Data Processing Agreement (DPA)

1. Parties and scope

Controller (the “Controller”): the holder of the Professional Account, identified by the account details; in teams, the Team Owner, as defined in the Terms. Processor (“we”): Vasco José Cardoso Correia, sole trader, tax identification number (NIF) 262045630, Rua de Campezinhos, 27, Lomba, 4600-663 Amarante, Portugal, who operates MyFitnessClient ([email protected]).

This DPA applies to the personal data that the Controller records or receives about their clients and other people in the course of coaching (“Controller Data”), under Article 28 of Regulation (EU) 2016/679 (GDPR).

The following are not covered, because we are the controller for them and they are governed by the Privacy Policy: accounts and billing; security and usage analysis of the platform; the marketplace (public profiles, requests until they are accepted and visitor contacts until they are delivered to the Controller); and the data a client records in their own account while they are not connected to a professional. Likewise, the services that the Controller connects directly, under their own contract, such as their Stripe account, their Google Calendar account or the video platforms whose content they embed, are not our sub-processors.

2. Subject matter, duration, nature and purpose

We process Controller Data for as long as the Controller's account exists and until the end of the periods in section 9, solely to provide the Controller with the Service described in the Terms: hosting, displaying, calculating, transmitting and notifying, making backups of and deleting that data, in accordance with the Controller's instructions. We do not use it for our own purposes, in particular advertising, profiling, sale or training artificial intelligence models. The only exception is aggregated and anonymous statistics on the use of the Service, which do not identify the Controller or the data subjects.

3. Data subjects and types of data

Data subjects: the Controller's clients and trainees, with or without their own account; people who respond to the Controller's forms or buy their courses and packages; members of the Controller's team; visitors who leave their contact details for the Controller on the public profile; third parties mentioned in notes or messages.

Data: identification and contact details; NIF and payment records; measurements, body composition, photos and videos; anamnesis and questionnaires, which may include health data; values calculated from the measurements (for example BMI and estimated body composition); training, nutrition, supplementation and habit plans and logs; text and audio messages and files; calendar; call metadata. Health data are special categories of personal data (Article 9 of the GDPR).

4. Instructions

We process Controller Data only on the basis of the Controller's documented instructions: the Terms, this DPA and the way the Controller uses and configures the Service. Additional instructions are given in writing to [email protected]; those that go beyond the normal operation of the Service and what is provided for in the Terms and this DPA are subject to our agreement and may be charged for. If we are required by Union or Member State law to process the data in another way, we inform the Controller beforehand, unless that law prohibits it. If we consider that an instruction infringes data protection law, we inform the Controller immediately; if the Controller maintains it, we may suspend the processing concerned and, if the situation persists, terminate the contract.

The Controller hereby gives the following standing instructions: (a) when a client with their own account deletes that account, we remove that client's profile data (name, email, contact details, photo, date of birth, gender, height, weight, NIF and clinical history) from the Controller Data, the coaching records remain in the Controller's account, where the Controller decides whether to delete them, and, if the coaching was ongoing or scheduled, we notify the Controller, giving the client's name, that the account was deleted and the coaching has ended; (b) client accounts with no activity for 12 months may be deleted in accordance with the Privacy Policy; (c) hosted files may be deleted 90 days after the end of a paid subscription, in accordance with section 9 of the Terms; (d) contacts left by visitors on the public profile are deleted one year after they are received.

5. Confidentiality and access

Only staff who need it have access to Controller Data, and they are bound by confidentiality and by the duty of secrecy in Article 29(4) of Law no. 58/2019. Access is limited to what is necessary to provide, maintain and protect the Service (in particular at the request of the Controller or of the data subject through support, to investigate security incidents or errors, or to test updates) or to comply with a legal obligation. Each session in which staff enter an account to provide assistance is logged and time-limited; whatever the staff save during that session is recorded in the account, like any other change. Neither those sessions nor the administration tools show private files (photos and documents), except for a photo that was on the mobile app screen when an error occurred and that appears in the screenshot in the error report; the app does not take that screenshot on screens such as progress, assessments, anamnesis and messages.

6. Security

We apply the technical and organisational measures in Annex II, which we review regularly without reducing the overall level of protection, taking into account the state of the art and the risk of the processing, including the processing of health data.

7. Sub-processors

The Controller gives general authorisation for the sub-processors in Annex III. We notify the Controller by email, at least 30 days in advance, of any addition or replacement, except in the case of an urgent replacement for security reasons or because the provider has discontinued its service, where we notify the Controller as soon as possible. The Controller may object on well-founded data protection grounds; if we cannot find a solution, the Controller may terminate the contract without penalty, with a pro rata refund of the paid period and export of the data. We impose on each sub-processor data protection obligations equivalent to those in this DPA and remain fully liable to the Controller for the sub-processor's compliance (Article 28(4) of the GDPR).

8. Assistance and data breaches

Requests from data subjects that reach us are forwarded to the Controller without undue delay; we do not respond to them without authorisation, except to tell them whom they should contact. The Service provides tools to consult, rectify and delete each client's data and, on request, we provide its export or its complete erasure. Taking into account the nature of the processing and the information available to us, we help the Controller to comply with the obligations in Articles 32 to 36 of the GDPR (security, breaches, impact assessment and prior consultation).

In the event of a personal data breach affecting Controller Data, we notify the Controller by email without undue delay and, where possible, within 48 hours of becoming aware of it, with the nature of the breach, the categories and approximate number of data subjects and records concerned, the contact point, the likely consequences and the measures taken or proposed. Information that is not yet available is sent in phases, without undue delay.

9. End of processing

While the account exists and after the end of a paid subscription, the Controller may request an export of the Controller Data under sections 20 and 23 of the Terms. When the account is deleted, we delete the Controller Data within 30 days, unless retention is required by law; whatever still remains in audit logs and backups is deleted at the end of the periods in Annex II, and error reports up to 90 days later. The data that a client entered in their own account remains in that account; from then on, it is no longer Controller Data and is governed by the Privacy Policy. This does not apply to the photos and files that the client sent in the course of the Controller's coaching: they are hosted in the Controller's account and are deleted with it.

10. Information and audits

We make available to the Controller the information necessary to demonstrate compliance with Article 28 of the GDPR and allow audits, including inspections, conducted by the Controller or by an auditor chosen by the Controller and bound by confidentiality. Audits are carried out with reasonable prior notice, no more than once a year, unless there are indications of non-compliance or a request from CNPD (the Portuguese data protection authority), in the first instance by means of documentation and questionnaires, and without compromising the security of our other customers. They are paid for by the Controller, unless non-compliance on our part is confirmed. We make this information available to the supervisory authority on request.

11. International transfers

We only transfer Controller Data outside the European Economic Area with the safeguards in Chapter V of the GDPR. Annex III indicates the location of each sub-processor and, where processing takes place outside the European Economic Area, the applicable safeguard. We send a copy of the Standard Contractual Clauses on request.

12. Obligations of the Controller

The Controller is responsible for: having a legal basis for each processing operation and, for health data, a basis under Article 9(2) of the GDPR (as a rule, the data subject's explicit consent; health professionals bound by secrecy may rely on point (h), together with paragraph 3); informing data subjects (Articles 13 and 14), including the people they record who have no account of their own; obtaining the authorisation of the legal representatives of minors; ensuring that the members of their team act under their authority and with confidentiality (Article 29); carrying out, where required, a data protection impact assessment; and giving lawful instructions.

13. Liability, precedence and amendments

The limitations of liability in the Terms apply only between the parties and do not affect the rights of data subjects (Article 82 of the GDPR). In the event of a conflict regarding the processing of Controller Data, this DPA prevails over the Terms. Amendments to this DPA follow section 25 of the Terms. This DPA is governed by Portuguese law. Terms not defined here have the meaning given to them in the GDPR.

Annex I: Summary of the processing

Annex II: Technical and organisational measures

• Production servers hosted in the European Union (Germany)
• Encryption in transit (HTTPS/TLS) for connections over the Internet
• Passwords stored as hashes; two-factor secrets and connections to external services encrypted on the servers
• Two-factor authentication available for all accounts
• Separation of data by account and by team, with permissions configurable by the Controller
• Attempt limits, anti-bot protection and access monitoring
• Audit logs of changes (180 days; 365 days for account and payments) and of support access (365 days)
• Assistance sessions within accounts, logged and time-limited; neither they nor the administration tools give access to private files, except for what is visible in the screenshot of a mobile app error report
• Database backups, deleted by rotation, as a rule after 30 days
• Calls not recorded; relay and group calls on our own servers
• Staff with access bound by confidentiality

Annex III: Sub-processors