Privacy Policy

01 Introduction

TuGymPR is a business-to-business (B2B) white-label fitness platform. We license our software to gyms ("Gyms"), who provide a branded app to their members ("Members"). This Privacy Policy explains how we collect, use, share, and protect personal information across our mobile and web applications. It takes effect on 2026-04-29.

TuGymPR, based in Puerto Rico, is the data controller for the personal information described in this policy. For any privacy matter, contact privacy@tugympr.com.

When you use a Gym's branded TuGymPR app, both TuGymPR and your Gym process your information to operate the service. Your Gym is responsible for its own use of your data within its program.

02 Data We Collect

Account information

Name, email address, password (stored hashed), profile photo, and the Gym you belong to.

Health & fitness data

Workouts, sets, reps, weights, cardio sessions (including distance, pace, and GPS route when you record one), attendance and check-ins, streaks, body weight, measurements, nutrition logs, and goals you enter or that the app records.

Photos

Progress photos and food photos you choose to capture or upload. See AI Photo Processing for how food photos are handled.

Location (GPS) — outdoor cardio only

Location is used for one purpose: tracking your live outdoor cardio sessions (running, walking, cycling, hiking) — distance, pace, and route. It is foreground-only and active only while you are recording a session you started. We never track your location in the background, never use it for advertising, and never share it with third parties beyond the map providers needed to render your route.

The route of a session you record is saved as part of that workout in your history (that's how your route maps and share cards work). Deleting the workout deletes its route. Location permission is optional — you can log cardio manually without GPS.

Gym check-in does not use GPS. Check-in works via signed QR codes, and any check-in photos are stripped of location (EXIF/GPS) metadata on-device before upload.

Device data

Device model, operating system, app version, push token, and general diagnostics needed to deliver notifications and keep the app reliable.

Communications & auxiliary services

To deliver certain features we route specific data to specialized providers: phone/SMS via Twilio, transactional email via Resend, translation via DeepL, barcode/food lookups via Open Food Facts, and map rendering for your cardio routes via Mapbox, Carto, and OpenStreetMap.

Usage analytics

We use PostHog with hashed identifiers to understand product usage and improve the app.

Messages & social

Direct messages, comments, posts, and friend connections. Message content is encrypted at rest with AES-256-GCM. Messaging is not end-to-end encrypted; we can access content as needed for security, legal compliance, and moderation.

Gym-provided data

Your Gym may add information about you, such as membership status, plan, notes, and risk indicators used for retention.

03 Third-Party Sub-Processors

We share data with the following sub-processors strictly to operate the service. We do not use ad networks, and we do not sell or share personal information for cross-context behavioral advertising.

04 AI Photo Processing

When you scan a food photo, we strip EXIF metadata on-device, transmit the image over TLS to OpenAI Vision for analysis, and use the result (e.g., estimated nutrition) in the app. OpenAI does not use this content to train its models, and any abuse-monitoring retention is limited to 30 days or less.

After analysis, the result is stored and the photo is discarded from the processing pipeline. You can opt out of AI photo processing in settings; food logging remains available via barcode and manual entry.

05 Apple HealthKit & Google Health Connect

With your permission, we read steps, heart rate, weight, and active calories, and write workouts, weight, and calories. Health data is used only to power your fitness experience. It is never used for advertising, never sold, and never used to train AI models.

You can revoke access at any time: on iOS via Settings → Privacy & Security → Health → TuGymPR, and on Android via the Health Connect app's permissions for TuGymPR.

06 Data Retention

• Active data is retained while your membership is active.
• Deletion requests are completed within 30 days.
• Audit logs are retained for 90 days.
• Backups follow a 30-day rotation.
• Anonymized, aggregated statistics may be retained indefinitely.

07 Your Rights

You can access and export your data in-app, correct inaccurate information, and delete your account in-app or via the web at tugympr.com/eliminar-cuenta. To exercise any right, contact privacy@tugympr.com. We respond within 30 days.

08 Children's Privacy

TuGymPR is intended for users 13 and older (or 16+ where required, e.g., parts of the EU). Age is confirmed by self-attestation. We do not operate in the Kids Category and do not knowingly collect data from children below the minimum age.

09 International Data Transfers

Our infrastructure is hosted in the United States. Where data is transferred internationally, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs), the UK IDTA, and recognition by the Swiss FDPIC as applicable.

10 Security

We protect data with TLS 1.2+ in transit, AES-256-GCM at rest for direct messages, HMAC-SHA256 for QR check-in codes, on-device EXIF stripping, magic-byte validation of uploads, and Row-Level Security (RLS) for per-Gym data isolation. In the event of a breach affecting your data, we are committed to notifying affected users and Gyms as required by law.

11 User-Generated Content & Moderation

Using social features requires accepting our EULA at signup. We provide in-app tools to report, block, and hide content and users. We review reported objectionable content and act within a 24-hour SLA. Moderation records are retained for 90 days.

12 Changes to This Policy

We may update this Privacy Policy. For material changes, we will provide at least 30 days' notice in-app and/or by email before the changes take effect.

13 Contact

Privacy questions: privacy@tugympr.com. Account deletion: tugympr.com/eliminar-cuenta. We respond to all privacy requests within 30 days.

TuGymPR operates from Puerto Rico (USA). We have not appointed a Data Protection Officer or an EU/UK representative; if that changes, this section will be updated.