Gymscanner GDPR Compliance Statement

Version 1.0 | Effective Date: June 15, 2026

This statement explains how Gymscanner complies with the EU General Data Protection Regulation (GDPR) and the UK GDPR. It is a plain-language summary for users, Vendors, and partners; the full legal disclosures are in our Privacy Policy, Cookie Policy, and Terms of Use. If this statement and the Privacy Policy differ, the Privacy Policy prevails.

1. Controller and Contact

For users in the EU, EEA, and UK, the data controller is Gymscanner SRL, Strada Valea Adâncă 17C, 700712 Iași, Romania. Gymscanner SRL operates within the Gymscanner group alongside Gymscanner, Inc. (USA) and Gymscanner General Trading Co. (Kuwait), under intra-group data transfer agreements.

All privacy matters, for any region, go through one contact point: [email protected].

2. How We Apply the GDPR Principles

Lawfulness, Fairness, and Transparency: Every processing purpose has a defined legal basis, published in the legal-bases table in Section 3 of the Privacy Policy. We do not process data for undisclosed purposes.
Purpose Limitation: Data collected for one purpose (for example, cycle predictions) is not reused for another (for example, advertising). Health data is never used for marketing.
Data Minimization: We collect only what the feature needs. Calorie scanner photos are processed on your device and never uploaded. AI nutrition requests carry only the inputs needed to generate the plan, pseudonymized where technically feasible.
Accuracy: You can correct your account and Health Tool data directly in the App at any time.
Storage Limitation: Retention periods are published in Section 8 of the Privacy Policy. Health Tool data is deleted from servers within 30 days of your deletion request and from backups within 90 days.
Integrity and Confidentiality: Security measures are described in Section 7 below.
Accountability: We maintain records of processing activities (Art. 30), data processing agreements with every processor, and a breach response procedure.

3. Legal Bases We Rely On

Contract (Art. 6(1)(b)): Operating your account, the marketplace, purchases, refunds, and Vendor payouts.
Explicit Consent (Art. 9(2)(a)): All Health Tool processing (cycle tracker, nutrition data, calorie entries, activity data) and AI nutrition plan generation. Each tool is off until you switch it on, and consent can be withdrawn in App settings at any time with full deletion.
Consent (Art. 6(1)(a)): Marketing communications and non-essential cookies.
Legitimate Interests (Art. 6(1)(f)): Fraud prevention, platform security, review integrity, and product analytics on pseudonymized data, each subject to a balancing assessment. You can object at any time (Section 5).
Legal Obligation (Art. 6(1)(c)): Tax, accounting, AML, and sanctions compliance.

ℹ️ Automated Decisions: We do not make solely automated decisions producing legal or similarly significant effects. AI-generated nutrition plans are informational content you choose to follow or ignore.

4. Special Category Data

The cycle tracker and parts of the nutrition features involve health data, a special category under Art. 9 GDPR. Our regime includes:

Explicit, granular, per-tool opt-in before any collection.
Storage on your device plus encrypted server sync for backup and cross-device access.
Withdrawal and permanent deletion available directly in App settings—no support ticket needed.
No use for advertising, profiling for marketing, or sale; no sharing with Vendors, advertisers, or data brokers.
Heightened internal access restrictions, limited strictly to personnel who need it to operate the service.
Narrow handling of legal demands: Validity assessment, scope reduction, challenge of overbroad requests, and user notification unless legally prohibited.

5. Your Rights and How to Exercise Them

Under GDPR Arts. 15 to 22, you have the rights of access, rectification, erasure, restriction, data portability, objection (including to legitimate-interests processing and direct marketing), and withdrawal of consent without affecting prior processing.

How to Exercise: Use in-App settings for most actions (download data, delete Health Tool data, close account), or email [email protected].
Timeline: Response within one month, extendable by two months for complex requests with notice.
Cost: Free, unless requests are manifestly unfounded or excessive.
Verification: We may verify your identity before acting, using the minimum data necessary.
Complaints: You may lodge a complaint with the Romanian supervisory authority, ANSPDCP (Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal, dataprotection.ro), or with the supervisory authority of your country of residence or workplace. We would appreciate the chance to resolve your concern first, but you are not required to contact us before complaining.

6. International Transfers

Gymscanner infrastructure spans EU and US data centers, and we use processors in other countries, so EU/EEA/UK personal data may be transferred outside the EEA.

Transfers to the US and other third countries rely on European Commission adequacy decisions where available, including the EU-US Data Privacy Framework for certified providers, and otherwise on Standard Contractual Clauses (SCCs) (with the UK Addendum or IDTA for UK data), supported by transfer impact assessments and supplementary measures where needed.
Intra-group transfers between Gymscanner SRL, Gymscanner, Inc., and Gymscanner General Trading Co. are governed by intra-group agreements incorporating Standard Contractual Clauses.

A copy of the relevant safeguards is available on request at [email protected].

7. Security Measures

We apply technical and organizational measures proportionate to the risk, including:

Encryption in transit (TLS) and encryption at rest for stored personal data.
Password hashing and account security controls.
Role-based access controls and least-privilege internal access, with heightened restrictions for health data.
Logging, monitoring, and alerting on production systems.
Data processing agreements and due diligence for every processor.
Periodic review of security measures and access rights.

⚠️ Note: We do not currently hold third-party security certifications and do not claim any. As certifications are obtained, this statement will be updated.

8. Data Protection by Design and by Default

Concrete design decisions on the Platform:

Calorie scanner photos are processed entirely on-device and never uploaded.
Health Tools are off by default, activated only by explicit opt-in.
Health data is segregated from marketing systems; marketing tags never fire on Health Tool screens.
AI nutrition requests are minimized and pseudonymized where technically feasible.
Vendors receive only redemption-necessary data (name, order reference, service, validity)—never health or payment data.
Privacy-protective defaults in the consent banner: nothing non-essential runs before opt-in, and rejecting is as easy as accepting.

9. Processors and Subprocessors

We use processors for hosting, payments (Stripe), AI processing (Anthropic), email and push delivery, analytics, and support tooling. Every processor is bound by a data processing agreement meeting Art. 28 requirements, covering confidentiality, security, subprocessor controls, audit rights, and deletion or return of data at the end of services. Categories of recipients are listed in Section 6 of the Privacy Policy.

10. Impact Assessments and Breach Response

Impact Assessments: We assess new features for privacy risk before launch and conduct Data Protection Impact Assessments (DPIAs, Art. 35) for processing likely to result in high risk, including the Health Tools.
Breach Response: If a personal data breach occurs, our procedure requires containment, assessment, notification to the competent supervisory authority within 72 hours where the breach is likely to result in a risk to individuals (Art. 33), and direct notification to affected users without undue delay where the risk is high (Art. 34).

11. Age Limit

The Platform is restricted to adults 18 and over. We do not knowingly process the personal data of anyone under 18, so the Art. 8 child-consent regime does not arise; accounts found to belong to minors are deleted.

12. Updates to This Statement

We review this statement when our processing, providers, or the law changes, and at least annually. Material changes are announced in line with Section 14 of the Privacy Policy. The Effective Date above reflects the latest version.

13. Contact

Privacy Requests, Questions, Safeguard Copies & Complaints: [email protected]
Postal Address: Gymscanner SRL, Strada Valea Adâncă 17C, 700712 Iași, Romania.