2trAIn Cliente app privacy policy

This is a courtesy translation. If the two versions differ, the Spanish one prevails.

This policy applies to the 2trAIn Cliente mobile app (iOS and Android), the app you use to train with your personal trainer. It explains what data we collect through the app, why we use it, who we share it with and what your rights are under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). This website’s privacy policy is here.

1. Who processes your data

Company: LMGINC SL, owner of the app
Tax ID (NIF): B93905438
Address: Calle Lagasca 95, 28006 Madrid (Spain)
Email: contact@2trainapp.com

Your health data is processed by your personal trainer. You record your injuries and discomfort, your weight and measurements, your workouts and anything from Apple Health or Health Connect for your trainer, who decides what is collected and why (to plan your training) and is responsible for it as the data controller. LMGINC SL processes it only on their behalf and following their instructions, as a processor (Art. 28 GDPR), so the app can work. You can exercise your rights with your trainer or by writing to contact@2trainapp.com, and we’ll pass your request on.

2. Data we collect through the app

Account data

Email and name: to create and manage your account.
Password: always stored hashed, never in plain text.
Invite code: links your account to your personal trainer.
Profile photo: optional. If you add one, you choose it from your phone’s camera or gallery; the app doesn’t access any other image.

Health and physical activity data (special category, Art. 9 GDPR)

Weight and body measurements (waist, body fat…) and their history, if you choose to log them.
Injuries, discomfort or pain you report, including at the end of a workout, so your trainer can adapt your plan.
Workout logs: exercises done, sets, reps, times, distances, weights lifted, perceived effort, rests and your reasons for skipping a session. While you train, the session in progress is saved to our servers so it isn’t lost.
How you feel and your habits: your answers to “How are you today?” and whether you complete the habits your trainer sets.

Apple Health or Health Connect data (only if you connect them)

If you choose to, in Profile → Connections, the app reads from Apple Health (iPhone) or Health Connect (Android): steps, active energy, distance, resting heart rate, heart rate variability, sleep, the workouts your watch records, weight, body fat, height and lean mass.

Read-only: the app doesn’t write anything to Apple Health or Health Connect.
What for: so you can see it under “Your watch” and so your trainer can see how you rest and move outside your sessions.
Never used for advertising or shared with third parties.
You can stop sharing at any time by removing the permission in your phone’s settings or withdrawing your consent in the app.

This data is only processed with your explicit consent (Art. 9.2.a GDPR), which the app asks for before it starts. You can withdraw it at any time (see section 7).

Location and routes (outdoor cardio only)

If you do an outdoor cardio session, the app uses GPS to draw your route and measure distance and pace:

Only during the session. Location is used from when you tap “start” on an outdoor session until you finish it. You are never located outside a workout you started yourself.
It keeps measuring with the screen locked while that session lasts; otherwise it would be useless. Your phone shows you when this is happening.
Not used indoors. A cardio session on a machine doesn’t use GPS.
What’s stored: the route, distance, time and pace, linked to that session and your account.
Your trainer can see your routes, just as they see the rest of your activity.
You can delete a route in the app without deleting the session or your account.

Like the rest of your physical activity, this data is processed with your explicit consent (Art. 9.2.a GDPR) and with the location permission your phone asks for, which you can revoke in its settings at any time.

Messages

Chat messages you exchange with your trainer in the app.

Technical and usage data

Installation ID: a random code generated on your device that helps us manage your session securely. It doesn’t identify your device to third parties and isn’t used for advertising.
Device data: operating system (iOS or Android) and version, phone model, language, time zone and app version.
App usage and errors: we always record on our servers when you use the app and any errors that occur, to keep it working properly.
Detailed usage, only if you accept it (off by default, in Profile): which screens you visit, what you do and which videos you watch, sent to our servers, plus a recording of how you use the app (screens and taps) with Microsoft Clarity, so we can see where people get stuck. Your messages, injuries, weight, “How are you today?” answers and watch data are hidden in that recording.
Server logs (IP address, date and time of access), needed for the security and operation of the service.

The app does not access your contacts or microphone, has no ads, uses no advertising trackers and doesn’t send crash reports to any external service. Its only third-party analytics tool, Microsoft Clarity, only runs if you accept detailed usage. It accesses your camera or gallery only for the profile photo you choose, and your location only during an outdoor cardio session, as explained above.

Minimum age: the service is intended for people aged 14 and over (Art. 7 LOPDGDD). If you are under 14, you must not sign up without the express consent of your parents or legal guardians.

3. Why we use your data

Providing the service: showing you the plan your trainer creates, logging your sessions and progress, and letting you message them. Legal basis: performance of a contract (Art. 6.1.b GDPR).
Processing your health data (weight and measurements, injuries, workout logs and, if you connect them, Apple Health or Health Connect data) so your trainer can plan and track your training. Legal basis: your explicit consent (Art. 9.2.a GDPR).
Service emails: emails strictly needed to manage your account (for example, password recovery). Legal basis: performance of a contract (Art. 6.1.b GDPR).
Keeping the app working: recording when it’s used and any errors. Legal basis: legitimate interest (Art. 6.1.f GDPR).
Improving the app: detailed usage (screens, actions, videos and the Microsoft Clarity recording), only if you accept it. Legal basis: your consent (Art. 6.1.a GDPR).
Security: preventing unauthorized access. Legal basis: legitimate interest (Art. 6.1.f GDPR).

We don’t sell your data or use it for advertising.

4. Who sees your data

Your personal trainer: the main recipient of your data within the service. Your trainer sees your plan, your workout logs, your weight and measurements, your injuries, your cardio routes, your habits, anything from Apple Health or Health Connect if you connect them, and your chat messages: they need all of this to coach you. Your trainer can only access their own clients’ data.

No AI replies to you. In the app’s chat, there’s a person on the other side: your trainer. The app doesn’t generate automatic replies or replace their judgment, or the advice of a healthcare professional: if you have any medical concern, see your doctor.

Processors: to run the service we use providers with whom we have signed the contracts required by Art. 28 GDPR:

Google Cloud (infrastructure): hosting of the service’s servers and database in the European Union (Belgium region). Google Cloud privacy notice.
Anthropic PBC (US), artificial intelligence: when your trainer imports a plan or training history from a PDF, image or CSV file, the file is sent to Anthropic to turn it into a plan, which your trainer reviews before publishing. Anthropic doesn’t use this data to train its models. Covered by standard contractual clauses. Anthropic privacy policy.
Resend (Plus Five Five, Inc., US), transactional email: sending service emails such as password recovery. Covered by standard contractual clauses. Resend privacy policy.
Cloudflare, Inc. (US), content delivery network: delivering the exercise demo videos. Covered by standard contractual clauses. Cloudflare privacy policy.
MapTiler AG (Switzerland), maps: draws the base map your route is drawn on. It receives the approximate area you’re looking at and your IP address, not your route: the route is drawn on your own phone, on top of the map. Switzerland has an adequacy decision from the European Commission. MapTiler privacy policy.
Microsoft Corporation (US), Clarity: only if you accept detailed usage, it receives the recording of how you use the app described in section 2. Covered by the EU-US Data Privacy Framework. Microsoft privacy statement.
Vercel Inc. (US), web hosting: serves the 2trainapp.com and 4trainers.2trainapp.com websites, where these legal pages live. Covered by standard contractual clauses. Vercel privacy policy.

5. How long we keep your data

We keep your data while your account is active. If you delete your account (in the app or by email), we will delete all of your data within 30 days, except for any data we must keep by law, which will remain blocked until the related liabilities expire.

6. Deleting your account

You can delete your account and all your data in two ways:

In the app: Profile → Danger zone → Delete account. Your account is closed immediately and all of your data is deleted within 30 days.
Without access to the app: follow the instructions on the Delete my account page.

7. Your rights

You have the right to:

Access (Art. 15): find out what data we hold about you.
Rectification (Art. 16): correct inaccurate data.
Erasure (Art. 17): ask us to delete your data (the “right to be forgotten”).
Objection (Art. 21): object to certain processing.
Portability (Art. 20): receive your data in a structured, readable format.
Restriction (Art. 18): ask us to restrict processing in certain circumstances.
Withdrawal of consent (Art. 7.3): withdraw your consent to the processing of your health data at any time, without affecting the lawfulness of earlier processing. Without this data, the service can’t be provided in its current form. Consent for detailed app usage can be withdrawn in Profile, with no consequences.

To exercise any of these rights, write to contact@2trainapp.com with the subject “GDPR rights”, from the email linked to your account. We will reply within one month.

If you believe your data is being processed unlawfully, you can file a complaint with the Spanish Data Protection Agency (AEPD).

8. Security

We apply appropriate technical and organizational measures to protect your data: encryption in transit (HTTPS) for all communications, session credentials kept in the system’s secure storage (Keychain on iOS, Keystore on Android), hashed passwords and restricted staff access to data.

9. Notifications

The app may show local notifications on your device (for example, the end-of-rest alert during a workout). They are optional: your phone will ask for permission and you can turn them off in your device settings at any time. These notifications are generated on your own device and don’t send any data to our servers.

10. Changes to this policy

We may update this policy to reflect changes in the service or the law. If the changes are significant, we’ll let you know in the app or by email at least 15 days in advance. The “last updated” date at the top always shows the current version.

11. Contact

For any privacy question, write to contact@2trainapp.com. We’ll reply as soon as we can.

App privacy policy