Privacy policy

1. Who we are

Coach SA ("we", "us") is an app for personal trainers and their clients, with a free food diary for anyone.

If you're a trainer's client: your trainer decides what information to keep about you and why, so under POPIA your trainer is the responsible party for your client record. We store and process it for them as their operator, only to run the app, and we keep it confidential and secure. For your own food diary account, and for trainer accounts, we are the responsible party.

2. What we collect

Trainers

• Name, email address and password (stored scrambled, never readable).
• If you sign in with Google: your Google name, email address and profile photo. We never see your Google password.
• Business name, WhatsApp number, area and short bio if you choose to be listed.
• Bank details for EFT and your Yoco payment link, so clients can pay you.
• Your plan and billing history.

Clients (added by your trainer)

• Name and WhatsApp number.
• Session packs, sessions used, late cancellations, bookings and payments.
• A private link to your page. Anyone with the link can open it, so don't share it.

Health information (only with your consent)

• Workouts you log, weights and reps, effort and notes.
• Body weight, measurements and body-fat percentage.
• Your food diary and nutrition targets.
• Challenge check-ins.
• Progress photos. They're stored privately (resized, with location and camera details removed) and only your trainer can see them, and only if you switch photo sharing on.

Food diary users

• Name, email, password, goal and calorie target, food diary and measurements.

Technical information

• A sign-in cookie to keep you logged in, and basic server logs to keep the service secure and working.
• If you turn on reminders, a notification address for your phone or browser, so we can send session reminders and nudges. Turn them off any time and it's deleted.
• Small settings saved on your device (for example, that you've dismissed a tip, or the invite code you signed up with).
• Our hosting provider records basic, anonymous visit statistics (such as country and browser type) to run its platform. We don't use advertising cookies and don't sell or share data for advertising.

3. Why we use it

• To run the app: client records, programmes, bookings, session balances and payment requests.
• To show your progress, streaks and challenges.
• To keep accounts secure and fix problems.
• To bill trainers and paid food diary plans, when payments are switched on.

We rely on: carrying out our agreement with you (running the service you signed up for), your consent (for health information), and our legitimate interest in keeping the service safe. We don't use your information for anything unrelated without asking you first.

4. Health information

Health information is "special personal information" under POPIA, so we only store it after you agree on your page. Workouts you log are shared with your trainer, because they set your programme. Measurements and your food diary stay private unless you switch on sharing. You can switch sharing off, or stop tracking completely, at any time. Stopping deletes your workouts, measurements and food diary.

5. Who we share it with

• Your trainer, as described above.
• Service providers that host the app and its database, and process data only on our instructions.
• Meal photos: if you use photo logging, the photo is sent to a food recognition service through our hosting provider to estimate the food in it. We don't store the photo.
• Meal plan questionnaire: if you fill it in, your answers (goal, age, height, weight, daily routine, food preferences and the health questions) are stored so we can work out your targets, and a summary is sent to a meal-planning service through our hosting provider to write your meal plan. If you're a trainer's client, your trainer can see your answers and plan. Stopping food tracking or deleting your account deletes them.
• Messages: chats between a trainer and their client are stored so both can see the conversation, and are sent as phone notifications if notifications are on. Only that trainer and that client can read them. Deleting the client from the trainer's account deletes the chat.
• Weekly check-ins: your answers (tiredness, hunger, sleep, stress, training, things that affect water weight and any warning signs you tick) are stored with the result, so your targets can be adjusted safely. The calculation runs on our own fixed rules. If you're a trainer's client, your trainer sees them and approves any change. Stopping food tracking or deleting your account deletes them.
• Barcode scans: only the barcode number is looked up in Open Food Facts, a public food database.
• Payment providers (such as Yoco or a card processor) when you pay. We never see or store full card numbers.
• WhatsApp: messages are sent by your trainer from their own phone. We don't send them for you.
• When the law requires it.

We never sell personal information.

6. Information stored outside South Africa

Our hosting and processing providers may store or process information on servers outside South Africa. We only use providers that are bound to protect it to a standard at least as strong as POPIA requires (section 72).

7. How long we keep it

We keep information while your account or client record is active. Trainers can delete a client at any time, which removes their whole record straight away. Clients can delete their health data from their page at any time. To close a trainer or food diary account, contact us and we'll delete it within 30 days, except where the law requires records to be kept (for example, financial records for tax). Backups are overwritten on a rolling basis.

8. Keeping it safe

Everything travels over encrypted connections. Passwords are stored scrambled. Client pages use long, random private links, and trainers only see their own clients. If a security breach puts your information at risk, we will tell you and the Information Regulator as POPIA requires.

9. Your rights

You can ask to:

• see the information we hold about you;
• correct or delete it;
• object to how it's used, or withdraw your consent;
• know who it has been shared with.

Clients: ask your trainer first, since they manage your record, or contact us. You can delete your own health data from your page at any time.

If you're unhappy with how we handle your information, you can complain to the Information Regulator: inforegulator.org.za, enquiries@inforegulator.org.za.

10. Children

Coach SA isn't meant for anyone under 18 without a parent or guardian's consent. Trainers who coach minors must get a parent or guardian's consent before adding them, and the parent or guardian should give the consents on the client page.

11. Changes

If we make important changes to this policy, we'll show a notice in the app before they apply.

12. Contact us

Information Officer: Coach SA. For privacy questions or requests, contact officialcoachingsa@gmail.com.