REPIVO Privacy Policy

1. Who we are

REPIVO is operated by Novogroup Systems S.R.L., registered with the Trade Register under J31/66/2023, tax identification number (CUI) 39736070. We are the controller of the personal data described here. For any question or request about your data, write to us at [email protected].

2. What data we use

Depending on what you use in REPIVO, we use the following categories of data.

• Account and profile. Email address, display name, account identifier, settings and preferences. If you use the app without an account, an anonymous profile linked to your phone.
• Workouts. Routines, exercises, sets, weights, reps and the rest of your training history, where you train and the equipment you note.
• Gym visits and scans. When you scan a REPIVO Tag, the gym, the machine and the time of the scan.
• Content you send. Messages, photos, videos and answers sent to a coach, machine reports, suggestions, bug reports, feedback, survey answers and what you choose to share.
• Communications with us. Messages you send us, demo form requests and support requests, with the contact details in them.
• Device, technical and usage data. IP address, device and system type, app version, language, technical identifiers, the notification token, logs, error reports and information about how you use the service. Approximate location, inferred from the connection, for statistics, without keeping the IP address in them. We use a more exact location only when you allow it for a feature, for example to find gyms nearby.
• Purchases and payments. Billing details, payment history and payment information received from payment providers. You enter full card details with the payment provider, not with us.
• Data from sign-in providers. When you sign in with Google or Apple, we receive the account identifier and the email address.
• Data about gyms, coaches and other businesses. Business contact details of people who work with us or whom we contact, company details, portal roles, proof of contract acceptance and the history of our contacts.
• Health data. Described in section 4.

We receive most data from you or from your device. Some comes from sign-in and payment providers, from the gym or coach who invites you and, for the list of gyms and business contact details, from public sources.

Some data is needed to create an account or to use a given feature. Without it, that feature cannot be provided. Health data and other optional data are never required.

3. Why we use data and on what legal basis

• To provide the service (Article 6(1)(b) GDPR). The account, workout sync, machine scans, the coach relationship, the sharing you choose, the portal for gyms and coaches, purchases, support and service emails.
• Our legitimate interest (Article 6(1)(f) GDPR). Security and abuse prevention, technical logs and error reports, statistics about how the service is used and improving it, aggregated statistics for gyms, business contacts with gyms and other businesses, our business records and defending our rights. You can object to this processing at any time (section 8). You can turn some statistics off directly in the app.
• Your consent (Article 6(1)(a) GDPR). Notifications and optional features for which we ask your consent, for example AI features or surveys.
• Your explicit consent (Article 9(2)(a) GDPR). Health data (section 4).
• Legal obligations (Article 6(1)(c) GDPR). Invoicing, accounting records and answering requests from authorities.

You can withdraw any consent at any time, without affecting earlier processing. If we send you marketing communications, we do so with your consent or where the law allows it, and you can unsubscribe at any time.

4. Health data

Some data you can use in REPIVO may be health data, for example

• the body profile, such as height, weight and goal, and body measurements
• check-in answers sent to a coach, such as weight, sleep and energy, and check-in photos
• data read from Apple Health or Health Connect, such as body weight, heart rate, calories and workouts, and the workouts REPIVO writes there

Some of this data stays only on your phone. We process health data that reaches our servers or a coach only with your explicit consent, which you give in the app. You can withdraw your consent at any time in the app, without affecting earlier processing.

The connection to Apple Health or Health Connect is optional. It starts only if you turn it on and give the app permission, and you can turn it off at any time. We do not use data received from Apple Health or Health Connect for advertising, we do not sell it, we do not use it to decide on credit or insurance, and we do not share it with others except as needed to provide the feature you asked for.

5. Who receives data

• The gym. The gym sees what it needs to manage its machines, for example aggregated scan statistics and reports sent about its machines. It does not see your individual workouts unless you choose to share them with it.
• The coach. A coach sees your data only after you accept their invitation, namely what the app shows you when you accept. You can stop sharing at any time.
• Other users. When you share a routine or a workout or train in a group, others see what you choose to share. You can share a workout through a link. Anyone with the link sees the workout's page, with what you chose to show. You can turn the link off at any time, and it expires. Information you give about a gym, for example its equipment, may be shown to other users, without your name.
• Our providers. We work with providers of hosting, storage and cloud infrastructure, email and communication, notifications, error monitoring and statistics, AI services, payments and invoicing, sign-in and abuse protection. They process data under a contract with us. Some, for example sign-in and payment providers, process some data as independent controllers, under their own policies.
• Authorities and advisers. Public authorities, when the law requires it, and our professional advisers, for example accountants or lawyers.
• Business changes. In a reorganisation, merger or sale of the business, data may be transferred to the new controller, in line with the law.

We do not sell your personal data.

6. Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area. In those cases we rely on the safeguards set out in the GDPR, for example an adequacy decision of the European Commission or the standard contractual clauses. You can ask us for information about these safeguards.

7. How long we keep data

We keep data for as long as it is needed for the purpose we received it for. We keep account data and the data linked to it for as long as the account exists. We keep a profile used without an account until you delete it or until it has been inactive for a long period. Data kept only on your phone stays there until you delete it, clear the app's data or uninstall the app.

After the account is deleted or a business relationship ends, we may keep some data for as long as the law requires, for example invoices and accounting records, or as long as it is needed for security and to defend our rights, for example proof that a contract was accepted. We keep technical logs and backups for a limited period. After that we delete the data or anonymise it. We may keep anonymous statistics that no longer identify you without a time limit.

8. Your rights

You have the right to ask for access to your data, its correction, erasure or restriction, and its portability. You can object at any time to processing based on our legitimate interest and to processing for marketing. You can withdraw any consent at any time. Write to us at [email protected]. We reply within the time set by law and may ask for information to confirm that the request comes from you.

If you are not satisfied, you can lodge a complaint with ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing, www.dataprotection.ro).

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

9. Deleting your account and exporting your data

You can delete your account at any time in the app or ask us to delete it by email. The steps are on the Delete your REPIVO account page. What we may keep after deletion is described in section 7.

You can export part of your data directly from the app and ask us for a copy of the data we keep about you, at [email protected].

10. Children

REPIVO is meant for people aged 13 or older. If the law in your country sets a higher age for giving consent on your own, you need the consent of a parent. If you learn that a person under 13 has given us data, write to us at [email protected] and we will delete the data.

11. Security

We use appropriate technical and organisational measures to protect data. If an incident may affect your data, we will inform you as the law requires.

12. Cookies and similar storage

The website, the scan pages and the portal use cookies and similar browser storage for the pages to work and stay secure, for sign-in and for preferences. For cookies that are not strictly necessary we ask for your consent where the law requires it. You can delete cookies in your browser settings.

13. Changes to this policy

We may update this policy. The version in force is always on this page, with the date of the last update. If a change requires your consent, we will ask for it first.