Privacy Policy
Last updated: 11 November 2026
1. Who we are
compleat is a coaching platform for online coaches, personal trainers and gyms. It is built and operated by MAX Hybrid Sport B.V., Mooie Vrouwenweg 45, 7608 RC Almelo, the Netherlands, registered with the Dutch Chamber of Commerce under number 68085885. The platform was previously called CompleteGym; both names refer to the same service.
This policy explains what personal data we handle when you use compleat as a client, coach or gym owner, when you visit our website, and when you connect a device such as a Garmin watch. It applies to the web app, the installable phone app and our public pages.
Questions about this policy or your data can be sent to info@compleatgym.com.
2. Our role, and your coach's or gym's role
Most people use compleat through a coach or a gym. That makes two parties responsible for your data, each for a different part.
Your coach or gym decides what happens with your coaching data. They invite you, write your program, read your training log and check-ins, and decide how long they keep your file. Under the GDPR they are the controller for that data and we are their processor: we store and handle it only on their instructions, under our Data Processing Agreement.
We are the controller for the account itself. That covers your login, your settings, the security of the platform, our own support contact with you, and the subscription an organisation holds with us.
In practice: a question about what your coach has recorded about you is best put to your coach first. Anything about your account, a device connection or this policy can come straight to us. If you ask us for something that is your coach's decision, we pass it on and tell you that we did.
3. The data we handle
We only hold what you, your coach or a device you connected puts into compleat. We do not buy data about you and we do not build advertising profiles.
| Category | What it contains | Where it comes from |
|---|---|---|
| Account | Name, email address, password hash or sign-in code, language, time zone, two-step verification settings | You, or your coach when inviting you |
| Profile | Phone number, date of birth, address, emergency contact, profile photo, goals | You or your coach |
| Training | Programs, planned and completed sessions, sets, weights, times, distances, notes, test results and personal records | You and your coach |
| Health and body | Weight, measurements, sleep, resting heart rate, heart rate variability, steps, mood, check-in answers, progress photos, injury notes | You, your coach, or a connected device |
| Nutrition | Meals you log, photos of meals, targets, supplements | You and your coach |
| Device data | Activities and daily health summaries from a wearable you connected (see section 6) | The device provider, after you agree |
| Messages | Messages, attachments and group conversations with your coach or gym | You and the people you talk to |
| Membership and payments | Membership, bookings, attendance, invoices, payment status, direct debit mandate reference | You, your gym and our payment provider. We never see or store full card or bank login details |
| Technical | IP address, browser and device type, sign-in times, error reports | Collected automatically when you use the service |
Coaches can also keep private notes about a client. Those notes are part of the coach's file and are not shown in the client's app.
4. Why we use it and on what basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Running your account and showing you and your coach your training, nutrition and progress | Account, profile, training, nutrition, messages | Performance of the agreement with you or your coach or gym (art. 6(1)(b)) |
| Coaching on health-related data | Health and body, device data, meal photos | Your explicit consent (art. 9(2)(a)), see section 5 |
| Memberships, bookings, invoices and payment collection | Membership and payments | Performance of the agreement; legal obligation for invoices and tax records (art. 6(1)(c)) |
| Sending service messages: sign-in codes, reminders, replies from your coach | Account, messages | Performance of the agreement |
| Keeping the platform secure and fixing errors | Technical, account | Our legitimate interest in a safe, working service (art. 6(1)(f)) |
| Product news to organisation owners | Email address | Legitimate interest; you can unsubscribe in every mail |
We do not sell personal data, we do not share it for advertising, and we do not make decisions about you by automated means alone.
5. Health data and your consent
Body weight, sleep, heart rate, injuries, meal photos and progress photos say something about your health. The law treats that as a special category, so we only process it with your explicit consent.
You give that consent in one step the first time you sign in. It covers sharing health-related data with the coach or gym that invited you, for the purpose of coaching you. Nothing else.
- Without consent you can still use your account, book classes and follow a program. Health-related fields, nutrition logging and device connections stay switched off, and your coach sees "Not shared" in those places.
- You can withdraw consent at any time under Profile → Account. From that moment your coach no longer sees the data. Withdrawing does not undo what happened before.
- Progress and check-in photos are stored in a private storage area. Only you and the coaches who have access to your file can open them.
- We keep a record of which version of the consent text you agreed to and when.
6. Connected devices and Garmin data
You can connect a wearable or training account so your sessions and recovery data arrive in compleat without typing them in. Connecting is always your own choice, made on the Connections page, and it requires the health consent from section 5.
How a connection works. You are sent to the provider's own sign-in page (for example Garmin Connect) and choose there what to share. We never see your Garmin password. Garmin then sends us the data you approved, from the moment you connect onwards.
What we receive from Garmin.
- Activities: type of sport, start time, duration, distance, pace or speed, power, heart rate, laps and the activity file.
- Daily health summaries, if you share them: sleep, resting heart rate, heart rate variability, steps and stress or body battery scores.
- Your Garmin user identifier, so we can match incoming data to your account.
What we use it for. To show the activity in your own training log, to link it to the session your coach planned, to fill your trackers, and to let the coaches with access to your file see it so they can adjust your training. If you switch it on, we also send workouts your coach planned to your Garmin account so they appear on your watch.
What we do not do with it. We do not sell device data, share it with advertisers or data brokers, combine it with data from other people for our own purposes, or use it to train AI models. Section 7 explains the one place where an AI provider may process it on your coach's instruction.
Disconnecting. You can disconnect under Connections at any time, or remove compleat in your Garmin Connect account. We then stop receiving data and delete the access tokens straight away. Activities already imported stay in your training log as part of your history until you delete them, ask us to, or delete your account. When Garmin tells us you withdrew permission, we treat that the same as disconnecting here.
The same rules apply to the other providers we support: COROS, Polar, Suunto, Whoop, Oura and Strava. You can always upload an activity file by hand instead.
7. AI features
Some features use a language model from Anthropic (Claude) to save you typing. Each one runs only when you or your coach starts it, and an organisation can switch them off entirely.
| Feature | What is sent to the model | Who starts it |
|---|---|---|
| Log a meal by photo, text or voice | The photo or the words you entered | You |
| Log training by describing it | Your message and the session it relates to | You |
| Import a program from a file | The contents of the file the coach uploads | Coach |
| "Ask about this client" and the weekly summary | That one client's sessions, check-ins, trackers and notes for the period asked about. This can include activities and daily summaries that came from a connected device | Coach |
What this means for you:
- The model returns a suggestion. You or your coach confirm it before anything is saved, and you can correct it.
- Anthropic processes the data on our instructions to produce the answer and does not use it to train its models.
- Passwords and payment data are never sent. A request contains the data of one person only.
- Answers and notes produced for a coach are visible only to coaches with access to that client's file.
- We log how often each feature is used and what it costs, not the content of your photos or messages beyond what the feature itself saves.
8. Who we share data with
Your data is seen by you, by the coaches and staff of your organisation who have access to your file, and by the companies below that run parts of the service for us. Each of them works under a contract that limits them to our instructions.
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | All data in your account | EU (Frankfurt) |
| Vercel | Hosting of the web app | Requests passing through the app, IP address | EU and US |
| Resend | Sending email | Email address, content of service mails | US |
| Mollie | Payments and direct debit | Name, email, amount, bank reference | Netherlands |
| Anthropic | AI features in section 7 | Content sent for that feature | US |
| Sentry | Error monitoring | Technical data, account identifier | EU and US |
| Apple, Google, Mozilla | Delivering push notifications | A device token and the notification text | Worldwide |
| Google Calendar | Calendar sync, only for coaches who switch it on | Session times and names in that coach's agenda | US |
| Garmin and other device providers | Sending us your activity data, receiving planned workouts | See section 6 | Varies by provider |
Other than this, we share data only when the law requires it, or with your coach's organisation when it is the controller of that data. If compleat were ever sold or merged, this policy would continue to apply to your data and we would tell you beforehand.
9. Where your data is stored
The database, sign-in system and file storage are in the European Union (Frankfurt, Germany).
Some of the providers in section 8 are based in the United States. Where data goes to them, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards that apply to a specific provider.
10. How long we keep data
| Data | Kept for |
|---|---|
| Your account and coaching file | As long as your account is active with a coach or gym. Your coach or gym decides when a file is closed |
| After you delete your account | Removed or made anonymous within 30 days. Tokens for connected devices are revoked at the provider at the same time |
| Invoices and payment records | 7 years, as Dutch tax law requires |
| Device access tokens | Until you disconnect |
| Sign-in and security logs | 12 months |
| Error reports | 90 days |
| API request logs | 30 days |
| Data read from a file during an import | 7 days after the import |
| Backups | Up to 30 days, then overwritten |
When an organisation stops using compleat, its data can be exported for 30 days and is deleted 90 days after the subscription ends, unless the organisation asks for earlier deletion.
11. Security
- All traffic is encrypted in transit, and the database and file storage are encrypted at rest.
- Access is enforced in the database itself: every record belongs to one organisation, a client sees only their own data, and a coach sees only the clients assigned to them unless the owner gives wider access.
- Owners and coaches can protect their account with two-step verification; an organisation can require it.
- Tokens for connected devices and payment providers are stored encrypted and are not readable through the app.
- Photos and attachments are kept in private storage and opened through short-lived links.
- Our own staff can only open an organisation's data for support, and each such access is logged.
If a breach affects your data, we report it to the Dutch Data Protection Authority within 72 hours where the law requires, and tell you and your organisation without delay if it is likely to put you at risk.
12. Your rights
You have the right to see your data, correct it, delete it, receive a copy, restrict or object to its use, and withdraw consent. Most of this you can do yourself:
| What you want | Where |
|---|---|
| See and correct your data | Profile, and each screen where you entered it |
| Download a copy | Profile → Account → Export my data |
| Withdraw health consent | Profile → Account → Privacy |
| Disconnect a device | Connections |
| Delete your account | Profile → Account → Delete account |
| Anything else, or a question | info@compleatgym.com |
We respond to a request within one month. We may ask you to confirm who you are first. Using these rights is free.
If you think we handle your data wrongly, tell us so we can put it right. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or to the authority in your own EU country.
13. Age, cookies and changes
Age. compleat is meant for people aged 16 and over. Younger athletes can only be added by a coach or gym with a parent's or guardian's permission, and the organisation is responsible for obtaining it.
Cookies. We use only the cookies needed to keep you signed in and remember your language and settings. We do not use advertising or cross-site tracking cookies. The details are in our Cookie Policy.
Changes. When we change this policy we publish the new version here with its date. If a change affects how we use health or device data, we ask for your consent again before it applies to you. Earlier versions are available on request.
Language. This policy is available in Dutch and English. If the versions differ, the Dutch version prevails.
14. Contact
MAX Hybrid Sport B.V.
Mooie Vrouwenweg 45
7608 RC Almelo, the Netherlands
Chamber of Commerce (KvK): 68085885
VAT: NL857295408B01
info@compleatgym.com