Privacy policy

1. Controller and roles

1.1This policy covers RxApp's website, web and mobile apps, provided by Dicabrio.com, Dijkwacht 114, 2353 EL Leiderdorp, the Netherlands; support@rxapp.io. It informs athletes, gym representatives and visitors. Blanket consent to this policy is not required.

1.2RxApp controls its own accounts, personal and social features, security, support and gym billing. For gym administration, bookings and collections on gym instructions, the gym is controller and RxApp processor. Actual purposes determine roles, not who fills in a field. Also consult your gym's privacy notice.

2. Data, purposes and lawful bases

2.1Account data includes name, email, password hash, language, settings and profile details you provide. Personal features use workouts, scores, photos, friendships and messages. Necessary contractual processing relies on Article 6(1)(b) GDPR. You choose and can change optional public or social visibility.

2.2Gym administration may include contact details, date of birth, emergency contacts, memberships, bookings, attendance, invoices, IBANs and mandates. The gym determines the lawful basis and informs members. Provide emergency contact details only as needed and inform that person.

2.3Support, abuse prevention and security use support messages, technical logs, IP addresses and device information where necessary for our legitimate interest in a safe, reliable service, balanced against your rights. Relevant acceptance records include account, any gym, document type, version, time and available IP address as evidence of arrangements.

2.4Business administration and legal obligations require invoice and payment data. Optional processing requiring consent has a separate request. Withdrawal does not affect prior lawful processing or processing based on other grounds.

2.5Health information, including injury notes, can be special-category data. Only necessary information may be recorded with a lawful basis and an applicable Article 9 GDPR exception. Terms acceptance or a debit mandate does not replace explicit consent where required.

3. Access and sharing

3.1Gym staff access data allowed for their tasks, not automatically all personal or social account information. Class participation may be visible within the relevant class. Result visibility is a separate setting.

3.2Without your own choice you are not discoverable in friend search, unless your gym chooses findability within the gym; other members of that gym can then find you, based on the legitimate interest of finding each other within the gym. Choose nobody, your gym's members or all RxApp athletes. Your own choice always takes precedence. Discoverability can expose name, photo and gym. Friendship requires mutual acceptance. Changing discovery does not automatically remove existing friendships or messages.

3.3Providers for hosting, storage, email, push and payments include Vercel, Amazon Web Services, Mailgun, OneSignal and Stripe depending on the feature. They receive data needed for their service. Payment providers may independently control data for their legal tasks. We do not sell personal data.

3.4Disclosure to authorities or others requires a legal obligation or other lawful basis. Transfers outside the EEA require an applicable adequacy decision or appropriate safeguards. Contact support@rxapp.io for provider details, locations and an explanation or copy of applicable safeguards.

4. Retention and deletion

4.1Account and training data is kept as needed for your account and selected features. On deletion it is erased or anonymised except where necessary for legal obligations or concrete legal claims. Financial administration generally has a seven-year statutory retention period where applicable. Logs, support requests and acceptance records are not kept beyond their security, handling or evidence purpose.

4.2Gym data follows gym instructions and retention duties. Backups are not used for day-to-day access and are overwritten under the applicable cycle. You may request specific retention information for your data.

4.3Account deletion does not cancel your real gym membership. A gym ending its RxApp subscription does not automatically delete your account. Contact the gym about membership cancellation and RxApp about your independent account.

5. Security and minors

5.1We use appropriate measures including restricted access, secure connections, password hashing and security management. No system is risk-free. Report suspected breaches or misuse to support@rxapp.io.

5.2Applicable representation and consent rules are considered for minors. Where processing relies on consent and parental permission is legally required, that permission must be obtained separately and appropriately verified. Gym admission rules do not replace this obligation.

6. Cookies, local storage and notifications

6.1Necessary cookies and local storage support login, security and preferences. Accepting terms does not consent to tracking or advertising cookies. Non-essential analytics is disabled while no separate consent mechanism is active; Google Analytics is not loaded in that case.

6.2Push notifications require applicable device permission. Manage notifications in RxApp and device settings. Turning off optional notifications does not cancel a membership.

7. Rights and complaints

7.1You may request access, correction, deletion, restriction and portability where GDPR provides those rights, object to legitimate-interest processing and withdraw consent for processing based on it. We do not make solely automated decisions with legal or similarly significant effects on you.

7.2Email support@rxapp.io. We verify identity proportionately and do not routinely request a full identity-document copy. We normally respond within one month; any permitted extension is notified with reasons. For gym-controlled processing we help direct your request to the gym.

7.3You may complain to the Dutch Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl or your competent local authority. We notify material policy changes through the service or email and seek separate consent for new consent-based purposes where required.