Privacy Policy
Version 2026.08.30 · Effective August 30, 2026
TRAIN HARD STAY HUMBLE GmbH ("we", "us" or "our") operates the STRENUO website and mobile application (the "Platform"). This Privacy Policy explains how personal data is processed, stored and protected in connection with your use of the Platform.
1. Controller and contact
TRAIN HARD STAY HUMBLE GmbH, Tangentenweg 11, 4058 Basel, Switzerland, e-mail: aroldo@thsh.fit. Send privacy requests to this address. We are not required to appoint a data protection officer and have not appointed one.
2. Roles and responsibilities
STRENUO is a coaching platform. There are two roles:
- For coaching data (training, nutrition, health and progress data, messages with your coach) your coach is the controller and decides the purposes and means of processing. TRAIN HARD STAY HUMBLE GmbH acts as processor on the coach's documented instructions; a data processing agreement (DPA) is in place with every coach.
- For operating the Platform itself (account, login, security, support, billing of coaches, product analytics, marketing towards coaches) TRAIN HARD STAY HUMBLE GmbH is the controller.
Important: TRAIN HARD STAY HUMBLE GmbH does not provide coaching, medical or nutritional services. All coaching services are delivered directly by the respective coach. TRAIN HARD STAY HUMBLE GmbH is not a party to the relationship between coach and client.
3. Data we collect
3.1 Data you provide
Account information
- E-mail address (required to create an account)
- Name, phone number (optional), gender, date of birth
- Password (stored securely as a hash)
- Profile picture
Health and fitness data
- Body weight and target values
- Wellbeing data (e.g. sleep, mood)
- Training data, check-ins and progress notes
- Nutrition data and food logs
- If you grant it on your device: data from Apple Health or Health Connect (e.g. steps, activity, heart rate, sleep). This data is sent directly from your device to us; Apple and Google do not process it on our behalf. You can revoke the device permission at any time in your device settings.
Health-related data (including data you share from Apple Health or Health Connect) is provided voluntarily by you and processed on the basis of your separate, explicit consent (Consent to the Processing of Health Data, withdrawable at any time in the settings) and at the direction of your coach for the purpose of delivering personalized coaching services. TRAIN HARD STAY HUMBLE GmbH does not independently determine how this data is used.
Media and communication
- Progress photos and videos
- Messages between you and your coach
- Video calls with your coach: audio and video are transmitted in real time only and are not recorded; participants, start time and duration are stored
Scheduling
- Appointments with your coach (title, time, description). If your coach has connected an external calendar (Google Calendar, Microsoft Outlook/365 or CalDAV), the appointment title, times and your name are transferred to that calendar; the privacy terms of your coach's calendar provider apply in addition.
3.2 Data collected automatically
- Technical access logs (IP address, timestamp, device type, app version) to run the Platform securely
- On a coach's public forms: a bot check processes your IP address and browser signals to prevent abuse
- Product usage events in the coach dashboard (only if the coach has enabled this; see section 7). No product analytics runs for clients in the app.
3.3 Data we do not collect
- Precise location data
- Advertising tracking
- No session recordings, no automatic capture of screen content
3.4 Public forms and enquiries to a coach
Coaches can offer public forms through the Platform (e.g. enquiry or questionnaire links). If you fill in such a form without already being that coach's client, the coach is the controller for the information you provide (typically name, e-mail, phone number and your answers). The data is stored in that coach's account; TRAIN HARD STAY HUMBLE GmbH processes it only as a processor. If the coach has added their own consent or information texts to the form and they were shown to you when filling it in, those apply in addition; the exact wording you accepted is stored with your submission. Direct access or erasure requests to the coach; we support them in fulfilling such requests. If no coaching relationship follows, the coach decides on deletion; the technical deletion periods in section 8 apply here as well.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Platform, account, login, messages, appointments | Performance of a contract (Art. 6(1)(b) GDPR; Art. 31(2)(a) Swiss FADP) |
| Coaching data on behalf of your coach | Processing on the coach's instructions; health data on the basis of your explicit consent (Art. 9(2)(a) GDPR; Art. 6(7) FADP) |
| Apple Health / Health Connect | Your explicit consent (device permission and health data consent) |
| Security, abuse prevention, bot protection | Legitimate interest (Art. 6(1)(f) GDPR) |
| Product analytics (coach dashboard) | The coach's consent (Art. 6(1)(a) GDPR) |
| Billing of coaches, invoice archive | Performance of a contract and statutory retention (Art. 6(1)(c) GDPR; Art. 958f Swiss Code of Obligations) |
| Notifications (e-mail, push) | Performance of a contract; can be switched off in the settings |
Payments may be processed through external payment providers or directly by the coach. Payment information such as card details is never stored on our systems.
5. Recipients and processors
We do not sell personal data. To operate the Platform we use carefully selected service providers that process data solely on our behalf under data processing agreements:
| Category | Processing location | Purpose |
|---|---|---|
| Hosting infrastructure | Zurich, Switzerland | Database, login, files, server logic |
| Media storage and delivery | EU | Images, files and videos; abuse protection |
| Video-call transmission | EU | Real-time transmission, no recording |
| E-mail and push delivery | EU / USA | Invitations, reminders, notifications |
| Payment processing | EU / USA | Processing of payments (independent controller under its own privacy policy) |
| Usage analytics | EU | Pseudonymised analysis of the coach account, only with the coach's opt-in |
| AI processing | USA / EU | AI features, only if your coach has enabled them (section 6) |
| The coach's calendar provider | provider-dependent | Calendar synchronisation, only if your coach connects a calendar (your coach is the controller for this) |
The complete, continuously updated list of sub-processors with company names and locations is Annex B of the data processing agreement (DPA) with your coach; you can request it through your coach or by e-mail to aroldo@thsh.fit.
Other recipients: your coach (to deliver the coaching), authorities where legally required, and a successor in the course of a business transfer.
6. AI-assisted processing
The Platform offers optional AI features (analysis of training and nutrition data, drafting of messages and content for the coach, evaluation of check-ins). These features are only active if the coach has subscribed to and enabled them.
What is processed: Only the data required for the specific analysis is sent to the AI providers, in data-minimised form; surnames and contact details are never sent, and your coach can individually exclude first names, free-text notes, health metrics and financial data.
Providers used: AI requests are routed through a routing service to selected language-model providers processing in the USA; technical logging takes place with an EU-based provider with automatic deletion after 30 days. Company names and locations are listed in Annex B of the DPA.
Stored AI insights (memory): Insights derived from your data (e.g. trends, preferences, summaries) are stored together with a technical representation (embedding) in our database in Switzerland and used in later requests so that responses and suggestions for you and your coach are personalised. They are not shared with third parties, are visible to your coach, and are deleted together with your data.
No training: The AI providers do not use your data to train their models. Every request is configured so that only providers that do not store or use the transmitted data for training are addressed.
Degree of automation: By default, AI outputs are suggestions and drafts that your coach reviews and approves. Your coach may enable automatic execution for individual task types (e.g. message drafts or publishing content). These are organisational and content workflows that your coach has configured in advance and remains responsible for.
Certain operations are permanently excluded from automation and always require the coach's explicit approval, including all deleting operations and all operations relating to payments and billing.
No automated decision-making with legal effect on you takes place.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) on the instructions of the coach as controller and, for special categories of personal data, your explicit consent (Art. 9(2)(a) GDPR).
Objection: You can object to AI processing of your data at any time towards your coach; from then on no data about you is sent to AI providers.
7. Cookies and local storage
The Platform uses no advertising or tracking cookies. Only technically necessary data is stored on your device:
- Login session (access token) so you stay signed in
- Preferences such as language and appearance
- In the coach dashboard, only after the coach's opt-in: a pseudonymous identifier for product analytics (local storage, no cookie)
- On public forms: a cookie set by the bot check for the duration of the check
- When paying through Stripe: Stripe's fraud-prevention cookies under Stripe's privacy policy
This storage is necessary to operate the Platform (Art. 6(1)(b) and (f) GDPR; § 25(2) German TDDDG) and requires no consent; product analytics requires the coach's consent.
8. Retention
| Data category | Retention |
|---|---|
| Account and profile data | Until the account is deleted, then erased within 30 days |
| Coaching data (training, nutrition, health, check-ins, photos, messages) | For as long as you are coached, or until your account is deleted or your coach instructs deletion; then erased within 30 days |
| Apple Health / Health Connect data | As coaching data; once the device permission is revoked no new data is imported |
| Video calls | Not recorded; call metadata (participants, start, duration) as coaching data |
| Data exports | 72 hours after creation |
| AI logs (EU provider) | 30 days |
| Product analytics (coach dashboard) | Until the coach withdraws the opt-in, at most 12 months |
| Technical access logs | At most 90 days |
| Invoices and billing data (coaches) | 10 years from the invoice date (Art. 958f Swiss Code of Obligations) |
After the retention period, data is erased or anonymised unless a statutory retention obligation applies.
9. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. You can withdraw any consent you have given (in particular to the processing of health data) at any time with effect for the future, in the app settings or by e-mail.
Rights concerning coaching data are exercised towards your coach as controller; we forward requests sent to us and support their fulfilment. For data we control ourselves, contact aroldo@thsh.fit directly.
Right to lodge a complaint: You may complain to a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. In the EU/EEA you may contact the supervisory authority of your place of residence; in Germany the data protection authority of your federal state, in Austria the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna.
10. Data security
We apply technical and organisational measures to protect personal data, in particular:
- Encryption in transit and at rest in line with the state of the art
- Secure password storage (hashing), optional two-factor authentication for all accounts
- Role-based access control and tenant isolation at the database level
- Signed, time-limited links for photos, videos and files
- Database and login hosted in Zurich, Switzerland
As with any digital system, complete security cannot be guaranteed.
11. International data transfers
The database and login are operated in Switzerland. Some providers (section 5) process data in the USA. Switzerland and the EU/EEA mutually recognise an adequate level of data protection. Transfers to the USA rely on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) as recognised by the FDPIC and, where the provider is certified, on the EU-U.S. or Swiss-U.S. Data Privacy Framework. A copy of the relevant safeguards is available on request.
12. Children's privacy
The Platform is not directed at persons under 16. We do not knowingly collect personal data from anyone under 16.
13. Changes to this Privacy Policy
This Privacy Policy may be updated. Material changes are shown within the Platform and must be accepted again; the current version and its date are visible in the app.
14. Language
The German version of this Privacy Policy is authoritative; translations are provided for convenience.
15. Contact
TRAIN HARD STAY HUMBLE GmbH E-mail: aroldo@thsh.fit Address: Tangentenweg 11, 4058 Basel, Switzerland