GymBud Privacy Policy

1. Who This Policy Covers

This policy applies to Personais, alunos, marketplace visitors, app users, support contacts, and anyone who interacts with GymBud websites, apps, onboarding flows, payments, communications, or support tools.

2. Information We Collect

We may collect account information, contact details, profile information, training preferences, goals, equipment, schedules, workout logs, check-ins, body check-in entries, photos uploaded by users, messages, documents, support requests, payment metadata, device information, IP address, app version, diagnostics, and usage events.

We do not store full card numbers. Payment providers process payment credentials directly.

3. Fitness Data Is Not Medical Care

GymBud may process fitness, wellness, activity, check-in, and body-progress information. This data is used to operate training features and is not treated as medical care provided by GymBud. GymBud is not a healthcare provider.

3A. Optional Apple Health and Health Connect Data

When an Aluno explicitly connects a supported health provider, GymBud may receive and store daily aggregates for steps, external workout count and duration with a broad activity category, sleep duration and timing consistency, resting heart rate, and heart-rate variability. GymBud stores Apple HRV as SDNN and Health Connect HRV as RMSSD without converting one method into the other.

GymBud does not request or store continuous heart-rate streams, sleep stages, calories, routes or location, ECG or rhythm data, blood oxygen, respiratory rate, temperature, blood pressure, glucose, reproductive data, nutrition, symptoms, medications, diagnoses, or treatment information for this feature. Sleep-stage records may be read on-device only to calculate total duration and timing, then discarded before upload.

GymBud uses these aggregates only to provide informational context around training and to improve the Aluno's own fitness experience. We do not sell this health data, use it for advertising, or use it to make automatic training-program changes. Sharing with the connected Personal is optional and off by default. Exporting a completed GymBud workout back to the provider is a separate optional setting and does not include calories or routes.

4. How We Use Information

We use information to create accounts, connect alunos and Personais, deliver training programs, support check-ins and progress tracking, process payments through providers, send operational communications, provide support, prevent abuse, secure the platform, personalize the experience, improve features, and comply with law.

We may use aggregated, de-identified, or anonymized training content and usage patterns to improve analytics, recommendations, automation, product quality, safety systems, and future AI features.

We use WhatsApp contact information and message history to send account, onboarding, support, platform update, training program, payment, renewal, and coach/student-related communications when allowed by user consent, service context, opt-out status, and WhatsApp rules.

5. Sharing With Personais

Aluno information is shared with the Personal or organization connected to that aluno so they can deliver coaching services. Personais are responsible for using and protecting aluno data appropriately in their own business.

6. Service Providers and Integrations

We may share information with service providers that help us host the platform, store data, send email or WhatsApp communications, provide support, analyze diagnostics, process payments, deliver push notifications, and operate security systems.

If a Personal or authorized organization enables an integration, GymBud may share a limited approved data set with that integration provider. We do not sell personal data.

WhatsApp messages may be processed by Meta, WhatsApp Business infrastructure, delivery providers, and GymBud support/automation systems so messages can be sent, received, routed, logged, and supported.

7. Legal Bases and LGPD

For Brazilian users, GymBud may process personal data under consent, contract performance, legitimate interest, legal obligation, fraud prevention, protection of health or safety, and regular exercise of rights, depending on the context.

Users may request access, correction, deletion, portability, information about sharing, consent withdrawal, and review of certain automated decisions where applicable.

8. International Transfers

GymBud may process information in the United States, Brazil, and other countries where we or our providers operate. We use reasonable safeguards for these transfers.

9. Retention and Deletion

We retain information while needed to provide the platform, support users, keep records, resolve disputes, comply with law, prevent fraud, and maintain security. Users may request deletion, but some records may be retained where legally or operationally required.

Synced daily health aggregates and their sync diagnostics are retained for up to 13 months while the connection is active. An Aluno can disconnect a health provider and can choose to delete synced health aggregates from GymBud sooner. Withdrawing native provider permission does not by itself delete information already synced to GymBud; the in-app delete option or a privacy request must also be used. Minimal consent and deletion audit records may be retained where needed to demonstrate the request and protect platform integrity.

10. Security

We use technical and organizational safeguards designed to protect data, including access controls, auditability, secure infrastructure, and limited access practices. No system is perfectly secure.

11. Privacy Requests

Privacy requests can be made through the platform or support channels. GymBud may need to verify identity before fulfilling a request.

12. Changes to This Policy

We may update this Privacy Policy. Material changes may require renewed acceptance in the product.