Privacy · Bicapp

Who is responsible

Bicapp is software for personal trainers and gyms, and for their clients and members. Bicapp belongs to [to be decided: company name of the VOF] (Chamber of Commerce (KvK) number [to be decided: Chamber of Commerce number of the VOF], VAT [to be decided: VAT number of the VOF]), [to be decided: address of the VOF]. Who is responsible for your data depends on how you use Bicapp.

If you train with a coach, your coach is responsible. If your coach works for a personal training business, that business is. Bicapp processes your data on their behalf, under the processing agreement.
If you are a member of a gym and do not have your own personal trainer, the gym is responsible. Bicapp processes your data on behalf of the gym. If the gym links you to a personal trainer, from that moment the same applies as for someone who trains with a coach.
If you are a coach or the owner of a business, Bicapp is responsible for your account data. For your clients' data, you are, or your business is if you work for a personal training business.
If you request a pilot on the website, Bicapp is responsible.

Bicapp's technology is built and managed for us by DeChef-AI. This is listed below under the parties we work with.

Send questions about privacy to info@bicapp.nl. If you train with a coach, you can also ask your coach. If you are a member of a gym, you can also ask the gym. Bicapp is for people aged 18 and over.

What data we use

Your name, your email address and your year of birth, for your account.
If you train with a coach, this covers your goals, training days and level, your height and weight, body measurements, progress photos, injuries and medical information, your lifestyle (work, sleep, alcohol, coffee and other sports), nutrition, sleep, energy, mood and your workouts. Also your check-ins and your chat messages, and whether you use the male or female figure in the muscle map.
Your coach's notes, such as your job, your hobbies and your birthday. You do not see these in the app, but you do get them when you export your data.
If you are a member of a gym and do not have your own personal trainer, this covers your height and weight, your goal, how you feel at the start (physically, mentally and your stress), your training days, level and other sports, your lifestyle, injuries and what you fill in under Medical and Rather not. After that, your plans, your daily target for calories and protein, your workouts, what you eat and drink, your diary, your body measurements and, if you want, progress photos. You log what you eat by name or with a barcode, not with a photo. You then have no chat. If you ask for a coach in the app, we keep that request, with what you write with it.
A photo of your meal, if you train with a coach. The app first makes the photo smaller and removes the location data. Claude by Anthropic, via AWS in the EU, makes a suggestion of what is on it. There the photo is not stored and not used to train AI. With us the photo is kept in your diary, so your coach can see it. What was recognised on the photo, such as the foods, the grams and the kcal, we keep with the request. That is also in your export.
A tailored plan, if you are a member of a gym without your own personal trainer. Claude by Anthropic, via AWS in the EU, then gets your goal, how many days a week you train, your level, whether you train at home or in the gym, how long a workout may last and the exercises it may choose. From your height, your weight, your year of birth and the figure you chose (male or female) we first work out ourselves roughly how many calories and how much protein suit you. Claude only gets that result, not your height or your weight. Your injuries and what you fill in under Medical and Rather not are never sent. We keep your daily target with your data, and the plan if you use it. With the request itself we only keep counts, such as how many workouts it contains.
A first draft of a workout or programme, if your coach asks for one in the builder. Claude then gets your goal, your level, how many days a week and for how long you train, which muscle groups you want to train extra and the exercises your coach chooses from. Bicapp only adds the muscles that bother you if you gave consent for your health data. Bicapp never adds your name or your email address. What your coach writes with the request is sent as it is written. In the dashboard we ask your coach not to put names or medical data in it. We keep the first draft with the request, but not what your coach wrote.
Your daily steps from Apple Health or Health Connect, only if you turn this on in the app. Bicapp reads nothing else from there and never uses that data for advertising.
If you are a coach, this covers your name, your email address, the name of your business, whether you are a freelance personal trainer or a personal training business, the address of your page and the link with your authenticator app. Also what you create and write in Bicapp, and who you invite.
A pilot. If you request a pilot on the website, we keep your name, your email address, the name of your business, how many personal trainers and clients you have and your answer about where you get stuck. Only to get in touch with you.
Your IP address and what your device sends along, in the logs of the services we use. On the website we count, without cookies, which pages are visited and how many people request a pilot. These are counts, not profiles. In the app we do not measure how you use it.

Your health data and your consent

Under the General Data Protection Regulation (GDPR, in Dutch the AVG), data about your health is a special category of personal data. It is only used with your explicit consent (Article 9(2)(a) GDPR). You give it separately in the app, and the box is never ticked in advance. That consent covers your coaching, including when your coach has AI make a first draft of your programme, your tailored plan if you are a member of a gym without your own personal trainer, and the suggestion for a photo of your meal. We keep a record of which version of the text you saw and when.

We ask for progress photos separately, and they are voluntary. You can always withdraw your consent in the app. What happened before that remains lawful. Without consent for health data your coach cannot coach you in Bicapp, and as a member without your own personal trainer you get no tailored plan and no suggestion for a ready-made plan.

If you train with a coach, your weight, photos and nutrition are only visible to you and your coach. If your coach works for a personal training business, the owner and the administrators of that business can see them too. A gym never sees them, it only sees counts per coach. Your photos are kept in secured storage and only open via links that expire quickly.

If you are a member of a gym and do not have your own personal trainer, your data is only visible to you. The gym sees your name, your email address, your goal, since when you have taken part and whether you have signed in yet. If you ask for a coach, the gym also sees that request, with what you are looking for help with and your message. If you choose, for example, pregnant or rehabilitation after an injury there, or write something about your health in your message, the gym sees that too. Your workouts, your weight, what you eat and anything else you fill in about your health in the app, the gym never sees. If the gym then links you to one of its personal trainers, you become a client of that personal trainer. They then also see what you tracked in the app before, such as your plan, your workouts, what you ate and your diary.

What we use it for

Coaching you in the app, with your programme, your check-ins and the chat, including with a first draft of your programme that AI makes for your coach. The legal basis is the agreement with your coach and your consent.
Making the app work if you are a member of a gym without your own personal trainer, with your tailored plan, your daily target and your workouts. The legal basis is the agreement with your gym and your consent for health data.
Passing your request for a coach on to your gym. The legal basis is your request.
Making a suggestion of what is on a photo of your meal, so you can log faster. The legal basis is your consent for health data.
Letting you sign in and sending you email, such as your sign-in code, an invitation from your coach or a reminder. The legal basis is the agreement.
Your account as a coach, your workspace and your team. The legal basis is the agreement.
Keeping Bicapp secure, fixing errors and making backups. The legal basis is legitimate interest.
Getting in touch after a request for a pilot. The legal basis is your request.
Counting how the website is used, without cookies and without profiles. The legal basis is legitimate interest.

Who decides about your programme

If you train with a coach, your coach decides. Your coach makes your programme and approves it before you see it. If your coach has AI set up a first draft of a workout or programme, your coach adjusts that first draft and approves it. You only see it after that approval.

If you are a member of a gym and do not have your own personal trainer, AI makes your tailored plan, within fixed limits. AI only chooses exercises from Bicapp's library, and we leave out jumps and exercises that need a lot of technique. Before you see the plan, fixed rules check the number of workouts, the sets, the repetitions and the rest, and whether a beginner only gets full body. If something is not right, you get a ready-made plan that the app chooses with fixed rules based on your goal, your days and your level. You also get a daily target for calories and protein. That is an estimate, not a prescription. You choose whether to use the plan. You can always choose a different plan or make one yourself.

If you have an injury, or fill in something under Medical or Rather not, AI does not make a plan. You then get the advice to train with a coach. If you did not give consent for your health data, AI does not make a plan either.

With a photo of your meal you first see the suggestion and adjust it before anything goes into your diary. No decisions are made about you without you or your coach looking at them.

Who we work with

These parties process data for us, and only for us. With each of them we have written agreements, in a processing agreement or in their terms and conditions.

Party	What for	Where	Outside the EU
Supabase	Database, signing in and storage of your data and photos	Paris (EU)	Supabase Inc. in the US can access data for support and maintenance. This is allowed on the basis of standard contractual clauses
AWS Bedrock	Claude by Anthropic, for three things. A suggestion of what is on a photo of your meal, which you check before you log it, if you train with a coach. A tailored plan with a daily target, if you are a member of a gym and do not have your own personal trainer. And a first draft of a workout or programme, if your coach asks for one in the builder. Exactly what is sent is described under What data we use. Bicapp itself never adds your name or your email address. What your coach writes when asking for a first draft is sent as it is written. AWS keeps nothing of the request, Anthropic does not get to see it and it is not used to train AI	EU. The request starts in Frankfurt, then AWS chooses a region within the EU	The parent company Amazon is in the US. This is allowed on the basis of the EU-US Data Privacy Framework
Resend	Email, such as sign-in codes, invitations, confirmations and reminders	We have the email sent from Ireland. Resend's account and log are in the US	Resend Inc. in the US. This is allowed on the basis of the EU-US Data Privacy Framework
Cloudflare	The website, the web version of the app and the coach dashboard, and forwarding email to info@bicapp.nl. Also the bot check (Turnstile) on the forms on the website, when signing in to the app and the dashboard and before you delete your account	Worldwide, via the nearest server	Cloudflare Inc. in the US. This is allowed on the basis of the EU-US Data Privacy Framework, with standard contractual clauses in the contract
PostHog	Only on the website. Counts, without cookies, how many people request a pilot. Never health data	Frankfurt (EU)	PostHog Inc. in the US is the parent company. This is allowed on the basis of standard contractual clauses
GitHub	Every night an encrypted copy (backup) of the database, kept for 30 days. The copy is made on a temporary GitHub computer and sits there unencrypted for a few minutes. The key is held by DeChef-AI, not by GitHub. The photos in storage are not in the copy	US	GitHub, Inc. (part of Microsoft) in the US. This is allowed on the basis of the EU-US Data Privacy Framework and standard contractual clauses
DeChef-AI	Builds and manages Bicapp's technology. Manages the GitHub account for the backups and its key. Email to info@bicapp.nl arrives here, because Cloudflare forwards it to a DeChef-AI mailbox	The Netherlands. The mailbox is hosted by Strato, in Germany (EU)	None. DeChef-AI and Strato are in the EU

Responsible themselves

These parties decide for themselves what they do with your data. Their own privacy statement therefore applies.

Party	What for	Where	Outside the EU
Open Food Facts	Product data when you scan a barcode or search for a product. Your phone asks Open Food Facts directly, which sees the barcode or search term and your phone's IP address, not who you are	France (EU)	None. It is a French organisation in the EU

Coaches and businesses pay Bicapp by invoice or with a payment link. Which payment service goes with that has not been decided yet. As soon as it has, it will be listed here.

Where your data is stored

The database, signing in and the storage of your photos are in Paris, in the EU. Some goes to the US, namely the backups at GitHub and what Resend and Cloudflare keep. Supabase, AWS and PostHog have an American parent company, which can access data for support or maintenance.

For each American party, the ground on which this is allowed is listed above. That is the EU-US Data Privacy Framework, or the standard contractual clauses of the European Commission. Where a service offers the choice, we choose the EU and turn off the option that would let your data be used to improve their own software.

How long we keep it

What	How long
If you train with a coach	As long as your package with your coach runs, and 24 months after that. During that time you can still export your data. If you get a new package, the period starts again after that package. After that we delete everything automatically.
If you are a member of a gym and do not have your own personal trainer	24 months after the last time you logged something or signed in. You get an email one month beforehand. If you log something after that, your account simply stays. This also applies if the gym ends your membership in the app.
A sign-in without an account	If you sign in but do not finish creating an account, as a client or as a coach, we delete the sign-in 30 days after your last sign-in.
Your account as a coach	As long as your account exists. If you want us to delete it, email info@bicapp.nl. What then happens to your clients' data is set out in the processing agreement.
Your account deleted	Everything is gone within 30 days, including from the backups. What remains is listed below.
Backups	30 days. After that a backup disappears automatically.
Invoices and payments	7 years, because the law requires it. Invoices to coaches and businesses are kept in Bicapp's accounts.
Entries in the log	For a few steps we write an entry with only numbers and a time, without a name, email address or content. These are creating an account or workspace, accepting an invitation, exporting your data and deleting your account. We keep the entry that an account was deleted for 12 months. That way we can show that the deletion went well. We keep the other entries for as long as they are needed to show that everything went securely and according to the rules.
A request for a pilot, if you do not become a client	6 months.
Email you send to info@bicapp.nl	Is kept in the DeChef-AI mailbox. We keep it for as long as we need it for your question. At your request we delete it sooner.

If you delete your account

As a client or as a member of a gym you delete your account in the app. Everything is then gone within 30 days, including from the backups. It takes that long because a backup stays for 30 days and then disappears automatically. Three things remain, namely your invoices (7 years), the entries in the log with only numbers, and email you sent us yourself. We delete that email if you ask us to. If you are a coach, email info@bicapp.nl to have your account deleted.

If a coach or a business stops using Bicapp, the processing agreement sets out what happens to the clients' data.

Your rights

Access. You see your data in the app. If you want to know what else we keep about you, ask us.
Export. In the app you download all your data in one go, as a file with your figures and links to your photos. Those links work for 7 days.
Deletion. As a client or as a member of a gym you delete your account in the app. Everything is then gone within 30 days, apart from the exceptions above. If you are a coach, or you have only requested a pilot, email info@bicapp.nl.
Correction, objection and restriction. If something is not right, or you want us to stop something, let us know.
Withdrawing consent. You can always do this, in the app.

If you send a request to info@bicapp.nl, we respond within one month.

If you train with a coach, your coach is responsible. If you are a member of a gym without your own personal trainer, the gym is. If your request reaches us, we pass it on to your coach or your gym and help with the answer. You can always export and delete your data yourself in the app.

If you cannot resolve it, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

Data is sent and stored encrypted. Each coach only sees their own clients, and this is enforced in the database itself. Of a personal trainer's clients, a gym only sees counts per coach. You sign in without a password, with a code in your email. Coaches also sign in with an authenticator app. The backups are encrypted and the key is not held by GitHub.

This website and cookies

This website does not use cookies to track you.

If you open Bicapp in your browser, we only store your sign-in and your settings on your device.

What is still to come

We do not do this now. It may come later.

Video calls with your coach in the app, via LiveKit. In the app this is currently shown as Coming soon.
Push notifications on your phone, via Expo.
Signing in with Apple or Google.
Recording your intake conversation and having it transcribed.
Measuring how you use the app.
Automatically forwarding error reports from the app to an external service.

If one of these things is added, we will update this statement and first ask for your consent where needed.

Changes

If something important changes, we will let you know in the app or by email. You can get older versions on request via info@bicapp.nl.

3 November 2026, version 2026-11-03.2. Bicapp Zelf, for people who train without a coach, will not go ahead. Anyone without their own personal trainer uses Bicapp as a member of a gym, and then the gym is responsible. Added: what the gym sees of a member, what happens if you ask for a coach, how long we keep a member's data, and what is sent to AI for a tailored plan and for a first draft of a programme for your coach, including what your coach writes with that request. The first draft of your programme with AI is no longer under What is still to come, because it is here now. Buying a coach's packages on this site is no longer possible, so Stripe is no longer listed, and requesting a demo is now called requesting a pilot.
3 November 2026, version 2026-11-03. Bicapp is now software for coaches, businesses and Zelf. Added: who is responsible if you train with a coach, in Zelf and as a coach, what a personal training business and a gym see, how long we keep a Zelf account, and a processing agreement for coaches and businesses. Video calls, push notifications, signing in with Apple or Google and the first draft of your programme with AI are now under What is still to come, until they are really here.
27 October 2026, version 2026-10-27. First full version. Added: who is responsible, the retention periods, the backups, push notifications, signing in with Apple or Google, the first suggestion for your programme, and per service on what ground data goes to the US. Removed: recording your intake, error monitoring and usage measurement in the app, because they are not in it yet.

See also the privacy statement, the terms, the data processing agreement and the licences.