iBetterCoach

iBetterCoach Version: 1.2 Date: 27 July 2026

⚠️ Notice: This consent is required by Article 9(2)(a) GDPR for processing of special category (health) data. It must be explicit, separate, granular and informed. Requires legal review before publication.

INTENDED RECIPIENT

This Consent is intended for the Athlete (end user) who uses the iBetterCoach Platform via their Professional Customer (Personal Trainer, nutritionist, physiotherapist, etc.).

The Platform is intended for Athletes aged 16 and over. The submission of body photographs is prohibited for those under 18 (technical block). For Athletes between 16 and 17 years old, and where health data (special category) is concerned, the following mark applies: ⚠️ [to be confirmed by counsel] whether the data subject's own consent suffices or whether the consent/authorisation of the holder of parental responsibility is required.

This consent is presented to the Athlete on a dedicated page, through a personal single-use token link sent to the Athlete's email address or, alternatively, after the Athlete signs in. The channel is independent of the Professional Customer and the Professional's device is never used to give consent. Health-data consent is presented separately from registration, the Athlete Terms and the Privacy Policy, through a dedicated, non-pre-ticked checkbox. The photo choice is presented separately and is optional.

1. Who processes my data?

iBetterCoach — [legal entity name TBD], [Address TBD], VAT/Tax ID [VAT/Tax ID TBD], which provides the Platform. (iBetterCoach's exact role — data controller and/or data processor — is subject to qualification under legal review; see the block below.)
Professional Customer (PT/nutritionist) who added me to the Platform.
iBetterCoach Data Protection Officer (DPO): dpo@ibettercoach.com [DPO to be confirmed]

⚠️ [UNDER LEGAL REVIEW] Qualification of the data controller

This point is being determined through legal advice and may alter the framing of several sections of this document. There are two possible readings of iBetterCoach's role: (a) Data processor of the Athlete's data, processed on behalf of the Professional (data controller), under the DPA; or (b) Data controller, possibly as a joint controller with the Professional (Article 26 GDPR), given that iBetterCoach maintains a direct relationship with the Athlete (own account, acceptance of the Terms and consent given directly to the Platform) and processes data for its own purposes (metrics/gamification, product improvement and security). The final determination will be reflected in this section, in the DPA document and in the consent flows. Pending validation by a lawyer specialising in GDPR.

2. What health data will be collected?

I may be invited to share personal data and health data, namely:

Data that I enter / upload in the mobile application:

Basic identification: name, date of birth, sex, contact
Manual measurements: weight, perimeters (waist, hip), and other anthropometric measurements I record
Body progress photographs (strictly optional, uploaded by me in the app or by my professional with my authorisation; never mandatory and available only to Athletes aged 18 or over — technical block for those under 18)

Health data synchronised automatically from a wearable / health app (optional — only with my specific consent, see section 3.1):

Through the integration with Apple Health / Health Connect: steps, heart rate, resting heart rate, sleep, HRV, VO₂max, training sessions

Sensitive clinical data entered by the Professional on the web platform (not in the mobile application):

Clinical anamnesis: personal and family history, diseases, surgeries, regular medication, allergies, intolerances, injuries, medical restrictions, chronic pain
Lifestyle and sports/nutritional data relevant to the prescription (sleep, stress, activity level, goals, 1RM, dietary restrictions, etc.)

3. What will my data be used for?

My data will be used for the following purposes:

✓ Allow my professional to perform an adequate anamnesis and assessment ✓ Allow my professional to read my habits (including data synchronised from the wearable) to adjust the follow-up ✓ Present my metrics to me (activity, sleep, heart rate, etc.) within a logic of gamification and habit tracking ✓ Generate training and nutrition prescription suggestions to be reviewed and validated by the professional ✓ Track changes in my current status over time, to support the professional's decisions ✓ Track my progress over time ✓ Detect alerts and contraindications to be flagged to the professional ✓ Enable secure communication between me and my professional on the Platform

My data will NOT be used for:

✗ Automated decisions producing legal or similarly significant effects without human intervention — every prescription requires professional validation ✗ Targeted marketing, commercial profiling or advertising ✗ Sale or transfer to third parties (insurers, employers, social networks, etc.)

The automatic synchronisation of health data from Apple Health / Health Connect (steps, heart rate, resting heart rate, sleep, HRV, VO₂max, training sessions) is subject to a separate, specific and optional consent:

The Platform works without this consent — synchronisation is not necessary to use the service.
This consent is revocable at any time (Article 7(3) GDPR), without affecting the lawfulness of prior processing.
Synchronisation only occurs after I give consent, in the following order: (1) legal consent in the application → (2) operating system permission (iOS/Android) → (3) synchronisation.
Two "yeses" are required: the legal consent given in the application and the operating system permission. The operating system permission does not replace the legal consent.
iBetterCoach records the version, text and date of the consent given.

4. What is the legal basis for the processing?

Because this involves special category data (health), the processing is based on my explicit consent (Article 9(2)(a) GDPR), given:

Freely — refusing the mandatory health-data consent prevents use of the Platform because that processing is necessary for the service; refusing the optional photo authorisation does not restrict the remaining service
Specifically — I consent for the purposes expressly identified in this document
Informed — I have read and understood all the information in this document
Unambiguously — manifested by clear positive action (dedicated checkbox)

(The identification of who acts as data controller for the purposes of this legal basis is subject to qualification under legal review — see section 1.)

5. Who else will access my data?

Only:

My Professional Customer (PT/nutritionist who added me)
Authorised members of my professional's team (interns, co-trainers, assistants)
iBetterCoach, to ensure the operation, security and support of the Platform (iBetterCoach's exact role is subject to qualification under legal review — see section 1)
iBetterCoach technical sub-processors, identified in section 7.1 of the Privacy Policy, with contractual GDPR obligations
Public authorities, only if required by law (court order, validly issued request)

Never: other professionals, other athletes, gyms not authorised by me, insurers, employers, social networks.

6. Will my data leave the European Union?

Persisted health data is stored in Supabase in Ireland (eu-west-1). The server-side application runs on Vercel in Dublin (dub1). The technical authentication service (Clerk) may involve transfers to the USA, always covered by:

Standard Contractual Clauses (SCC) approved by the European Commission
EU-US Data Privacy Framework (where applicable)

The current providers, purposes, locations and safeguards are listed in section 7.1 of the Privacy Policy.

7. How long will my data be kept?

For as long as the relationship with my professional is active
After termination: 30 days to allow me to request a copy of the data or its deletion
After this period, the personal and health data are deleted or anonymised, unless a legal retention obligation applies

Exceptions due to legal obligation (not deleted when the remaining data are deleted):

Billing / accounting records: kept for the tax/accounting retention period provided for under Portuguese law (~10 years — ⚠️ [to be confirmed by counsel/accountant] the exact period). These records are not deleted upon account deletion; only the user identifier is anonymised.
Any clinical record that the healthcare professional has a legal duty to keep — ⚠️ [to be confirmed by counsel].

At any time I may request, in advance, the deletion or a copy of my data, subject to the legal reservations above.

8. What are my rights?

I have the right to:

Access my data (Art. 15)
Rectify incorrect or outdated data (Art. 16)
Erase my data / right to be forgotten (Art. 17) — see section 8.1 on what is deleted and what is retained due to legal obligation
Restrict processing (Art. 18)
Object to processing (Art. 21)
Portability — ask iBetterCoach for a copy of my data in a structured format and transfer it to another controller (Art. 20)
Not be subject to automated decisions with significant impact (Art. 22) — iBetterCoach always guarantees human validation
Withdraw consent at any time, without affecting the lawfulness of prior processing
Lodge a complaint with the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt

To exercise any of these rights, I may contact:

My professional (Professional Customer)
iBetterCoach: privacy@ibettercoach.com

(The determination of which point of contact acts as data controller is subject to qualification under legal review — see section 1.)

8.1 Deleting my account and the right to erasure

When I delete my account, iBetterCoach deletes or anonymises my personal and health data, but retains what the law requires it to keep, namely:

Tax/accounting records linked to billing, for the legal retention period (see section 7) — in these, the user identifier is anonymised, the record itself not being deleted.
Any clinical record that the healthcare professional has a duty to keep — ⚠️ [to be confirmed by counsel].

I may request deletion through:

Mobile application (in-app account deletion option)
Public page dedicated to deletion requests: www.ibettercoach.com/account-deletion

At the moment of the action, the Platform transparently informs me about what is deleted and what is retained, why and for how long (for example: "this deletes your training and health data; billing records are retained for X years due to a legal obligation, with the identifier anonymised").

iBetterCoach will respond to or forward the request within 30 days, a period extendable by 60 additional days under the GDPR.

(These periods and rights are without prejudice to the legal retention obligations described in sections 7 and 8.1.)

Use of the iBetterCoach Platform requires explicit consent to the processing of the health data needed for the service. If I do not agree to that mandatory processing, I cannot use the Platform.

This requirement is proportional because health data is strictly necessary for the purpose of the service — safe training or nutrition prescription would not be possible without it. No equivalent service can function without this consent.

Photo authorisation is separate and optional. I may refuse it and continue using the remaining service; only photo assessment and the conclusions derived from those photographs become unavailable.

When the consent flow is active, clinical data remains blocked in the product while mandatory consents are pending. The request records an initial 30-day period, which may be extended once for a further 30 days, with the extension recorded.

Yes, at any time and without justification. Withdrawal takes effect for the future and does not affect the lawfulness of processing already carried out.

Mandatory health data: withdrawal prevents the service from continuing and may be requested through privacy@ibettercoach.com or the public account-deletion flow.
Optional photographs: I may revoke or grant authorisation again on the dedicated consent page after signing in. Revocation immediately blocks new reads, new assessments and new URL issuance. A bearer URL issued before revocation may remain functional for no more than 15 minutes.

Each act is associated with the version and cryptographic digest (SHA-256) of the text actually shown. The Professional Customer cannot withdraw or give these consents on my behalf.

11. The Platform is an assistance tool — I am responsible for myself

I understand and accept that:

iBetterCoach is an assistance tool for my professional and for me. It is not a medical service, it does not replace medical consultation and it does not issue diagnoses.
The gamification and metrics presentation features are intended to celebrate habits and adherence and to reinforce my professional's prescription. The Platform does not encourage me to push beyond my limits (it does not pressure me into "one more rep" or "one more kilometre") and never exceeds my professional's prescription. Special care is given to weight/body metrics and to the protection of minors.
All information, suggestions, plans or recommendations presented by the Platform are informative and supportive in nature, and must be reviewed by my professional.
The Platform may produce incorrect information. I understand that automated calculations and entered data may produce content that is incorrect, outdated, incomplete or unsuitable for my specific case. For this reason, I must not treat any information from the Platform as absolute truth, I must keep a critical mindset and I must always validate with my professional and, where appropriate, with a doctor.
In case of any doubt about a health matter, symptom, pain, discomfort, medication, allergy, clinical condition or contraindication, I must consult a doctor or other qualified healthcare professional before acting.
I am responsible for myself: for my decisions, for respecting my own physical limits, for following my doctor's guidance, for honestly reporting my health status to my professional and for immediately stopping any exercise, meal plan or supplementation if I feel pain, dizziness, breathing difficulty or any other warning sign, and for seeking medical help.
The Platform cannot replace my common sense, my self-observation or the direct relationship between me and my healthcare professionals.

I declare that:

☐ I have read and understood this Informed Consent in full
☐ I had the opportunity to ask questions and received clarification
☐ I am 16 years of age or older (the Platform is intended for Athletes aged 16 and over; the submission of body photographs is only permitted from the age of 18). ⚠️ [to be confirmed by counsel] for Athletes between 16 and 17 years old and health data: whether the data subject's own consent suffices or whether the consent/authorisation of the holder of parental responsibility is required
☐ I understand that iBetterCoach is an assistance tool, that it does not replace medical advice, and that I am responsible for my own health decisions and for consulting qualified healthcare professionals in case of doubt
☐ I understand that the Platform may produce incorrect, inaccurate or unsuitable information for my case and that I must always critically validate it with my professional and, if necessary, with a doctor
☐ I expressly consent to the processing of my health and special category data by iBetterCoach and by my Professional Customer, for the purposes, conditions and periods described herein
☐ (Optional and separate) I authorise the use of body photographs for assessment and progress tracking; if I refuse, the remaining service continues to be available
☐ (Optional) I consent to the automatic synchronisation of health data from Apple Health / Health Connect, under the terms of section 3.1 — this consent is optional and revocable at any time

Date: [auto-filled by the Platform] Athlete identification: [auto-filled] Associated Professional Customer: [auto-filled] Consent version accepted: 1.2

Document prepared for iBetterCoach. Requires formal legal review before publication. The Consent must be presented to the Athlete on the dedicated consent page, with separate choices, never grouped with the general Terms or the Privacy Policy.