Privacy Policy

Last updated: June 1, 2026

We at Romy Coaching ("we", "us", "our") respect your concerns about privacy.

This Privacy Policy explains how we collect, use, and protect any personal data we obtain about you, and describes your rights in relation to that information. "Personal data" means any information that identifies you as an individual, or that could be used to identify you.

For the purposes of applicable data protection laws, including the General Data Protection Regulation (the "GDPR") and the California Consumer Privacy Act ("CCPA"), the data controller is Romy Coaching, contact email: contact@romy-coaching.com.

1. Information Covered by This Policy

This Privacy Policy covers all personal data collected and used by us. This includes, but is not limited to:

• Your name, age, postal address, email address, and phone number.
• Payment details, including credit card number.
• Preferences you share with us, along with your comments and questions.
• Technical information from the devices you use to access our website or app.
• Information about your body and wellbeing that you choose to share, including height, weight, body statistics, workouts, mood, meals, nutrition, and general health and wellbeing.
• Any photos or media you decide to share with us.

2. Personal Data We Collect

We (and our service providers) collect personal data from you when you:

• Purchase products or services from us, including a coaching subscription or any related program.
• Submit any information through this website.
• Create an account with us or otherwise sign up for our services.
• Opt in to receive marketing from us or our representatives.
• Participate in our customer feedback surveys.
• Communicate with us via third-party social media platforms.
• Contact us, correspond with us, or otherwise provide information to us.

We also work closely with third parties (such as business partners and analytics providers) and may receive personal data about you from those third parties, which we may combine with the information you have already provided. All data obtained from such other sources is processed in accordance with this Privacy Policy.

Automatically Collected Information

When you visit our website or use our app, we (and our service providers) may use cookies and similar technologies to automatically collect the following:

• Technical information, including your IP address, login information, browser type and version, device identifier, location and time zone settings, browser plug-in types and versions, operating system, page response times, and download errors.
• Visit information, including the websites you visit before and after ours, and the products you view or search for.
• Interaction data, including length of visits to certain pages, scrolling, clicks, mouseovers, and methods used to browse away from the page.

In-App Data

Within our app, you may choose to:

• Record a fitness activity, such as a run. You must first allow the app to access your location. The app will then access your location data from the moment you start recording until you stop the recording, including while the app runs in the background. You can revoke this permission at any time in your device settings.
• Import your fitness history from Apple Health or Google Fit. You must first allow the app to access your data from these sources. We will then use the relevant APIs to receive the information. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke this permission at any time in your app settings.

3. How We Use Your Information

We use the personal data we collect from and about you for the following purposes:

• To set up and manage your online account.
• To provide our services to you, which may include:
  • Designing tailored meal and workout plans.
  • Monitoring changes or adaptations in your body to improve your coaching cycle, and combining information we receive (e.g., updates on your body transformation) to give you a more personalized experience and to make informed decisions about future coaching. This also provides vital statistics that help us better understand the efficacy of different approaches to diet and training.
  • Maintaining a history of your fitness activities, including (where available) duration, distance, speed, activity type, heart rate, and an overview of your progress.
  • Providing access to chat functionality, including group chat with other clients, where you may post and communicate.
• To provide you with information about our products and services (provided you have consented or we are otherwise permitted to reach out to you for marketing purposes).
• To process your payments.
• To keep our website safe and secure.
• To maintain an up-to-date suppression list where you have asked not to be contacted, so we do not inadvertently re-contact you.
• To notify you of any changes to our services that may affect you.
• To comply with our legal obligations, including internal (financial) recordkeeping.

Legal Bases (GDPR)

The legal bases on which we collect, use, transfer, or disclose your personal data include:

• The performance of our contract with you (Article 6(1)(b) GDPR).
• Our legitimate interests (Article 6(1)(f) GDPR), including improving our offerings, personalizing our services, and detecting and preventing fraud.
• Compliance with our legal obligations (Article 6(1)(c) GDPR).
• Your consent (Article 6(1)(a) GDPR), where required — for example, for marketing communications.

Photos that you choose to share with us are used solely for tracking your progress and will never be posted on our website or social media without your explicit consent.

4. Consent for Processing Health Data

In order to deliver customized meal and workout plans, we may process certain health data provided by you, including information on allergens, obesity, specific injuries, or other information relevant to your physical or mental health status.

The legal basis for processing your health information is Article 9(2)(a) in conjunction with Article 6(1)(b) of the GDPR, which means we will ask for your explicit consent to process your health data before you become a client. You may also choose to disclose certain information yourself, for example through the group chat; in that case, the legal basis is Article 9(2)(e) in conjunction with Article 6(1)(b) of the GDPR.

You may withdraw your consent at any time. However, please note that if we are unable to process relevant health data, we will not be able to provide our services (customized meal and workout plans tailored to your unique needs).

5. Third Parties and Data Sharing

The security of your personal data is extremely important to us. We do not sell your personal data to any third parties, and we never will.

Access to your personal data is only provided to carefully selected third parties, including:

• Service providers who help us provide our services, such as our infrastructure, IT, analytics, and payment processing providers (for example, Stripe). These providers act as data processors on our behalf.
• Regulators or organizations to which we are required to disclose your personal data by law.
• Parties involved in business transfers, such as reorganizations, restructurings, mergers, acquisitions, or asset transfers, provided the receiving party agrees to treat your personal data in a manner consistent with this Privacy Policy.

Our website may from time to time contain links to and from the websites of our partners or affiliates. Those websites have their own privacy notices, and we have no control over how they use your personal data. You should review their privacy notices before submitting any personal data to them.

6. How Long We Keep Your Data

Your personal data will only be stored for as long as necessary for the purposes for which it was collected, and only to the extent permitted by applicable law. When we no longer need to use your information, we will remove it from our systems and records or take steps to promptly anonymize it, unless we need to keep it to comply with legal or regulatory obligations.

Any health information and uploaded body images will always be deleted 6 months after your last activity.

7. International Data Transfers

The personal data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us or one of our service providers.

We take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this Privacy Policy and applicable data protection laws, including, where relevant, entering into EU Standard Contractual Clauses (or equivalent measures) with the party receiving the data outside the EEA.

8. Keeping Your Information Secure

We have implemented technical and organizational security measures to safeguard the personal data in our custody and control. These include limiting access to personal data only to employees and authorized service providers who need to know such information for the purposes described in this Privacy Policy, as well as other technical, administrative, and physical safeguards.

While we endeavor to protect our systems, sites, operations, and information against unauthorized access, use, modification, and disclosure, due to the inherent nature of the internet, we cannot guarantee that any information — during transmission or while stored on our systems — will be absolutely safe from intrusion by others, such as hackers.

Certain personal data stored in your online account is only accessible via your username and password. You are responsible for maintaining the confidentiality of your account credentials. We strongly recommend that you do not share your username or password with anyone. We will never ask you for your password in an unsolicited communication. Please notify us immediately of any unauthorized use of your credentials or any other suspected security breach.

9. Your Personal Data Rights

You have several rights in connection with our processing of your personal data:

• Access. You have the right to request a copy of the personal data we process about you, which we will provide in electronic form.
• Rectification. You have the right to have any incomplete or inaccurate personal data rectified.
• Deletion. You have the right to request that we delete personal data we process about you, except where we are required to retain it to comply with a legal obligation or to establish, exercise, or defend legal claims.
• Restriction. You have the right to restrict our processing of your personal data where you believe such data is inaccurate, our processing is unlawful, or we no longer need to process the data for a particular purpose.
• Objection. Where the legal basis of our processing is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation.
• Withdrawal of Consent. Where we process personal data on the basis of your consent, you have the right to withdraw that consent at any time, including for direct marketing purposes.

If you wish to exercise one or more of these rights, please contact us at contact@romy-coaching.com and include your name, email, postal address, and specific request. In some cases, we may need to verify your identity before responding.

You also have the right to file a complaint with your local data protection authority if you believe we have not complied with applicable data protection laws.

10. United States — California (CCPA)

This section provides additional details for California residents about the personal information we collect and use under the California Consumer Privacy Act ("CCPA").

a. How We Collect, Use, and Disclose Your Personal Information

Section 2 above describes the personal information we may have collected about you within the last 12 months, including its sources. Section 3 explains the purposes for which we collect it. Section 5 explains how we share it.

b. Your CCPA Rights and Choices

As a California consumer, and subject to certain limitations under the CCPA, you have the following choices:

• Right to Know: You may request the categories and specific pieces of personal information we have collected, the sources, the business or commercial purpose for collecting it, the categories of third parties with whom we shared it, and the categories of information disclosed for a business purpose.
• Right to Delete: You may request that we delete the personal information we have collected from you, subject to certain legal exceptions.
• Right to Opt Out of Sale: You may request to opt out of any "sale" of your personal information. We do not use, share, rent, or sell the personal information of our customers or site visitors for interest-based advertising.
• Non-Discrimination: You may not be discriminated against for exercising these rights.

11. How to Contact Us

If you have any questions about this Privacy Policy, or about the privacy practices of our service providers, please contact us at contact@romy-coaching.com.