Last updated October 23, 2026
Privacy Policy
2Workout handles training and health information, so we keep this policy plain: what we collect, why, who can see it and how you control it.
1. Who we are
The 2Workout app and website (the “Service”) are operated by [Legal entity name], [Registered address] (“2Workout”, “we”, “us”). We are the controller of the personal data described in this policy. You can reach us at privacy@2workout.app.
2Workout connects personal trainers (“Trainers”) with the people they coach (“Clients”). Trainers are independent professionals, not our employees. When a Trainer uses 2Workout to manage their own clients, the Trainer is responsible for their own coaching decisions and for any data they keep outside the Service.
2. The data we collect
Data you give us
- Account data: name, email address, password (stored only as a secure hash), role (Trainer or Client), language and unit preferences, profile photo.
- Client profile: date of birth or age, sex, height, goals, training level, availability and an emergency contact you choose to add.
- Health and fitness data: body measurements (such as weight, body fat and waist), body mass index (BMI), injuries, health notes, pain or effort you report after a session, logged workouts, habits and nutrition plans. This is “special category” or “sensitive” data in many laws, and we treat it that way (see section 4).
- Trainer profile: headline, about text, specialties, certifications, gyms, languages, social links, introduction video and exercise videos you upload.
- Content you create: plans, workouts, exercises, notes, messages and questions you ask the AI coach.
- Support and communications: what you send us when you write to us.
Data collected automatically
- Technical data: device type, operating system, app version, IP address, time zone and server logs needed to run, secure and debug the Service.
- Sign-in tokens stored securely on your device so you stay signed in (see the Cookie Policy).
We do not use advertising trackers, we do not sell personal data and we do not share it for cross-context behavioural advertising.
3. Why we use it, and our legal bases
| Purpose | Legal basis (EU/UK GDPR and similar laws) |
|---|---|
| Create and run your account; connect Trainers and Clients; share plans; log sessions and progress | Performance of our contract with you (the Terms of Use) |
| Store and show health and fitness data to you and to the Trainers you choose | Your explicit consent, which you can withdraw at any time |
| AI coach answers for Trainers about their own clients | Contract with the Trainer, and the Client's explicit consent for their health data |
| Security, fraud and abuse prevention, debugging, service improvement with aggregated data | Our legitimate interests in a safe, working Service |
| Service emails (verification, password reset, invitations, important changes) | Performance of contract |
| Billing, tax and accounting records for paid subscriptions; answering legal requests | Legal obligation |
4. Health data and consent
We only process your health and fitness data with your explicit consent, given in the app when you add it. You can withdraw consent at any time by deleting that data or your account, or by writing to us. Withdrawing does not affect processing that happened before. Some features (for example, sharing measurements with your Trainer) cannot work without this data.
5. Who can see your data
- Your Trainers: a Trainer sees a Client's profile, measurements, plans and logged sessions only while the coaching relationship is active. Either side can end it at any time, and the Trainer's access ends immediately.
- Other Trainers: never see another Trainer's private notes or plans. A Client with several Trainers decides which plans to follow; each Trainer sees only their own.
- The public: a Trainer's public profile (headline, about, specialties, certifications, gyms, languages, social links and introduction video) is visible to anyone so prospective clients can choose. Client data is never public.
- Service providers who process data on our behalf, under contracts that limit their use of it (section 6).
- Authorities when the law requires it, or to protect someone's safety, and a buyer or successor if 2Workout is involved in a merger or acquisition (we will tell you first).
6. Service providers
| Provider | What they do | Data involved |
|---|---|---|
| MongoDB Atlas (MongoDB, Inc.) | Database hosting | All account and app data |
| Cloud file storage (Amazon Web Services or an S3-compatible provider) | Photos and videos you upload | Profile photos, introduction and exercise videos |
| Anthropic, PBC | Generates the AI coach's answers | The Trainer's question and the relevant data of that Trainer's own clients |
| Resend | Sends service emails | Name, email address, email content |
| Apple App Store, Google Play and/or our payment processor | Subscription payments | Purchase records. We never see your full card number. |
| ExerciseDB by AscendAPI | Exercise catalogue content | None: we only fetch exercises from it |
About the AI coach. When a Trainer asks a question, we send the question and only the data needed to answer it to our AI provider. Under its commercial terms the provider processes it to return the answer and does not use it to train its models. Answers are generated automatically, may contain mistakes and are not medical advice. No decision with legal or similarly significant effect is made about anyone solely by automated means.
7. International transfers
Our providers may process data outside your country, including in the United States. Where the law requires it, we rely on adequacy decisions or Standard Contractual Clauses (and the UK Addendum) and additional safeguards.
8. How long we keep it
- Account and app data: while your account is open.
- After you delete your account: removed from active systems within 30 days and from backups within 90 days, except what we must keep by law (for example billing records, usually for up to the period tax law requires).
- Server logs: up to 90 days, unless needed to investigate a security incident.
- AI coach conversations: until the Trainer deletes them or closes their account.
9. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy in a portable format;
- correct inaccurate data;
- delete your data and account;
- restrict or object to some processing, including processing based on legitimate interests;
- withdraw consent at any time;
- not be discriminated against for exercising your rights;
- complain to your data protection authority.
Most of this you can do in the app (edit your profile, delete measurements, end a coaching relationship, delete your account). For anything else write to privacy@2workout.app. We answer within 30 days and may need to verify your identity. See also how to delete your account.
California residents: we collect the categories listed in section 2 (identifiers, personal records, sensitive personal information about health, internet activity and inferences limited to your training progress) for the purposes in section 3. We do not sell or share personal information and we use sensitive personal information only to provide the Service. Brazil (LGPD), Mexico, Argentina and other countries: you have the equivalent rights of access, correction, deletion, portability and to revoke consent, exercised the same way.
10. Security
We encrypt data in transit (HTTPS/TLS), hash passwords, use rotating sign-in tokens, keep data encrypted at rest at our hosting providers and limit staff access to what is needed. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.
11. Children
2Workout is not intended for anyone under 16. We do not knowingly collect data from children under that age. If you believe a child has created an account, contact us and we will delete it.
12. Changes
We will post any update here with a new date. If a change is significant we will tell you in the app or by email before it takes effect.
13. Contact
[Legal entity name], [Registered address]. Email: privacy@2workout.app.