Privacy Policy
Last updated: 11 October 2026
On this page
1. Who we are
Gymwise is a workout-tracking app for iPhone and Apple Watch, published by Medorius ("we", "us"). This policy covers the Gymwise apps and the website at gymwise.net. For data-protection purposes, Medorius is the controller of the personal data described here.
You can reach us at support@medorius.com.
2. What we collect
Data you give us
| Account details | Your email address, and a display name if you set one. If you sign in with Apple or Google, we receive an identifier and the email address that service provides (which may be a private relay address). |
|---|---|
| Training data | Workouts, sets, reps, weights and notes; routines and folders; custom exercises; personal records; and the gym profiles and equipment lists you create. |
| Body measurements | Only what you choose to enter, for example body weight, body fat percentage and circumference measurements. |
| Preferences | Units (kg/lbs, cm/inches), language, appearance, training goal, experience level, notification and rest-timer settings. |
| Support correspondence | The content of emails you send us, so we can answer them. |
Data collected automatically
| Technical data | Basic device and app information needed to deliver the service: app version, device model and operating system version, and the IP address your requests come from. Our infrastructure providers log this as part of normal operation. |
|---|---|
| Abuse prevention | Gymwise uses App Attest via Firebase App Check to confirm that requests come from a genuine, unmodified copy of the app. This produces a device attestation token; it does not identify you. |
| Crash reports | If the app crashes, Firebase Crashlytics sends a report so we can fix the problem: the stack trace, app version, device model, operating system version and a random installation identifier. Crash reports do not include your workouts, measurements or health data. |
| Media requests | Exercise animations and equipment images are served from a content delivery network. Fetching them reveals your IP address to that provider, as any web request does. |
What we don't collect
Gymwise contains no advertising SDKs, no third-party analytics and no tracking across other apps or websites. We do not sell or rent your personal data, and we do not share it for advertising or profiling. There is no social feed and no public profile, so other Gymwise users cannot see your training data.
This website
gymwise.net sets no cookies and uses no browser storage, no analytics, no advertising pixels and no embedded third-party content. Every file it loads, including its fonts, is served from gymwise.net itself. The only party that sees your visit is our hosting provider, which needs your IP address to deliver the pages. No cookie banner is shown because none is required.
Using Gymwise without an account
You can use Gymwise without signing in. In that case your workouts, routines and settings are stored on your device and are not sent to our servers at all. Creating an account is what enables cloud backup and syncing between your iPhone and Apple Watch.
3. Why we use it
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Providing the app: storing your training data, syncing it across your devices, restoring it on a new device. | Performance of a contract. |
| Authenticating you and keeping accounts secure. | Performance of a contract; legitimate interests (security). |
| Managing Gymwise Pro entitlements. | Performance of a contract. |
| Preventing abuse of our servers (App Check, rate limiting). | Legitimate interests (protecting the service). |
| Answering your support emails. | Legitimate interests; performance of a contract. |
| Complying with legal obligations, such as tax and accounting records. | Legal obligation. |
| Health data: body measurements you enter, and heart rate, active energy, body mass and body fat read from Apple Health if you allow it. | Your explicit consent (UK GDPR Article 9(2)(a)), given when you enter a measurement or grant the Health permission. Withdraw it at any time by deleting the measurement or revoking the permission in the Health app; we then stop processing it. |
We do not use your training data to build advertising profiles, and we do not make automated decisions that produce legal or similarly significant effects about you.
4. Apple Health data
If you grant permission, Gymwise integrates with Apple Health:
- Writing: completed workouts, and the heart-rate and active-energy samples recorded during a session on Apple Watch.
- Reading: heart rate, active energy, body mass and body fat percentage, so your training summaries and measurement charts are complete.
This is entirely optional. Decline the permission and the rest of the app works unchanged. Health data read from HealthKit is used on your device to display your stats. In line with Apple's requirements, we never use HealthKit data for advertising or marketing, never sell it, and never disclose it to third parties for those purposes. You can revoke access at any time in the Health app under Sharing → Apps.
5. Payments and subscriptions
Gymwise Pro is sold as an auto-renewing subscription through Apple's In-App Purchase system. Apple handles the payment; we never see or store your card details, billing address or Apple ID password. We receive confirmation of whether an entitlement is active, which is what unlocks Pro features. Apple's own privacy policy governs the transaction.
6. Who processes your data
We use a small number of providers to run the service. They process data on our instructions, under contract, and only for the purposes below.
| Provider | What it does | Where |
|---|---|---|
| Google (Firebase Authentication) | Account sign-in and identity, including Sign in with Apple and Google sign-in. | EU / US |
| Google (Cloud Firestore) | Stores your synced training data, routines, gym profiles and settings. | EU / US |
| Google (Firebase App Check) | Verifies requests come from a genuine copy of the app. | EU / US |
| Google (Firebase Crashlytics) | Collects crash reports so we can find and fix bugs. | EU / US |
| Web hosting provider | Serves this website. As with any web host, it receives your IP address and the pages you request in order to deliver them, and keeps standard server logs for a short period. | UK / US |
| Cloudflare (R2 and CDN) | Serves exercise animations and equipment images. | Global edge network |
| Apple | App distribution, In-App Purchase billing, push notifications and Live Activities. | Global |
Where data is transferred outside the UK or EEA, those transfers rely on the providers' Standard Contractual Clauses and equivalent safeguards. We may also disclose data if we are legally required to, or where it is necessary to establish or defend legal claims.
7. How long we keep it
- Account and training data: for as long as your account exists. Delete your account and it is removed from our live systems promptly, and from backups within 30 days.
- Support emails: up to 24 months after the conversation ends.
- Records we must keep by law (for example transaction records): for the period the law requires.
Data held only on your device is deleted when you delete the app.
8. Your rights and choices
Depending on where you live, you have the right to access, correct, delete, restrict or object to our processing of your personal data, to portability, and to withdraw consent where we rely on it. To exercise any of these, email support@medorius.com from your account address.
- Delete your account: in the app under Profile → Account → Delete Account, or by emailing us. See the deletion guide.
- Export your data: in the app under Settings → Exercise Library & Data → Download All My Data, which gives you a complete copy in a machine-readable format (JSON). You can also email us and we'll send it to you.
- Notifications: turn them off in iOS Settings at any time.
If you are in the UK or EEA and think we've handled your data badly, you can complain to your supervisory authority. In the UK that is the Information Commissioner's Office at ico.org.uk. We would welcome the chance to address any concern before you do so.
9. US state privacy rights
This section is for residents of California and the other US states with consumer privacy laws (currently including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island). The rights described elsewhere in this policy apply to you too; this section restates them in the terms those laws use.
What we collect, in California's categories
| Category | Collected? | Examples and source |
|---|---|---|
| Identifiers | Yes | Email address, display name, account ID, IP address. From you, or from Apple or Google if you sign in with them. |
| Commercial information | Yes | Whether a Gymwise Pro subscription is active. From Apple. We never see payment details. |
| Internet or network activity | Yes | App version, device model, OS version and IP address. From your device. |
| Sensitive personal information: health | Yes, with your consent | Body measurements you enter; heart rate, active energy, body mass and body fat from Apple Health if you allow it. From you and your device. |
| Sensitive personal information: account credentials | Yes | Your login, held by Firebase Authentication. We never store a plain-text password. |
| Precise geolocation | No | Gym profiles are names you type, with no location. |
| Biometric, audio or visual data | No | |
| Inferences for profiling | No | Training summaries are calculated from your own logs, for you. We do not build profiles for advertising or decision-making. |
Selling, sharing and sensitive information
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months. There is no "Do Not Sell or Share" opt-out to exercise because there is nothing to opt out of. We do not knowingly sell or share the personal information of anyone under 16.
We use sensitive personal information only to provide the service you asked for: your health data is used to show you your own stats and, if you choose, to save workouts to Apple Health. That is a purpose permitted without a "Limit the Use of My Sensitive Personal Information" option, so none is offered.
We disclose personal information only to the service providers listed in section 6, for business purposes, under contracts that restrict what they can do with it.
Your rights
- Know and access what we hold about you, including the categories above and the specific pieces.
- Delete it, subject to exceptions the law allows (for example, records we must keep).
- Correct anything inaccurate.
- Portability: receive a copy in a usable format.
- Non-discrimination: we will not deny you the service, charge you differently or lower its quality because you exercised a right.
- Appeal, in states that provide one: if we refuse a request, reply to our decision and a different person will review it within 45 days. If you are still unhappy you may contact your state attorney general.
How to exercise them
Email support@medorius.com, or use the in-app deletion under Profile → Account. We will confirm receipt within 10 days and respond within 45, extending by a further 45 if we need to and telling you why. To protect your account we verify requests by matching the email address you write from to the one on the account; we may ask a follow-up question if that does not settle it. You may use an authorised agent, in which case we will ask for your written permission and may still verify with you directly. Requests are free unless they are manifestly excessive.
Consumer health data
Washington, Nevada and Connecticut regulate "consumer health data" specifically. Our Consumer Health Data Privacy Policy sets out how Gymwise handles it in the terms those laws require.
10. Other regions
Gymwise is available worldwide through the App Store. Wherever you live, you can exercise the rights in section 8 by emailing us. Where local law gives you additional rights, such as under Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act or Switzerland's FADP, we will honour them; contact us and tell us where you are based.
11. Children
Gymwise is for people aged 16 and over. It is not directed at children, and we do not knowingly collect their personal data. We use 16 because it is the default age at which someone can consent for themselves under the UK and EU GDPR, and because the health data Gymwise handles deserves the higher of the ages member states are free to choose. If you believe a child has given us data, contact us and we will delete it.
12. Security
Data in transit is encrypted with TLS, and data at rest is encrypted by our infrastructure providers. Access to production data is restricted to the people who need it to operate the service, and server-side security rules limit each account to its own records. No system is completely secure. If a breach affects your data and the law requires it, we will notify you and the relevant regulator.
13. Changes to this policy
If we change this policy we'll update the date at the top, and for significant changes we'll tell you in the app or by email before they take effect.
14. Contact
Questions about this policy, or about your data:
Medorius
support@medorius.com
medorius.com