Privacy statement

1. Who is responsible

DuoVitaal is provided by Arnout van der Vorst, in the Netherlands. He is the controller of the data in the app. Questions about privacy or a request about your data: info@duovitaal.com. We'll send you the postal address on request.

2. Which data

Kind	Examples
Account and profile	Name, profile photo, e-mail address or phone number, how you sign in (Apple, Google, phone or e-mail), language, time zone. Contact details, date of birth, gender and height are stored separately and only you can read them.
Training	Your workouts and live sessions, training schedule, preferences, fitness profile, missed workouts and the reason you gave, your own activities, programmes.
Health and wellbeing	Weight and other measurements, progress photos, goals, habits, your intake with a coach (for example injuries or limitations), your journal, mood, affirmations and reflections.
Together	Groups, chat messages and photos, cheers, reactions, shared activities, invites, challenges and your score, blocks and reports.
Coaching	Your connection with a coach, nudges, support requests, rewards, coaching requests. For coaches also the coach profile, their own exercises and videos.
Device and usage	Push token, device type and app version, crash reports, usage statistics (which screens and features are used), a check that requests come from the genuine app.

When you invite someone from your contacts, you pick one contact yourself. We only use that phone number, to check whether that person already has DuoVitaal. We don't read your address book.

3. What for, and on what basis

• Providing the app (your account, your day, workouts, chats, coaching): necessary to perform our agreement with you.
• Health data (measurements, intake, journal, mood): only with your explicit consent, which you give by entering it. You can always erase it or delete your account.
• Notifications on your phone: with your consent, which you switch on and off on your phone and under Me › Notifications.
• Safety, fixing bugs and improving the app (crash reports, usage statistics, preventing abuse, reports of inappropriate behaviour): our legitimate interest in a safe app that works.

We don't use your data for advertising, don't build advertising profiles and don't sell anything on.

4. Who sees what

• Your buddies see what you share. You choose that per part under Me › Sharing with buddies. Of your journal they see at most your mood or your reflection, if you choose so; the rest of your journal stays yours.
• Your coach sees what's needed to guide you: your workouts and missed workouts, assignments, goals, measurements, your intake and your monthly check. Progress photos only if you share a set. Your coach doesn't see your journal.
• Other users see your name and profile photo when you're in the same group or chat. Coaches who turn on "Findable in the app" have a public coach profile for signed-in users.
• We only look at your data when that's needed for support you asked for, a report of abuse or a bug. We do so read-only.

5. Services we use

We use a few services from other companies. Data processing terms with them are in place through their standard terms.

Service	What for	Where
Google Firebase: Firestore, Storage, Cloud Functions	The database, your photos and videos, and the app's servers	European Union (Firestore: several EU regions; Storage: the Netherlands; Functions: Belgium)
Google Firebase: Authentication	Signing in, text message codes when you sign in with your phone number	Google, also outside the EU
Google Firebase: Cloud Messaging	Push notifications	Google, also outside the EU
Google Firebase: Crashlytics, Analytics, App Check, Remote Config	Crash reports, usage statistics, checking that requests come from the genuine app, remote settings	Google, also outside the EU
Apple, Google	Signing in with your Apple or Google account (if you choose to)	Apple, Google
Cloudflare	Delivering the exercise videos to the app	Global network; the videos themselves are on our own server in the Netherlands

Where data leaves the EU (with Google and Cloudflare, in the United States), this is based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

6. How long we keep it

• We keep your data as long as your account exists.
• If you delete your account, we erase your data right away, with a few exceptions listed on Delete your account: messages in chats with others stay without your name and content, and reports of abuse are kept for safety.
• Google keeps crash reports and usage statistics according to Firebase's retention periods (90 days for Crashlytics).

7. Your rights

You have the right to access your data, have it corrected or erased, restrict processing, object, and take your data with you in a common format. You can always withdraw consent. Much of this you do yourself in the app; for the rest, e-mail info@duovitaal.com. We reply within a month.

If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or the authority in your own country.

8. Security

Connections are encrypted. Who may read what is enforced on the server, not only in the app. Contact details and push tokens are in a separate document only you can read. The exercise videos are only reachable for signed-in users of the app.

9. Age

DuoVitaal is meant for people aged 16 and over. If you're younger, only use the app with permission from your parent or guardian.

10. Changes

If something important changes in this statement, we'll let you know in the app. The date at the top says when the text was last updated.