All-In Fit
עברית

Data Processing Addendum (Coaches)

Effective date: November 10, 2026 · Version 2026-11-10

This Data Processing Addendum ("DPA") forms part of the Coach Terms between you (the "Coach") and AllinFit, LLC ("All-In Fit"). It applies to personal data about your clients that you collect, enter or manage in the Services for your coaching business and for which you are the controller ("Client Data"). It does not apply to data that clients enter in their own accounts for their own use, for which All-In Fit is the controller under its Privacy Policy.

1. Roles and instructions

1.1. The Coach is the controller of Client Data, and All-In Fit is the processor (or "service provider" / "processor" under U.S. state laws).

1.2. All-In Fit processes Client Data only on the Coach's documented instructions, which are: providing the Services as described in the Coach Terms and as configured by the Coach, and complying with law. If an instruction appears to infringe data-protection law, All-In Fit will inform the Coach.

1.3. Details of processing. Subject matter and duration: providing the Services for the term of the Coach's account. Nature and purpose: hosting, storage, display, communication, analytics for the Coach, and AI-assisted drafting where the client has consented. Data subjects: the Coach's clients and prospective clients. Categories of data: identification and contact data; health and fitness data (body measurements, workouts, nutrition, check-ins, progress photos and videos); communications. Special categories: health data.

2. All-In Fit's obligations

All-In Fit will:

  • (a) ensure that personnel authorised to process Client Data are bound by confidentiality;
  • (b) implement appropriate technical and organisational security measures (including encryption in transit, access controls and database row-level security);
  • (c) not sell Client Data, not use it for its own purposes other than operating, securing and improving the Services with de-identified data, and not combine it with other data except as needed to provide the Services;
  • (d) assist the Coach, taking into account the nature of processing, in responding to data-subject requests and in meeting obligations relating to security, breach notification, data-protection impact assessments and prior consultation;
  • (e) notify the Coach without undue delay (and in any case within 72 hours of becoming aware) of a personal-data breach affecting Client Data, with the information reasonably available;
  • (f) at the end of the Coach's use of the Services, delete or return Client Data at the Coach's choice within a reasonable period, unless retention is required by law;
  • (g) make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits by the Coach or an auditor it mandates, no more than once a year, on reasonable notice, at the Coach's cost, using All-In Fit's existing documentation where it suffices.

3. Sub-processors

3.1. The Coach gives general authorisation for All-In Fit to engage the sub-processors listed in the Privacy Policy (including Supabase, Vercel, Anthropic, Google, xAI, Google Firebase and email providers).

3.2. All-In Fit will impose data-protection obligations on sub-processors equivalent to this DPA and remains responsible for their performance.

3.3. All-In Fit will give notice of new sub-processors by updating the Privacy Policy at least 14 days before they process Client Data. The Coach may object on reasonable data-protection grounds by emailing support@allinfit.app; if the parties cannot resolve the objection, the Coach may terminate the affected Services and receive a pro-rated refund of prepaid fees.

4. International transfers

Client Data may be processed in the United States and other countries where All-In Fit and its sub-processors operate. Where a transfer from the EEA, UK or Switzerland requires it, the parties agree to the European Commission's Standard Contractual Clauses (Module 2, controller-to-processor, and Module 3 for onward transfers), incorporated by reference, with the UK International Data Transfer Addendum and Swiss amendments as applicable.

5. The Coach's obligations

The Coach is responsible for having a lawful basis (including explicit consent where required for health data and photos) for the Client Data it provides and instructs All-In Fit to process, and for using AI features with a client's information only where that client has given AI consent.

6. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms of Use, except where such limitation is prohibited by applicable data-protection law. If this DPA conflicts with the Coach Terms or Terms of Use regarding Client Data, this DPA prevails.

Contact

AllinFit, LLC · support@allinfit.app (subject "DPA")