1. Introduction and general provisions
1.1. This Privacy Policy (the “Policy”) describes the processing of personal data in connection with the downloading, installation, registration, access and use of the mobile application operating under the name Coach.ai (the “Application”), together with its associated software, artificial intelligence functionalities, exercise monitoring capabilities, instructional materials, digital content, updates and related services (collectively, the “Services”). The Application is developed, maintained and operated by Stay Fit Software - FZCO, a legal entity duly incorporated under the laws of United Arab Emirates (the “Company”, “we”, “us” or “our”).
For the purposes of this Policy, “User”, “you” and “your” refer to any natural person who downloads, installs, registers for, accesses or otherwise uses the Application.
1.2. The Application is a digital fitness and exercise assistance solution incorporating artificial intelligence, computer vision and automated movement analysis technologies. Its primary purpose is to provide exercise instructions, monitor physical movements, evaluate certain aspects of exercise execution and generate real-time fitness coaching feedback. The Application enables Users to establish personal accounts and, where selected, maintain records of completed training sessions, exercise performance and workout history. Certain functionalities require access to the User's device camera. The Application analyses camera information locally on the User's device, without transmitting the underlying video footage to the Company's servers or third-party processing infrastructure.
1.3. The Company recognises the fundamental importance of privacy, personal data protection and individual control over information relating to physical activity. The Application has been developed with particular emphasis on data minimisation, privacy by design, purpose limitation and the avoidance of unnecessary retention of sensitive visual information. Accordingly, live camera footage is processed exclusively within the User's device for the purposes of the active exercise session. The Company does not collect, upload, record, permanently store or maintain an archive of such footage. The Company distinguishes between temporary visual information processed locally during a workout and exercise-related information that a User may choose to save as part of their account history.
1.4. The Company processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “General Data Protection Regulation” or “GDPR”), applicable national legislation implementing or supplementing the GDPR, relevant electronic communications and privacy requirements, and other mandatory provisions of European Union law governing personal data processing. The Company further takes into account the applicable privacy and user data requirements established by the Apple App Store and Google Play Store in connection with the distribution of the Application.
1.5. This Policy should be read together with the Company's Terms and Conditions and End-User Licence Agreement, and any supplementary notices concerning camera processing, artificial intelligence functionalities or the exercise of User rights. Nothing in those documents shall be interpreted as limiting or excluding rights granted to data subjects under applicable data protection legislation.
2. Identity of the data controller
2.1. For the personal data processing activities for which the Company determines the purposes and essential means of processing, the Company acts as the data controller within the meaning of Article 4(7) GDPR.
2.2. All questions concerning this Policy, the processing of personal data, data protection safeguards or the exercise of statutory rights may be addressed to the Company's designated privacy contact. Where the Company is required to appoint a Data Protection Officer under Article 37 GDPR, or voluntarily appoints such an officer, the relevant contact details shall be made available to Users.
2.3. Users have the right to lodge complaints with a competent supervisory authority in accordance with Article 77 GDPR.
3. Categories of personal data processed
3.1. The Company processes only those categories of personal data that are reasonably necessary for specified, explicit and legitimate purposes associated with the provision, maintenance, security and lawful operation of the Services. The nature and extent of processing depend on the functionalities selected by the User, the information voluntarily provided during registration, and the technical operations necessary to deliver the relevant Services.
3.2. The Application supports personal account registration and authentication. For these purposes, the Company processes information necessary to establish and administer the contractual relationship with the User. Such information may include the User's email address, chosen username or display name, unique account identifier, authentication credentials or corresponding cryptographic authentication information, account preferences, registration date, account status and records of material changes to account information. The Company does not require the submission of government-issued identification documents for ordinary account registration and does not intentionally collect identification information unrelated to the operation of the Services. Authentication credentials shall be protected through appropriate technical safeguards, including secure credential handling and password hashing where password-based authentication is implemented.
3.3. The Application enables Users to save information relating to their exercise sessions and training progress. Depending on the available functionalities and the User's selections, such information may include the type of exercise performed, the date and duration of training sessions, completed repetitions, exercise completion records, performance indicators, automated movement assessments, progress measurements and other exercise-related information generated by the Application. Where workout history is saved, the corresponding records may be associated with the User's account to enable subsequent access, review, continuity of training and recovery of previously saved information. Saved workout records are distinct from the underlying camera footage used to generate them. The Company does not associate stored exercise metrics with permanent recordings of the User's physical movements.
3.4. During an active camera-assisted training session, the Application temporarily processes visual information captured through the device camera. Such information may include live video frames, observable body positions, estimated skeletal landmarks, joint alignment, movement trajectories, posture characteristics and other visual information technically necessary for exercise monitoring. All such processing takes place locally within the computational environment of the User's device. The Company does not receive the original visual information, does not maintain access to live camera feeds and does not collect or retain copies of the User's exercise video footage.
3.5. To maintain the security and proper operation of the Services, the Company may process limited technical information associated with account access and communication with Company-operated infrastructure. Depending on the relevant operation, such information may include the Application version, operating system, general device characteristics, authentication timestamps, IP addresses associated with account requests, security events and information necessary to investigate technical failures. The processing of such information shall be limited to legitimate operational and security purposes. It shall not be used to establish advertising profiles or monitor Users' physical activities outside the functionality of the Application.
3.6. Where a User contacts the Company, submits a complaint or requests assistance, the Company may process the contact information, correspondence and relevant account information reasonably necessary to review and respond to the matter. The Company shall not require Users to disclose medical information, workout recordings or other sensitive information unless such disclosure is genuinely necessary for a specific support request and supported by an appropriate legal basis.
4. Camera access and exclusively on-device processing
4.1. The Application requires access to the device camera for the purpose of providing certain automated fitness coaching functionalities. Camera access enables the Application to analyse movement, identify supported exercises, assess selected aspects of posture, count repetitions and generate exercise-related feedback during an active workout. Camera access is not used for surveillance, facial recognition, individual identification, behavioural advertising or monitoring unrelated to the active training session.
4.2. The Application processes camera footage entirely on the User's device. Visual information captured by the camera is analysed using locally executed software components and computational resources available on the device. The Company does not transmit video frames, live camera streams or visual recordings to its servers, remote artificial intelligence platforms or external computer vision providers. The underlying video information remains within the local processing environment and is not accessible to Company personnel through the Application's ordinary operating infrastructure.
4.3. During an active session, video frames and associated computational information may temporarily exist in device memory for the period necessary to perform the relevant movement analysis. Such temporary processing is integral to the functioning of real-time computer vision and does not involve the creation of a persistent video archive. Once the relevant information is no longer necessary for the ongoing analytical operation, it is discarded through the Application's temporary data-handling processes. Termination of the training session terminates the corresponding camera-analysis operations and causes temporary processing information to be released in accordance with the Application's technical design.
4.4. The Application does not create permanent recordings of training sessions. In particular, the Company does not collect workout video files, upload camera footage, maintain historical video recordings, store raw video frames in account databases or provide Company personnel with access to previously captured workout footage. The Application does not maintain a centralised visual archive and does not offer the Company the technical capability to retrieve recordings of completed exercise sessions. Consequently, requests for access to previously processed workout video recordings cannot result in the provision of material that was never recorded or retained. This does not affect a User's entitlement to access other personal data actually held by the Company.
4.5. The Application may derive exercise-related information from the temporary analysis of visual inputs. Such information may include exercise classifications, repetition counts, movement assessments and other numerical or descriptive outputs. Where the User saves these outputs, they may be retained as part of the User's workout history. The retention of derived exercise information does not involve the retention of the original video frames from which the information was generated. Saved exercise information shall remain subject to the purposes, legal bases, retention periods and User rights described in this Policy.
4.6. The Company does not provide video footage to third-party artificial intelligence providers, external machine learning platforms or remote video-analysis services. Camera-based movement analysis is carried out through on-device software functionality. The Company does not use camera footage to create external training datasets or to train, fine-tune or improve artificial intelligence models through the collection of User workout recordings.
4.7. Camera access is requested through the permission mechanisms provided by the applicable operating system. Camera-based exercise monitoring is activated in connection with a training session initiated by the User. The Application does not intentionally activate the camera for exercise monitoring outside such a session. Users may terminate camera-assisted processing by ending the workout session or withdrawing camera access through their device settings. Where camera access is disabled, functionalities requiring live visual analysis may become unavailable.
4.8. Users are encouraged to conduct camera-assisted exercise sessions in an environment that respects the privacy of other individuals. The Application is not designed to identify or monitor third parties incidentally appearing within the camera's field of view. Any incidental visual processing remains subject to the same on-device, temporary processing architecture described in this Section.
5. Artificial intelligence, biometric characteristics and health-related information
5.1. The Application uses artificial intelligence and computer vision technologies to interpret physical movement and generate exercise-related assessments. These technologies may involve the estimation of skeletal landmarks, classification of movement patterns and automated generation of training feedback. The purpose of these operations is to support fitness activity and improve the User's ability to understand and perform supported exercises.
5.2. The Application is not intended to establish or verify the unique identity of Users through facial recognition or other biometric identification techniques. The processing of body landmarks and movement characteristics for fitness analysis does not, solely by reason of the technology used, necessarily constitute processing of biometric data for the purpose of uniquely identifying an individual under Article 9 GDPR. The Company shall assess the classification of such information by reference to the actual technical processing operations, their purposes and applicable legal requirements.
5.3. The Company acknowledges that certain exercise-related information may, depending on its nature and context, reveal information concerning an individual's physical health or condition. Where particular processing operations involve data concerning health within the meaning of Article 4(15) GDPR, the Company shall ensure that such processing satisfies an applicable condition under Article 9 GDPR, in addition to the requirements of Article 6 GDPR. Where the Company relies on explicit consent under Article 9(2)(a) GDPR, such consent shall be obtained through a separate, specific and appropriately documented affirmative action before the relevant processing commences.
5.4. The Application generates automated coaching recommendations, observations and performance assessments. Such functionality is intended to provide informational assistance and does not involve decisions producing legal effects or similarly significant effects concerning Users within the meaning of Article 22 GDPR. The Company does not use the Application's movement analysis to determine employment eligibility, insurance eligibility, creditworthiness or other comparable matters involving significant individual consequences.
5.5. Automated exercise assessments may be affected by technical limitations, environmental circumstances and the characteristics of the movements being analysed. Accordingly, information generated by the Application should not be interpreted as a medical diagnosis or definitive assessment of an individual's physical health. Further provisions concerning the nature and limitations of the fitness coaching functionality are contained in the Terms and Conditions.
6. Purposes and lawful bases of personal data processing
6.1. The Company processes account registration information, authentication information, account preferences and relevant exercise records where such processing is objectively necessary to establish, perform and administer the contractual relationship with the User under Article 6(1)(b) GDPR. This includes maintaining registered accounts, providing access to requested functionalities, preserving workout history selected by the User and enabling the continuity of the Services. The Company shall not rely on contractual necessity for processing activities that are not objectively required for the relevant contractual purpose.
6.2. Where particular processing operations require consent under Article 6(1)(a) GDPR, the Company shall obtain such consent through an appropriate affirmative mechanism. Consent shall be freely given, specific, informed and unambiguous and shall be capable of withdrawal in accordance with applicable legislation. Where explicit consent is required for the processing of special-category personal data, the Company shall implement an appropriate separate consent mechanism satisfying Article 9 GDPR. The grant of camera permission through an operating system shall not, by itself, be treated as satisfying all requirements for consent under the GDPR.
6.3. The Company may process limited technical and security-related information on the basis of legitimate interests under Article 6(1)(f) GDPR where such processing is necessary to maintain service integrity, protect accounts, prevent unauthorised access, investigate security incidents or defend the Application against unlawful interference. Before relying on this legal basis, the Company shall assess the necessity of the processing and balance the relevant interests against the rights and freedoms of affected Users.
6.4. The Company may process or retain personal data to the extent necessary to comply with legal obligations under Article 6(1)(c) GDPR. Such processing may include responding to legally binding requests from competent authorities, complying with applicable data protection requirements or preserving records where required by law.
6.5. Where saved exercise information or other relevant processing qualifies as special-category personal data, the Company shall ensure that an applicable Article 9 GDPR condition is satisfied independently of the Article 6 lawful basis. The availability of a general contractual basis does not dispense with the additional requirements applicable to special-category information.
6.6. The Company does not use personal data collected for fitness coaching to undertake unrelated advertising profiling, commercial exploitation of exercise information or the creation of datasets for external artificial intelligence training. Any materially different processing purpose introduced in the future shall be assessed independently and disclosed in accordance with applicable law.
7. Data retention and storage limitation
7.1. The Company applies the principle of storage limitation under Article 5(1)(e) GDPR. Personal data shall be retained only for the period reasonably necessary to fulfil the purpose for which it was processed, unless a longer period is required or permitted by applicable law. The retention periods set out below constitute the Company's intended standard retention framework and shall be implemented through corresponding technical and organisational procedures.
7.2. Live camera footage is not persistently recorded or stored. Temporary video frames and visual processing information are discarded when no longer required for the relevant computational operation. The Company does not maintain backups, archives or historical repositories containing User workout video recordings.
7.3. Personal data necessary for the administration of a registered account shall generally be retained for the duration of the User's active account. Upon account deletion, the Company shall delete or irreversibly anonymise account information that is no longer required for a lawful purpose, subject to the arrangements described in this Policy.
7.4. Workout records, exercise metrics and training history voluntarily saved by the User shall generally remain available for the duration of the User's account, unless deleted earlier through the functionality provided by the Application or pursuant to a valid erasure request. Where the User deletes an individual exercise record, the corresponding data shall be removed from active records in accordance with the applicable deletion procedures. Where the User requests permanent account deletion, saved workout history associated with the account shall also be deleted unless a specific lawful retention exception applies.
7.5. Following receipt and verification of a valid account deletion request, the Company aims to complete deletion of associated personal data from active operational systems without undue delay and, under its ordinary operational procedure, within thirty (30) calendar days. This operational period shall not be interpreted as extending or reducing any mandatory deadline established by the GDPR. Where a legal obligation or other valid legal ground requires retention of particular information, the Company may retain only the relevant information for the applicable period.
7.6. Where account information or saved workout history is included in secure system backups, such backups shall be retained for no longer than ninety (90) calendar days under the Company's standard backup rotation arrangements. Personal information contained in backups shall remain subject to appropriate security controls and restricted access. Where deleted information is restored from a backup for legitimate disaster recovery purposes, the Company shall take appropriate measures to ensure that valid deletion requests are respected and the relevant information is not improperly reintroduced into active systems.
7.7. Security logs, authentication records and other technical records necessary to investigate unauthorised access, system abuse or material security incidents shall ordinarily be retained for no longer than twelve (12) months from their creation. A longer period may apply where reasonably necessary to investigate a specific incident, comply with legal requirements or establish, exercise or defend legal claims.
7.8. Correspondence and records concerning User support requests and complaints shall ordinarily be retained for no longer than twenty-four (24) months following the resolution of the relevant matter. Where longer retention is necessary for an identified legal obligation or the establishment, exercise or defence of legal claims, the applicable information may be retained for the period permitted or required by law.
7.9. The Company may extend a retention period where necessary to comply with a legal obligation, preserve evidence concerning a specific dispute or investigate a documented security incident. Any such extension shall be assessed individually, limited to the information necessary for the relevant purpose and supported by an appropriate legal basis.
8. Account management and personal data deletion
8.1. Users retain control over their registered accounts and may exercise applicable rights concerning information maintained by the Company. The Application shall provide a reasonably accessible mechanism for managing account information and initiating permanent account deletion.
8.2. Users may request deletion of their accounts through the relevant functionality within the Application or through the Company's webpage. The Company may require proportionate authentication or verification measures where necessary to prevent unauthorised deletion.
8.3. Permanent account deletion shall ordinarily result in the removal of the User's account profile, associated authentication information, saved workout history, training statistics, preferences and other personal information for which no continuing lawful retention basis exists. Deletion shall not be limited to the temporary suspension or deactivation of the account.
8.4. The Company shall carry out valid deletion requests without undue delay, subject to applicable legal requirements and the technical arrangements described in Section 7. Where particular information must be retained for legal reasons, the Company shall restrict its processing to the extent required and provide relevant information to the User where legally appropriate.
8.5. Removing the Application from a device does not automatically delete an account or exercise history maintained within Company-controlled infrastructure. Users wishing to permanently delete their accounts should use the account deletion mechanisms identified above.
9. Third-party service providers and data disclosures
9.1. The Application does not integrate third-party analytics, advertising, behavioural tracking or external artificial intelligence processing SDKs. The Company does not use external software development kits to collect information concerning User movements, workout behaviour or camera activity for third-party commercial purposes.
9.2. Notwithstanding the absence of third-party SDKs, the Company may engage infrastructure or technical service providers where necessary to operate account registration, authentication, secure data storage or other supporting systems. Where such providers process personal data on behalf of the Company, the Company shall ensure that appropriate contractual safeguards are established in accordance with Article 28 GDPR, including provisions relating to confidentiality, security, processing instructions, subprocessing and deletion. The categories and identities of relevant providers shall be disclosed to the extent required under applicable law.
9.3. As camera processing takes place entirely on-device, the Company does not receive or disclose live video footage to external service providers. No third party is authorised by the Company to collect or archive camera footage through the Application's exercise monitoring functionality.
9.4. The Company does not sell or commercially license Users' personal information, workout history or camera-derived exercise data to data brokers, advertising networks or other third parties for unrelated commercial exploitation.
9.5. The Company may disclose personal data where necessary to comply with a binding legal obligation, valid judicial order or lawful request issued by a competent public authority. Such disclosure shall be limited to the information legally required and shall be subject to applicable procedural safeguards.
9.6. Where the Company undergoes a lawful merger, acquisition, restructuring or transfer of business, personal information may be transferred to an appropriate successor or acquiring entity, provided that the transfer is supported by a lawful basis and the applicable GDPR requirements are satisfied.
10. Geographical location of data processing
10.1. The Company's central personal data processing infrastructure is intended to operate within the European Economic Area. Account information, saved workout history and related records maintained on Company-controlled infrastructure shall be hosted and processed within the EEA under the Company's established operating arrangements.
10.2. Video footage used for exercise analysis remains on the User's device and is not transmitted to the Company's servers.
10.3. The Company does not carry out international transfers of personal data outside the EEA as part of the ordinary provision of the Services. The Company shall maintain appropriate organisational and contractual controls to ensure that its hosting, technical support, system administration and infrastructure arrangements remain consistent with this processing model.
10.4. Should the Company introduce processing arrangements involving transfers of personal data outside the EEA, such transfers shall be implemented only after compliance with Chapter V GDPR, the establishment of appropriate safeguards and the provision of any required transparency information. The Company shall not introduce such transfers without first assessing the applicable legal requirements.
11. Information security
11.1. The Company shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Such measures shall be selected in accordance with Article 32 GDPR, taking into account the nature, scope, context and purposes of processing, the state of the art, implementation costs and the risks presented to individuals.
11.2. The Company's security framework may include secure authentication mechanisms, cryptographic protection of credentials, encryption in transit and at rest where appropriate, role-based access restrictions, secure software development practices, vulnerability management, backup protection and procedures for monitoring and responding to security incidents. The implementation of specific safeguards shall be proportionate to the Company's actual systems and processing activities.
11.3. Access to centrally maintained personal information shall be limited to authorised persons who require such access for legitimate operational, support, security or legal purposes. Persons granted access shall be subject to appropriate confidentiality and security obligations.
11.4. The local processing architecture constitutes an essential privacy safeguard by avoiding the central collection and storage of raw exercise footage. The Company does not maintain administrative access to Users' live camera feeds or historical workout recordings.
11.5. Where a personal data breach occurs, the Company shall investigate the incident, assess the risks to affected individuals and comply with its obligations under Articles 33 and 34 GDPR. Notifications to supervisory authorities and affected individuals shall be provided where the relevant statutory conditions are satisfied.
12. Rights of data subjects
12.1. Users have the right to obtain confirmation as to whether personal data concerning them is being processed and, where applicable, access to such data and relevant processing information in accordance with Article 15 GDPR.
12.2. Users may request the correction of inaccurate personal data and completion of incomplete information in accordance with Article 16 GDPR.
12.3. Users may request erasure of personal data where the conditions established by Article 17 GDPR are satisfied. The Company shall comply with valid erasure requests without undue delay, subject to applicable statutory exceptions.
12.4. Users may request restriction of processing in the circumstances provided by Article 18 GDPR.
12.5. Where processing is based on consent or contractual necessity and carried out by automated means, Users may have the right to receive applicable personal data in a structured, commonly used and machine-readable format and to transmit such information to another controller in accordance with Article 20 GDPR.
12.6. Users may object to processing based on legitimate interests or other grounds covered by Article 21 GDPR. Where such an objection is valid, the Company shall cease the relevant processing unless it demonstrates an applicable lawful basis for continuation.
12.7. Where processing relies on consent, Users may withdraw their consent at any time. Withdrawal shall not affect the lawfulness of processing performed before withdrawal and shall be facilitated through an accessible mechanism.
12.8. Where applicable, Users may exercise the rights and protections available under Article 22 GDPR concerning solely automated decisions producing legal or similarly significant effects.
12.9. Requests concerning personal data may be submitted to hello@coach.ai. The Company shall respond without undue delay and, in principle, within one month of receiving the request, subject to lawful extensions and verification requirements under Article 12 GDPR. Where necessary, the Company may request proportionate additional information to confirm the identity of the individual making the request.
12.10. Users may lodge a complaint with a competent supervisory authority, particularly in the Member State of their habitual residence, place of work or place of an alleged infringement. The exercise of this right does not require prior submission of a complaint to the Company.
13. Children's privacy
13.1. Unless the Company expressly establishes a legally compliant arrangement for younger Users, the Application is intended for persons aged eighteen (18) years or older.
13.2. The Company does not knowingly solicit personal data from individuals who are ineligible to use the Application under its applicable Terms and Conditions. Where the Company becomes aware that personal data concerning an ineligible minor has been collected or otherwise processed, it shall assess the circumstances and implement appropriate measures in accordance with applicable legislation.
13.3. Any future extension of the Application to minors shall be subject to additional assessment of age-related privacy protections, transparency requirements, lawful bases and parental authorisation obligations where applicable.
14. Device permissions and user choices
14.1. The Application requests camera access for the purpose of enabling real-time exercise monitoring. Permission may be granted or withdrawn through the privacy settings of the relevant operating system.
14.2. The core exercise monitoring functionality does not require access to the device's microphone, contact directory, precise geographical location or personal photograph library. Where additional permission-dependent functionality is introduced, the Company shall provide appropriate disclosures and request the relevant permissions before accessing the corresponding device resources.
14.3. Users may modify or withdraw granted permissions through the settings provided by their devices. Withdrawal of a permission may affect the availability of functionality dependent upon that permission but shall not, where technically feasible, prevent access to unrelated features.
14.4. Device-level permission controls and statutory data protection rights operate independently. The granting of operating-system permission shall not be treated as a waiver of rights or as consent to unrelated personal data processing activities.
15. Analytics, advertising and tracking
15.1. The Application does not integrate third-party analytics SDKs designed to monitor User behaviour, collect advertising identifiers or compile cross-service usage profiles.
15.2. The Company does not use workout history, movement characteristics or exercise-related information for behavioural advertising or targeted commercial profiling.
15.3. The Application does not engage in cross-application or cross-website advertising tracking through third-party tracking technologies.
15.4. The Company may process limited technical information strictly necessary for authentication, system functionality and service security, subject to the lawful bases and retention arrangements described in this Policy.
15.5. Any introduction of third-party analytics, advertising or tracking technologies shall be subject to a prior legal and technical assessment, updated disclosures and any applicable consent or platform permission requirements.
16. Apple App Store and Google Play Store
16.1. The Application may be distributed through the Apple App Store and Google Play Store. The Company remains responsible for the personal data processing activities that it determines and undertakes in connection with the Services. Apple and Google may independently process information relating to their respective application distribution platforms, user accounts, downloads and other platform-operated services under their own privacy arrangements.
16.2. The Company shall maintain accurate and current privacy declarations within App Store Connect reflecting the actual categories of personal data collected, their purposes and relevant processing practices. Such declarations shall distinguish on-device camera processing from account information and saved workout records maintained through the Services.
16.3. The Company shall provide accurate information through the Google Play Data Safety section, including applicable disclosures concerning account data, saved exercise information, security practices and deletion arrangements.
16.4. Because the Application supports account registration, the Company shall provide a readily accessible mechanism for initiating permanent account deletion within the Application. The Company shall also maintain an appropriate external webpage through which Users may request account deletion in accordance with the applicable Google Play requirements.
16.5. The Company shall ensure that statements concerning camera processing, data retention, security, account deletion and personal data sharing remain consistent across this Policy, the Application's permission notices, its in-app disclosures and the relevant App Store and Google Play declarations.
17. Amendments to this policy
17.1. The Company may revise this Policy to reflect developments in applicable law, regulatory guidance, technical functionality, information security practices or the nature of its personal data processing activities.
17.2. Where changes materially affect the purposes, legal bases, categories or recipients of personal data processing, the Company shall provide appropriate notice in accordance with applicable law. Where necessary, Users shall be informed before the revised processing activities commence.
17.3. Where a proposed processing activity requires consent or explicit consent, the Company shall obtain the required authorisation before undertaking that processing. Continued use of the Application shall not substitute for legally required consent.
17.4. The current version of this Policy shall be accessible through the Application and at the relevant publicly available privacy policy webpage. The Effective Date and Last Updated date shall be amended whenever a revised version enters into effect.
18. General provisions
18.1. This Policy shall be interpreted and applied in accordance with applicable European Union and national data protection legislation. Any provision inconsistent with mandatory statutory requirements shall be ineffective to the extent of such inconsistency, without prejudice to the continuing applicability of the remaining provisions.
18.2. Nothing in this Policy shall exclude, restrict or diminish the rights of individuals under the GDPR or other applicable mandatory legislation.
18.3. The Company may make this Policy available in multiple languages. Where a translation is required by applicable law, the relevant language version shall be provided in accordance with that requirement. Any contractual language-precedence provision shall not override statutory transparency obligations or rights.
18.4. The Company shall make this Policy available in a clear, accessible and reasonably understandable format through the Application and an appropriate public website.
19. Contact information
Any questions, requests, complaints or communications concerning this Policy or the processing of personal data may be directed to: hello@coach.ai.
The Company shall review and address relevant communications in accordance with applicable legislation and its internal data protection procedures.
20. Final declaration
The Company is committed to maintaining an Application architecture that respects the privacy of Users and minimises the unnecessary collection and retention of personal information. In particular, the Company maintains a distinction between real-time, locally processed camera footage and account-related exercise information that Users may choose to save. Camera footage is analysed entirely on the User's device and is not uploaded, recorded or permanently retained by the Company. Saved exercise information is processed only for identified purposes, subject to appropriate security safeguards, retention limitations and statutory User rights. The Company shall review its data protection practices as necessary to ensure continued consistency between the actual operation of the Services, the disclosures made in this Policy and applicable legal requirements.