iBetterCoach

iBetterCoach Version: 1.4 Date: 18 September 2026

⚠️ Notice: This consent is required by Article 9(2)(a) GDPR for processing of special category (health) data. It must be explicit, separate, granular and informed. Requires legal review before publication.

INTENDED RECIPIENT

This Consent is intended for the Athlete (end user) who uses the iBetterCoach Platform via their Professional Customer (Personal Trainer, nutritionist, physiotherapist, etc.).

In this initial release, the Platform is intended only for Athletes aged 18 or over; the Professional Customer must not register, or enter data relating to, anyone under 18. The submission of body photographs is prohibited for those under 18 (technical block) and this rule remains in place as an additional safeguard.

Prospective framework for minors. The references to minors retained in this Consent and in the other legal documents — including the ⚠️ [to be confirmed by counsel] question of whether, for Athletes between 16 and 17 years old and health data (special category), the data subject's own consent would suffice or the consent/authorisation of the holder of parental responsibility would be required — form a prospective framework and do not authorise, in this release, the registration, onboarding or data processing of minors. Any future opening to minors requires prior legal review, an explicit product-policy activation and an update of this Consent and of the consent flows.

Decision requested (RJ-02): who can provide each consent, how parental responsibility is verified, what evidence must be retained, how age-appropriate information is presented and what happens on withdrawal or conflicting choices. Until then, this consent may be given only by Athletes aged 18 or over.

This consent is presented to the Athlete on a dedicated page, through a personal single-use token link sent to the Athlete's email address or, alternatively, after the Athlete signs in. The channel is independent of the Professional Customer and the Professional's device is never used to give consent. Health-data consent is presented separately from registration, the Athlete Terms and the Privacy Policy, through a dedicated, non-pre-ticked checkbox. The photo choice is presented separately and is optional.

1. Who processes my data?

iBetterCoach — SOFTBRICK, LDA, Rampa Doutor Barreto, 15, 9000-688 Funchal, Portugal, VAT/Tax ID 519595270, which provides the Platform. (iBetterCoach's exact role — data controller and/or data processor — is subject to qualification under legal review; see the block below.)
Professional Customer (PT/nutritionist) who added me to the Platform.
iBetterCoach privacy and data-protection channel: privacy@ibettercoach.com (alternative channel: dpo@ibettercoach.com). Any formal DPO appointment is subject to decision RJ-05 described in the Privacy Policy.

⚠️ [UNDER LEGAL REVIEW] Qualification of the data controller

This point is being determined through legal advice and may alter the framing of several sections of this document. There are two possible readings of iBetterCoach's role: (a) Data processor of the Athlete's data, processed on behalf of the Professional (data controller), under the DPA; or (b) Data controller, possibly as a joint controller with the Professional (Article 26 GDPR), given that iBetterCoach maintains a direct relationship with the Athlete (own account, acceptance of the Terms and consent given directly to the Platform) and processes data for its own purposes (metrics/gamification, product improvement and security). The final determination will be reflected in this section, in the DPA document and in the consent flows. Pending validation by a lawyer specialising in GDPR.

What this section is intended to do: identify the entity to which the Athlete gives each consent and the entity responsible for proving that the choice was explicit, freely given, specific and informed.

Specific question and requested decision (RJ-01 and RJ-09): the Professional determines coaching purposes while iBetterCoach collects acceptance directly, maintains the account and has purposes of its own. Counsel should provide a purpose × data × role × legal basis × required/optional × withdrawal-consequence matrix and approve the evidence each party must retain. Until then, these are working hypotheses.

2. What health data will be collected?

I may be invited to share personal data and health data, namely:

Data that I enter / upload in the mobile application:

Basic identification: name, date of birth, sex, contact
Manual measurements: weight, perimeters (waist, hip), and other anthropometric measurements I record
Body progress photographs (strictly optional, uploaded by me in the app or by my professional with my authorisation; never mandatory and available only to Athletes aged 18 or over — technical block for those under 18)

Health data synchronised automatically from a wearable / health app (optional — only with my specific consent, see section 3.1):

Through the integration with Apple Health / Health Connect: steps, heart rate, resting heart rate, sleep, HRV, VO₂max, training sessions

Sensitive clinical data entered by the Professional on the web platform (not in the mobile application):

Clinical anamnesis: personal and family history, diseases, surgeries, regular medication, allergies, intolerances, injuries, medical restrictions, chronic pain
Lifestyle and sports/nutritional data relevant to the prescription (sleep, stress, activity level, goals, 1RM, dietary restrictions, etc.)

3. What will my data be used for?

My data will be used for the following purposes:

✓ Allow my professional to perform an adequate anamnesis and assessment ✓ Allow my professional to read my habits (including data synchronised from the wearable) to adjust the follow-up ✓ Present my metrics to me (activity, sleep, heart rate, etc.) within a logic of gamification and habit tracking ✓ Generate training and nutrition prescription suggestions to be reviewed and validated by the professional ✓ Track changes in my current status over time, to support the professional's decisions ✓ Track my progress over time ✓ Detect alerts and contraindications to be flagged to the professional ✓ Enable secure communication between me and my professional on the Platform

My data will NOT be used for:

✗ Automated decisions producing legal or similarly significant effects without human intervention — every prescription requires professional validation ✗ Targeted marketing, commercial profiling or advertising ✗ Sale or transfer to third parties (insurers, employers, social networks, etc.)

The automatic synchronisation of health data from Apple Health / Health Connect (steps, heart rate, resting heart rate, sleep, HRV, VO₂max, training sessions) is subject to a separate, specific and optional consent:

The Platform works without this consent — synchronisation is not necessary to use the service.
This consent is revocable at any time (Article 7(3) GDPR), without affecting the lawfulness of prior processing.
Synchronisation only occurs after I give consent, in the following order: (1) legal consent in the application → (2) operating system permission (iOS/Android) → (3) synchronisation.
Two "yeses" are required: the legal consent given in the application and the operating system permission. The operating system permission does not replace the legal consent.
iBetterCoach records the version, text and date of the consent given.

4. What is the legal basis for the processing?

Because this involves special category data (health), the processing is based on my explicit consent (Article 9(2)(a) GDPR), given:

Freely — refusing the mandatory health-data consent prevents use of the Platform because that processing is necessary for the service; refusing the optional photo authorisation does not restrict the remaining service
Specifically — I consent for the purposes expressly identified in this document
Informed — I have read and understood all the information in this document
Unambiguously — manifested by clear positive action (dedicated checkbox)

(The identification of who acts as data controller for the purposes of this legal basis is subject to qualification under legal review — see section 1.)

5. Who else will access my data?

Only:

My Professional Customer (PT/nutritionist who added me)
Authorised members of my professional's team (interns, co-trainers, assistants)
iBetterCoach, to ensure the operation, security and support of the Platform (iBetterCoach's exact role is subject to qualification under legal review — see section 1)
iBetterCoach technical sub-processors, identified in section 7.1 of the Privacy Policy, with contractual GDPR obligations
Public authorities, only if required by law (court order, validly issued request)

Never: other professionals, other athletes, gyms not authorised by me, insurers, employers, social networks.

6. Will my data leave the European Union?

Persisted health data is stored in Supabase in Ireland (eu-west-1). The server-side application runs on Vercel in Dublin (dub1). The technical authentication service (Clerk) may involve transfers to the USA, always covered by:

Standard Contractual Clauses (SCC) approved by the European Commission
EU-US Data Privacy Framework (where applicable)

The current providers, purposes, locations and safeguards are listed in section 7.1 of the Privacy Policy.

7. How long will my data be kept?

For as long as the relationship with my professional is active
After termination: 30 days to allow me to request a copy of the data or its deletion
After this period, the personal and health data are deleted or anonymised, unless a legal retention obligation applies

Exceptions due to legal obligation (not deleted when the remaining data are deleted):

Billing / accounting records: kept for the period applicable under Portuguese law. The working reference is close to 10 years, but the exact period, scope, start date and minimum fields depend on decision RJ-03.
Any clinical record that the healthcare professional has a legal duty to keep, subject to decision RJ-04.

What remains to be decided (RJ-03 and RJ-04): a tax table by record type and a clinical matrix by Professional and data type, covering period, custody, access, export, restriction, erasure and the information shown to the Athlete.

At any time I may request, in advance, the deletion or a copy of my data, subject to the legal reservations above.

8. What are my rights?

I have the right to:

Access my data (Art. 15)
Rectify incorrect or outdated data (Art. 16)
Erase my data / right to be forgotten (Art. 17) — see section 8.1 on what is deleted and what is retained due to legal obligation
Restrict processing (Art. 18)
Object to processing (Art. 21)
Portability — ask iBetterCoach for a copy of my data in a structured format and transfer it to another controller (Art. 20)
Not be subject to automated decisions with significant impact (Art. 22) — iBetterCoach always guarantees human validation
Withdraw consent at any time, without affecting the lawfulness of prior processing
Lodge a complaint with the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt

To exercise any of these rights, I may contact:

My professional (Professional Customer)
iBetterCoach: privacy@ibettercoach.com

(The determination of which point of contact acts as data controller is subject to qualification under legal review — see section 1.)

8.1 Deleting my account and the right to erasure

When I delete my account, iBetterCoach deletes or anonymises my personal and health data, but retains what the law requires it to keep, namely:

Tax/accounting records linked to billing, for the legal retention period (see section 7) — in these, the user identifier is anonymised, the record itself not being deleted.
Any clinical record that the healthcare professional has a duty to keep, under decision RJ-04 explained in section 7.

I may request deletion through:

Mobile application (in-app account deletion option)
Public page dedicated to deletion requests: www.ibettercoach.com/account-deletion

At the moment of the action, the Platform transparently informs me about what is deleted and what is retained, why and for how long (for example: "this deletes your training and health data; billing records are retained for X years due to a legal obligation, with the identifier anonymised").

iBetterCoach will respond to or forward the request within 30 days, a period extendable by 60 additional days under the GDPR.

(These periods and rights are without prejudice to the legal retention obligations described in sections 7 and 8.1.)

The current Platform coaching flow requires the processing of certain health data. If I do not authorise processing that is legally confirmed as necessary for that flow, coaching cannot continue in that configuration.

What this passage is intended to do: explain the consequence of refusal honestly, without treating genuinely necessary data as optional or making consent artificially mandatory for optional purposes. Specific legal question (RJ-09): which data are strictly necessary for each selected service, whether consent remains freely given when refusal prevents the service, whether another legal basis should apply to any operation, and what reduced experience can remain available. Decision requested: a purpose × data × legal basis × required/optional × refusal-or-withdrawal-consequence matrix, with approved wording for each checkbox.

Photo authorisation is separate and optional. I may refuse it and continue using the remaining service; only photo assessment and the conclusions derived from those photographs become unavailable.

When the consent flow is active, clinical data remains blocked in the product while mandatory consents are pending. The request records an initial 30-day period, which may be extended once for a further 30 days, with the extension recorded.

Yes, at any time and without justification. Withdrawal takes effect for the future and does not affect the lawfulness of processing already carried out.

Mandatory health data: withdrawal prevents the service from continuing and may be requested through privacy@ibettercoach.com or the public account-deletion flow.
Optional photographs: I may revoke or grant authorisation again on the dedicated consent page after signing in. Revocation immediately blocks new reads, new assessments and new URL issuance. A bearer URL issued before revocation may remain functional for no more than 15 minutes.

Each act is associated with the version and cryptographic digest (SHA-256) of the text actually shown. The Professional Customer cannot withdraw or give these consents on my behalf.

11. The Platform is an assistance tool — I am responsible for myself

I understand and accept that:

iBetterCoach is an assistance tool for my professional and for me. It is not a medical service, it does not replace medical consultation and it does not issue diagnoses.
The gamification and metrics presentation features are intended to celebrate habits and adherence and to reinforce my professional's prescription. The Platform does not encourage me to push beyond my limits (it does not pressure me into "one more rep" or "one more kilometre") and never exceeds my professional's prescription. Special care is given to weight/body metrics and to the protection of minors.
All information, suggestions, plans or recommendations presented by the Platform are informative and supportive in nature, and must be reviewed by my professional.
The Platform may produce incorrect information. I understand that automated calculations and entered data may produce content that is incorrect, outdated, incomplete or unsuitable for my specific case. For this reason, I must not treat any information from the Platform as absolute truth, I must keep a critical mindset and I must always validate with my professional and, where appropriate, with a doctor.
In case of any doubt about a health matter, symptom, pain, discomfort, medication, allergy, clinical condition or contraindication, I must consult a doctor or other qualified healthcare professional before acting.
I am responsible for myself: for my decisions, for respecting my own physical limits, for following my doctor's guidance, for honestly reporting my health status to my professional and for immediately stopping any exercise, meal plan or supplementation if I feel pain, dizziness, breathing difficulty or any other warning sign, and for seeking medical help.
The Platform cannot replace my common sense, my self-observation or the direct relationship between me and my healthcare professionals.

I declare that:

☐ I have read and understood this Informed Consent in full
☐ I had the opportunity to ask questions and received clarification
☐ I am 18 years of age or older (in this release, the Platform is intended only for adult Athletes; the submission of body photographs is only permitted from the age of 18)
☐ I understand that iBetterCoach is an assistance tool, that it does not replace medical advice, and that I am responsible for my own health decisions and for consulting qualified healthcare professionals in case of doubt
☐ I understand that the Platform may produce incorrect, inaccurate or unsuitable information for my case and that I must always critically validate it with my professional and, if necessary, with a doctor
☐ I expressly consent to the processing of my health and special category data by iBetterCoach and by my Professional Customer, for the purposes, conditions and periods described herein
☐ (Optional and separate) I authorise the use of body photographs for assessment and progress tracking; if I refuse, the remaining service continues to be available
☐ (Optional) I consent to the automatic synchronisation of health data from Apple Health / Health Connect, under the terms of section 3.1 — this consent is optional and revocable at any time

Date: [auto-filled by the Platform] Athlete identification: [auto-filled] Associated Professional Customer: [auto-filled] Consent version accepted: 1.3

Document prepared for iBetterCoach. Requires formal legal review before publication. The Consent must be presented to the Athlete on the dedicated consent page, with separate choices, never grouped with the general Terms or the Privacy Policy.