message.
• Photo and Document Attachments: Images and documents you choose to attach in chat (e.g. photos of equipment or a workout plan), which are sent to our AI service providers so they can reference them in their response.
• Location Data: If you allow location access on your iPhone, we use your precise location to find gyms near you and to match a workout to the gym where you trained. For that matching, the app records your location when you start and when you finish a workout, and we store those two readings with the workout. We do not track your location at other times. If you use gym search in the web app, your browser asks for permission before sharing your location.
• Community Content: Messages and photos you post in communities, the communities you join, and your community sharing settings.
• Health Data: Optional Apple Health data you allow Gymlab to read. Today the app reads your birth year, biological sex, height, and weight to prefill your profile, and the heart rate recorded during your workouts. The permission request also covers steps, distance, active calories, resting heart rate, heart rate variability, respiratory rate, blood oxygen, sleep, and workouts recorded by other apps, which Gymlab does not currently read. Your account may also hold body metrics (such as body fat percentage, lean body mass, and waist circumference), daily summaries (such as sleep, resting heart rate, heart rate variability, and VO2 max), and related permission and sync status details from earlier syncs.
• Subscription & Purchase Data: Subscription status, entitlements, trial status, and transaction identifiers received from Apple In-App Purchase, or from our payment processor when you subscribe on the web. We do not receive or store your payment-card details.

Automatically Collected Information

• Usage Data: Features used, time spent in app, workout generation requests
• Device Information: Browser type, operating system, app version, time zone, device identifiers, and push notification tokens
• Analytics Data: App events, page views, and performance metrics collected by our product analytics provider
• App Session Recordings: Screen images and interactions, such as taps and scrolling, recorded in the iPhone app by our product analytics provider. These recordings can show text you enter and content visible on screen, including account and profile information, workouts, Health information, coach conversations, and images. They use device and session identifiers and are linked to your Gymlab user identifier after sign-in. We record sign-in and onboarding sessions and sample later sessions. Our team can view recordings to diagnose problems and improve the product.
• Diagnostics Data: Crash logs, error stack traces, request context, and diagnostic session replays from the iPhone and web apps, captured by our crash and error reporting provider to help us diagnose and fix issues. Diagnostics can be linked to your account identifier when you are signed in.
• AI Quality Telemetry: Copies of prompts sent to and responses received from our AI service providers, recorded by our AI observability provider so we can monitor and improve AI quality.

AI Processing & Third-Party AI Services

Gymlab is an AI-powered fitness application. To generate your workouts and provide coaching, we share certain personal data with the categories of AI providers described below.

• AI service providers: Receive your fitness profile, name, year of birth, gender, optional Health summary, exercise history, coach memories, onboarding interview answers, chat messages, and any photos or documents you attach in chat, so they can generate workout plans and coaching responses. If you connect Hevy, your coach can also look up your Hevy workout history. They also receive short audio recordings when you use voice input, so they can transcribe them. When you share a public exercise video link with your coach, the video and its caption are sent to an AI service provider for analysis, without your profile or account details. Community messages are not sent to AI service providers.
• AI observability provider: Receives copies of the prompts we send to our AI service providers and the responses we receive, including voice-input transcripts, plus your Gymlab user identifier, so we can monitor and improve AI quality.

These providers act as data processors under contractual terms that require security and confidentiality protections at least equivalent to those described in this Privacy Policy. We do not sell your personal information.

Your Choices

• Voice input: Decline microphone access on your device to disable voice input.
• Health data: Apple Health access is optional. Revoke it at any time from device settings, or delete synced data in the app's Apple Health settings, where you can also stop the iPhone app saving workouts to Apple Health. Workouts you finish on your Apple Watch are saved under the watch's own Apple Health permission.
• Photo attachments: Only sent when you choose to attach a photo in chat.
• Coach memories: Review, edit, or remove them in Settings → Memories. A removed memory is no longer used for coaching, but we keep a record of it until you delete your account.
• Location: Location access is optional. Decline or revoke it in your device settings; you can still search for gyms by name.
• Communities: Joining a community is optional, and you can leave at any time.
• Account deletion: Removes your data from our systems as described under Data Retention below.

Gymlab's core features depend on these AI providers. If you are not comfortable with the data sharing described above, please do not use Gymlab.

Data Controller

Gymlab is a product of Pyrean B.V. (Dutch Chamber of Commerce registration: 66494834), which is the data controller responsible for your personal information. Our Data Protection Officer can be contacted at [email protected] for any privacy-related questions or concerns.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our fitness coaching services
• Generate personalized workout plans by sending your fitness profile, exercise history, optional Health summary, and onboarding interview answers to our AI service providers for AI-based plan generation
• Transcribe short voice-input recordings through our AI service providers when you use the voice-input feature
• Track your fitness progress and workout history
• Personalize coaching and workout recommendations with optional Health data such as activity, sleep, heart rate, and body metrics
• Find gyms near you and match your workouts to the gym where you trained
• Run communities, including rankings, shared workouts, and chat
• Send you push notifications when your coach replies or your plan or workout is ready (you can turn each type off in Settings)
• Monitor and debug the quality of AI responses via our AI observability provider, which receives copies of prompts and AI responses
• Analyze usage patterns and review session recordings to improve our product, AI prompts, and user experience
• Diagnose and fix crashes and errors via our crash and error reporting provider
• Manage subscriptions, free trials, and entitlements via Apple In-App Purchase and, for subscriptions bought on the web, our payment processor
• Create de-identified example plans for our website, as described below
• Protect against fraud and ensure platform security
• Comply with legal obligations

Communities

Communities are private groups and gym communities where members compare training. Joining is optional. When you join, you choose what to share, and a community can require some categories of sharing as a condition of membership. Gyms are open to any Gymlab member, so anything you share in a gym community can be seen by anyone who joins it.

Other members of a community you join can see:

• Your name, profile photo, role, and the date you joined
• Messages and photos you post in the community chat
• If you share workouts: the workouts you publish (title, date, duration, volume, exercises, and sets) and the gym where they were done. Members can copy a shared workout into their own account.
• If you share records: your personal records and rankings. Records are ranked in separate men's and women's divisions based on the gender in your profile, so members can see which division you are in.
• If you share training load: your training-load (strain) score and ranking. This score can reflect Health data such as sleep, resting heart rate, and heart rate variability.

Members never see your email address, workout notes, workout photos, raw Health data, or your location readings. Community owners and admins can remove messages and members. Leaving a community removes your membership but keeps the messages you posted; deleting your account deletes them.

Public Example Plans

To show what Gymlab can do, we publish example workout plans on our website. We create them from plans generated for adult members. Before a plan is used, we remove your name and any other detail that could identify you. An example can describe the plan's audience in general terms, such as an age range, sex, or body-size range. We send the de-identified plan to our AI service providers to write the page, and an administrator reviews and approves every page before it is published. If you do not want your plans used this way, email [email protected] and we will exclude them.

Services You Connect

Some features send your data to services you choose to connect. Those services receive the data because you asked us to share it, and their own terms and privacy policies apply to it.

• Apple Health: If you allow it, Gymlab saves your completed workouts to Apple Health. This is on by default once you grant access, and you can turn it off in the iPhone app's Apple Health settings. A workout you run on your Apple Watch is saved to Apple Health from the watch whenever the watch has Apple Health permission, regardless of that iPhone setting.
• Hevy: If you connect Hevy with your own Hevy API key, every workout you complete in Gymlab is sent to your Hevy account, including its title, times, exercises, weights, reps, and RPE. These workouts are posted as public on Hevy. We store your key encrypted, and you can disconnect Hevy at any time.
• AI assistants: You can connect an AI assistant to your Gymlab account through our MCP connector. An assistant you authorize can read your workouts, plans, logged sessions, exercise notes, training preferences, statistics, strength estimates, strain, streak, and personal records. The training preferences include your sex and how many sessions a week you train. It can log sessions, create workouts and plans, change workouts and the exercises in them, rename a plan, change how many sessions a week a plan aims for, choose the plan you follow, delete workouts and plans that were created through an assistant, and update your exercise notes and training preferences. It cannot change or delete a session you have logged. Before an assistant designs a training plan or a workout with you, it asks you the questions Gymlab's coach asks. To do so it reads what you told Gymlab's coach about your equipment, your injuries and limitations, and the exercises you like or dislike, so that you can confirm or correct them, together with a summary of your logged training and how recovered your muscles are. We keep your answers while the questions are being asked. When a plan or workout is saved from them, that record is cleared. A plan keeps the answers it was built on with the plan, so that Gymlab's coach knows what it was built for, and the equipment and the injuries and limitations you corrected are saved to your account, so that Gymlab's coach in the app knows them too. Answers that are not used are deleted after seven days without activity. The Gymlab skills and plugin for AI assistants are written instructions only: they send and fetch nothing themselves, and every request goes through the connector described above. If you have connected Hevy, a session logged through an assistant is also posted to your Hevy account as a public workout, as a session logged in the app is. A connection you approve through the assistant's own sign-in flow always has read and write access, and you remove it in that assistant. A personal access token you create in Gymlab can be limited to read access, and you can revoke it in the app's settings.

Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your personal data based on the following lawful grounds:

• Contract Performance: Processing necessary to provide our fitness coaching services that you have requested, including communities you join and services you connect
• Legitimate Interests: Improving our services (including through analytics), creating de-identified example plans, preventing fraud, and ensuring platform security
• Consent: For voice recordings, location access, and Apple Health access. Health information, including Health data and injuries or conditions you tell your coach about, is processed and shared with our AI service providers on the basis of the explicit consent you give during onboarding. You may withdraw consent at any time. Revoking a device permission stops future access through it but does not remove information already stored in Gymlab; to remove that too, delete stored Health data in the app's Apple Health settings, remove coach memories, or delete your account.
• Legal Obligation: Complying with applicable laws and regulations

Other Third-Party Services

In addition to the AI providers above, we use the following categories of service providers to operate Gymlab:

• Authentication provider — sign-in, sign-in code emails, and account security.
• Cloud database and hosting providers — store your account and fitness data and run our servers.
• Cloud storage provider — storage for files and media you upload.
• Apple Health — read the Health categories you grant access to on your device, and save workouts if you allow it.
• Payment processor — handles subscriptions bought on the web and collects your payment details directly. We do not receive payment-card data.
• Crash and error reporting provider — crash and error reporting, including diagnostic session replays.
• Product analytics provider — product and usage analytics, including iPhone app session recordings.
• Maps and places provider — finds gyms. It receives your search text and, if you allow location access, your location or the location readings of a workout. It does not receive your name or account details. Maps inside the iPhone app are provided by Apple.
• Push notification service — Apple delivers our push notifications using your device's push token.
• Exercise video search provider — finds exercise demonstration videos from public sources such as YouTube. Only the exercise name is sent; no personal data.
• Video link resolution provider — when you share a public social media video link with your coach, receives that link so we can fetch the video. No personal data is sent with it.

Data Storage and Security

We implement industry-standard security measures to protect your personal information:

• All data transmitted between your device and our servers, and between our servers and our AI providers, is encrypted using HTTPS/TLS
• We do not use passwords; sign-in is handled by our authentication provider
• Credentials for services you connect, such as a Hevy API key, are stored encrypted
• Database access is restricted and monitored
• Regular security audits and updates
• Voice-input recordings are sent to our AI service providers for transcription and are not stored on our servers in raw form. Conversation transcripts are stored in your account so you can review past sessions.
• Synced Health data is stored in your Gymlab account database and scoped to your authenticated user account

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

Cookies and Tracking

The web app uses cookies and similar storage, and the iPhone app uses similar technologies, to:

• Maintain your login session
• Remember your preferences and settings
• Analyze application usage with our product analytics provider
• Improve performance and user experience

We do not use advertising trackers, and we do not track you across other companies' apps or websites. You can control cookie settings through your browser, but disabling cookies may limit functionality.

Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Delete your account in the app's settings, or ask us to delete it
• Data Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on our legitimate interests, such as analytics or the use of your plans for example plans
• Restrict Processing: Limit how we use your data

To exercise any of these rights, including to receive a copy of your data, email [email protected].

GDPR Rights (European Users)

If you are in the European Economic Area (EEA), you have specific rights under GDPR, including the right to lodge a complaint with your local data protection authority.

CCPA Rights (California Users)

California residents have specific rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information (subject to certain exceptions)
• Right to Opt-Out: Opt-out of the “sale” or “sharing” of personal information
• Right to Non-Discrimination: Exercise your rights without discriminatory treatment

Do Not Sell or Share My Personal Information: We do not sell or share your personal information for monetary value. We do share data with third-party AI service providers strictly to provide our fitness coaching services. If you wish to opt-out of this data sharing, please contact [email protected], noting that this may limit service functionality.

Data Retention

We retain your personal information for as long as necessary to:

• Provide our services to you
• Comply with legal obligations
• Resolve disputes and enforce our agreements

Your workouts, plans, coach conversations, and uploaded files are kept until you delete them or your account. Coach memories, including ones you remove, are kept until you delete your account. Photos and documents you upload but never send are deleted after 7 days.

When you delete your account, we immediately delete your workouts, plans, coach conversations, memories, Health data, community messages, and other personal data from our active systems, and we delete your account with our authentication provider and payment processor. We also delete your uploaded files; if that fails, some files can remain in storage. We keep a pseudonymous record of the account, with your name, email address, year of birth, gender, and profile photo removed. Custom exercises you created stay linked to that record, including their names and any descriptions you wrote. Copies may remain in our database backups until those backups are deleted, and we keep invoices where tax law requires it. Deleting your account cancels a subscription bought on the web; a subscription bought through the App Store must be cancelled in your Apple account settings.

You can delete stored Health data separately in the app's Apple Health settings. This removes Health connection details, body metrics, daily summaries, and sync history stored by Gymlab. It does not delete information from Apple Health on your device.

AI service providers retain prompts, responses, and related data according to their own retention policies. Where supported by the provider, we have configured our integrations so that your data is not used to train their models. Our AI observability, product analytics, and crash and error reporting providers keep the data they have received, including session recordings, for their configured retention periods; deleting your account does not remove it from them earlier. Deleting your account also removes any example plan pages derived from your plans from our website.

Children's Privacy

Gymlab is rated 17+ on the Apple App Store and is not intended for users under the age of 17. We ask for your year of birth during sign-up and do not let anyone who says they are under 17 continue. We do not knowingly collect personal information from minors below this age. If you believe we have collected information from a child below this age, please contact us immediately at [email protected], and we will take steps to delete such information.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our servers are hosted. These countries may have data protection laws that differ from those in your country.

For transfers from the European Economic Area, the United Kingdom, or Switzerland to providers located outside those regions (notably our hosting providers and our AI service providers in the United States), we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with supplementary technical and organisational measures. By using Gymlab, you consent to the transfer of your information to our facilities and to the third-party service providers described in this policy.

AI Limitations and Safety

Workout plans, coaching responses, and any health-related guidance produced by Gymlab are generated by AI and may be inaccurate, incomplete, or unsuitable for your individual circumstances. Gymlab is not a medical device and is not a substitute for professional medical, fitness, or nutritional advice. Consult a qualified healthcare or fitness professional before starting any new exercise programme, especially if you have an injury, medical condition, are pregnant, or are recovering from illness. Stop exercising and seek medical attention if you experience pain, dizziness, or any other concerning symptom.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or our data practices, or if you wish to exercise your privacy rights, please contact us: