Data Processing Terms

1. Who does what

Your Organisation (the gym) is the controller of the personal data of its members and staff that is put into ClearGym ("Member Data"). ClearGym, a trading name of Asdfx Labs Limited, is your processor: we process Member Data for you, to provide the Service, and for no other purpose. Words such as "personal data breach" and "data subject" have the meaning they have in UK GDPR.

2. What we process, and for how long

• Subject matter and purpose: running your gym's memberships, bookings, classes, personal training, payments, health screening, waivers and emails through ClearGym.
• Nature of the processing: storing, organising, showing, sending, updating, exporting and deleting Member Data when you, your staff or your members use the Service.
• Duration: for as long as your Organisation uses the Service, and then until it is deleted as section 9 says.
• People the data is about: your members (including children and other people in a member's household, where you add them), your staff, and members' emergency contacts.
• Types of data: names, contact details, dates of birth, emergency contacts, memberships, bookings and attendance, passes and credits, payment references from Stripe (never full card or bank details), signed waivers, messages you send, and records of what staff did in ClearGym.
• Special category data: health information, namely PAR-Q answers, medical conditions, injuries, medications, allergies and clearance notes, which members give with their explicit consent.

3. Your instructions

We process Member Data only on your documented instructions. Your instructions are these terms, the Platform Terms, and what you and your staff choose in the Service and its settings. This includes transfers outside the UK, which we make only as section 6 says. If we think an instruction breaks data protection law, we will tell you. If the law requires us to process Member Data in another way, we will tell you first unless the law forbids it.

4. Confidentiality

Everyone we allow to process Member Data is bound by a duty of confidentiality. ClearGym support staff look at or act on your gym's records only to fix a fault or at your request. What they do in ClearGym's own support tools, including signing in as one of your staff to see what they see, is recorded in an audit log.

5. Security

We take appropriate technical and organisational measures to protect Member Data, as UK GDPR Article 32 requires. They include:

• Encryption at rest: health information is encrypted with AES-256 using a key that is different for every gym, so one gym's key cannot read another gym's data.
• Encryption in transit: every connection to ClearGym uses TLS (HTTPS).
• Access control: each person signs in with their own login, and what staff can see and do depends on their role (owner, manager, trainer or front desk). Each gym sees only its own data. Members see only their own records.
• Audit logs: we record what staff do in ClearGym and every action our support staff take.
• Backups: the database is backed up every night to Amazon Web Services in London, and we check every day that the latest backup is there.
• Keeping things up to date: we apply security updates to the software and servers that run ClearGym, and secrets such as keys are never stored in our code.

6. Sub-processors and transfers

You authorise us to use the sub-processors below. We put data protection obligations on each one that are no less protective than these terms, and we stay responsible to you for what they do.

• HOSTKEY (Iceland): the servers that run ClearGym and store its database.
• Amazon Web Services (London, UK): database backups, uploaded files such as gym logos, and sending email.
• Stripe (UK, EU and US): payments, Direct Debits and the Stripe account your gym connects.
• Cloudflare (worldwide network, US company): securing and carrying traffic to ClearGym.
• Sentry (Germany): error monitoring. It receives technical details of errors, never the contents of forms or support messages.
• GitHub (US): tracking support requests. Each support message is copied to a private issue after names, email addresses, phone numbers, postcodes and long numbers are masked.
• Anthropic (US): AI help sorting support requests. It receives only the masked support message and technical details of the page and any error, and does not use them to train its models.
• Google (US): when a trainer uses the AI training plan feature, the member's age range, experience level, the equipment available and the trainer's instructions, as the trainer typed them, are sent to Google's Gemini service. No names or health information from the member's record are sent, and staff are told not to type names or health details into their instructions.

We will tell your Organisation's owners by email at least 30 days before we add or replace a sub-processor. If you object on reasonable data protection grounds, tell us within those 30 days and we will try to resolve it with you. If we cannot, you may end your Platform Subscription. It ends at the end of the month you have already paid for (on a yearly plan, the current month), and on a yearly plan we refund the whole months after that.

We transfer Member Data outside the UK only to countries the UK has found adequate (such as Iceland, Germany and Ireland in the EEA), to US companies certified under the UK Extension to the EU-US Data Privacy Framework, or under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. Helping you

Taking into account what we can reasonably do, we will help you:

• answer requests from members and staff to use their data protection rights, such as access, correction and deletion. You can do much of this yourself in ClearGym: edit a member's details, export your members' data, or deactivate a member. Ask us to delete a member's health information or anything you cannot do yourself. If a member asks us directly, we will pass the request to you;
• keep Member Data secure, and deal with and report personal data breaches;
• carry out data protection impact assessments and, where needed, consult the Information Commissioner's Office.

8. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting your Member Data. We will tell your Organisation's owners by email and give you the information we have that you need to decide whether to report it to the Information Commissioner's Office and tell your members, and we will keep you updated as we learn more.

9. When your gym stops using ClearGym

While your Platform Subscription is active, owners and managers can download your members' data at any time from the Members page (Export), and an owner can export the whole gym's data. An owner can export the gym's data from Settings for 30 days after the Platform Subscription ends; a subscription left unpaid counts as ended on its 30th unpaid day. You can also ask us and we will send you a copy.

We delete the gym's data, including Member Data, 90 days after the Platform Subscription ends, unless members are still paying through the gym's Stripe account (then we delete it once those memberships have ended, and the owner can end them from the export page), or the gym has asked us to keep it. Retention required by law is not affected. Copies in our backups are deleted within a further 90 days.

A gym that signs up but never starts its Platform Subscription is deleted with all its Member Data 90 days after it signs up, after we have reminded its owners by email, as section 5.2 of the Platform Terms says.

When a gym leaves, and when a gym never subscribes, we keep a short deletion record: the gym's name and ClearGym ID, its owners' email addresses, its Stripe IDs, dates and counts, and no Member Data. We keep it in ClearGym for 2 years and in secure archive storage for 6 years, and then delete it, as our Privacy Policy explains.

10. Information and audits

We will give you the information you reasonably need to show that we meet these terms. Once a year, if you ask, we will answer a written security questionnaire. Any further audit or inspection is by agreement, on reasonable notice, during working hours and at your cost, and must not give you access to other gyms' data.

11. Liability and changes

Section 11 of the Platform Terms applies to these terms, except where the law does not allow it. We change these terms in the same way as the Platform Terms, with at least 30 days' notice by email of a material change.

12. Contact

• Data protection: dpo@cleargym.uk
• Security or a suspected breach: privacy@cleargym.uk