Privacy Policy
GimiGym is software that clubs, studios and personal trainers use to run memberships, bookings, check-in, training and nutrition. This policy explains what personal data the GimiGym mobile app, the web app (login.gimigym.com) and the website (gimigym.com) process, why, and the choices you have.
- Who we are
- Who is responsible for what
- Data we process
- How we use it and why
- Health and body data
- AI features
- Who we share it with
- Where data is stored
- How long we keep it
- Your rights
- Deleting your account
- The website gimigym.com
- Security
- Children
- Changes and contact
1. Who we are
GimiGym is developed and operated by Boris Matić, an independent developer based in Serbia. Contact for everything related to privacy and your data: office@gimigym.com.
2. Who is responsible for what
If you are a member of a club, your club decides what data it keeps about you and why. The club is the controller of your membership, training and body data. GimiGym processes that data on the club's behalf, as its processor. You can contact your club or us about it; we will help either way.
Another club can add you as a member only after you accept its invitation in the app; until then it sees only a shortened version of your name. Clubs of the same organisation (locations of one owner) can add you directly. You can leave any club other than your home club in Profile → Settings → Account → Leave a club.
If you are a club owner, admin or trainer, we are the controller of your account data (name, phone, email, sign-in records) and of the data needed to provide the service to your club.
For security and fraud prevention (sign-in, SMS abuse, rate limits) and for the website gimigym.com, we are the controller.
3. Data we process
| Category | Examples | Source |
|---|---|---|
| Account | Name, mobile phone number (your login), email address (account recovery), language | You, or your club when it registers or imports you |
| Invitations | Phone number and email address of someone a club invites as staff or as a new club owner | The person sending the invitation |
| Membership | Plans bought, sessions left, start and due dates, pause status, sales records (amount, date). We never see or store card numbers. | Your club |
| Bookings and check-in | Sessions booked, waitlists, attendance and QR check-ins with time | You and your club's staff |
| Training and nutrition | Workout programmes and logs, food diary, meal plans, coaching notes, injury notes a trainer enters | You and your trainer |
| Photos | Profile picture; optional progress photos (faces can be blurred on your device before upload) | You or your trainer |
| Body and health (optional) | Weight, height, body measurements, body-fat %; with your consent, daily steps and sleep, and smart-scale weight and body-fat % from Apple Health or Health Connect | You or your trainer |
| Messages | Chats with your club's staff, announcements | You and your club |
| Club activity log | A record of staff actions in the club (for example sessions added or removed, sales, bookings moved, settings changed): who did it, when, what changed and the reason given. Visible to the club's administrators; trainers see only their own actions. | Your club's staff |
| Club notices | Messages your club's system sends to you about your membership, sessions and programs (for example sessions added, a class cancelled, a membership expiring), shown under "From the club" in Messages, and whether you have read them. | You and your club's administrators |
| Live video sessions | Your camera picture and microphone sound while you are in an online session with your trainer. Streamed live through Agora and not recorded (see below). | You |
| Device and security | Push-notification token, app version, IP address, sign-in and request logs, device-check signals used to block automated SMS requests | Your device |
Online sessions. When you join an online session, your trainer sees your camera picture and hears your microphone (staff of your club who join the session can too). In a group session the other members hear you but do not see you: members only receive the trainer's video. You can turn your camera and microphone off at any time during the call. Video and sound are transmitted in real time through Agora and are not recorded by GimiGym; we only keep who joined and when, for attendance.
4. How we use it and why
- To provide the service: sign-in by SMS code, memberships, bookings, check-in, training and nutrition features, messages and reminders. Legal basis: performance of a contract (for members, the contract with your club).
- To keep accounts secure: verifying phone numbers and emails, blocking automated or fraudulent SMS requests, rate limits, account recovery. Legal basis: legitimate interest in a safe service.
- To send notifications: session reminders, membership expiry, messages. You can turn most of them off in the app's settings.
- Trainer insights: see AI features.
- To improve the product: aggregated, non-identifying counts (for example, the number of check-ins per club).
We do not sell personal data and we do not use it for advertising. The app contains no advertising or third-party analytics.
5. Health and body data
Weight, body measurements, body-fat %, progress photos, injury notes and data from Apple Health or Health Connect are health data, which the law protects specially. We process it only with your explicit consent: the app asks for it before you first add such data, adding it is always optional, and you can withdraw the consent in Profile → Settings → Privacy. You can delete the data at any time in the app or ask your club to delete it. When a trainer enters such data for you, your club is responsible for having your consent.
Connecting Apple Health or Health Connect requires a separate consent in the app. We read only daily totals of steps and sleep and, if you allow it, the day's last weight and body-fat % from a smart scale, for the last 30 days, never minute-by-minute data. Your assigned trainer and your club's admins can see these values; scale weight also appears in your progress charts and in the weekly trainer insights. You can withdraw consent at any time in your profile; the synced data is then deleted immediately. Data from Apple Health is never used for advertising or shared with data brokers.
6. AI features
Clubs that use the training and nutrition features can use two AI-assisted features. Both are processed by Anthropic (Claude, United States).
- Weekly trainer insights. Once a week, the app scores each member's training, attendance, nutrition, sleep and steps (for example, the risk that a member stops coming) and asks an AI model for short coaching tips. The AI receives weekly statistics such as weight, sessions, visits, calorie target %, sleep and steps. It does not receive your name, phone, email or photos. The results are shown only to your club's staff and are suggestions for your trainer: no decision about you is made automatically.
- Workout plan builder. When a trainer asks for a draft programme, the AI receives the goal, level, available equipment, the joints to protect and any notes the trainer writes, including notes about injuries. It does not receive the member's name or contact details. Trainers are asked not to type names into these notes.
7. Who we share it with
Inside a club, your data is visible to that club's staff according to their role (for example, a trainer sees the members assigned to them). If you belong to several locations of the same organisation, those locations can see the membership you use there. We use these service providers:
- Google Cloud / Firebase: database, sign-in and SMS codes, device checks against automated sign-ins (reCAPTCHA, Play Integrity), file storage, hosting, push notifications.
- Agora: real-time video and audio for online training sessions (transmitted live, not recorded).
- Anthropic: the AI features described above.
- Zoho Mail (EU data centre): verification, account-recovery, welcome and invitation emails.
- Open Food Facts: when you search for a food or scan a barcode, the app asks the Open Food Facts database directly from your phone. They receive the search term or barcode and your IP address, nothing else.
- Apple and Google: app distribution, and health data only when you connect Apple Health or Health Connect.
We may disclose data if the law requires it.
8. Where data is stored
The database, photos and other files, and the server code are in the European Union (Google Cloud: the database in multi-region Europe, files and server code in Belgium). Only sign-in (your phone number and sign-in records) is handled in the United States (Google Firebase Authentication); push notifications pass through Google's global network, and Anthropic and Agora may also process data outside Europe. Transfers outside Serbia and the European Economic Area rely on the providers' standard contractual clauses or equivalent safeguards.
9. How long we keep it
- Account and membership data: while your account exists.
- When you delete your account, or a club deletes a member, personal data is removed from the live systems immediately and from backups within 30 days.
- Sales records a club must keep for its own bookkeeping stay with that club and contain only the name you had. Attendance logs stay as counts only: your name is replaced with “Deleted member”.
- Your chats are deleted completely, for both sides, including photos sent in them.
- Security and sign-in logs: up to 30 days. Temporary sign-in permissions and rate-limit counters: minutes to 30 days.
- Club activity log: 12 months, then deleted automatically.
- Club notices: 90 days, then deleted automatically.
- Trial-session guests: only the club's staff see a guest's name and phone; members see just that a place is taken. Removed 6 months after the session.
- Invitations: until they are used, revoked or expire (staff invitations expire after 7 days).
10. Your rights
You can ask to access, correct, export or delete your data, to restrict or object to processing, and to withdraw any consent you gave (this does not affect processing before the withdrawal). To get a copy of your data, use Profile → Settings → Privacy → Export my data or write to us; for anything else, also write to office@gimigym.com; we answer within 30 days. If your request concerns data your club controls, we will pass it on to the club and help it respond.
You can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of Serbia (poverenik.rs) or with the data-protection authority of the country where you live.
11. Deleting your account
In the app: Profile → Settings → Account → Delete account. This permanently deletes your account and your personal data at every club. You can also request deletion without the app: see gimigym.com/delete-account.
12. The website gimigym.com
The website uses no analytics or advertising cookies. If you leave your email address in a form on the website, it is stored in a Google Sheet so we can reply to you, and deleted on request. Fonts are served from gimigym.com itself; pages load nothing from third parties.
13. Security
Data is encrypted in transit and at rest. Access inside a club is limited by role and enforced on our servers; staff accounts are protected by SMS sign-in and email-verified recovery. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.
14. Children
GimiGym is not intended for children under 16 without the consent of a parent or guardian. Clubs that register younger members are responsible for obtaining that consent.
15. Changes and contact
We will post changes here and update the date above; significant changes are announced in the app. Contact: office@gimigym.com. This policy is available in English and Serbian; both versions have the same meaning.