Privacy Policy

Version 1.0 · Effective October 29, 2026

The summary is a guide; the full text below is what applies.

1. Who we are and who this applies to

trainer.do is a service operated by Digital Motion Labs, LLC, a limited liability company organized in United States (Delaware) (“trainer.do”, “we”, “us”).

This policy explains how we process the personal data of coaches (fitness and nutrition trainers and professionals who subscribe to trainer.do), of the users or clients who use the app (with or without a coach) and of people who contact us through the website. It applies to the mobile app, the web app, the website and the API pages.

2. Who decides about your data (controller and processor)

• If you are a coach’s client: your coach is the controller of the data you share with them (plan, assessments, measurements, photos, health questionnaire, chat, appointments, payments). Digital Motion Labs, LLC acts as a processor: we process that data on the coach’s behalf and on their instructions, under a Data Processing Agreement. To exercise your rights you can contact your coach or us; if you contact us we will help and coordinate with your coach.
• We are the controller of: coach account data (including their subscription billing), data of users who use the app without a coach, sign-in and security data of every account, the website contact form and the evidence of acceptance of legal documents.

3. Data we process

• Identity and contact: name, email (required, verified with a code), phone (optional: only if you add and verify it in My account), language, time zone and, for coaches, business name, logo and public profile data.
• Coach invitations: the name and email a coach enters to invite you (and, if they provide it in advance, questionnaire data). They are only used to send you the invitation: they are erased when you accept it and, if you do not, shortly after it expires or is revoked. Your account is only created if you accept.
• Access and security: one-time codes (OTP) sent by email or, if you verified your number, via WhatsApp, active sessions, IP address and device/browser type, and audit logs (who changed what and when). We do not use passwords.
• Health data (special category): health questionnaire or “intake” (allergies, intolerances, diet, injuries, medical conditions, medications, date of birth, sex, height), weight, body measurements, skinfolds, assessments, progress photos (may show a shirtless torso), documents you upload (lab results, medical reports, protocols), meal photos and logs, workouts and sets, habits, water and supplements.
• Wearables and phone health (only if you connect them): data from WHOOP, Oura, Health Connect (Android) or Apple Health / HealthKit (iPhone): heart rate, resting heart rate, heart rate variability (HRV), steps, active energy, sleep and sleep stages, recovery and strain, workouts and weight.
• Communications: chat messages with your coach, community posts and comments, appointments, notifications sent and the push-notification token.
• Payments: coach subscription (processed by Stripe: we never see or store the full card number), memberships, payment records and bank-transfer receipts you upload, orders from the coach’s shop and the payment methods a coach sets up so their clients pay them directly (e.g. their bank account; only their clients see them and, summarized and without full numbers, their public page if they turn it on). We do not process payments between coach and client.
• Website contact: name, email, optional phone and message from the form; the IP only as a hashed fingerprint to prevent abuse.
• Legal evidence: which version of each document you accepted, when, in what context, the language, a shortened User-Agent and your IP only as a keyed hash, never in clear text.

4. Health data: explicit consent

Health data is sensitive data. We only process it with your explicit consent, which you give when completing the health questionnaire (a specific box, never pre-ticked) and when connecting a wearable or your phone’s health data. It is seen by your coach (if you have one) and by you. It is never used for advertising, never sold and never shared with insurers or employers.

Progress photos marked “Only me” are not shown to your coach. Files are kept in private storage and opened with temporary signed links.

5. Why we use data and on what legal basis

6. Artificial intelligence

Some features use AI from Anthropic (Claude): analyzing a meal photo to estimate nutrients and reading protocols or plans in PDF. They only run when you ask and give your explicit consent at that moment. Only the photo or PDF and the necessary context are sent. Under the provider’s commercial terms, it does not use this data to train its models. Results are estimates that may be wrong: review them and do not use them for medical or allergy decisions. We do not make decisions with legal or similarly significant effects about you by automated means.

7. Email and WhatsApp messages

We send sign-in codes and service notices by email (Resend), which every account must have, and by WhatsApp (Meta) only if you add your number in My account and verify it with a code. We never message on WhatsApp a number its owner has not verified (including one a coach types in); if you do not want WhatsApp notices, you can remove your number in My account or ask support (sign-in codes are still sent to your email). All our emails are transactional (about your account); we do not send advertising. If we ever did, it would be only with your prior permission and with an unsubscribe link.

8. Who we share data with

• Your coach, if you have one (except what you mark as private).
• Providers (subprocessors) that help us operate: hosting, storage, CDN, server monitoring, payments, email, WhatsApp, AI and wearables. See the full list. They only receive what is necessary and under contract.
• Authorities, only when a law or a valid order requires it.
• A successor, if the company changes its legal form, merges or sells the service; it will remain bound by this policy.
• We do not sell personal data or “share” it for cross-context behavioral advertising (as defined by California’s CCPA/CPRA).

9. International transfers

Digital Motion Labs, LLC is organized in the United States and several providers operate in the United States and other countries. Your data may therefore be processed outside your country (for example, outside the Dominican Republic). By accepting this policy and using the service you expressly consent to that international transfer, as allowed by Dominican Law 172-13. In addition, we only use providers that contractually commit to protecting the data (including, where applicable, the European Commission’s Standard Contractual Clauses or equivalent safeguards) and we apply the security measures in section 11.

10. How long we keep data

• While your account is active.
• Client who deletes their account: it is disabled immediately and personal and health data are purged after 7 days (you can cancel within that period). Only accounting records without health data remain.
• Coach who deactivates their account: nothing is deleted (their data and their clients’ data are kept and the platform admin can restore it). If the coach asks for permanent deletion, we handle it under the DPA.
• Payment and billing records: as long as applicable tax and accounting laws require.
• Contact form messages: up to 365 days.
• Acceptance evidence and audit logs: while the account exists and up to 5 years afterwards, for defense against claims.
• Backups, if any, are deleted in their normal rotation cycle.

11. Security

We apply reasonable measures: encrypted connections (HTTPS/TLS), sign-in with one-time codes, isolation of each coach’s data, role-based permissions, files in private storage with temporary signed links, encrypted integration secrets and an audit log. No system is 100% secure: if a breach affects your data, we will notify you and/or your coach and the authorities where the law requires.

12. Your rights

• Access, rectification, cancellation (erasure) and objection (rights recognized by Dominican Law 172-13 and the Dominican Constitution, which protects privacy and habeas data).
• Portability: “Export my data” in My account.
• Delete your account: from the app or as explained in Delete my account.
• Withdraw your consent at any time (My account → Legal), without affecting prior processing.
• If you are in the EU/EEA or the UK: also restriction of processing and the right to complain to your data protection authority. If you live in California: to know, delete, correct and not be discriminated against for exercising your rights.
• To exercise them contact us at [email protected]. We answer within the deadlines set by applicable law (we aim for no more than 30 days) and may ask you to verify your identity. If your coach controls your data, we will coordinate with them.

13. Minors

The service is only for people 18 or older. We do not knowingly collect data from minors (nor from children under 13 within the meaning of the US COPPA law). If we detect an account belonging to a minor, we will delete it.

14. Cookies and local storage

We do not use advertising or analytics cookies. See the Cookies policy.

15. Changes to this policy

Each version has a number and a date. If a change affects your rights (major version) we will ask you to accept it again when you open the app; minor changes will be notified. Versions and dates are in the Legal center.

Who operates the service

Legal center: all documents and versions