1. Controller
Andreas Heumann · Thrive Zone Personal Training · Otto-Weidt-Platz 10, 10557 Berlin · andreas@heumann-personaltraining.berlin
2. What data we process
(a) Sign-in: your email address. (b) Training and health data you enter: training sessions, sets/weights, nutrition/meals, sleep, steps, movement, supplements and, where applicable, body measurements. If you turn on cycle tracking, also your cycle details (start and end of your period, bleeding between periods, whether you use hormonal contraception or hormone therapy, and your optional monthly check-in). (c) Optional: photos of meals or nutrition labels, and free-text/voice input, if you use those features. Some of this is health data within the meaning of Art. 9 GDPR.
3. Purpose & legal basis
We process this data to provide your training, nutrition and daily coaching and to support you as your trainer. The legal basis is your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You give it here on this page and can withdraw it at any time, effective going forward.
4. Sign-in via one-time code (Supabase Auth & Brevo)
To sign you in, we send you an 8-digit one-time code by email. Emails are sent via Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin). User management runs via Supabase (see 5).
5. Storing your data (Supabase, EU)
Your data is stored in a database hosted by Supabase; the servers are in the EU (Frankfurt am Main). The data is encrypted in transit and at rest. There is a data-processing agreement with Supabase under Art. 28 GDPR; for any transfers to third countries, the EU Standard Contractual Clauses apply.
6. Optional AI analysis (Anthropic)
If you use the photo, voice or label feature, the relevant content (photo or text) is sent to Anthropic (Anthropic PBC, USA) for automatic analysis. Anthropic processes the content solely to answer the request, does not use API data to train AI models, and deletes technical logs after 7 days by default. There is a data-processing agreement with EU Standard Contractual Clauses. These features are optional — you can use the app entirely without photo/voice and log meals manually.
7. Delivering the app (Cloudflare)
The app is served via Cloudflare (Cloudflare Inc.). Technically necessary connection data is processed; there is a data-processing agreement with EU Standard Contractual Clauses. The connection is TLS-encrypted throughout.
8. Who sees your data (coach access)
Your trainer Andreas Heumann sees the training and tracking data you record in the app — that's exactly the point of the app, so your coaching can respond to your real data. One exception: Andreas only sees your cycle details if you explicitly allow it in the app — and you can withdraw that at any time. There is no sharing with third parties for advertising, and no sale.
9. Retention
We store your data for as long as your coaching relationship lasts, or as long as you use the app. At your request, or after your coaching ends, your data is deleted.
10. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), as well as the right to withdraw your consent at any time. You also have the right to lodge a complaint with a supervisory authority — in Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin. For access or deletion, an email to andreas@heumann-personaltraining.berlin is enough.
11. Taking part is voluntary
Using the app is voluntary. Without your consent we can't provide the app to you; but you can withdraw your consent at any time and ask for deletion, with no disadvantage to the rest of your coaching.
As of October 2026 (cycle details added) · draft — have it legally reviewed before wide use.
