Coach Data Processing Agreement

1. Parties and application

This Data Processing Agreement (DPA) forms part of the agreement between Symbiote Fitness Ltd, company number 16649354, of 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE (Symbiote), and the coach or coaching business accepting the Symbiote Terms of Service (Coach).

It applies where Symbiote processes personal data on behalf of the Coach in connection with the service. Capitalised terms not defined here have the meaning in applicable data-protection law or the Terms of Service.

2. Roles

The Coach is controller and Symbiote is processor for client personal data that the Coach enters, collects, instructs the platform to process, or receives through the Coach's client app. The Coach determines the purposes of coaching and client management.

Symbiote is an independent controller for coach account administration, platform security, fraud prevention, billing, legal compliance, service-level communications, and establishment or defence of legal claims. Stripe may also act as an independent controller for regulated payment processing.

3. Processing details

Subject matter and purpose: hosting and operating an AI-assisted fitness coaching platform, including client accounts, communication, tracking, programs, knowledge retrieval, media analysis, notifications, support, security, and authorised deletion or export.

Duration: for the term of the Coach's service and the retention or deletion period described in the agreement, unless law requires longer.

Data subjects: clients and prospective clients of the Coach, and other individuals whose data the Coach lawfully submits.

Personal data: identity and contact details; authentication identifiers; coaching communications; activity and usage; subscription metadata; uploaded documents, images, and media; device and security data; and coach-created notes or instructions about a client.

Special-category data: health and fitness information such as height, weight, body measurements, nutrition, activity, injuries, allergies, health conditions, progress photos, and information disclosed in chat or check-ins.

Operations: collection, recording, organisation, storage, retrieval, consultation, analysis, AI inference, transmission, restriction, export, deletion, and backup.

4. Coach instructions and obligations

The agreement, the Coach's documented configuration and use of the service, and lawful support requests are the Coach's documented instructions. Symbiote will process client personal data only on those instructions unless required by law, in which case we will notify the Coach unless prohibited.

The Coach must:

• Have a valid Article 6 lawful basis and, for health data, a valid Article 9 condition, normally explicit consent where appropriate to the Coach's service.
• Give clients transparent privacy information and collect legally valid consent through the available flow before health processing.
• Ensure submitted data is accurate, relevant, limited, and lawfully obtained.
• Configure access appropriately, protect credentials, supervise staff, and avoid sharing accounts.
• Respond to data-subject requests and notify Symbiote when assistance is required.

Symbiote will tell the Coach if, in our reasonable opinion, an instruction infringes applicable data-protection law and may suspend that instruction while it is clarified.

5. Confidentiality and personnel

Symbiote ensures that people authorised to process client personal data are subject to confidentiality obligations and receive access only as needed for their role. We maintain appropriate privacy and security awareness for relevant personnel.

6. Security

Taking account of the state of the art, cost, nature, scope, context, purposes, and risk, Symbiote maintains appropriate technical and organisational measures, including:

• Encryption in transit and at rest using managed cloud controls.
• Managed authentication, least-privilege access, tenant-scoped database queries, tenant-separated vector namespaces, and private object storage.
• Secrets management, environment separation, rate limiting, web-application firewall controls, input validation, and audit or application logging.
• Backup, recovery, health monitoring, alarms, incident response, and tested deletion workflows.
• Measures designed to prevent one coach's personality, methodology, knowledge, or client data being used for another coach.

The Coach is responsible for endpoint security, account permissions, credentials, exports, and data used outside Symbiote.

7. Subprocessors

The Coach gives general written authorisation for the subprocessors in the published Subprocessor List. Symbiote will impose data-protection obligations appropriate to each subprocessor and remains responsible for its processor obligations to the extent required by law.

We will provide reasonable advance notice of a material new subprocessor. The Coach may object on reasonable data-protection grounds within 14 days. The parties will work in good faith on a solution; if none is reasonably available, either party may terminate the affected service without penalty for the unused prepaid affected period.

8. International transfers

Symbiote will make restricted international transfers only under a lawful transfer mechanism applicable to the actual parties, countries and processing roles. This may be an applicable adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or the EU standard contractual clauses where EU GDPR applies. We will assess supplementary measures and transfer risks where required.

Where contractual safeguards are required, the applicable transfer documentation must identify the exporter and importer, the relevant clauses and modules, the processing details and security measures. A general reference in this DPA does not replace those particulars. Symbiote is responsible for its onward transfers to subprocessors as required by law; its UK location does not make it the US importer for those transfers. The Coach can request information about applicable safeguards through support@symbiotefitness.com.

9. Data-subject requests

Taking account of the nature of processing, Symbiote will provide reasonable assistance through product controls and support so the Coach can respond to requests for access, correction, erasure, restriction, portability, objection, consent withdrawal, and automated-decision review. If a request comes directly to Symbiote for Coach-controlled data, we will refer it to the Coach where lawful and appropriate.

10. Personal-data breaches

Symbiote will notify the Coach without undue delay after becoming aware of a personal-data breach affecting Coach-controlled data. We will provide information reasonably available about the nature of the breach, affected data and people, likely consequences, and measures taken or proposed, and will provide updates as information becomes available. Notification is not an admission of fault. The Coach is responsible for regulatory or data-subject notifications unless law assigns that duty to Symbiote.

11. Assessments and consultations

Symbiote will provide reasonable information and assistance for the Coach's data-protection impact assessments and regulator consultations relating to the service, taking account of the nature of processing and information available to us. Additional bespoke assistance may be charged at an agreed reasonable rate where it is not caused by our breach.

12. Return and deletion

During the service, available export tools can provide client data in a commonly used format. On a valid instruction or termination, Symbiote will delete or return Coach-controlled personal data, at the Coach's choice where technically available, unless law requires retention.

Deletion is designed to cover the database, all client-scoped object-storage versions, client-scoped vector data, cache or rate-limit records, and applicable AgentCore memory. Data may remain temporarily in encrypted disaster-recovery backups until normal overwrite, normally up to 35 days. We may retain restricted records required for legal obligations, fraud prevention, billing, or claims.

13. Audit information

Symbiote will make available information reasonably necessary to demonstrate compliance. Where that is insufficient, the Coach may request an audit no more than once per year, or following a material breach, with reasonable notice, confidentiality, minimal disruption, and no access to another customer's data or security-sensitive material. The Coach bears reasonable audit cost unless the audit identifies a material Symbiote breach.

14. Priority, liability, and contact

If this DPA conflicts with the Terms of Service about processing Coach-controlled personal data, this DPA prevails. Liability under this DPA is subject to the lawful liability terms in the main agreement, without limiting rights or liabilities that cannot be limited by law.

Privacy contact: support@symbiotefitness.com.