Privacy Policy — MJ Coaching

Last updated: 12/7/26

Who we are (controller)

The data controller is MJCoaching, registered in Ajman Free Zone, UAE, contactable at michaelpcj.pt@gmail.com.

What we collect

•Account details — name, email address, date of birth, and (optionally) a profile photo.

•Health & fitness data you enter — workouts and sets, bodyweight, body measurements, progress photos, nutrition/food logs, supplements, daily habits (steps, water, sleep), check-in questionnaires, goals, tasks, and notes.

•Apple Health / Health Connect data (only with your permission) — steps, bodyweight, and heart-rate metrics (incl. resting HR / HRV) read from Apple Health (iOS) or Health Connect (Android); workouts and bodyweight you choose to write back. Used only inside the app; never sold.

•Push notification token — to send reminders and coach messages.

•Technical data — timezone, last-active timestamp, and basic security data.

Much of the above is special-category / sensitive personal data (data concerning health). We treat it accordingly — see Legal basis below.

We do not use third-party advertising or analytics/tracking SDKs, and we do not track you across other apps or websites.

Legal basis for processing (UK/EU GDPR + UAE PDPL)

•To deliver the coaching contract (UK/EU GDPR Art.6(1)(b)) — running your account, programmes, tracking, and reminders.

•Your explicit consent for health data (UK/EU GDPR Art.9(2)(a); UAE PDPL consent for sensitive personal data) — we process the health & fitness data above only with your explicit consent, which we ask for at onboarding (see the in-app health-data consent, health-data-consent.md). You can withdraw this consent at any time by contacting us or deleting your account; withdrawal doesn't affect processing already carried out.

•Legitimate interests (Art.6(1)(f)) — keeping the service secure and preventing abuse, balanced against your rights.

We do not sell your personal data and do not use it for automated decisions that produce legal or similarly significant effects.

AI-assisted coaching insights

To help your coach, the app can generate a short written "coaching read" of your recent progress. For this, a limited, minimised set of data — your first name and numeric activity signals (e.g. a health score and counts such as "3 of 14 days logged") — is sent to our AI provider Anthropic (Claude) to produce that summary, which is shown only to your coach. No progress photos, free-text notes, contact details, or raw health records are sent.## Food search When you search foods, your query is sent to FatSecret (our nutrition data provider), with USDA FoodData Central and Open Food Facts as fallbacks, to return results. These queries are not linked to your identity. Nutrition data is "Powered by FatSecret."

Service providers (processors)

We use trusted providers to run the app; each processes data on our behalf under their own security and data-protection commitments:

•Supabase — database, authentication and file storage (your data lives here, hosted in the EU (Ireland)).

•Expo — push-notification delivery.

•FatSecret — food/nutrition search.

•Anthropic — AI coaching-summary generation (see above).

•Resend — sending coach/administrative emails.

•Vercel — hosting the coach web dashboard.

Payments for coaching are arranged and handled outside the app — we do not collect or store card details in the app.

International transfers

Your core data is stored in the EU (Ireland). Some processing happens outside your country, including in the United States (e.g. Anthropic, Resend, Vercel, FatSecret). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses / the UK International Data Transfer Agreement or an adequacy decision.## Storage & security Data is stored with row-level access controls so only you and your coach can access your information. Access is authenticated, coach sign-in is protected by two-factor authentication, and data is encrypted in transit. Progress photos and check-in media are kept in private storage served via short-lived, per-user signed links.

Data retention & deletion

We keep your data while your account is active. You can request deletion at any time from Profile → Delete account. Deletion is coach-reviewed and then permanent: after a short grace period (currently 30 days), your account and associated data (workouts, logs, photos, measurements, etc.) are permanently removed, including from storage.## Your rights Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to processing, and to withdraw consent for health-data processing. To exercise these, email michaelpcj.pt@gmail.com; you can also delete everything yourself in-app. You may complain to your data-protection authority (in the UK, the ICO).

Children & under-18s

The app is intended for adults. It is not intended for children under 16. If you are under 16, you may only use the app with verifiable parent/guardian consent, and a parent/guardian must accept the Terms on your behalf. We do not knowingly collect data from children under 16 without that consent.## Changes We may update this policy; material changes are reflected by the "last updated" date and, where appropriate, notified in-app.

Contact

michaelpcj.pt@gmail.com · MJCoaching