Privacy Policy

A. Personal Data You Provide to Us

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

• Identity Data: Name, username, or similar identifier.
• Contact Data: Email address (used for waitlist, login, and communication).
• Profile Data: Your password, preferences, feedback, and survey responses.

B. Sensitive Personal Data (Health Data)

When you use our Mobile App or Web Platform to track workouts, body metrics (weight, height, body fat %), nutrition logs, or progress photos, we process data concerning your health ("Health Data").

• Legal Basis: We process this data ONLY based on your explicit consent (Article 9(2)(a) GDPR), which you provide when you start using the tracking features. You can withdraw this consent at any time by deleting your account or data.

If you are a Client, Health Data you share with your Coach — such as weight, step counts, and check-in answers — may also be read by a third-party AI assistant your Coach has connected, but only as computed trends and answers, only if your Coach has specifically enabled that access, and only at your Coach's instruction. See "AI Assistant Connections" below for how this works.

C. Information Automatically Collected

When you visit our Site or App, our servers automatically collect certain technical information, including:

• Log and Usage Data: IP address, browser type, device settings, operating system, and crash data.
• Cookies and Tracking Technologies: We may use cookies (like Google Analytics 4, Meta Pixel and our Intercom support chat) to access or store information. Specific details are set out in our Cookie Policy.
• Product Analytics: While you are signed in to our App or Web Platform, we record how you use it with PostHog, hosted in Frankfurt, Germany (EU): the screens you open and actions such as starting or completing a workout, submitting a check-in or changing a setting, together with your account ID, email address and device details (model, operating system, app version). We do not send the content of your messages or notes, or your health measurements. In the App this starts once you have accepted our Terms and this Privacy Policy when creating your account; on the Site and Web Platform it follows your cookie choices. On the Web Platform this also includes session recordings of how pages are laid out and where you click, scroll and navigate; every piece of text, every form field, and all images and videos are hidden in your browser before anything is sent, and recordings are kept for 30 days.
• Crash and Error Reports: When the App crashes or hits an error, a report is sent to Sentry, hosted in Germany (EU), so we can fix it. It holds technical details (device model, operating system, app version, what the App was doing when the error occurred) and does not include your messages, notes or health measurements.

We use the information we collect or receive:

• To provide the Service: To create your account, track your fitness progress, and deliver coaching content.
• To manage the Waitlist: To send you updates about our launch and grant you access when ready.
• To send administrative information: Changes to our terms, conditions, and policies.
• To protect our Services: For fraud monitoring and prevention.
• To improve the Service: To understand how the App and Web Platform are used (product analytics with PostHog) and fix what gets in your way.
• For Marketing (with your consent): To send you promotional emails via Mailchimp. You can opt-out at any time.

We do not sell your personal information. We share information with the following third-party vendors who perform services for us (Data Processors):

A Coach using Jimmy may connect a third-party AI assistant (currently Claude by Anthropic, ChatGPT by OpenAI, or Perplexity) to their Jimmy account. This is done through an OAuth connection that the Coach reviews and approves on a Jimmy consent screen; Jimmy does not connect an assistant on a Coach's behalf.

By default, a connected assistant can only read and create training programmes — it has no access to Client data. A Coach may additionally choose to turn on read-only access to any of the following, individually:

• Their Clients' names and programme status.
• Training sessions completed or missed, and logged sets.
• Weight and step trends.
• Check-in answers and scores.
• Payment status — never card or bank details, which we do not hold.

A connected assistant can never read Chats, and can never send messages to Clients or change Client data — those capabilities do not exist for this feature, regardless of what access a Coach enables.

Data is sent to an AI provider only when the Coach's assistant makes a request under a connection the Coach has authorised; Jimmy never initiates a request to an AI provider on its own. We also minimise what leaves our systems: Clients are identified to the assistant by their display name and an opaque reference, never by email address, phone number, date of birth, photo, physical address, or internal account ID.

We keep a record of every request an assistant makes (which tool was called, when, and which Clients it concerned) and show it to the Coach; this record is retained for 12 months.

The Coach decides whether to connect an AI assistant and which access to grant. In doing so, the Coach acts as the data controller for their Clients' personal data and is responsible for obtaining any agreement from their Clients that applicable law requires. The AI provider processes any data it receives under its own terms of service and privacy policy — on a consumer plan, a provider may use conversations to train its models unless the Coach disables that setting with the provider directly.

A Coach can change or revoke an assistant's access at any time from Settings → AI assistants. Revocation takes effect on the assistant's next request.

Clients are shown a notice when they join a Coach's space: "Your coach may use AI tools to work with the data you share."

Primary Storage Location

We store all user data (including Health Data) on secure servers located in Frankfurt, Germany (EU), provided by our partner Supabase. We have specifically selected this region to ensure that your personal data remains within the European Economic Area (EEA) to the maximum extent possible.

Legal Framework for US Transfers

Although our servers are in the EU, Just Jimmy LLC is a company incorporated in the United States. Therefore, we may access your data from the US for technical support, maintenance, or legal purposes. To ensure your data remains protected during such access, we rely on:

• Standard Contractual Clauses (SCCs): We have signed Data Processing Agreements (DPAs) with our vendors that include the European Commission's Standard Contractual Clauses.

We use administrative, technical, and physical security measures to protect your personal information.

• Encryption: Data is encrypted in transit (SSL/TLS) and at rest.
• Access Control: We utilize Row Level Security (RLS) within our database (Supabase) to ensure strict access control, meaning each user can only access their own data.
• Server Security: Our data is stored in ISO 27001 certified data centers.

Depending on your location, you may have the following rights:

1. 1The right to access: Request copies of your personal data.
2. 2The right to rectification: Request that we correct any information you believe is inaccurate.
3. 3The right to erasure ("Right to be forgotten"): Request that we erase your personal data (e.g., delete your account).
4. 4The right to restrict processing: Request that we restrict the processing of your personal data.
5. 5The right to withdraw consent: You can unsubscribe from our emails or withdraw consent for health data processing at any time.

To exercise these rights, please contact us at: hello@jimmycoach.com.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy policy (e.g., until you delete your account), unless a longer retention period is required by law.

We may update this privacy policy from time to time. The updated version will be indicated by an updated "Revised" date and will be effective as soon as it is accessible.

If you have questions or comments about this policy, you may contact us at:

Just Jimmy LLC, 800 North King Street, Suite 304, Wilmington, DE 19801, US.

Email: legal@jimmycoach.com