Data Retention Policy

We updated this policy on 17 August 2026 to add data the platform now holds, and to answer a question we were not answering clearly: what happens when a gym changes its subscription plan.

• New and important — the section "Deactivation Is Not Deletion". A gym moving to a smaller plan does not delete anybody's data.
• New rows in the retention table for wearable daily summaries, ledger and fee records, retail transactions, staff time-clock and pay records, check-in codes, recovery codes, referral attribution, survey responses, form-review video, and body scans.

This Data Retention Policy describes how long MyTrainerOS retains your personal information and the procedures for data deletion. We retain data only as long as necessary to provide our services and comply with legal obligations.

Two distinctions run through this whole policy, and confusing them is the usual source of alarm:

• Deactivating is not deleting. Data that is switched off is still held, in full, and can be switched back on. Only deletion removes it.
• Your account's data and your gym's business records are different things. Deleting your account removes your personal data; it does not erase the financial record of a transaction your gym is legally required to keep.

Gym owners can move between our subscription plans in either direction. If an owner moves to a plan that allows fewer members, locations, staff accounts, or less branding than the gym is currently using, the records over the new limit are deactivated.

What deactivation means

• The record is hidden from everyday use and no longer counts against the plan's limit.
• The underlying data is retained in full. Nothing is trimmed, anonymised, or purged.
• If the gym moves back up to a larger plan, the records are restored exactly as they were — the same members, locations, staff accounts, and branding, with their history intact. Nothing is re-entered and nothing is lost.

The one thing that does not spring back

If an owner had already suspended a staff member before the plan change, that person stays suspended when the gym moves back up. A plan change does not quietly reinstate someone an owner deliberately switched off. The owner's decision outranks the plan cycle in both directions.

What deactivation is not

A plan change is never a deletion event. It does not start a retention clock, it does not trigger the account-deletion process below, and it is not a reason we would erase a member's workouts, nutrition logs, health data, messages, or ledger. Deletion happens only through the deliberate routes described in "Account Deletion Process" — you asking us, or a data-deletion request from the person the data is about.

Data Category	Retention Period	Basis
Account profile	Until account deletion + 30 days	Service delivery
Workout logs	Until account deletion + 30 days	Service delivery
Nutrition logs	Until account deletion + 30 days	Service delivery
Progress photos	Until user deletes or account deletion + 30 days	User consent
Wearable daily summaries (stored on our servers)	Until consent withdrawal or account deletion + 30 days	User consent
Wearable raw samples	Not stored — never uploaded from your device	Minimization
Health sync log (when a sync ran, its source, any error)	Until account deletion + 30 days	Service delivery
Body scans	Until user deletes or account deletion + 30 days	User consent
Form-review video and coach annotations	Until user deletes or account deletion + 30 days	User consent
Messages	Until account deletion + 30 days	Service delivery
Voice recordings	Deleted immediately after transcription	Minimization
AI coaching conversations	Until account deletion + 30 days	Service delivery
Payment records	7 years after transaction	Legal obligation (IRS)
Member ledger, balances, fees charged and fees waived	7 years after transaction	Legal obligation (IRS) — it is a financial record
In-person retail sales, receipts, returns	7 years after transaction	Legal obligation (IRS)
Staff time-clock entries (including geofenced clock-in location)	Retained while the gym's account is active; deletion is subject to the employer's own recordkeeping obligations	Employer recordkeeping
Staff role, permissions, classification, pay rate	Retained while the gym's account is active, including while the staff account is deactivated	Employer recordkeeping
Kiosk check-in code (one-way hash only)	Until the code is replaced or the account is deleted	Security
Multi-factor recovery codes (one-way hash only)	Until used, regenerated, or multi-factor authentication is turned off	Security
Referral link attribution (views, clicks, sign-ups)	Until account deletion + 30 days	Service delivery
Satisfaction survey responses	Until account deletion + 30 days	Service delivery
Signed waivers	7 years after expiration	Legal obligation
Audit logs	3 years	Security / compliance
Error logs	90 days	Operational
Database backups	90 days rolling	Disaster recovery

Initiating Deletion

You may request account deletion through:

• Settings > Privacy & Consent > Delete My Account
• Email to privacy@mytraineros.com

72-Hour Cooling-Off Period

After you request account deletion, there is a 72-hour cooling-off period during which:

• Your account is immediately deactivated (no login possible)
• Your data is not yet deleted
• You may cancel the deletion by contacting us

Deletion Execution

After the cooling-off period, the following occurs within 30 days:

• All personal information is permanently deleted from primary storage
• All health data is permanently deleted
• All progress photos are deleted from storage buckets
• All messages are deleted (other party retains their copy)
• Financial records are anonymized (retained for legal compliance)
• Backups containing your data are purged within 90 days

What We Cannot Delete

Certain data must be retained even after account deletion:

• Payment and transaction records (7 years per IRS requirements)
• Signed waivers and consent records (7 years for liability protection)
• Data required to comply with legal proceedings or court orders

This data is anonymized where possible and stored with restricted access.

We may retain anonymized, aggregated data that cannot be linked back to any individual. This data is used to:

• Improve platform features and AI model accuracy
• Generate industry benchmarks and analytics
• Conduct research into fitness trends

Anonymized data does not constitute personal information and is not subject to deletion requests.

For questions about our data retention practices, contact:

• Email: privacy@mytraineros.com
• Subject line: "Data Retention Inquiry"