Privacy policy

Who is responsible

Webreact B.V. runs the app and is responsible for your data.

Questions about your privacy? Email support@webreact.nl.

What we store

• Your account. Your name and email address. When a trainer invites you by email and you have no account yet, the account is made with the name and email address they entered; you choose your own password, and nobody else knows it. We also keep your password (only as a hash, so nobody can read it), your language, your timezone (your device sends it, so "today" is right when you travel), your reminder time and your other settings. If you turn on two-factor authentication or add a passkey, we keep what is needed to check them: an encrypted secret with recovery codes, or the passkey's public key. Your fingerprint or face never leaves your device. If you work for a trainer or studio, we also keep which organization you are part of and your role there.
• Your training. The programs and schedule your trainer makes for you, your sessions with their start and end times, the sets you log (reps, weight, time), the energy rating and notes you add when you finish, and comments between you and your trainer. For every session and set we also keep who logged it: you, or a trainer who logged it for you. The app has no place for health details yet. Please keep medical details, such as an injury, out of your notes and comments and tell your trainer in person: health information is a special category of personal data.
• Invitations and your choices. For every trainer or studio that invites you: who invited you, when, the name they used, what they asked you to share, and when you accepted, declined or stopped. Every time you accept or change what you share, and when the coaching stops (because you leave, or the organization stops or leaves the platform), we keep a record of your choices with the date and time and who did it.
• The iPhone app. An install id the app makes up, the app version, a label such as "iPhone · 7k2m9q" (the model and part of the install id, not your phone's name), when the phone was last seen and a sign-in token for each phone. If you allow notifications, also the push token Apple gives the app.
• Notifications in the browser. If you turn them on, the address and keys your browser's push service gives us to deliver them. You can remove them in Settings → Reminders.
• Technical data. Every visit to the website has a session, stored with your IP address and the type of browser, also before you sign in. Old sessions are removed automatically. Errors and requests are logged, with the IP address, so we can keep the app secure and fix problems.

Trainers and what they see

A trainer or studio (an organization on the platform) invites you by email, or shares an invitation link or QR code with you. Nobody there sees anything of your training until you accept the invitation in the app. The link is stored only as a hash, so not even the database holds a working link; it works once and expires after 14 days.

When you accept, you choose for each kind of data what that organization may see:

• Training log: your sessions, sets, weights and notes. To be coached you share at least this; if you switch it off later, the organization sees none of your training.
• Apple Health workouts: runs and other workouts from Apple Health.
• Health details: limitations you report, such as injuries.
• AI assistant: whether an AI assistant may use your data to draft changes for your trainer.

For now the app only collects and shows the training log. It does not read Apple Health, has no place for health details and has no AI assistant; your choices for those are kept, so nothing is shared until you have agreed to it.

You can change your choices or stop being coached at any time in the app, and it applies at once. Your history stays yours: when you or the organization stop, its access ends straight away, and your sessions stay in your account. The same happens when an organization leaves the platform: its programs stop, and the sessions you logged stay in your account with the exercises you did.

• Only their own sessions. When more than one organization coaches you, each sees only the sessions from its own programs or that its trainers planned for you, and the sessions you plan yourself; never those of another organization.
• Who sees it there. The trainer you are linked to, and the organization's owners. Other trainers there, other clients and the staff of Utmost do not see your training.
• Logging for you. During a session together, your trainer can log it for you in the app. It is saved as logged by them, and you see it in your history like any other session.

Why we use it

• To coach you: to plan your training, let you and your trainer log it, show your progress to you and to the trainers you share it with, send reminders, and send account emails such as an invitation or a password reset. The legal basis is the agreement about the coaching. What a trainer sees is what you chose to share; you can change that at any time.
• To keep the app secure: sign-in protection, sessions, logs and error monitoring. The legal basis is our legitimate interest in an app that is safe and works.

We use your data for nothing else. No analytics, no ads, no tracking, and we never sell your data.

Who helps us

These services process data for us, only for what is listed here:

• Laravel Cloud hosts the app and its database, on servers in Frankfurt, Germany.
• Our email provider delivers the account emails: invitations, password resets and messages about your email address.
• Apple Push Notification service delivers notifications to the iPhone app. It receives the push token and the text of the notification, such as a reminder or the start of a comment from your trainer.
• Your browser's push service (from Apple, Google, Mozilla or Microsoft, depending on your browser) delivers notifications in the browser. The messages are encrypted, so only your browser can read them.
• Laravel Nightwatch watches for errors and slow pages. It receives technical details of requests and errors, including your account's id, name, email address and IP address. This data is kept in Frankfurt too.
• OpenAI draws the pictures of exercises. It only receives what describes the exercise: its name, a description of the movement, its equipment, the trainer's instructions for that picture and a few existing exercise pictures as a style example. Never anything about you.

Laravel, Apple, Google, Microsoft, Mozilla and OpenAI are American companies. Where data goes to them, that relies on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses, with a data processing agreement where the provider offers one. Apart from the trainers and studios you choose to share with, we share your data with nobody else.

Apple Health

If you allow it, the iPhone app saves every finished session as a workout in Apple Health on your phone: the type of workout and when it started and ended. That stays on your phone and is not sent to us. The app does not read your health data; it only checks which sessions it saved before, so none is added twice. You can change this at any time in the Health app.

Where and how long

Your data is stored in the app's database in Frankfurt, Germany:

• Your account, sessions and sets for as long as you have an account, also after coaching stops. A session taken off your calendar stays stored, marked as removed, until then.
• Comments until their author or a trainer of yours deletes them, or until your account is deleted.
• Phones and push tokens until the phone is removed or your account is deleted. A push token that Apple no longer accepts is forgotten.
• Invitations and the records of your choices for as long as you have an account, so it stays clear what you agreed to and when, also after the coaching stopped. They are deleted with your account and not kept apart: once your training data is gone, there is nothing left that they would have to account for. An account made only for an invitation that the trainer withdraws before you used it is deleted with it.
• Technical logs and monitoring data are deleted automatically after a limited time.

Do you want your account removed? Email us, and we delete it with everything linked to it: your schedule, your sessions with their sets and notes, the comments on them and the ones you wrote, your invitations and the records of your choices, the devices and sign-ins of the app and the website, push notifications and passkeys. This cannot be undone.

If you work for a trainer or studio, you can also delete your account yourself in Settings on the website. If you are the only owner of an organization, you confirm that it is deleted with your account: coaching of its clients stops, and they keep everything they logged.

Cookies and storage on your device

The website only uses the cookies it needs to work: one for your visit, which keeps you signed in, one that protects forms against misuse, and, if you tick "Keep me signed in", one that remembers you. There are no cookies for tracking or ads, so there is no cookie banner.

Your browser also keeps your theme and copies of the website's own files and of exercise pictures, so pages load faster.

So you can keep training without a connection, the iPhone app keeps a copy of your schedule and sessions on your phone, and removes it when you sign out; it only remembers your email address, to fill it in next time.

Your rights

Under the GDPR you can ask us to:

• show you the data we have about you;
• correct it;
• delete it;
• limit how we use it;
• give it to you in a file you can take elsewhere (portability);
• stop using it for the security purposes above, if you object.

Email support@webreact.nl and we will answer within a month. You can change your name, email address and language yourself in Settings, and what each trainer sees in the app. Not happy with how we handle your data? You can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Security

All traffic to the app is encrypted (HTTPS), and passwords are only stored as a hash. You can add two-factor authentication or a passkey in Settings → Security. When you change your password in Settings, every app and your other browsers are signed out; the browser you used stays signed in. After a password reset by email, you are signed out everywhere. Trainers never change your account or password for you.

Changes

When we change this policy, the date at the top of this page changes with it.