Your clients' data, handled seriously

Gymkee stores health data on behalf of coaches and their clients. This page explains, without marketing, where that data lives, who can touch it, and what we commit to. Every statement here was checked against our infrastructure and our legal documents.

Last reviewed

5,000+
coaches
150+
countries
Since 2019
bootstrapped, independently owned

Hosted in Europe, primarily in Paris

Your coaching data (clients, programs, measurements, messages, media) is processed in the European Union. No production data is stored in the United States.

  • Application and API: AWS, Paris (eu-west-3)

    The Gymkee backend, search cluster and file storage (videos, photos, documents) run on Amazon Web Services in the Paris region. AWS is an HDS-certified host for that region; Gymkee itself does not hold an HDS certification.

  • Database: MongoDB Atlas, European Union

    All application data is stored on MongoDB Atlas clusters located in the EU, encrypted at rest.

  • Marketing site only: Cloudflare

    gymkee.com (this website) is served by Cloudflare Pages. No client or health data is processed through Cloudflare.

  • Some tooling sits outside the EU

    Support messaging, analytics, push notifications and AI providers are US-based companies operating under Standard Contractual Clauses and, where certified, the EU-US Data Privacy Framework. They are all listed on the sub-processors page, and you are notified 30 days before any new one is added.

Card data never touches Gymkee servers

Gymkee Pay is built on Stripe Connect. Gymkee never sees, stores or transmits a full card number.

  • Stripe handles the card

    Card fields in the coach dashboard and in payment links are Stripe-hosted elements. The card number goes straight from your client's browser or phone to Stripe. PCI DSS compliance is carried by Stripe, not re-implemented by Gymkee.

  • Your own Stripe account, your own payouts

    Each coach gets a Stripe connected account. Client payments settle in that account and are paid out to your bank by Stripe. Gymkee's commission is 0.97% plus standard Stripe fees; there are no hidden processing add-ons.

  • Your subscription to Gymkee, same rule

    The card you use to pay for Gymkee itself is also stored by Stripe Payments Europe (Ireland), never in our database. Invoices are available in your account at any time.

  • Webhooks are signature-checked

    Every event Stripe sends us (payment succeeded, subscription updated, dispute opened) is verified against a signing secret before anything is written to your account.

GDPR by contract, not by slogan

Under the GDPR you are the data controller for your clients and Gymkee is your processor. That relationship is written down in a Data Processing Agreement you can read right now, no sales call required.

  • A public DPA covering health data

    Weight, measurements, nutrition and performance data are treated as Article 9 health data. The DPA commits Gymkee to purpose limitation, access logging, encryption at rest and deletion within 30 days after consent is withdrawn.

  • Explicit client consent, collected in the Gymkee app

    Your clients give a separate, specific consent for health data inside the Gymkee mobile app, and can withdraw it from their settings at any time. You keep the proof.

  • Export and deletion

    You can delete a client from your dashboard, and a client can delete their own account from the Gymkee app. Any user can request a full copy of their data in a machine-readable format (JSON or CSV); we answer within one month. When you cancel, your content stays retrievable for 30 days, then it is deleted, except what accounting law forces us to keep.

  • Breach notification in 48 hours

    If a personal data breach affects your clients, we notify you within 48 hours of becoming aware of it, with the facts and the measures taken, so you can meet your own 72-hour CNIL obligation. We never sell personal data and never use it for targeted advertising.

What Dwayne is allowed to see

Dwayne, the AI copilot inside Gymkee, calls external models (Anthropic, OpenAI, Google Gemini). Here is exactly what leaves our infrastructure and what never does.

  • Minimized before it leaves

    Before any client data reaches an AI provider it goes through a data-minimization layer: first name only, age instead of date of birth, and emails, phone numbers and links are stripped from free-text notes and comments. Client-written text is also fenced so it can never be interpreted as an instruction.

  • No model training on client data

    Our AI providers process requests under API terms with no training on the data sent. Prompts are retained by them for at most 30 days for abuse prevention, then deleted. Client health data is contractually excluded from any AI training, by Gymkee or by anyone else (DPA, Article 5).

  • A processing log you can ask for

    Every Dwayne turn writes an entry to a GDPR processing log: which client records, which categories of data, which model, under which consent version. It records categories, never the prompt content. It exists so we can answer an Article 15 access request precisely.

  • Your own content: one switch

    Separately from client data, Gymkee can use your anonymized coaching content (programs, templates) to improve Dwayne. That is your choice: the switch is in Workspace settings and turning it off removes you from the training pipeline.

The controls that are actually in place

  • Encryption in transit and at rest

    TLS 1.2 or higher on every connection between the apps, the API and our providers. Data at rest is encrypted with AES-256 on the database and on file storage.

  • Least privilege inside the team

    Access to production data is limited to team members with an operational need, access to health data is logged, and development, testing and production environments are separated.

  • Least privilege inside your team too

    On team plans every capability (clients, training, nutrition, payments, settings) is granted per role. Client contact details can be hidden from a role, so an assistant coach sees "Marie D." and no email or phone. Every action is written to an activity log you can read.

  • API hardening

    Public endpoints are rate-limited, all inputs are validated server-side, and every request is scoped to your workspace so one coach's data can never be returned to another.

  • Backups and recovery

    The DPA commits us to regular encrypted backups and a disaster recovery plan. Planned maintenance is announced in advance and scheduled outside peak hours whenever possible.

  • Found a vulnerability?

    Write to hello@gymkee.com with "security" in the subject line. It reaches the founders directly. We acknowledge every report and will not take legal action against good-faith research.

How you sign in

  • Password or magic link

    Coaches sign in with an email and password, or with a passwordless magic link sent to their inbox. Passwords are hashed with bcrypt; we cannot read them.

  • Signed sessions

    Sessions are asymmetrically signed tokens (RS256). A leaked database would not let anyone forge a session.

  • Team access you control

    Invite team members with a role, restrict what each role can see, and revoke access instantly. The activity log shows who did what and when.

What we promise about uptime

We do not publish an uptime figure or a status page today, so we will not quote one. Here is what is contractually true.

  • Reasonable efforts, honestly stated

    Our terms commit Gymkee to reasonable efforts to keep Gymkee available and to announce planned maintenance in advance, outside peak hours whenever possible.

  • Breaches are never silent

    If an incident touches personal data, coaches are notified within 48 hours with the facts, the likely consequences and the measures taken, and the CNIL is notified within 72 hours when the law requires it.

Need a DPA signed, a security questionnaire filled, or a straight answer?

We are a small, independent team based in Paris. Security and privacy questions go to the founders, not a ticket queue. Studios and teams doing vendor reviews: send us your questionnaire and we will answer every line honestly, including the ones where the answer is "not yet".

Email hello@gymkee.com Read the DPA

Questions coaches ask before trusting us

Where is my data hosted?

In the European Union. The application, API, search and file storage run on Amazon Web Services in Paris (eu-west-3); the database runs on MongoDB Atlas in the EU. Only the marketing website is served by Cloudflare, and no client data goes through it.

Can I export my data?

Yes. Every user can request a full copy of their personal data in a machine-readable format (JSON or CSV) by writing to hello@gymkee.com; we answer within one month. If you cancel your subscription, your content stays retrievable for 30 days after the end of your plan.

What happens to my clients' data when I cancel?

You keep access until the end of the paid period. Your content is then retained for 30 days so you can retrieve it, after which it is deleted, with the exception of billing records that French accounting law requires us to keep for 10 years.

Who can see my clients' data?

You, the team members you invite (within the permissions you give them), and the Gymkee team members who need operational access, whose access to health data is logged. Sub-processors only receive what their function requires, and AI providers only receive minimized data. Nobody else.

Is Gymkee GDPR compliant?

Gymkee operates as your processor under Article 28 of the GDPR with a public Data Processing Agreement, a published list of sub-processors with 30-day change notice, explicit health-data consent collected in the Gymkee app, defined retention periods, and a 48-hour breach notification commitment to coaches. KEEZOKU, the company behind Gymkee, is a French SAS registered in Paris and subject to the CNIL.

Does Gymkee sell my data or my clients' data?

No. We never sell personal data to third parties and we do not use it for targeted advertising. Client health data cannot be used for Gymkee's own product research, for AI training, or for any purpose other than providing Gymkee to you. That is written in the DPA.

Is AI trained on my data?

Client data: no, never, by contract. Third-party AI providers process Dwayne requests under no-training API terms and see only minimized data. Your own coaching content (programs, templates) can be used in anonymized form to improve Dwayne, and you can switch that off at any time in Workspace settings.

How are payments secured?

Gymkee Pay runs on Stripe Connect. Card details are entered in Stripe-hosted fields and never reach Gymkee servers, so PCI DSS compliance is handled by Stripe. Each coach has their own Stripe connected account and receives payouts directly from Stripe.