Privacy policy

REPS (identified in the legal notice) is responsible for the data processed to run the service. For any question, write to contact.reps.coaching@gmail.com.

Each coach is responsible for how they use the data of their own clients (their notes, their training plans, their conversations). They may only use it to coach them.

If you're a coach

• your name, your email, your phone number if you give it;
• your public page (photo, banner, introduction, specialities, city, links);
• your services, slots, locations, video call links, classes, packages and invoices;
• the notes you take about your clients;
• your plan and the status of your subscription (never your card);
• if you connect your personal calendar, only the times you are busy, without any title.

If you're a client

• your name, your email and your phone number, given when you book;
• your sessions, your cancellations, your no-shows and what you have paid;
• the optional note left for your coach, and your review if you leave one;
• if you have coaching, your completed workouts, your meals, your check-ins, your habits, your measurements, your photos and your videos;
• your messages with your coach and their attachments (photos, voice messages, documents).

For everyone

• your password, stored in encrypted form (bcrypt), never in plain text;
• if you use Google or Apple, the identifier provided and your email (or Apple's relay address, which we respect);
• the list of your connected devices (device type and browser, sign-in dates), without your IP address;
• your phone's notification token, if you accept notifications;
• the date you accepted the terms;
• the reports you send (reason, details, a short excerpt of the reported content) and the people you block, so that the team can handle them.

Your measurements (weight, waist and arm measurements…), your progress photos, your meals and your check-ins can reveal information about your health. They therefore get the strongest protection.

• They are optional. You are the one who records them, whenever you want. Recording nothing does not stop you from being coached.
• Your coach chooses what they follow. Weight and measurements, photos, nutrition, check-ins… A part they don't follow stays closed, for you as for them. What is included is shown to you before you pay.
• Legal basis. Your explicit consent (article 9 of the GDPR). The first time you open one of these parts, a short screen asks for your consent, coach by coach. Nothing is ticked in advance. Without your consent, these parts stay closed and your coach cannot follow you on them, and the rest of your coaching continues. If your coach later adds a part of this kind, your consent is asked again for it.
• Proof. We keep the date of your consent, the exact text you read and its version, the parts concerned, the device type and the IP address of the connection. The same applies when you withdraw it. This proof is kept for as long as needed to show that your consent was indeed given.
• Withdrawing your consent. At any time, in Settings then “My health consents”. These parts close immediately for both of you and your coach is notified. Nothing is deleted, and you can give your consent again later. You can also delete each piece of data yourself, without having to give a reason.
• Who sees them. You, and the coach with whom you have active coaching. If the coaching link is removed, your coach no longer has access. You keep read access to your measurements, photos and statistics, even after a package ends.
• Your coach’s commitment. Before offering coaching that includes this data, your coach commits to using it only to coach you, to keeping it confidential and to never sharing it. We keep the date and version of this commitment.
• Private storage. Photos, videos and attachments have no public address. Each time one is opened, we check who is asking.
• Videos. They last 30 seconds at most, without sound, and are deleted 28 days after they are sent. You are notified by email 5 days before.
• Never any other use. No advertising, no resale, no training of artificial intelligence.
• Sent to an AI only if you agree. If your coach uses the optional AI assistant, your measurements, nutrition and check-ins are only sent if you have also agreed that their assistant may read them (you can withdraw this at any time in your settings). Your name, contact details, photos and your messages are never sent. See part 6.

REPS never asks for a medical certificate or any medical proof, from either the coach or the client.

• To run the service you use (account, bookings, payments, reminders, coaching, messages). This is necessary for the contract.
• To comply with the law, in particular keeping invoices and responding to the authorities.
• To protect the service and its users (anti-bot checks, attempt limits, reports, clients that a coach no longer takes). This is the legitimate interest of REPS and of coaches.
• To measure the audience and speed of the website, anonymously, and understand what interests people on the home page (parts viewed, time spent, clicks, device type, the part from which someone goes on to create an account). Daily counters only, with no IP address kept and no identifier. Nothing makes it possible to recognise you, and a signed-in account is not measured. This is the legitimate interest of REPS.
• With your consent, for your health data and notifications on your phone.

No-shows. A coach sees your no-shows with them, and only they do. If they no longer take your bookings, your address and your account stay on their own list. No other coach sees it.

REPS never sells, rents or shares your data for commercial purposes. No advertising.

• Your coach or your client, for what concerns both of you. A client who has two coaches has two separate coaching relationships.
• The public, for a coach's page, the directory and reviews (with the name you choose to display).
• The REPS team, only to help you, handle a report or fix a problem. It can open a coach account “in their place”, without being able to write any message in it, and each opening is logged.
• The service providers below, each for its own task only.

• Vercel (United States), hosting of the website, run in Frankfurt (Germany), file storage (including private storage for photos, videos and attachments) and anonymous audience measurement.
• Contabo (Germany), a server in Germany that hosts the database.
• Stripe (Ireland), payments from clients to coaches and coach subscriptions. Stripe is also responsible for its own processing (identity verification, fraud prevention).
• Apple, Sign in with Apple, notifications on iPhone and in-app purchases.
• Google, Sign in with Google, and notifications on Android (Firebase).
• Resend (United States), sending emails (confirmations, reminders, codes).
• Upstash, attempt limits against abuse (IP address or email, kept for 24 hours at most).
• Pusher, live updates of the schedule. It only carries a signal, no personal data.
• Cloudflare (Turnstile), anti-bot check on forms.
• Open Food Facts, the details of a product scanned by its barcode. Only the barcode is sent.
• Anthropic (United States, Claude) and OpenAI (United States, ChatGPT), only for a coach who connects the optional AI assistant with THEIR own key, after giving their consent, and only when they ask for it. What is then sent is their instructions and their texts, their schedule (slots, appointments, classes, places, services and templates, with each client replaced by a reference), the names of the exercises, a coached client's programme and training performance without the client's name or contact details and, only if that client has agreed on their side, their weight, measurements, nutrition and check-ins. Never sent are the client's name, email, phone number or photo, or your messages. The assistant does nothing on its own: it suggests, the coach approves. The coach's key stays encrypted on the REPS server. REPS keeps the coach's conversations with their assistant in their account until they delete them, plus counters (number of requests and of tokens).

Some of these providers are American. When data leaves the European Union, the transfer is covered by the safeguards provided for by the GDPR (standard contractual clauses of the European Commission or the EU-US Data Privacy Framework).

• Your account, as long as you use it.
• An account that was never verified, deleted after 7 days.
• A deleted account, coach or client, deactivated right away and erased 30 days after the request.
• During those 30 days, only REPS can restore the account, if you ask us. After that, nothing can be recovered.
• Coaching videos, 28 days.
• Invoices and credit notes, 10 years, as the law requires for accounting documents.
• Connected devices, until the end of the session (30 days at most) or until you sign out.
• Your measurements and photos, as long as you keep them. You delete them whenever you want.
• Reports, 1 year after they are handled. A block, until you unblock.

The sessions, payments and classes of a deleted account remain in the other person's history, but with nothing left that identifies you (see the next article).

Download my data. From your settings, you get everything REPS keeps on your account, in a JSON file. Your photos, videos and attachments are included as links valid for 15 minutes. No secrets are included (passwords, tokens, keys).

My devices. You see each device connected to your account and you can sign them all out at once.

Deleting your client account. From your area, by confirming that it's really you (password, Face ID in the app, or a code received by email if you sign in with Google or Apple). Your upcoming sessions are cancelled as if you cancelled them yourself (more than 24 h before, refunded minus payment fees; less than 24 h before, your coach keeps 30%, €30 at most). Your account is deactivated right away, then erased 30 days later.

• We erase your account, your measurements, photos, videos, meals, check-ins, habits, completed workouts, training plans, messages and attachments, as well as your images.
• We anonymise your past sessions and enrolments, which are also your coach's records, and your reviews, signed “Former client”.
• We keep the invoices your coach issued to you, as the law requires them to.

Closing your coach account. Your account is deactivated right away, your subscription stops with no refund, your upcoming sessions are cancelled and refunded in full to your clients, who are told. Their coaching packages and packs stop, with nothing refunded pro rata. It is erased 30 days later. Until then, you can ask us to restore it.

• We erase your page, your slots, services, locations, video call links, template weeks, notes on your clients, reviews received, devices, connected calendar and images.
• We anonymise your account itself, then the sessions, payments, coaching and messages, which also belong to your clients.
• We keep your invoices, as the law requires.

The GDPR gives you the right:

• to access your data and get a copy of it;
• to have it corrected;
• to have it erased;
• to object to processing or ask for it to be restricted;
• to get it back in a machine-readable format;
• to withdraw your consent at any time;
• to say what happens to your data after your death.

Most of these you can do yourself from your settings. For the rest, write to contact.reps.coaching@gmail.com. We reply within one month at most. If you are not satisfied with the reply, you can lodge a complaint with the CNIL (the French data protection authority).

• All connections are encrypted (HTTPS).
• Your session is held in a protected cookie (HttpOnly, Secure, SameSite), which a third-party page cannot read.
• Each session is recorded and checked, and you can end it from “My devices”.
• Sensitive files are kept in private storage, served only after a check.
• Public forms are protected against bots and rapid-fire attempts.

In the event of a data breach that presents a risk to you, REPS notifies the CNIL within 72 hours and informs you without delay if the risk is high, explaining what happened and what was done. To report a security flaw, write to us, it is handled as a priority.

The REPS app only uses your phone's features with your consent.

• Notifications, for a booking, a cancellation or a message. The text of a message never appears in them, only “New message from…”.
• Calendar, only when you add a session yourself. REPS reads nothing else there.
• Camera and photos, only for the photo or video you choose to send.
• Face ID, to lock the app or confirm an important action. The check stays on your phone, REPS never receives your face.

No advertising tracking and no third-party tracking tool in the app. You can remove each permission in your phone's settings.

REPS gives you a private address to see your schedule in Google Calendar, Apple Calendar or Outlook. It shows your sessions with your clients' names, so keep it to yourself. The other way round, if you connect your personal calendar, REPS only keeps the times you are busy, never the title or the content of your appointments.

REPS only uses cookies that are necessary for the service or for anonymous audience measurement, so no banner asks for your consent.

• the session cookie, which keeps you signed in (30 days at most);
• temporary cookies during a sign-in with Google or Apple (a few minutes);
• a marker when you click to create your account from the home page, which only records the part of the page you came from and your screen type (1 hour);
• cookies reserved for the REPS team when it opens an account to help;
• the language cookie (reps_locale), which remembers the language you chose so that REPS is shown to you in it (1 year). It is a preference cookie, needed for the site to work, which does not require your consent.

A few preferences (a chosen tab, a collapsed block) stay in your browser and are never sent to us. On the home page, your browser also remembers the day of your visit and the parts already viewed, so that you are counted only once a day. No advertising cookies, no tracking tools (no Google Analytics, no Meta pixel). Vercel's audience measurement works without cookies.

If its substance changes, the new version is shown to you the next time you sign in, with a summary of what changes. The date of the last update is at the top of this page.