Data Processing Agreement (DPA)
As a coach, you are the controller of your clients’ data; we are your processor: we process it only on your instructions and to provide the service, with confidentiality, security measures, listed subprocessors and breach notice. You warrant that you have a legal basis (consent) to process your clients’ health data.
1. Parties and purpose
This Agreement is entered into between the coach who accepts the Terms of Service (the “Controller”) and Digital Motion Labs, LLC (the “Processor”), and forms part of the Terms. It governs the processing of the coach’s clients’ personal data that the Processor performs on the Controller’s behalf when providing trainer.do, under Dominican Law 172-13 and, where applicable, the General Data Protection Regulation (GDPR, art. 28) and other privacy laws.
2. Details of the processing
- Data subjects: the coach’s clients (current and former) and people the coach invites by email (whose invitation data is erased upon acceptance or shortly after expiry). The coach does not create accounts: each person creates their own when accepting.
- Data categories: identity and contact; health data (questionnaire, allergies, injuries, conditions, medications, measurements, skinfolds, weight, progress photos, assessments, medical documents); nutrition, workouts, habits and wearables; chat, appointments, payments, orders and community.
- Purpose: provide the contracted service (store, organize, display, communicate, notify, back up and, with consent, analyze with AI). Nothing else.
- Duration: for the term of the subscription and until the data is returned or deleted under clause 9.
3. Processor obligations
- Process the data only on the Controller’s documented instructions (these Terms, the DPA and the settings the coach makes in the app), unless legally required, in which case it will inform the Controller if the law allows.
- Not use the data for its own purposes, not sell it and not use it for advertising.
- Ensure that persons authorized to process it are bound by confidentiality.
- Apply appropriate technical and organizational measures (clause 5).
- Reasonably assist the Controller in responding to data subject requests (the app allows exporting and deleting accounts) and with impact assessments or consultations with authorities.
- Notify the Controller without undue delay (aiming to do so within 72 hours of becoming aware) of any security breach affecting its data, with the information available.
- Make available the information necessary to demonstrate compliance with this Agreement and allow reasonable audits, with 30 days’ notice, at the Controller’s expense, at most once a year, except after a breach or at an authority’s request.
4. Controller (coach) obligations
- Have a legal basis for each processing and, for health data, the explicit consent of each client (the app collects it in the health questionnaire; if you enter data yourself, you are responsible for having obtained it).
- Inform your clients about the processing (you may refer them to our Privacy Policy) and handle their rights.
- Upload only data that is necessary, accurate and that you have the right to process; not upload data of minors under 18.
- Protect access to your account and to any data you download or export outside the app.
5. Security measures
- Encryption in transit (HTTPS/TLS) on every connection.
- Passwordless sign-in with one-time codes and attempt limits; revocable sessions.
- Logical isolation of each coach’s data and role-based access control.
- Files in private storage (Cloudflare R2) accessible only via temporary signed links; according to the provider, R2 encrypts data at rest.
- Encrypted integration credentials; audit log of relevant changes.
- Processor staff access limited to what is necessary for support and operations.
6. Subprocessors
The Controller grants general authorization for the subprocessors listed in Subprocessors. The Processor will contractually impose equivalent data protection obligations on them and remain liable for them. It will give notice of any addition or replacement by publishing the updated list (new version) and notifying in the app at least 15 days in advance; the Controller may object on reasonable grounds and, if no solution is found, cancel without penalty.
7. International transfers
The Processor is organized in the United States and some subprocessors process data outside the Dominican Republic. The Controller authorizes those transfers. The Processor carries them out with adequate safeguards (providers’ contractual commitments, including Standard Contractual Clauses where applicable) and the Privacy Policy informs clients about them and collects their express consent.
8. Clients without a coach and Processor’s own data
Users who use the app without a coach, sign-in and security data, and evidence of acceptance of documents are processed by the operator as controller, not as processor.
9. End of processing
When the subscription ends, the coach account is deactivated without deleting data, to allow reactivation. The Controller may at any time request export of its data and, afterwards, permanent deletion; the Processor will complete it within a reasonable period (at most 90 days), except what it must keep by law and backups, which are deleted in their normal cycle. Each client keeps their own account and rights.
10. Liability and precedence
Each party’s liability under this Agreement is subject to the limitations in the Terms of Service, except what the law does not allow to be limited. In case of conflict on data protection matters, this Agreement prevails.
Who operates the service
Address: 1111B South Governors Avenue, STE 40566, Dover, DE 19904, United States
Contact: [email protected]