Política de Privacidad

GymVox (operated by NexlyLab) provides an AI-powered personal training app and website at gymvox.app. This Privacy Policy applies to both the GymVox mobile app and the gymvox.app website, including the waitlist and contact forms.

We respect your privacy and are committed to handling your personal data responsibly. Given the nature of our service, we process health and fitness information, which carries additional obligations under applicable law. Please read this policy carefully.

Account and Contact Information: - Email address and display name - Date of birth and gender (used to personalise training and nutrition plans) - OAuth provider identity (if you sign in with Google or Apple)

Health and Fitness Information (special-category data under GDPR Art. 9): - Injury history, pain assessments, and movement limitations - Wellness check-ins including bodyweight, sleep quality, and recovery ratings - Workout data: exercise selection, sets, reps, weight, and perceived exertion (RPE) - Nutrition data: daily food logs, calorie and macro targets - Body composition estimates derived from optional body photos (body fat percentage, muscle mass estimate) - Free-text health disclosures you share voluntarily in conversations with the AI coach (including conditions, medications, or symptoms you mention)

Conversation Content: - Text messages with the AI coach, including any personal circumstances you share voluntarily - Session summaries and an AI-derived coaching memory (a structured profile of your goals, challenges, and progress) - Onboarding questionnaire answers, including fitness background and dietary preferences

Voice Data: - When you use voice mode, live audio is streamed directly from your device to OpenAI via WebRTC. GymVox does not store the raw audio stream. Transcripts of voice sessions are stored as part of your conversation history.

Body and Workout Media: - Body photos (optional): stored securely and automatically deleted after 30 days - Meal and equipment photos: transmitted transiently to the AI provider for analysis and not stored by GymVox - Form-check photos or video clips: transmitted to the AI provider for technique analysis; assessment scores are stored but the media bytes are not retained by GymVox

App Usage and Analytics: - App events, interactions, and device properties collected by PostHog (analytics) only after you grant consent via the in-app prompt

Purchase and Subscription Information: - Subscription type, status, and purchase history managed via RevenueCat

Push Notifications: - Push device tokens for delivering workout reminders and streak notifications via Expo, Google Firebase (FCM), or Apple APNs

Email Communications: - Email address and communication preferences managed via Resend - Delivery and engagement data (open and click events) for emails we send you

Website and Network Data: - IP address, browser type, device information, pages visited, and referring site - Waitlist form submissions include email, IP address, user agent, and referrer URL

We use the information we collect to:

• Provide and personalise the AI coaching service, including workout and nutrition planning, progress tracking, and voice sessions
• Analyse optional body photos to generate body composition estimates at your request
• Maintain coaching continuity by building and updating a coaching memory profile across sessions
• Process form-check media to provide technique feedback
• Send workout reminders, achievement notifications, and service-related emails
• Manage your subscription and process payments
• Operate the waitlist, respond to inquiries, and send product updates (with your consent)
• Measure app performance and understand how features are used (analytics, with your consent)
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

If you are in the European Economic Area (EEA) or the UK, we rely on the following legal bases:

Contract (Art. 6(1)(b)): Processing your account data, fitness and health inputs, conversation content, workout data, and subscription information is necessary to deliver the coaching service you signed up for.

Consent (Art. 6(1)(a)): Analytics data collection via PostHog requires your consent, which you grant via an in-app prompt (and the iOS App Tracking Transparency dialog on Apple devices). Marketing emails require separate consent. Body photo analysis requires your explicit confirmation before each upload.

Legitimate Interests (Art. 6(1)(f)): Security monitoring, fraud prevention, system logging, Cloudflare traffic routing, and anti-abuse verification, where our interests do not override your rights.

Legal Obligation (Art. 6(1)(c)): Tax records, subscription receipts, and other legal compliance requirements.

Health Data (Art. 9): GymVox processes health and fitness information that may constitute special-category data under Art. 9 of the GDPR, including injury history, body composition data, dietary information, and health disclosures made in conversations. We rely on Art. 9(2)(a) (explicit consent) for body photo analysis, and on Art. 9(2)(h) (provision of health or fitness management services at your request) for the broader coaching service. If you are in the EEA and have questions about the legal basis for a specific processing activity, please contact us.

We share data with the following service providers who process it on our behalf:

OpenAI: Powers the AI coach for text conversations, voice sessions, onboarding analysis, meal photo analysis, body photo analysis, and form-check assessment. Your conversation content, health disclosures, body photos, and voice audio are transmitted to OpenAI. By default, OpenAI does not use API data to train or improve its models. EEA users contract with OpenAI Ireland Ltd; Standard Contractual Clauses (SCCs) govern the transfer.

Google Gemini: Used for form-check video analysis. Form-check media (photos and video frames) is sent to Gemini and deleted after analysis. Google Cloud DPA applies.

DigitalOcean Spaces: Body photos are stored encrypted at rest in DigitalOcean object storage and automatically deleted after 30 days. DigitalOcean is certified under the EU-US Data Privacy Framework (DPF).

PostHog: Analytics service that collects app usage events using a pseudonymised identifier, after you grant consent. PostHog operates from the United States and is DPF-certified.

RevenueCat: Manages subscription state, purchase receipts, and entitlements. SCCs govern EU transfers.

Resend: Handles transactional and marketing email delivery. SCCs apply.

Expo, Google Firebase (FCM), Apple APNs: Deliver push notifications. Push tokens and notification payloads are transmitted through these services.

Google / Apple: If you sign in with Google or Apple, your account identity is received from their OAuth services under their own terms.

Cloudflare: Routes all web and API traffic and provides security protection and anti-abuse verification. Cloudflare is DPF-certified.

We do not sell your personal data. We do not share your data with advertisers based on your health or fitness information.

GymVox uses service providers located in the United States and other countries. When your data is transferred outside the EEA or UK, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• EU-US Data Privacy Framework certification (where applicable)
• Data Processing Addenda with each processor

Key transfers: AI processing to OpenAI (OpenAI Ireland Ltd for EEA users, SCCs); analytics to PostHog (US, DPF-certified); body photo storage to DigitalOcean (US, DPF-certified); subscription data to RevenueCat (US, SCCs); email to Resend (US, SCCs).

We retain your personal data for as long as your account is active or as needed to provide services, subject to the following:

• Body photos: Automatically deleted from storage after 30 days
• Body composition analysis results: Retained for account lifetime to support trend analysis
• Conversation history and coaching memory: Retained for account lifetime to maintain coaching continuity
• Wellness check-ins, workout logs, and food logs: Retained for account lifetime
• AI request logs: Retained for a limited period for security and abuse monitoring
• Subscription and payment records: Retained as required by applicable tax and legal obligations (typically 5-10 years)
• Analytics events (PostHog): Per PostHog project retention settings
• Waitlist entries: Until you unsubscribe or request deletion
• Email engagement logs: Retained temporarily for deliverability and compliance purposes

You may request deletion of your account and associated data at any time.

Depending on your location, you may have the following rights regarding your personal data:

• Access (Art. 15 GDPR): Request a copy of your personal data. You can export data from within the app via Settings.
• Rectification (Art. 16): Request correction of inaccurate or incomplete data. You can update most profile information directly in the app.
• Erasure (Art. 17): Request deletion of your account and personal data. You can delete your account from within the app in Settings.
• Data Portability (Art. 20): Receive your data in a machine-readable format.
• Objection (Art. 21): Object to processing based on our legitimate interests.
• Withdraw Consent: Withdraw consent for analytics or marketing emails at any time, without affecting the lawfulness of prior processing.
• Restriction (Art. 18): Request that we limit how we use your data in certain circumstances.
• Complaint: You have the right to lodge a complaint with your local supervisory authority (e.g., the relevant EEA data protection authority).

To exercise any right, contact us at [email protected]. We will respond within 30 days.

We implement appropriate technical and organisational measures to protect your personal data:

• All data is encrypted in transit using TLS
• Body photos are encrypted at rest using server-side encryption
• Access controls restrict who can view personal and health data
• Rate limiting and abuse monitoring protect against unauthorised access

No method of transmission over the internet is completely secure. If you become aware of a security concern, please contact us at [email protected].

GymVox uses OpenAI's API to power the AI coach. By default, OpenAI does not use API data submitted by its customers to train or improve its models. GymVox has not opted in to any model-training data-sharing arrangement.

OpenAI may retain API inputs and outputs for up to 30 days for abuse-monitoring purposes, after which they are deleted.

All AI-generated coaching output is for informational and motivational purposes only and does not constitute medical advice. If you have a medical condition, injury, or health concern, consult a qualified healthcare professional before following any coaching recommendations.

GymVox is not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that a person under 16 has provided us with personal data, we will delete it. If you believe a minor has registered, please contact us at [email protected].

We may update this Privacy Policy from time to time. When we do, we will update the date shown at the top of this page. For material changes that affect your rights, we will notify you in the app or by email before the changes take effect.

If you have questions about this Privacy Policy, your data rights, or our privacy practices, please contact us:

Email: [email protected] Website: https://gymvox.app

For EEA residents: if you are not satisfied with our response, you have the right to lodge a complaint with your national data protection authority.