Privacy Policy

This Privacy Policy explains what personal data the App collects, why, the legal basis for processing it, who we share it with, how long we keep it, and the rights you have. It also covers what happens when you buy a Founding membership on this website. We are based in the Netherlands, so the EU General Data Protection Regulation (GDPR) applies, and this policy is written around it.

This policy is published at https://doctoryaad.com/privacy and is linked inside the App under Settings → Legal.

1. Who we are

The App is a calisthenics training tool with an adaptive AI coach. Doctor Yaad is run by YSA Medical Services (eenmanszaak), KvK 88159396, Valkreek 52, 3079 AN Rotterdam, The Netherlands, which is the data controller responsible for your personal data. If you have any question about this policy or your data, contact us at yaad@doctoryaad.com.

2. What data we collect

We only collect what we need to run the App and provide coaching. We do not sell your data.

a) Account data: your email address (the only login identifier). We use passwordless sign-in: you log in with a one-time code / magic link sent to your email. We never collect or store a password.

b) Athlete profile: the information you give us to personalise training:

• Name (or display name)
• Sex
• Body weight and height
• Training level / experience
• Training goals
• Training days / weekly availability
• Available equipment
• Strength statistics (e.g. your numbers on key lifts and holds)

c) Training data: generated as you use the App:

• Workout sessions and the sets you complete (reps, load, hold times)
• Daily / pre-session check-ins: sleep, readiness, perceived recovery, stress, and soreness levels
• Pain reports, including the body site and severity of any pain you report
• Training decisions made by the engine (e.g. load changes, regressions, deloads)
• Coach-chat conversation logs: the messages you send to the AI coach and its replies

d) Technical data: crash reports, error logs, and diagnostic information (via Sentry, see Section 5) so we can fix bugs and keep the App stable.

e) Founding membership data: when you buy a Founding membership on doctoryaad.com.

• Your name and email address, your billing address (Stripe uses it to work out the VAT due and to check the country you buy from), the plan you chose, the amount paid, and the payment and subscription references Stripe gives us
• Whether your membership is active or has ended
• If you join the Founders Discord: your Discord user ID
• Your card details go straight to Stripe. We never see or store your card number

We keep a small record of each Founding member (our “founder ledger”) so we know who has a spot, can send your TestFlight invite, and can take away app access when a membership ends.

f) Website analytics and marketing, only if you accept cookies: the first time you visit doctoryaad.com a banner asks whether you accept analytics and marketing cookies. Your choice (accept or decline) is saved in your own browser. Only if you accept do we load Google Analytics (which pages you visit and how you use the site, plus a sign-up event when you join the waitlist) and the Meta Pixel(page views and a sign-up event when you join the waitlist, so we can measure and reach the right people with our content on Meta’s platforms). Both set their own cookies and receive technical data such as your IP address, browser and device. If you decline, or ignore the banner, neither is loaded and nothing is sent to Google or Meta. To change your choice, clear this site’s data in your browser and the banner will ask again. The App itself contains neither.

Sensitive / health-adjacent data. Pain reports, soreness, recovery and body-metric data describe your physical state and are sensitive. We treat them with extra care, process them only to provide the training and pain-management features you ask for, and rely on your explicit consent for them (see Section 4). You can withdraw that consent at any time by deleting your account (Section 8).

3. Why we collect it (purposes)

We do not use your App data (your profile, training, check-ins, pain reports or coach chats) for advertising or profiling unrelated to training, and the App runs no ad-tracking. The only advertising-related tool we use is the Meta Pixel on the website, and only if you accept cookies (Section 2f).

4. Legal basis (GDPR Article 6 and 9)

• Contract (Art. 6(1)(b)): processing your account and core training data is necessary to provide the App you signed up for.
• Explicit consent (Art. 9(2)(a)): for health-adjacent data (pain, soreness, recovery, body metrics) we rely on your explicit consent, captured during onboarding. You may withdraw consent at any time (Section 8); withdrawal does not affect processing already carried out.
• Legal obligation (Art. 6(1)(c)): we keep payment records for as long as Dutch tax law requires.
• Legitimate interests (Art. 6(1)(f)): for crash reporting, security, and preventing abuse, balanced against your rights.
• Consent (Art. 6(1)(a)): for any optional features you separately opt into, and for website analytics and marketing cookies (Google Analytics, Meta Pixel), which load only after you accept them.

5. Who we share data with (sub-processors)

We use a small number of trusted service providers (“sub-processors”) to run the App. Each only receives the data needed for its function, and each is bound by a data processing agreement.

About crash reporting (Sentry). Before any crash report leaves your device, we scrub the free text you typed: chat messages and pain notes are redacted on-device, so diagnostic data does not contain what you wrote. Crash reports are tagged with a pseudonymous device identifier: a random ID stored only on your device, never derived from or linked to your account, which automatically regenerates every 30 days so old reports stop correlating to your device on their own.

About the AI coach specifically. When you chat with the coach, the App sends your message and a packet of your training context to an AI model so it can answer with awareness of your training. Every coach conversation goes through OpenRouter to an open model (DeepSeek) that runs at DeepInfra. When DeepInfra cannot answer at that moment, the same model answers at CoreWeave or Together instead. All of them are based in the United States. Every request names those three as the only hosts allowed to answer it and asks for zero data retention: OpenRouter is told not to store your data, and only a host that does not store your messages or the replies may serve it. If none of them can answer, the request is not sent anywhere else.

As a general precaution, do not share information in the coach chat that you would not want sent to these providers for processing.

We may also disclose data where required by law, or to protect our rights, users, or the public.

6. Where your data is stored and international transfers

Your account and training database (Supabase) is hosted in the European Union (Ireland). Where each sub-processor stores or processes your data:

Where data is processed outside the European Economic Area (EEA), currently by OpenRouter, DeepInfra, CoreWeave, Together, Expo / EAS, Resend, Vercel and Discord, all based in the United States, by Sentry’s US company, and by the US parent companies of Apple, Stripe, Google and Meta, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework.

7. How long we keep data (retention)

• Account, profile, and training data: kept while your account is active. Deleted when you delete your account (Section 8).
• Coach-chat logs: kept while your account is active, and deleted when you delete your account.
• Pain / health-adjacent data: kept while your account is active, and deleted when you delete your account.
• Crash / diagnostic data: kept for 90 days, then automatically deleted. Crash reports are scrubbed on-device before they are sent. Free text you typed (chat messages, pain notes) is redacted, so diagnostic data does not contain what you wrote.
• Founding membership records: kept while your membership is active. After it ends we keep the payment records Dutch tax law requires us to keep (7 years), and nothing more than that.
• Emails: Resend keeps a log of the emails we sent you for a limited period. If you joined the waitlist, your name and email stay on it until you unsubscribe (every email has a link).
• Website analytics (only if you accepted cookies): Google Analytics keeps usage data for the retention period set in our Google Analytics account; Meta keeps Pixel data under its own retention rules. Your cookie choice stays in your browser until you clear it.
• After account deletion: your data and authentication account are erased (Section 8). Backups that may contain residual copies are overwritten on our hosting provider's standard backup rotation.

8. Your rights and how to use them

Under the GDPR you have the right to:

• Access a copy of your data
• Rectify inaccurate data (you can edit most profile data in the App)
• Erase your data (“right to be forgotten”)
• Port your data (receive it in a portable format)
• Object to / restrict certain processing
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with a supervisory authority: in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl)

In-app account deletion. You can delete your account from within the App, in its settings, or by emailing us at yaad@doctoryaad.com. Deletion erases your personal data and your authentication account.

Other requests. To exercise access, portability, rectification, objection, restriction, or to withdraw consent, email yaad@doctoryaad.com. We will respond within one month as required by the GDPR (extendable by two further months for complex requests, with notice). We may ask you to verify your identity first.

9. Children

The App is intended for users aged 16 and over and is not directed at children under that age. (The Netherlands sets the GDPR digital-consent age at 16.) We do not knowingly collect data from anyone under the minimum age. If you believe a child has provided us data, contact yaad@doctoryaad.com and we will delete it.

10. Security

We use reasonable technical and organisational measures to protect your data, including encrypted transport, access controls at our sub-processors, on-device redaction of free text before crash reports are sent, and pseudonymous crash identifiers that expire on their own. No system is perfectly secure; we cannot guarantee absolute security.

11. Changes to this policy

We may update this policy. If we make material changes, we will notify you in the App or by email and update the effective date above. Continued use after changes take effect means you accept the updated policy.

12. Contact

Questions or requests: yaad@doctoryaad.com
Data controller: Doctor Yaad is run by YSA Medical Services (eenmanszaak), KvK 88159396, Valkreek 52, 3079 AN Rotterdam, The Netherlands.