This text is a draft awaiting legal review. It will be updated before the app is submitted to the stores.
This policy explains how the CoachBase mobile app processes personal data. The data controller is Viritias, established in Istanbul, Türkiye.
CoachBase processes health data. Under Turkish data protection law (KVKK) health data is a special category of personal data and may only be processed with your explicit consent. Please read this document before you start using the app.
What we process
Account data. Name, email address, password (stored only as an irreversible hash), profile photo, gender, role (client or trainer).
Health and measurement data. Height, weight, body circumferences, body fat percentage, muscle mass, visceral fat, body mass index, basal metabolic rate; photographs of body composition reports; progress photos (front, side, back).
Training and nutrition data. Assigned programmes, completed sessions, set/rep/weight records, meal logs, calorie and macro values, meal photos, meal plans.
Weekly check-in data. Reported sleep, stress and energy levels, plus free-text notes.
Communication data. Messages between a client and their trainer.
Trainer verification documents. From trainer accounts only: certificate, diploma and identity document.
Technical data. Device push token, session information, in-app error records.
Why we process it, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Creating and running your account | Account data | Performance of a contract |
| Letting your trainer build programmes and plans | Health, training, nutrition, check-in data | Explicit consent |
| Verifying that trainers are qualified | Verification documents | Legitimate interest and legal obligation |
| Client–trainer communication | Messages | Performance of a contract |
| Sending reminder notifications | Device push token | Explicit consent |
| Security and abuse prevention | Technical data | Legitimate interest |
You may withdraw your consent to the processing of health data at any time. Withdrawing it makes the coaching features unusable; you can delete your account in that case.
Who can see your data
In CoachBase, authorisation is enforced at the database level, not in the app interface. The rules are:
- A client sees only their own data.
- A trainer sees only the data of clients they are actively linked to.
- When a trainer–client relationship is ended, the trainer's access stops immediately — including your progress photos.
- A trainer who has not passed document verification reaches no client data at all.
Photos are held in non-public storage and served only through short-lived, signed links.
Our administrators view verification documents solely to assess trainer applications. Administrator accounts do not have access to clients' health data. Every approval and rejection is logged with who made it and when.
Where it is stored
Our database and file storage are hosted in Frankfurt, Germany, inside the European Union. Our infrastructure provider is Supabase.
Session tokens are kept in the iOS Keychain or Android Keystore rather than in plain text on your device.
AI-assisted report scanning
The app includes an optional feature that lets you photograph a body composition report and have the values filled in automatically.
- If you do not use it, your photo is never sent anywhere.
- When you do use it, the photo is sent to our AI provider (Anthropic) for the sole purpose of reading the numbers on the report.
- The result is not saved automatically — you must review the preview and confirm it.
- Each account has a limited number of scans.
Third parties
| Party | Purpose | Location |
|---|---|---|
| Supabase | Database, file storage, authentication | Frankfurt, EU |
| Anthropic | Optional report scanning only | United States |
| Apple, Google | App distribution and notification delivery | United States |
We do not share your data with third parties for advertising, and we do not sell it.
Retention
Your data is kept for as long as your account is active. When you delete your account, your personal data is permanently deleted. Records we are legally required to retain (for example invoicing and payment records) are kept only for the applicable period and only for that purpose.
Your rights
Under Article 11 of the KVKK you have the right to learn whether your personal data is being processed; to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties to whom it is transferred, in Türkiye or abroad; to request correction if it is incomplete or inaccurate; to request erasure or destruction; to request that these actions be communicated to third parties the data was transferred to; to object to a result reached solely through automated analysis that works against you; and to claim compensation if you suffer damage from unlawful processing.
You can export your data and permanently delete your account from inside the app. If you cannot reach the app, follow the instructions on the account deletion page.
Children's data
CoachBase is not designed for people under 18, and we do not knowingly collect data from that age group.
Changes
When we change this policy we update the date shown at the top of the page, and for material changes we notify you inside the app.
Contact
Send questions about this policy, or requests relating to your rights, to the address below.
Questions about this document: coachbase@viritias.com