Privacy Policy

The data controller for personal data processed through Coachly is the Coachly project, based in Amsterdam, the Netherlands. You can reach us at the email above.

The categories of data we hold are:

• Account data: name, email, profile photo, the authentication provider you used (Apple, Google, email + magic link), and basic account preferences.
• Coaching data: the workout plans, meal plans, check-ins, notes, and messages you create or receive inside Coachly.
• Health data (only with your explicit permission): selected Apple HealthKit categories — for example steps, workouts, heart rate, sleep, weight, body measurements. You choose which categories Coachly may read.
• Device & usage data: device type, OS version, app version, language, and basic analytics about how the app and website are used (no third-party advertising trackers).
• Billing data: if you subscribe to a paid plan or process client payments, our payment partner handles card / SEPA details. Coachly stores invoice metadata only.

The lawful bases we rely on (under GDPR / AVG):

• Contract:to provide the Service you’ve signed up for — your account, coaching workflow, messaging, billing.
• Consent: for Apple Health data, optional marketing emails, and any data category we explicitly ask you about. You can withdraw consent any time.
• Legitimate interest: to keep the Service secure, prevent abuse, and improve product quality (with privacy-preserving analytics).
• Legal obligation: billing records, tax records, and responding to lawful requests.

Coachly stores data on Supabase infrastructure in the EU (Frankfurt). Some operational sub-processors (e.g. email delivery, payment processing, error monitoring) may process limited data outside the EU under Standard Contractual Clauses or equivalent safeguards. We maintain a list of sub-processors and will share it on request.

When you give Coachly access to HealthKit categories, that data is read on your device and synced to your account so your coach can see the signals you’ve agreed to share. We never sell HealthKit data, never use it for advertising, and never use it to train machine-learning models. You can revoke HealthKit access in the iOS Settings app at any time.

The whole point of Coachly is selective sharing between coach and client. Beyond that:

• Within a coaching relationship: the coach and the client you explicitly link to can see the data scoped to that relationship.
• Service providers: a small number of vendors who help us run Coachly (hosting, email, payments, error monitoring) under a contract.
• We don’t sell your data. Ever.

We keep data only as long as needed. Account & coaching data stay while your account is active and for up to 90 days after closure (to support undeletion, audit, and abuse investigations). Billing records are kept for 7 years (Dutch tax law). HealthKit data is deleted from our servers when you revoke access or delete your account.

Under GDPR / AVG you have the right to:

• Access the data we hold on you;
• Correct anything inaccurate;
• Delete your data (right to be forgotten);
• Export your data (data portability);
• Withdraw consent at any time;
• Lodge a complaint with the Dutch DPA (Autoriteit Persoonsgegevens).

To exercise any of these, email hello@hellocoachly.com. We respond within 30 days.

Coachly isn’t designed for users under 16. If we learn that we’ve collected data from someone under 16 without a parent or guardian’s consent, we’ll delete it.

We may update this policy. Material changes will be notified in-product or by email at least 14 days before they take effect.