FitPal Coach

Legal

Last updated: 14 November 2026. This text also exists in French and Spanish; where they differ, the French version prevails.

Publisher

FitPal Coach is published by Ahmed Chioua, an individual, business address Bureau 69, Wilaya Center, Tetouan, Morocco.

Contact: contact@fitpal.ma

Hosting

This site is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. The FitPal Coach application (coach.fitpal.ma) and its database are hosted by Namecheap, Inc., Phoenix, Arizona, USA.

Personal data

This site

This site sets no cookies and runs no analytics. No browsing data is collected and none is passed to a third party.

Who is responsible

For their clients' data (programs, sessions, measurements, check-ins, the answers to a request to join), the coach is the data controller: they decide to collect it and what it is for. FitPal Coach, published by Ahmed Chioua, is the processor: it hosts and processes that data on the coach's behalf, on their instructions, and for nothing else, except the referral check described below, for which FitPal Coach is the controller. For the coach's own account (identity, email address, subscription), FitPal Coach is the controller; it is also the controller of prospecting coaches on Instagram and of setting up their program, described below. The contract between each coach and FitPal Coach, the processor agreement included, is in the coach terms.

The app's data is never sold or used for advertising, and it exports to JSON on request at any time. Only the date a coach account was made leaves it, so we stop writing to that coach ("Prospecting coaches on Instagram").

Asking to train with a coach

A coach's page lets you ask to train with them. The form collects a first name, an email address (checked with a code), a goal, a level, a number of sessions a week and the equipment you have; and, only if you want to give them, your injuries or pain and a WhatsApp number. If that coach signed up through another coach's referral link, we only check whether you have trained since being accepted, to credit that other coach a free month; they learn nothing about you. We are the controller for this, on the basis of our legitimate interest and that other coach's (GDPR Article 6(1)(f)), and keep nothing about you from it. You can object by writing to contact@fitpal.ma: we then remove the record of who referred your coach, and the check no longer happens.

Injuries and pain are health data (GDPR Article 9; Moroccan law 09-08). They are processed only with your explicit consent, given with a separate checkbox, and only to prepare your program. Only the coach you write to can read them. Legal basis: your explicit consent (GDPR Articles 6(1)(a) and 9(2)(a)). Your account and the coaching itself rest on providing the service (Article 6(1)(b)).

You can withdraw your consent at any time by asking the coach, who can delete your answers from the app, or contact@fitpal.ma; your request and your answers are then deleted.

Your health data in the app

Weekly check-ins (sleep, soreness, stress, energy, a note), body weight, measurements, meals and progress photos can reveal your health. If a coach coaches you, the app asks for your explicit consent (GDPR Article 9(2)(a)) before the first entry, so that your coach sees them; without it, these features record nothing. If you are under 16, a parent or guardian must agree. You can withdraw this consent at any time in Settings: the data is then deleted. The consent is for the coach who coaches you: if you change coach, you are asked again.

While a workout is open, your coach sees that you are training; nothing of it is kept once the workout ends.

Processors

These providers are outside the European Union and Morocco. For data protected by the GDPR, transfers to Namecheap, Resend and Cloudflare rely on the European Commission's standard contractual clauses in each one's data processing agreement and, for Cloudflare and Resend, which are certified under it, on the EU–US Data Privacy Framework. These agreements are public: Namecheap, Resend, Cloudflare. The notification services receive only encrypted notifications they cannot read. In Morocco, the transfer to the United States falls under articles 43 and 44 of law 09-08: the application for the CNDP's authorisation is being prepared.

Minimum age

Asking to train with a coach from their page is for people aged 16 or older: the form asks you to confirm it. A coach who invites a client under 16 themselves does so under their own responsibility as controller, and must have the agreement of a parent or guardian.

Security log

Actions on accounts (sign-ins, invitations, the coach's decisions, settings) are recorded with the id and name of the accounts concerned (and, for a refused sign-up, the name typed in), without IP addresses, and kept for at most 90 days, to protect the service from abuse and trace the cause of an incident. Legal basis: our legitimate interest in keeping the service secure (GDPR Article 6(1)(f)).

Right to object. You can object at any time, on grounds relating to your particular situation, to this processing based on legitimate interest (GDPR Article 21), by writing to contact@fitpal.ma.

Referrals

If you create your coach account from another coach's referral link, we record which coach referred you, to credit them a free month when a client who came through your public page trains after you accept them. To decide, we check whether such a client has trained since being accepted; nothing about them is kept for the referral or shown to anyone. That coach sees how many coaches signed up through their link and how many earned them a month, never which. The link travels only in the page's address: nothing is stored on your device.

The record of who referred you is kept for as long as your account exists. Legal basis: our legitimate interest in making FitPal Coach known through its coaches' recommendations (GDPR Article 6(1)(f)). You can object at any time by writing to contact@fitpal.ma: we then remove, by hand, the record of who referred you. A month already credited to that coach stays theirs. The security log also records your sign-up through that link and, if it comes to that, the month you earned that coach, with the id and name of your account and theirs. An objection does not remove those lines: they leave the log at most 90 days after they were written (see "Security log"). The database backups keep a copy of them: 14 days for the daily backups (their copy off the hosting account up to a day more), at most 90 days for the copy taken before each update of the service.

Prospecting coaches on Instagram

FitPal Coach's founder writes to coaches on Instagram to tell them about the tool. For this we keep a list noting what the coach's public Instagram profile shows of their business: their handle, country, language, number of followers, niche, bio link, the coaching app they mention and the post the message mentions. Added to that, from our exchanges, are the dates of the messages and of a call, if there is one, the answer and a few words of notes; and, if the coach makes a FitPal Coach account, the date it was made, taken from FitPal Coach, so we stop writing and can count sign-ups. Nothing else. We are responsible for it, on the basis of our legitimate interest in making FitPal Coach known to coaches (GDPR Article 6(1)(f)). The list is used for these messages only, a first one and two follow-ups at most: it is never added to a newsletter, sold or shared. Each week we count how many messages got an answer, as numbers with no names.

Only the founder has access to it. The list is a spreadsheet file kept offline, on an encrypted computer and an encrypted backup drive: no online service hosts it. The messages go through Instagram (Meta). When you say no or "stop", or six months after your last message (or our first, if you did not answer), we keep, within 7 days, only your handle, your answer and those two dates, so we never write again, and we delete them 3 years after the later of the two. If you ask for erasure, everything is deleted the same day except your handle and the date of your request, on a "do not write" line deleted 3 years later, so a later search does not find you again; you can ask for that line to be deleted too.

Right to object. You can object to these messages at any time: reply "stop", or write to contact@fitpal.ma. You can also see your line, have it corrected, restrict its use or have it erased, by replying to the message or writing to the same address, and complain to your country's data protection authority (see "Your rights").

Setting up your program

If you ask us to, we enter your program into your coach account ourselves. You send us on WhatsApp your program (PDF, Sheet or photos), a photo of you, two lines on what you do and your account's e-mail address; WhatsApp also shows us your number and profile name. We are responsible for this, to do what you asked (GDPR Article 6(1)(b)). We never ask for your sign-in code or your passkey, and we want no data about your clients: a file that has any is deleted at once, and we tell you so.

The files go through WhatsApp (Meta), encrypted end to end, and stay on the founder's phone and computer while the setup lasts. They are deleted as soon as your page is checked or, if you stop answering, 14 days after your last message; the chat's backup, with Google (Google Drive) or Apple (iCloud) depending on the phone, may keep a copy until the next day. The chat itself, with your number, stays as the record of what was asked and agreed, for as long as your account exists, or until you ask us to delete it.

To measure our times, we note in the same file as the prospecting your handle, the time your files arrived, the time your page was checked, and a few words on what took time. Your handle and those words are deleted at the first weekly review after 30 days; only the times and the duration stay, with no name.

Signing in

Sign-in uses a passkey (WebAuthn) or a code or link sent by email: no password is ever stored.

Your rights

You have the right to access, correct, erase and export your data, and to object. Ask your coach, or contact@fitpal.ma: we pass the request on to the coach concerned. For what FitPal Coach is the controller of (your coach account, referrals, prospecting, setting up your program), we answer it ourselves. You can also complain to your country's data protection authority: the CNIL in France, the APD/GBA in Belgium, the AEPD in Spain, the CNDP in Morocco.

You can also delete your account yourself, with everything in it, in the web app, from Settings → “Delete my account”, once you have confirmed it is you: your data is erased for every coach. All that remains is the security log's lines, for at most 90 days, and the database backups, which drop it within 90 days at most. What your other devices keep offline stays there until you clear it.

Intellectual property

FitPal Coach is built on openGym. Customer coaches' marks, logos and content remain the property of their respective owners. Third-party component attributions are documented in the repository's NOTICE file.

Liability

FitPal Coach is a tracking tool. It provides neither medical advice nor training prescription. Responsibility for a program given to a client rests with the coach who wrote it.