CoachLoop Data Processing Addendum (DPA)

Last updated: 2026-05-25

1. Purpose

This DPA defines responsibilities for processing personal data shared between trainees and trainers through CoachLoop.

2. Roles

• CoachLoop acts as data processor for hosted application operations.
• Trainer organizations generally act as data controllers for trainee coaching usage within their business context.
• Trainees control consent scope for trainer-visible data in the product.

3. Subject Matter and Duration

Processing includes hosting, syncing, and presenting coaching-related data while the account and trainer link remain active, or until deletion is requested.

4. Categories of Data

• Identity and account data.
• Nutrition/workout log data and summaries.
• Progress metrics (for example weight and adherence indicators).
• Consent and audit metadata.

5. Processing Purposes

• Deliver trainee and trainer product functionality.
• Enforce access controls and consent scope.
• Maintain security, reliability, and billing operations.

6. Security Measures

• JWT-based authentication and protected API authorization.
• Role and ownership checks for trainer/trainee boundaries.
• Signature verification for billing webhooks.
• Operational logging and route-level rate limiting.

7. Subprocessors

CoachLoop may use subprocessors for identity, cloud hosting, observability, messaging, and billing infrastructure. Subprocessors are contractually required to protect data.

8. Data Subject Rights

CoachLoop supports data export and account deletion mechanisms. Trainer organizations are responsible for handling data subject requests in line with applicable law and their controller obligations.

9. Deletion and Return

Upon account deletion or contract termination, CoachLoop deletes or returns data in accordance with configured retention obligations and legal requirements.

10. Cross-Border Transfers

Where cross-region processing occurs, CoachLoop applies contractual and organizational safeguards consistent with applicable laws.

11. Incident Notification

CoachLoop maintains incident response procedures and will notify impacted controllers of confirmed incidents according to contractual and legal timelines.