GymJoin privacy policy

1. Who we are

GymJoin is a platform that connects athletes with gyms, private coaches, and training sessions. For the purposes of the Law of Ukraine "On Personal Data Protection" No. 2297-VI, GymJoin acts as the owner (controller) of the personal data you provide through the app and website. This policy explains what we collect, why we collect it, who can see it, and the choices you have.

2. Legal framework

We process personal data in accordance with the Law of Ukraine "On Personal Data Protection" No. 2297-VI. Ukraine is currently completing a GDPR-aligned reform of its data protection legislation (Draft Law No. 8153, expected to replace Law 2297-VI as part of EU accession), and we already build our practices to meet those stricter standards. If you use GymJoin from the European Economic Area, the EU General Data Protection Regulation (GDPR) also applies to you.

3. Data we collect

We only collect data that the service needs to work. Depending on how you use GymJoin, this includes:

• Account data — name, email address, phone number, date of birth, country and city, and your account role (athlete, private coach, gym, or administrator).
• Profile media — a profile photo or gym/coach photos, only if you choose to upload them.
• Business data — for gyms and coaches: venue address, contact details, sport types, pricing, and schedules you publish for discovery.
• Location data — your approximate or precise device location, used only while you browse the map or search for nearby gyms, coaches, and trainings. Location is requested with your permission and is never collected in the background.
• Activity data — your subscriptions, booking requests, confirmations, check-ins, attendance history, training statistics, and the reviews and ratings you write.
• Payment records — attendance-linked payment confirmations recorded by a gym, coach, or administrator (for example, "paid in cash"). We do not collect or store card numbers; in-app payment processing, when introduced, will be handled by a licensed payment provider.
• Technical data — device type, operating system, app version, language, push notification token, and diagnostic logs used to keep the service secure and stable.

4. Why we process your data

Each category of data is tied to a specific purpose and legal basis:

• Providing the service — creating your account, showing gyms and coaches near you, managing subscriptions, check-ins, and attendance (performance of a contract).
• Trust and safety — verifying accounts via one-time codes, preventing fraud and abuse, securing the platform (legitimate interest and legal obligation).
• Communication — booking confirmations, schedule changes, and service notifications you have enabled (performance of a contract; consent for optional notifications).
• Statistics — aggregated, de-identified visitor and attendance statistics for gyms and coaches (legitimate interest).
• Improvement — diagnosing crashes and improving app and website performance (legitimate interest).

We do not use your personal data for automated decision-making that produces legal effects, and we never sell your personal data to anyone.

5. Who can see your data

GymJoin is a social platform, so some information is visible to others by design. We keep that visibility as narrow as possible:

• Gyms and coaches you subscribe to see your name, profile photo, subscription status, check-ins, and attendance — they need this to confirm your visits.
• Administrators of a gym see the same visitor information as the gym itself, strictly for managing subscriptions and attendance.
• Other users see only your public reviews and ratings, together with your display name and photo.
• Your email, phone number, date of birth, and location are never shown to other users.
• Public gym and coach profiles (name, photos, address, schedule, pricing, rating) are visible to everyone, including in web search — that is their purpose.

6. Service providers

We share data with a small number of processors who help us run the service — cloud hosting and database infrastructure, map tile providers (to render the discovery map), push notification delivery, and email/SMS delivery for verification codes. Each provider is bound by a data processing agreement, receives only the minimum data needed for its task, and may not use it for its own purposes. We may also disclose data where Ukrainian law requires it — for example, on a lawful request from a competent authority.

7. International transfers

Some of our infrastructure providers operate in the European Economic Area. Transfers outside Ukraine happen only under the conditions of Article 29 of Law 2297-VI and, where the GDPR applies, with appropriate safeguards such as EU Standard Contractual Clauses. We transfer data only to jurisdictions that ensure an adequate level of personal data protection.

8. How long we keep your data

• Account and profile data — for as long as your account exists, and up to 30 days after deletion to allow accidental-deletion recovery.
• Attendance and payment records — up to 3 years, because gyms and coaches may need them for accounting and dispute resolution; after that they are deleted or fully anonymised.
• Reviews — kept while the reviewed gym, coach, or training exists; deleted reviews are removed immediately.
• Technical logs — up to 12 months, then deleted or anonymised.

9. How we protect your data

All traffic between your device and our servers is encrypted (TLS). Data is stored on servers with access limited to authorised personnel under confidentiality obligations, with role-based access control, audit logging, and regular security reviews. Sign-in is performed with one-time codes rather than stored passwords wherever possible. No system is perfectly secure, so if a breach ever affects your data, we will notify you and the supervisory authority as required by law.

10. Your rights

Under Article 8 of Law 2297-VI (and the GDPR, where it applies), you have the right to:

• know whether we process your data and access a copy of it;
• have inaccurate data corrected;
• have your data deleted ("right to be forgotten") when there is no legal ground to keep it;
• object to or restrict specific processing;
• withdraw any consent at any time, without affecting past processing;
• receive your data in a portable, machine-readable format;
• lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights (the Ombudsman) or, in the EEA, your local data protection authority.

To exercise any of these rights, email us — we respond within 30 calendar days. You can also edit your details or delete your account directly in the app under Profile → My details.

11. Children

GymJoin is not directed at children under 14. Users aged 14–18 may use the service with the consent of a parent or legal guardian, as required by Ukrainian civil law. If we learn that we have collected data from a child under 14 without verified parental consent, we will delete it.

12. Cookies and local storage

The mobile app stores your session token and preferences on your device only. This website uses strictly necessary cookies for sign-in and, with your consent, basic analytics cookies. We do not use advertising or cross-site tracking cookies.

13. Future features

Some planned features — in-app payments, messaging, coach diet recommendations, and optional weight tracking — involve new categories of data, including health-related data. None of them will be enabled silently: each will require your separate, explicit consent, and this policy will be updated before launch.

14. Changes to this policy

When we change this policy, we will update the version and effective date above and notify you in the app or on this website before significant changes take effect. Continued use of the service after the effective date means the updated policy applies.

15. Contact us

Questions about this policy or your personal data: gym.join.app@gmail.com

You can also reach our support team directly in the GymJoin app under Profile → Support.