Privacy policy.
What we do with your data, why, where it is kept, for how long and how you decide about it. Includes the cookie policy.
In brief
- Movexa is the platform your gym, studio or trainer uses to manage its activity (in this policy, the "business"). The data the business records about you belongs to that business: it is the controller, and we process the data on its behalf.
- Your login account (email, password, the businesses you belong to) is processed by us, because the same account works across several businesses.
- Health data is only processed with your explicit consent, which you give and withdraw in the app. Under the age of 13, consent is given by the parent or guardian.
- The database, files and servers are in the European Union. Requests to artificial intelligence, notifications to your phone and some providers' logs leave the EU, with the safeguards described below.
- Artificial intelligence only uses your health data, workouts and training loads if you authorise it, and the gym can turn it off.
- We do not sell data, we do not show advertising in the app, and the app does not track what you do in other apps.
- You can view, correct, take away and delete your data. You can delete your account in the app itself or at movexagym.com/en/delete-account.
- For any question: rgpd@movexagym.com.
Who we are
Movexa is provided by Juliano Schorr, as a sole trader (em nome individual), NIF 327357754, Rua Ferreira de Castro, 93, 2.º Dto, 3880-218 Ovar, Portugal. Privacy contact: rgpd@movexagym.com.
We have not appointed a data protection officer. We have assessed that, at our current size, this is not mandatory; we will reassess as the number of businesses and of health data grows. In the meantime, the contact above handles everything.
Who decides about your data
The GDPR distinguishes between whoever decides what the data is used for (the controller) and whoever processes it on someone else's behalf (the processor). At Movexa, it depends on who you are:
| Who you are | Controller | Movexa’s role | Who to contact to exercise your rights |
|---|---|---|---|
| Website visitor | Movexa | Controller | Movexa |
| Owner or manager of a business that uses Movexa | Movexa (your customer account, the subscription and invoicing) | Controller | Movexa |
| Staff member of a business | The business (your employer or whoever engages you) | Processor; controller for your login account | The business; Movexa for the account |
| Member, student or client of a business | The business | Processor; controller for your login account | The business; Movexa for the account. If you write to us, we forward your request and help respond to it |
| Parent or guardian | The business | Processor; controller for your login account | The business; Movexa for the account |
| Person named by someone else (emergency contact, guardian, referral by a friend) | The business | Processor | The business |
We process the businesses' data according to each one's instructions and only use it for our own purposes in three cases: keeping the platform secure, complying with legal obligations and producing aggregated statistics that do not identify anyone.
What data we process
It depends on your role and on the features the business uses. You do not need to use all of them to have an account.
- Identification and contact: name, email, phone number, photograph, date of birth, NIF (tax number), address, emergency contacts and guardians.
- Account: password (stored encrypted, never in plain text), second factor, sessions, the businesses you belong to and your role in each one.
- Activity at the business: plans, signed contracts, bookings, attendance, entries (time and door), workouts, training loads, results, points, challenges and rankings.
- Health: health questionnaire (anamnesis), clinical record, physical assessments and measurements, progress photos, check-ins (weight, energy, sleep), injuries, restrictions, blood type, allergies and nutrition. Only with your consent (see health data).
- Facial recognition: a numerical model of your face, to enter the business through the kiosk. Only if you authorise it.
- Movement: daily steps and distance, read from your phone's motion sensor, if you allow it. We do not use Apple Health or Health Connect.
- Payments: amounts, status, method and references. Full card details go directly to the payment provider and never pass through us. The IBAN and the direct debit mandate are stored, because direct debit requires them.
- Content and messages: what you post in the feed, comments, stories, chat messages, conversations with MOovi and support requests.
- Technical: IP address, device type and app version, error and security logs.
- Sign-up source: when someone registers a business, we record which campaign they came from (the address parameters, such as utm_source), so that we know which campaigns work.
The data comes from you, from the business (which enrols you and records your activity), from people who name you as a contact or guardian, or from systems the business connects to its account. We do not collect your location.
Purposes, legal bases and retention periods
For the processing for which we are the controller:
| Purpose | Legal basis (GDPR) | For how long |
|---|---|---|
| Creating and managing your login account | Performance of a contract (Art. 6(1)(b)) | For as long as the account exists |
| Providing the service to businesses and charging the subscription | Performance of a contract (Art. 6(1)(b)) | For as long as the contract lasts |
| Invoicing and complying with tax obligations | Legal obligation (Art. 6(1)(c)) | 10 years (Portuguese Corporate Income Tax Code, Art. 123) |
| Security, abuse prevention, access logs | Legitimate interest (Art. 6(1)(f)): protecting the platform and the people who use it | 1 year for entry logs; up to 30 days for technical logs |
| Fixing app errors | Legitimate interest (Art. 6(1)(f)): an app that works | 30 to 90 days, depending on the provider’s plan |
| Responding to support and privacy requests | Performance of a contract or legal obligation | The duration of the request and the period in which it can be challenged |
| Knowing which campaigns new customers come from | Legitimate interest (Art. 6(1)(f)); measurement cookies only with consent | For as long as the business’s account exists; cookies: see below |
| Proving consents and objections | Legal obligation (Art. 7(1)) | 3 years |
Where the legal basis is legitimate interest, you can object (Art. 21): write to us and we will explain what changes.
For the data the business records about you, it is the business that defines the purpose and the legal basis; Movexa gives it the tools to record them, such as health consent.
Class invitations. If the business turns this feature on, Movexa uses, on its behalf, your bookings and absences from the last eight weeks to let you know when a class you usually attend has free spots. At most two notices per week, between 9:00 and 21:00, only for classes included in your plan. This is not advertising and the data does not leave the business. You can turn it off in Settings, under "Class invites".
Health data and facial recognition
Health data and biometric data are special categories of data (Art. 9). Therefore:
- Explicit consent, per business. Before you record health data, the app asks for your consent for that business to process it. You can withdraw it at any time in Settings; from then on, the business can no longer record new data on that basis.
- In-person consent. If you gave it at the front desk, the staff can record it; who recorded it and when is stored.
- Who sees it. Only the staff who look after you (trainer and management). Reception and sales staff do not see health data, unless the business gives them that access.
- Facial recognition. It has its own consent. Without it, your face is not captured or used, and you enter with the QR code. Withdrawing it deletes your face model.
- Never used for advertising, never sold.
- Notifications. Notifications do not contain answers from the health questionnaire, assessments or the clinical record, but they may contain an excerpt of what someone wrote, such as a check-in comment or the trainer's reply.
- The Face ID or fingerprint you use to sign in to the app is verified by your phone; Movexa never receives it.
Artificial intelligence
Some features use artificial intelligence from Anthropic, in the USA. Anthropic deletes requests and responses within 30 days and, under its commercial terms, does not use them to train models. The output is generated by AI and may contain errors: a person always decides what to do with it. The business can turn AI off in Settings.
| Feature | Who uses it | What is sent | Consent |
|---|---|---|---|
| Physical progress analysis | The member and the staff | Physical assessments, without the name | The member’s, always (health data) |
| Virtual PT | The member | What you write and your training context | The member’s |
| Load progression suggestions | The member and the trainer | The plan’s loads and notes, without the name | The member’s |
| Generating a training plan | The trainer | Goal, level, days and equipment; restrictions and load history only with consent; without the name | The member’s, for restrictions and loads |
| MOovi, the management assistant | The staff | Business data that the role has access to, including names; a member’s workouts, loads and notes only if they have consented | The business decides; the member, for their own workouts |
| Retention suggestions and sales targets | The staff | Indicators with pseudonyms (S1, S2), without names | The business decides |
| Help with importing data | The staff | Column names and masked examples | The business decides |
Under the age of 13, AI consents are given by the parent or guardian. Anyone talking to MOovi or to the Virtual PT is told that they are talking to an AI.
Profiling and automated decisions
- Dropout risk. Every day we calculate, for each member, an indicator based on three data points: days without coming in, when their plan ends and whether there are overdue payments. Only the staff see it, so that they know whom to call. It does not decide anything on its own: nobody is suspended, charged or refused because of it.
- Automations. The business can turn on automatic messages, such as reaching out to someone who has not come in for a while or a reminder about an overdue payment. They are messages, not decisions. You can ask the business not to send them to you.
- Rankings. Your results may appear in the business's rankings (WOD, spinning, points, challenges). You can choose not to appear in Settings; you will still see your own results.
There are no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22).
Who receives data and where it is kept
For the platform to work, we use the following providers. They all process data only on our behalf, under a data processing agreement.
| Provider | Purpose | Location | Safeguard outside the EU |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Database and files | Ireland | Standard contractual clauses, for access from outside the EU |
| Railway (Railway Corporation) | API servers | Netherlands (Amsterdam) | Standard contractual clauses |
| Vercel (Vercel Inc.) | Website and web application | Ireland (Dublin) | EU-US Data Privacy Framework |
| Resend (Plus Five Five, Inc.) | System emails (invitations, confirmations) | Sent via Ireland; content and logs stored in the USA | Standard contractual clauses |
| Anthropic | Artificial intelligence | USA | Standard contractual clauses |
| Sentry (Functional Software, Inc.) | App errors | Germany (Frankfurt) | EU-US Data Privacy Framework |
| Expo (650 Industries, Inc.), Apple and Google | Phone notifications | USA | Expo and Google: EU-US Data Privacy Framework; Apple: standard contractual clauses |
| Hostinger (HOSTINGER, UAB) | Contact email | Lithuania | Not applicable |
| Cloudflare | Domain DNS (website traffic does not pass through it) | Global | EU-US Data Privacy Framework |
| Google, Meta and TikTok | Measuring campaigns on the website, only with consent (see cookies) | USA and other countries | Google and Meta: EU-US Data Privacy Framework; TikTok: standard contractual clauses |
Business integrations. Payments (Stripe, Eupago), invoicing (InvoiceXpress), SMS (Twilio), the business's own email and calendar (Google) only work when the business connects its own account. In that case, it is the business that chooses the provider, and the necessary data is sent to that provider under its terms.
Other people. What you post in the feed, in stories and in rankings is seen by the other members of the business. Do not post other people's data without their permission.
Authorities. Only when required by law and upon a valid request.
You can ask us for a copy of the transfer safeguards at rgpd@movexagym.com.
How long we keep data
| Data | Period | Where the period comes from |
|---|---|---|
| Login account | For as long as it exists; when you delete it, the personal data is removed immediately | Performance of a contract |
| Data the business records about you | The business decides, within the limits below; if the business leaves Movexa, we delete it at the business’s request | The business’s instructions |
| Physical assessments and health questionnaire | Deleted 2 years after you stop having an active membership at any business | Our decision: the minimum necessary |
| Entry logs at the business | 1 year | Security |
| Payments and invoices | 10 years; without your name if you delete your account | Portuguese Corporate Income Tax Code, Art. 123 |
| Signed contracts | For as long as they may be needed as evidence; without your name if you delete your account | Limitation period |
| Proof of consent given in forms (sign-ups, bookings, contact requests) | 3 years | Evidence (GDPR, Art. 7(1)) |
| Feed stories | Visible for 24 hours; kept until you delete them or delete your account | Your choice |
| AI requests at Anthropic | Up to 30 days | Anthropic’s terms |
| App errors (Sentry) | 30 to 90 days | Provider’s plan |
| System emails (Resend) | 30 days | Provider’s plan |
| Technical server logs | Up to 30 days | Provider’s plan |
| Database backups | 7 days | Provider’s plan |
Your rights
| Right | How to exercise it |
|---|---|
| Access to and a copy of your data | Ask at rgpd@movexagym.com; we send it in a machine-readable format, which you can also use to take it elsewhere (portability) |
| Rectification | In the app, in Settings; or ask the business |
| Erasure | Delete your account in Settings, in the app or on the web, or at movexagym.com/en/delete-account |
| Withdrawing consent | In Settings: health data, AI, facial recognition, marketing, rankings |
| Objection and restriction | Write to us; for the business’s data, to the business |
| Not being subject to automated decisions | There are none (see profiling); if you think there are, write to us |
It is free of charge. We respond within one month; if the request is complex, we will let you know within that month and may take up to two further months. We may ask you to confirm your identity, only as far as necessary. Requests about a business's data are forwarded to that business, and we help it respond.
Deceased persons. Their data remains protected. The person designated by the data subject or, failing that, their heirs may request access, rectification or erasure (Law 58/2019, Art. 17).
If you believe we have not handled your data properly, you can lodge a complaint with the Comissão Nacional de Proteção de Dados, the Portuguese data protection authority (cnpd.pt). We would appreciate it if you wrote to us first, so that we can try to resolve it, but this is not mandatory.
Minors
From the age of 13, each person decides on their own consents (Law 58/2019, Art. 16). Under 13, consents are given by the parent or guardian, in their own app, under My Children. The child can always withdraw a consent or ask not to appear in rankings. A minor's date of birth can only be corrected by the business. Minors' data is not used for marketing without the parent or guardian's consent.
Security and data breaches
- Connections always encrypted (HTTPS, with HSTS).
- Encrypted passwords, two-factor authentication and a limit on login attempts.
- Each staff member sees only what their role allows; important staff actions (members, payments, roles, credentials) are logged.
- Photographs and personal documents in private storage, delivered through links that expire.
- Integration credentials are never shown on screen.
- Data in the European Union and daily backups.
No system is infallible. If there is a data breach that puts your rights at risk, we notify the CNPD within the legal deadline (72 hours) and notify you directly when the risk is high. When the data belongs to a business, we notify the business without delay, so that it can meet its obligations. We record all incidents, even those that do not need to be notified.
App permissions
| Permission | Purpose | Required? |
|---|---|---|
| Camera | Scanning QR codes at the entrance; progress and profile photos | No |
| Photos | Choosing progress and profile photos | No |
| Face ID or fingerprint | Signing in without typing your password; verified on the phone | No |
| Motion | Counting your daily steps | No |
| Notifications | Alerts about classes, payments, messages | No |
| Local network | Showing workouts on a TV (Chromecast) | No |
The app does not ask for your location, does not use advertising identifiers and does not track you in other apps. You can change the permissions in your phone's settings.
Communications
- From the service: invitations, confirmations, receipts, account notices. They are not marketing and you cannot turn them off while you use the service.
- From the business to you: campaigns, SMS or WhatsApp messages sent by the business through Movexa. The business is the controller, and you only receive them if you have consented; you can withdraw in Settings.
- From Movexa to its customers: if we send product news to our customers, it will always include a simple way to stop receiving it.
Changes to this policy
When we change something significant, we let you know in the app or by email before the change takes effect and, if necessary, ask for your choice again.
| Version | Date | What changed |
|---|---|---|
| 1 | 28 September 2026 | First published version |
| 1.1 | 28 September 2026 | Invitations to classes with free spots, based on your bookings |