Privacy Policy

Yilmaz Atakan Kara, omniOne Fitness, Roedernstr. 13, 12459 Berlin, Germany, is the controller for the purposes described below as omniOne's own processing. Contact for privacy and data subject rights: support@omniOne.fitness. If you were invited as a Client, your specifically assigned Coach is generally the controller for your coaching data; their identity is shown during invitation or consent. You can contact your Coach or ask us to forward your request. As a Coach, you reach omniOne about your own account at the same address.

omniOne is the controller for its public website, business relationship with the Coach, billing, own support, and necessary operational and security evidence for these purposes. The Coach decides the purposes and content of processing their Clients' data. omniOne provides the platform as a processor under Art. 28 GDPR. Invited Clients do not enter a separate platform contract with omniOne by using it. Client account and profile data provided for coaching form part of processing on the Coach's behalf. Any separate, purpose-bound processing of minimised technical security or legal evidence by omniOne is described below as its own processing. This policy does not replace information the Coach must provide about their specific services and other recipients.

The website, app frontend, backend, database and private object storage are operated with Railway (Railway Corporation, San Francisco, USA). The selected region is EU West (Amsterdam, Netherlands); the object storage for photos and files is also located in the EU. Access and operation may involve IP address, time, requested resource, status, browser/device information and necessary connection and security data. The purposes are delivery, fault diagnosis and preventing misuse; the legal basis for our own processing is Art. 6 (1)(f) GDPR (a legitimate interest in a functional, secure service), and Art. 6 (1)(b) GDPR for services necessary to perform the Coach contract. Access and security logs contain no message content and are deleted after 30 days at the latest. Access and disclosure are purpose-bound. Support and operational access by the provider from the USA requires the transfer safeguards under section 11 to be checked and documented beforehand.

The website remembers the selected language and appearance locally in your browser. The app uses necessary session, security and preference information, including a refresh cookie and necessary local settings. Access serves expressly requested presentation or secure signed-in use (section 25 (2) TDDDG); further processing follows the respective GDPR purposes stated here. You can delete settings through your browser; you may then need to select them again or sign in. Fonts are self-hosted. No advertising cookies, analytics pixels or third-party trackers are used.

As a Coach: we process for your account identity, contact and profile information, authentication and account status, preferences, and necessary contract and acceptance evidence. Passwords are stored as salted hashes. Contractual processing is based on Art. 6 (1)(b) GDPR; legally required evidence on point (c), and necessary misuse prevention and legal defence on point (f). Document acceptance may record version, language, content hash, confirmed wording, time, account association and minimised technical origin. Privacy information is acknowledged; it is not blanket consent.

If you are invited as a Client, your Coach provides your email address and necessary association information for the invitation. This information originates from your Coach; further account, profile and coaching information is supplied by you or the Coach or arises from agreed use. It serves invitation, secure account setup and your coaching relationship. The Coach informs you about their legal bases, required information and consequences of not providing it. An invitation alone does not authorise unrestricted processing of your health data. Sections 3 and 5 describe omniOne's own technical security purposes.

Depending on the agreed coaching, processing includes identity and association information, inputs and answers, goals and planning, measurements and progress data, training entries and professional notes. It includes necessary drafts, private Coach preparations, assessments, changes and their history. These categories cover examples such as questionnaires, plans, check-ins and progress photos without prescribing a fixed feature catalogue. Health information may also appear in free text, pictures, messages or files. The Coach is the controller and omniOne acts on their behalf. Where processing relies on explicit health-data consent, it is for the named Coach and the described coaching purpose under Art. 6 (1)(a) and Art. 9 (2)(a) GDPR; as a Client, you find the wording in the health-data consent. The Coach must explain other purposes and legal bases separately. A new feature does not automatically extend consent to new purposes.

Coaching involves processing messages, sender/recipient association, timestamps and processing states, and submitted media. This may include voice, image, video and document files, filenames and metadata or previews necessary for processing/playback. Content is technically validated and, where necessary, normalised for safe presentation. Access follows the authorised coaching relationship; private Coach preparations are not automatically visible to Clients. In-app notices arise from assigned work and change states. There is no automated medical diagnosis or decision producing legal or similarly significant effects under Art. 22 GDPR. Sharing health information in chat requires particular care; ordinary chat communication does not replace required consent.

System emails are sent through Hostinger (Hostinger International Ltd., Larnaca, Cyprus). Their purposes include invitations, account security, contractual administration and payment notices; coaching content is not included in system emails. Recipient address, necessary content and delivery information are processed for those purposes. Our own Coach contract communication is based on Art. 6 (1)(b) GDPR; necessary security and general enquiries on point (f); Client communication on the Coach's behalf follows the Coach's legal basis. Contact enquiries through the website form contain the submitted contact and message fields; to prevent misuse, the IP address, browser identifier, time and selected language are included in the internal notification (Art. 6 (1)(f) GDPR). Contact enquiries are handled by email and not stored as records in the app. In-app support reports contain reporter association, content and submitted page/browser/build context for fault correction and improvement (Art. 6 (1)(f) GDPR). Please do not submit health information or secrets unnecessary for the issue. Contact and support enquiries in the mailbox are deleted as soon as they are no longer needed for handling and necessary follow-up, normally within twelve months after final handling. Longer retention occurs only where required by statutory retention duties or the establishment, exercise or defence of concrete legal claims; use is restricted to that purpose and the data is deleted when the reason ceases to apply. Support reports stored in the app follow section 12.

Coaches set up payment with Stripe. Necessary contact/billing details, customer and subscription association, billable quantity, payment status and minimised processing evidence are used. Complete card details are not stored in omniOne. Our processing serves contractual performance (Art. 6 (1)(b) GDPR) and legal obligations, in particular commercial and tax retention duties (point (c)). The payment service provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland. Stripe processes payment data for payment processing, fraud prevention and its own legal obligations as an independent controller under its own privacy policy; transfers to Stripe, Inc. (USA) rely on its certification under the EU-U.S. Data Privacy Framework and the EU standard contractual clauses. Coaching content is not transmitted to Stripe.

Recipients, to the extent necessary, include authorised users, our operational providers and, where applicable, legally authorised bodies and advisers bound by confidentiality. Your data is not sold. Providers acting on instructions are bound under Art. 28 GDPR:

• Railway Corporation (San Francisco, USA): hosting of the website, app, backend, database and object storage in the EU West region (Amsterdam). EU standard contractual clauses under Art. 46 (2)(c) GDPR are the intended basis for support and operational access from the USA. Before a transfer, omniOne checks and documents their effective incorporation, the required transfer assessment and suitable supplementary measures. The EU storage region, encryption and restricted access must be considered; EU storage alone does not replace a transfer safeguard. No transfer takes place without a valid basis.
• Hostinger International Ltd. (Larnaca, Cyprus, EU): delivery of system emails.
• Stripe Payments Europe, Ltd. (Dublin, Ireland): payment processing as an independent controller (section 10); transfers to Stripe, Inc. (USA) on the basis of the EU-U.S. Data Privacy Framework and the EU standard contractual clauses.

No other third-country transfers take place. Copies of the safeguards used are available on request at support@omniOne.fitness.

Data is retained only for the stated purposes and permissible evidence or retention reasons. Account deletion follows this staged workflow:

• Access is blocked; direct profile identifiers are immediately anonymised or put through deletion. Structured email snapshots in support reports are anonymised immediately; the report content follows its category retention period and may contain personal free-text information until then.
• Communication data is finally removed 30 days after either participant's account is deleted.
• Health and coaching data of a deleted Client is removed after 90 days, including associated drafts, histories, photos and professional provenance.
• Minimised consent, security, administrative and support evidence is removed after one year.

For processing data, these periods are the documented instruction of the respective Coach under Annex 4 to the DPA; for its own evidence, omniOne relies on Art. 6 (1)(f) GDPR (evidence and security interests) and, where applicable, point (c). Unsent chat attachments are ordinarily removed after 24 hours; expressly discarded preparations are removed through the intended workflow. Failure to remove private objects leads to another deletion attempt until deletion is verifiably complete. Legally necessary billing evidence is retained separately for the statutory period and does not extend retention of coaching content.

A pause, end of coaching or cancellation of billing does not automatically start account deletion. Active coaching relationships must first be ended for the self-service deletion workflow; statutory erasure rights may be exercised independently. A complete Coach exit with return or deletion of processing data is handled under Annex 4 to the DPA. Self-service data export is not provided; requests for access or data portability are fulfilled manually, for processing data in coordination with the responsible Coach. Backup copies of the database and object storage are kept encrypted, used exclusively for recovery and overwritten or deleted after 90 days at the latest. Deleted data may remain in backup copies until then. After a recovery, intervening deletions and anonymisations are reapplied without undue delay. Affected data remains excluded from normal processing until completion. Unaffected areas may resume operation only where effective isolation of the affected data has been demonstrated.

As a Client, you can withdraw explicit consent at any time for the future, particularly in privacy settings or by contacting the named Coach. Lawful processing before withdrawal remains lawful. Without active health-data consent, the relevant new health/coaching submissions and changes are blocked; coaching dependent on that processing cannot continue in that form. Existing data is not automatically erased solely by withdrawal: the Coach must assess whether another lawful basis permits limited further retention or whether data must be erased. Available history is not itself a legal basis. Renewed consent does not authorise processing retrospectively.

Where the legal conditions are met, you may request access, rectification, erasure, restriction of processing and data portability. You may object to processing under Art. 6 (1)(f) GDPR on grounds relating to your particular situation under Art. 21 GDPR. If you are a Client, your Coach is responsible for your coaching data; we assist and forward relevant requests. For your Coach account, the website and billing, contact omniOne at support@omniOne.fitness. You may complain to a data protection authority, particularly where you live, work or believe an infringement occurred. The competent authority for omniOne is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.

The version provided for an action remains traceable through its document version and archive. We update this policy when our service, our providers or the legal situation change; the current version is available on the website. Changes to this information do not alter consent or authorise new processing purposes. Before relevant new processing, we inform you and obtain any necessary consent separately.