Privacy Policy

Account and registration information

• Name (display name) and email address — used to create and access your account.
• Password — stored as a hashed credential managed by our platform infrastructure; we cannot see your plain-text password.
• Date of birth — used to calculate your age for age-banded fitness benchmarking.
• Sex / gender — used for sex-stratified fitness benchmarking. You may select "Prefer not to say", though this limits benchmark accuracy.
• Town — used to help match you with a local participating gym.
• Account type — gym member, home fitness member, or personal trainer.
• Gym affiliation — the gym you are linked to, for challenges and leaderboards.

Profile information

• Profile photo and bio.
• Self-reported physical stats: bodyweight, height and body fat percentage. These are used for BMI and to inform certain fitness tests.
• Self-reported fitness experience level.

Fitness Test results and scores

• Raw performance results from fitness tests (e.g. distances, times, reps, weights, measurements).
• Your overall Fitness Score (a 1–100 value) and individual fitness component scores across the seven fitness components.
• Derived test scores and benchmarking data, including the age band and sex category applied when scoring your results.
• Cardio Fitness Age, where applicable, estimated from your cardio result.

Challenges, leaderboards and achievements

• Challenge entries and the results you submit, including any video links you choose to attach as evidence.
• Leaderboard information (your name, gym and result) so your ranking can be displayed to other users.
• Personal bests (PBs) tracked over time.
• Achievements, badges and experience points (XP) earned through platform activity.
• Comments you post on challenges.

Training plans and AI-generated content

• Workouts and training plans associated with your account.
• AI-generated personalised training plans, focus plans, fitness reports and progression recommendations produced from your assessment results.

Messaging and notifications

• Direct messages you send to or receive from other members.
• In-app notifications (e.g. leaderboard changes, new messages, achievements).
• Your preference for receiving email notifications.

Personal trainer features (where applicable)

• If you are a personal trainer, the client profiles you create (name, email, sex, date of birth, bodyweight, notes), workout programmes, session blocks, client results, measurements and progress photos you log.
• PT enquiry requests you submit to a gym (your name and email so the gym can reply).

Contact and enquiry information

• Information you provide through the contact form (name, email, subject and message).
• Information provided in a gym partnership enquiry (contact name, gym name, town, email and message).

Usage and technical information

• Authentication tokens and session data needed to keep you logged in.
• Basic technical data such as device type and browser, processed by our hosting infrastructure to operate and secure the Platform.

• To create and manage your account and authenticate you.
• To calculate your Fitness Score, component scores, benchmarks, Cardio Fitness Age and other results.
• To place you in the correct age and sex band for fair, age- and sex-stratified scoring.
• To run monthly challenges, verify entries and display leaderboards.
• To track your personal bests, achievements and progress over time.
• To generate personalised training plans, focus plans and fitness reports using AI based on your results.
• To enable messaging and notifications between members.
• To allow personal trainers to manage clients and log client results.
• To respond to contact and partnership enquiries.
• To operate, secure, maintain and improve the Platform.

Under the UK GDPR, we rely on the following lawful bases:

• Contract — to provide the account and services you signed up for (account, scoring, challenges, training plans).
• Consent — for optional features such as email notifications, profile photos, video evidence and AI-generated content. You can withdraw consent at any time.
• Legitimate interests — to operate and secure the Platform, display leaderboards, prevent fraud and misuse, and communicate with you about the service.
• Legal obligation — where we are required to retain certain records.

GymChamp uses AI (large language model) services to generate personalised fitness reports, training plans, focus plans and progression recommendations based on your assessment results. The information you provide (such as your test results, age and sex) may be sent to our AI provider as part of generating this content. AI-generated content is provided for general fitness and informational purposes only and is not medical advice.

Platform infrastructure

GymChamp is built on the Base44 platform, which provides hosting, database storage, authentication, file storage and integration services. Base44 acts as a processor and stores and processes your data on our behalf to operate the Platform.

Payment processing

Gym subscriptions for participating gyms are processed by Stripe. Stripe processes payment data (such as card details) directly and acts as an independent controller of that payment data. GymChamp does not store your full card details.

Email delivery

Transactional emails (such as verification codes and notifications) are sent through our platform's email delivery service, which processes the email address and message content necessary to deliver the email.

AI services

AI-generated content is produced using third-party large language model providers accessed through our platform. These providers process the prompts (which may include your fitness data) needed to generate your reports and plans.

Sign-in providers

If you choose to sign in with Google, Google authenticates you and shares the basic profile information needed to create or access your account.

Other members

Information you choose to make public — such as your display name, gym, challenge results, leaderboard rankings, comments and profile — is visible to other members in line with how you use the Platform.

Gyms

If you are linked to a participating gym, that gym can see engagement insights and may receive PT enquiry requests you submit to them. Partner gyms with a dashboard can view aggregate member engagement information.

Your data is stored in the Base44-hosted database and file storage. Access is restricted using role-based permissions and row-level security so that members can only access their own data (and, where relevant, data shared with them such as messages). Administrative access is limited to authorised GymChamp administrators.

We use authentication tokens rather than storing plain-text passwords, and we apply reasonable technical and organisational measures to protect your data. However, no method of transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

We keep your information for as long as your account is active. Fitness results, scores, challenge entries, achievements and training data are retained while you use the Platform so you can track progress over time.

If you delete your account, we anonymise or delete your personal data across the Platform (see "Account deletion" below). Some limited, non-personal records may be retained where required for legitimate business or legal purposes (for example, aggregated, de-identified analytics or records we are legally required to keep).

Contact and partnership enquiries are retained while your enquiry is open and for a reasonable period afterwards so we can respond to and resolve them.

Under the UK GDPR you have the right to:

• Be informed about how we use your data (this policy).
• Access the personal data we hold about you.
• Have inaccurate personal data corrected.
• Have your personal data deleted (the "right to erasure").
• Restrict or object to certain processing.
• Withdraw consent at any time where processing is based on consent.
• Data portability — to receive certain personal data in a structured, machine-readable format.
• Lodge a complaint with the UK Information Commissioner's Office (ICO).

To exercise any of these rights, contact us using the details at the end of this policy.

You can delete your account at any time from the Edit Profile area of your account. When you do, GymChamp deletes or anonymises your personal data across the Platform — including fitness results, scores, snapshots, challenge entries, training plans, workouts, messages, notifications, comments, achievements and profile information — and anonymises your user record.

Because the underlying authentication account is managed by our platform infrastructure, the account record itself may remain in a deactivated, anonymised state after deletion (it no longer holds personal data). If you require complete removal of the authentication record, contact us and we will arrange this.

GymChamp does not use advertising cookies or third-party tracking cookies. The Platform uses local storage on your device to keep you signed in and to remember basic preferences (such as dismissing a notice during your session). These are strictly necessary for the Platform to function and are not used to track you across other websites.

We may use first-party, aggregated analytics to understand how the Platform is used and to improve it. This does not involve selling your data or sharing it with advertising networks.

GymChamp is not directed at children. You must be 18 or older to create an account. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will take steps to delete it.

Some of the third parties we use (such as AI and sign-in providers) may process data outside the UK. Where this happens, appropriate safeguards (such as UK International Data Transfer Agreements or recognised adequacy decisions) are in place to protect your data.

We may update this policy from time to time. We will update the "Last updated" date above and, where significant changes are made, notify you through the Platform. Continued use after changes take effect constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or want to exercise your data protection rights, contact us through our Contact page or by the contact details provided there.

If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.