Data processingagreement

Who and when

This agreement is between you and Bicapp. You are the coach or the business that coaches clients with Bicapp, or the gym that gives the app to its members. Under the GDPR that makes you the controller. Bicapp is the processor. Bicapp is owned by [to be decided: company name of the VOF] (Chamber of Commerce (KvK) number [to be decided: Chamber of Commerce number of the VOF], VAT [to be decided: VAT number of the VOF]), [to be decided: address of the VOF].

With a personal training business, the business is the controller, because the clients belong to the business. With a gym, the clients belong to the personal trainer, so the personal trainer is the controller. The gym only sees numbers per personal trainer.

If a gym also gives the app to its members, the members without their own personal trainer belong to the gym. For their data, the gym is the controller. If a member asks for a coach in the app, the gym can link the member to one of its personal trainers. The member then becomes a client of that personal trainer, with the data they already had in the app. That can only happen if the member asked for it themselves.

This agreement is part of the terms. It applies from the moment you create a workspace or accept an invitation to a team. With a gym or a larger business, we also sign it on paper.

What we process the data for

We only process your clients' data to make Bicapp work for you. That means the dashboard and the app, with programmes, workouts, check-ins, chat, nutrition, progress, the suggestion for a photo of a meal, the first draft of a programme with AI and the tailored plan for members without their own personal trainer. For this, we store the data, make backups and send mail on your behalf, such as the invitation for your client.

We only do this on your instructions. What you set up and do in the dashboard are those instructions. We do not use the data for ourselves. We do not sell it, we do not use it for advertising and we do not let anyone train AI with it.

If the law requires us to do something else with the data, we will tell you in advance, unless the law forbids that. If we think an instruction from you goes against the GDPR, we will say so straight away.

How long

The agreement runs for as long as you use Bicapp for your clients. If you stop, it continues until we have returned or deleted all the data. How that works is under If you stop.

Which data and whose

Whose

• Your clients, including people you have invited who have not started yet.
• The members of your gym without their own personal trainer, if you also give the app to your members.
• The personal trainers in your team, for what you see of them as the owner. That is their name and their numbers.

Which data

• Name, email address and year of birth.
• Goals, training days, level, height, weight and body measurements.
• Health data, such as injuries, medical information, how your client feels at the start, sleep, energy and mood. That is a special category under the GDPR. The app asks your client for separate consent for this.
• Progress photos, if your client gives consent for them.
• Workouts, nutrition, photos of meals, and steps per day if your client turns on that connection.
• Check-ins, chat messages and the notes you make about your client.
• Technical data, such as IP addresses in the logs.

What we promise

• Only people who need the data for their work can access it. Anyone who can access it must keep it confidential.
• We only access your clients' data when that is needed for support or maintenance, or when you ask us to.
• We help you when a client wants to view, correct, export or delete their data. Your client can also export and delete it themselves in the app. If such a request reaches us, we pass it on to you.
• We help you if you need to carry out a risk assessment (DPIA), or if the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) asks you questions.
• You may ask us how we keep to these agreements. If you want an independent expert to check this, we will agree on that together in advance.

Who helps us

These parties work with your clients' data for us. They keep to written agreements, in a data processing agreement or in their terms. The legal basis on which data may go to the US is listed per party in the privacy statement.

Not a sub-processor

• We only use PostHog on the website. None of your clients' data goes there.
• If your client looks up a product or scans a barcode, their phone asks Open Food Facts directly. Open Food Facts sees the barcode or the search term and the phone's IP address, not who your client is.
• Your clients pay you outside Bicapp. No party of ours is involved in that.

A new party

If we take on a new sub-processor, we will let you know by email [to be decided: number of days] in advance. If you do not agree, you can object. If we cannot work it out together, you may stop. If video calls or push notifications are added, LiveKit and Expo will go on this list, and we will let you know in the same way.

How we keep the data secure

• Data is encrypted when it travels over the internet and encrypted when it is stored.
• Each coach only sees their own clients. The database itself enforces this, not just the app.
• At a personal training business, the owner and the admins see the business's clients. Of the clients of the personal trainers at a gym, the owner only sees numbers per personal trainer.
• Of the members without their own personal trainer, the owner and the admins of a gym only see name, email address, goal, since when they have taken part and whether they have signed in yet. If a member asks for a coach, they also see that request, with what the member wants help with and their message. If a member chooses pregnancy or rehabilitation after an injury there, or writes something about their health in the message, the owner and the admins see that too. Nobody sees workouts, weight, nutrition or any other health data a member enters in the app in the dashboard.
• Signing in works without a password, with a code sent by email. Coaches also sign in with a code from an authenticator app. Without that second step, a coach cannot access clients' data.
• Progress photos are kept in protected storage and only open through links that expire quickly.
• A photo of a meal goes to AWS without location data and is not stored there. The server logs then only contain numbers and times. What was recognised in the photo, such as the foods, the grams and the kcal, we store with the request. That is also included in your client's export.
• If a coach asks for a first draft in the builder, Bicapp only adds the muscles a client has trouble with if the client gave consent for health data. What the coach writes with the request is sent as written. Do not put names or medical data in it. The dashboard also asks this next to the field.
• We make an encrypted backup every night. The key is not held by GitHub, and we test whether a backup can be restored.

If there is a data breach

If we discover a data breach involving your clients' data, we will tell you without undue delay, and no later than [to be decided: number of hours] after we discovered it. We will tell you what happened, which data and how many people are involved, what the consequences may be and what we are doing about it.

You decide whether to report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and to your clients. A report to the Dutch Data Protection Authority must be made within 72 hours. We will help you with everything we know.

If you stop

If you stop using Bicapp, you can first get your clients' data back. Your clients can always export their own data themselves in the app. If you want all your clients' data in one go, email info@bicapp.nl. There is no button for this in the dashboard yet.

After that, we delete the data within [to be decided: period after the end], including from the backups. A backup disappears automatically after 30 days. What the law requires us to keep, such as invoices, we keep for as long as required.

If a personal trainer leaves a personal training business, the clients stay with the business. If a personal trainer works through a gym, the clients stay with the personal trainer, even if the gym stops and the personal trainer carries on with Bicapp on their own.

We also delete data automatically, even if you do not stop. A client's data is deleted 24 months after the end of their last package. The data of a member without their own personal trainer is deleted 24 months after the member last logged something or signed in, with an email to the member a month in advance. If you want it deleted sooner, email info@bicapp.nl. All periods are listed in the privacy statement.

Liability and law

For damage under this agreement, what the terms say about liability applies. [to be decided: review by a lawyer]. If the terms and this agreement contradict each other on data, this agreement applies. This agreement is governed by Dutch law.

Changes

If we change something important, we will let you know by email first.

• 3 November 2026, version 2026-11-03.2. Added the members of a gym without their own personal trainer, with the gym as the controller. Also what the gym sees of them, how long we keep their data, and AWS Bedrock for the first draft of a programme and the tailored plan, with what is sent along.
• 3 November 2026, version 2026-11-03. First version.