Data processing agreement

1. Subject matter and duration

We process personal data to provide Conquest to the Coach, for as long as the Coach uses the service and until the data is deleted or returned under section 9.

2. What is processed

• Data subjects: the Coach's clients, and the Coach's owners, coaches and assistants.
• Personal data: names, email addresses, time zones, intake answers, goals, programmes and training logs, daily logs, check-ins, messages, coach notes, dietary preferences and allergies, and figures and workouts imported from Apple Health.
• Apple Health: the iPhone app reads figures and workouts (type, start and end times, distance, energy, average and maximum heart rate, and the app that recorded them) from Apple Health, and writes finished sessions to it as strength workouts, only with the permissions the client grants in iOS.
• Further Apple Health categories: resting heart rate and heart rate variability, sleep stages, body fat, lean body mass and waist measurement, cardio fitness (VO2 max), exercise minutes, stand hours, distance and flights climbed, mindful minutes, caffeine, sugar, sodium and saturated fat intake, blood pressure and blood glucose. From these the service shows a Recovery rating. It does not read cycle tracking, clinical records, medications or ECG data.
• Special category data: health data, such as weight, sleep, heart rate, blood pressure, blood glucose, injuries, food intake and answers to the pre-exercise health questionnaire.
• Purpose and nature: storing, displaying, organising and sending this data so the Coach can coach their clients through the service.

3. Our obligations

We will:

• process the data only on the Coach's documented instructions, which are these terms, this DPA and the Coach's use of the service, unless the law requires otherwise, in which case we will tell the Coach first unless the law forbids it;
• make sure everyone who can access the data is bound by confidentiality;
• keep the data secure under section 5;
• help the Coach answer requests from data subjects and meet its obligations on security, breach notification, impact assessments and consultation with regulators, taking into account what we can reasonably do;
• make available the information needed to show we comply with this DPA, and allow reasonable audits on 30 days' notice, no more than once a year unless a regulator requires it or there has been a breach;
• tell the Coach straight away if we believe an instruction breaks data protection law.

4. The Coach's obligations

The Coach is responsible for having a lawful basis for the data it puts into the service, including explicit consent from clients for health data where needed, for giving clients a privacy notice, and for the accuracy of the data it enters.

5. Security

We keep appropriate technical and organisational measures in place, including:

• encryption of data in transit;
• passwords stored only as hashes, and sign-in tokens and email links stored only as hashes;
• separation of each coaching business's data, and access within a business limited by role;
• restricted access to production systems, and an audit log of administrative actions;
• rate limiting and monitoring to protect against abuse.

6. Sub-processors

The Coach gives general authorisation for us to use sub-processors. We currently use:

• Railway, for application hosting and the database;
• Cloudflare (R2), for organisation logo uploads and database backups;
• Resend, for sending email;
• Apple, for Sign in with Apple and push notifications;
• Google (Gemini API), for generating meal ideas, which receives dietary preferences, allergies and targets but no names or contact details.

We will give at least 30 days' notice by email before adding or replacing a sub-processor, during which the Coach may object on reasonable data protection grounds. If we cannot address the objection, the Coach may end its use of the service. Each sub-processor is bound by data protection terms no less protective than this DPA, and we remain responsible for them.

7. International transfers

We will only transfer the data outside the UK, or the EEA where the EU GDPR applies, with appropriate safeguards in place, such as adequacy regulations or the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

8. Personal data breaches

We will tell the Coach without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting its data, with the information we have about what happened, what data and how many people are affected, its likely consequences, and what we are doing about it. We will update the Coach as we learn more.

9. Deletion and return

When the Coach stops using the service, we will, at its choice, return its data in a commonly used format or delete it within 30 days, unless the law requires us to keep it. Data in backups is overwritten as those backups roll over.

10. Liability and precedence

Each party's liability under this DPA is subject to the limits in the terms, except where the law does not allow them to apply. If this DPA and the terms conflict about personal data, this DPA wins.

This DPA is governed by the law of England and Wales. To ask for a signed copy, write to [email protected].