Privacy Policy

This is an English translation of the Portuguese Política de Privacidade, provided for convenience. The Portuguese version is the legally binding one and prevails in case of any conflict or difference in interpretation.

1. Who we are and who decides about your data

Personal X is an app of PERSONAL X LTDA, CNPJ 70.038.004/0001-44, managed by Matheus. For any question about your data, contact us at matheus.seupersonal@gmail.com.

The app is used by personal trainers to serve their own clients (students). For that reason, there are two roles:

• Student data (profile, workouts, assessments, photos, attendance and payments): whoever decides what to collect and for what purpose is the personal trainer who serves the student — the trainer is the controller. Personal X is the processor: it stores and processes this data on the trainer's behalf, only so that the app works.
• Trainer account data (sign-up and app subscription) and app usage data (section 2.3): the controller is Personal X.

If you are a student, you can exercise your rights with your trainer or directly with us — we forward and handle the request.

2. What data we process

• Name, email, phone number and the other sign-up data that the trainer or you fill in;
• CPF (Brazilian taxpayer ID), when there is automatic billing — a requirement of the payment provider;
• Workout data: training plans, loads, repetitions, attendance, schedule and make-up sessions;
• Financial data of the service: amounts, due dates and status of monthly fees;
• Health data (see section 2.1): physical assessments (weight, measurements, skinfolds, bioimpedance, body fat percentage), body progress photos and data coming from a watch or from health apps;
• App usage data and error logs (see section 2.3).

2.1 Health data (sensitive data)

The LGPD treats health data as sensitive data. It is used only for your trainer to follow your training, and with specific consent:

• Physical assessments: performed and recorded by your trainer, who must have your consent to do so. You accept this policy when you enter the app;
• Progress photos: the app asks for a separate consent before the first photo. You can delete your photos at any time under Privacy, inside the photos;
• Watch and health apps: only if you connect them (section 2.2).

2.2 Watch and health apps (Apple Health, Health Connect and Garmin Connect™)

If you connect a watch or health app under Watch & apps, Personal X may:

• Read the workouts you have finished (running, cycling, walking and strength training): date, duration, distance, pace and speed, heart rate, calories, cadence, power, elevation, laps/steps and the device model;
• Read the route (GPS location) of the workout, only if you allow it;
• Send to your watch the workouts your trainer has created and, if you authorize it, save your workouts to Apple Health.

The sources are Apple Health (HealthKit) on iPhone, Health Connect on Android — which gathers data from apps such as Samsung Health, Fitbit and Garmin Connect — and, when available, your Garmin Connect™ account. Each connection asks for your consent first and can be turned off at any time in the app (Profile › Watch & apps) or in the device's own settings.

This data is used only to show the results of your workouts to you and to your own trainer (summary, charts, zones, splits, planned vs. completed and route map) and to calculate training load. It is not sold, not used for advertising and not shared with other trainers or third parties. Apple Health and Health Connect data is read on your phone, and only finished workouts are sent to Personal X.

2.3 Usage and error data

To know which screens and features are used and to fix failures, the app records usage events (screens opened, buttons tapped, workout completed) and error reports (device model, operating system and app version), linked to an internal code of your account. These records do not include the content of your workouts, assessments or photos.

2.4 Garmin Connect™ data

If you connect your Garmin Connect™ account, the data we receive from Garmin (the workouts described in section 2.2) follows these rules:

• How we use it: only to show your workouts to you and to your own trainer, to calculate your training load and to send to your watch the workouts your trainer has created. There is no other use;
• Who processes it: only Google (Firebase and Google Cloud), our hosting provider, which stores and processes it on our behalf — the database and server functions in Brazil (São Paulo) and the workout files (the original file, the route and the data series, such as heart rate and pace) on Google Cloud, in the United States. No other vendor, integration partner or data processing service receives Garmin data. The notice telling your trainer that you finished a workout is generic (“Name completed a workout.”) and carries no Garmin data;
• Sale and sharing: Garmin data is not sold, is not shared with third parties or with other trainers, and is not used for advertising, nor in the usage statistics and error reports of section 2.3;
• Artificial intelligence: Garmin data is not sent to any artificial intelligence service — including the Google Vertex AI (Gemini) mentioned in sections 3 and 5 — and is not used to train AI models, ours or anyone else's. If this ever changes, it will only happen after we clearly inform you and you give specific consent, which you may withdraw at any time;
• How long: the original file of each workout received from Garmin is deleted within 90 days; the workout itself stays in your history until you delete it (when disconnecting or deleting your account) or request its deletion (section 10);
• Your controls: you can see your workouts in the app and request access, correction, a copy (portability) or deletion via the email in section 1. You can also withdraw your consent at any time: by disconnecting under Profile › Watch & apps — which revokes our access at Garmin, deletes our access keys and removes from your Garmin calendar the not-yet-completed workouts we sent, and lets you choose to keep your history or immediately delete everything that came from Garmin — or by removing Personal X from the connected apps in your Garmin Connect™ account.

3. What we use it for

• To build and follow up on your workouts and record your progress;
• To organize schedule, attendance, make-up sessions and monthly fees between you and your trainer;
• To send app notifications (today's workout, make-up session, billing);
• Artificial intelligence features: checking whether a progress photo is good enough for comparison (dark, too far, cropped) before it is sent — the image is not stored by the AI — and generating supporting texts for the trainer, such as the student's monthly report, from workout and assessment data. Data received from Garmin is not used in any artificial intelligence feature (section 2.4);
• To improve the app and fix errors (section 2.3).

We do not sell your data and do not use it for advertising.

4. Legal basis

• Performance of the contract between you and your trainer, and of the app's terms of use contract (art. 7, V);
• Your consent (art. 7, I);
• Compliance with a legal obligation, for payment records (art. 7, II);
• Legitimate interest, for security, fraud prevention and app usage and error data (art. 7, IX);
• Health data: specific and highlighted consent (art. 11, I) and, where applicable, compliance with a legal obligation (art. 11, II, “a”).

5. Who we share it with

Only with the vendors essential for the app to work, which process the data on our behalf:

• Google (Firebase and Google Cloud) — database, login, file storage, server functions, usage statistics (Google Analytics for Firebase) and error reports (Crashlytics);
• Google Vertex AI (Gemini) — the artificial intelligence features of section 3, processed in Brazil (São Paulo). Google does not use this data to train its models. Garmin data is not sent to this service (section 2.4);
• Asaas — payment processing (your card details go directly to Asaas, which is PCI-DSS certified, and are never stored in our app);
• Expo — delivery of notifications to your phone (it receives the short notification text);
• Garmin — only if you connect your Garmin Connect™ account: we receive your workouts from Garmin and send it your trainer's workouts (section 2.4).

Each trainer only has access to the data of their own students. We may also provide data when required by law or by a competent authority.

6. Where the data is stored

The database and the server functions are in Brazil (São Paulo). Some data is stored or processed outside Brazil: photos and watch activity files (Google Cloud, in the United States), usage statistics and error reports (Google), notifications (Expo, United States) and, if you connect it, Garmin data (section 2.4). This transfer is made with vendors that adopt data protection standards compatible with the LGPD, as provided in its art. 33.

7. Security

Data travels encrypted (HTTPS) and is stored encrypted on Google's infrastructure. Access is restricted by rules that isolate the data of each trainer and each student. No system is completely immune to failures: if there is an incident that may cause significant risk or harm, we will notify the affected people and the Brazilian National Data Protection Authority (ANPD), as required by law.

8. Children and adolescents

A student under 18 may only be registered by the trainer with the authorization of one of the parents or of the legal guardian, who is the one who consents to this policy on the student's behalf. The parent or guardian may request access to, correction or deletion of the data via the email in section 1. At sign-up, the trainer confirms this authorization when the date of birth indicates the student is under 18, and anyone who creates their own account declares that they are 18 or older or have the guardian's authorization.

9. How long we keep it

• For as long as the account exists, or until you request deletion (section 10);
• Payment records: up to 5 years, due to tax and legal obligations;
• Original workout file received from Garmin: deleted within 90 days (the workout itself stays in your history). When disconnecting a watch or health app, you can choose to keep the history or immediately delete everything that came from it;
• Usage statistics and error reports: for a limited time, according to Google's retention.

10. Your rights and account deletion

You may, at any time, request: confirmation that we process your data, access, correction, anonymization or deletion of what is unnecessary, portability, information about whom we share it with, and withdrawal of consent. We respond via the email in section 1 within 15 days. You may also file a complaint with the ANPD.

For portability, we send you a copy of your data in a structured, commonly used format. The consent given to a watch or health app (section 2.2) can be withdrawn at any time by disconnecting under Profile › Watch & apps; for Garmin, see also section 2.4.

How to delete your account: in the app, open Profile and tap “Delete my account”, at the bottom of the screen. Deletion is immediate:

• Student: deletes your login, your profile, your records with the trainers and everything linked to them: workouts, assessments, progress photos (yours and those taken by the trainer), attendance, load history, runs and rides. Only payment records remain, for the period in section 9;
• Trainer: deletes your account and all the data you registered, including your students' data and the files (photos, receipts and activities).

Payment records may be kept for the period in section 9. You can also request deletion by email at matheus.seupersonal@gmail.com.

11. Changes

This policy may be updated. If there is a significant change, we will notify you in the app and ask for a new acceptance.