Legal
Privacy Policy
This policy explains what Koapath collects, why we collect it, who processes it on our behalf, and the control you have over it. It covers the Koapath app for trainees, the Koapath Coach app and coach website, koapath.com, and the servers that support them.
Effective:
The short version
- We do not advertise to you or track you across other apps. There is no advertising SDK, we collect no advertising identifier, and we never sell your data.
- We do collect health information, such as your measurements, allergies, medications and medical conditions, because a coach cannot build a safe plan without it. You choose what to enter.
- Your coach sees what they need to coach you. Nobody else does, apart from the service providers listed in section 6, each for one stated job.
- The apps send crash reports and anonymous usage events so we can fix problems and see which features are used. They are not linked to your name or email.
- You can close your account from inside the app at any time, and we then erase your personal data within 30 days.
1. Who we are
Koapath is a marketplace that connects trainees with independent private fitness coaches and gives both sides the tools to manage plans, progress and communication. Koapath is operated by Abdallah Abusidu, an individual based in Dubai, United Arab Emirates, who is the data controller for the personal data described in this policy. "Koapath", "we" and "us" in this policy mean him.
You can reach us at any time at team@koapath.com.
2. What we collect
We collect what the service needs in order to work. Most of it you enter yourself; the rest is generated by your use of the apps.
| Category | What this includes | Why we need it |
|---|---|---|
| Account | Name, email address, phone number if you add one, account role (trainee or coach), and sign-in identifiers. If you sign in with Apple or Google, we receive the name, email and account identifier they share with us. | To create your account, sign you in, and keep it secure |
| Personal details | Date of birth, gender, and your city and country | To match you with suitable coaches and to calculate plans. Your coach can see your age. |
| Health and fitness data | Height, weight, body measurements, body-fat percentage, training goals, diet, sleep, allergies, medications and medical conditions | So a coach can build a plan that is safe and appropriate for you |
| Step count | If you allow it, your daily step count read from Apple Health or Android Health Connect. We read steps only. | To show your activity to you and your coach |
| Progress photos and check-ins | Photos you upload to record your progress, and your answers to check-in forms your coach sends you, which can include photos, measurements and how you are feeling | So you and your coach can see your progress |
| Coaching content | Plans, workouts, meals, habits, booked sessions and the daily progress you log | To deliver the coaching relationship |
| Messages | In-app chat messages and what you attach to them: photos, videos, documents and voice notes | To let you and your coach communicate inside the app |
| Coach profile | Biography, specialities, certifications, pricing, location, whether you coach in person or online, and profile media. Most of this is public, because trainees use it to choose a coach. | To let trainees find you |
| Coach identity check | A photo of an identity document and a selfie taken with the camera when a coach signs up | To check a coach is who they say they are. Only Koapath staff can see these, never trainees. |
| Purchases | Subscription status, purchase history, payment amounts, and the store or payment identifiers for each transaction. For coaches paid directly by their clients, any payment proof a client uploads. | To give you access to what you paid for and handle refunds |
| Notifications and emails | Your push-notification device token and your email address | To send sign-in codes, notifications you have agreed to, and reminders to coaches who have not finished signing up. Every reminder email has an unsubscribe link. |
| Crash reports and usage events | When something goes wrong in the app: the error, the device model, operating system and app version. When you use the app: events such as opening it or finishing a step, tied to a random install identifier rather than to your name or email. | To find and fix problems, and to see which features are actually used |
| Website forms | If you join a waitlist or the coach pilot on koapath.com: your name, email, role, country, phone number and any note you add. If you send feedback: what you write and, if you choose, your name and email. | To contact you about what you signed up for, and to fix what you report |
3. What we do not do
- No advertising. Koapath shows no ads and contains no advertising SDK. None of your data, least of all your health data, is used to target advertising anywhere.
- No advertising identifier. We do not collect the IDFA or any equivalent device advertising identifier, and we do not track you across other companies' apps or websites.
- No sale of personal data, and no sharing with data brokers.
- No model training. We do not use your content to train AI models.
- Apple Health and Health Connect data is used only to provide the coaching service to you. It is never used for advertising or marketing, never sold, and never shared with anyone other than your coach.
4. How we use your data
- To run the service: coach discovery and matching, plans, progress tracking, chat, sessions and subscriptions.
- To control access, so that your coaching data reaches only you and the coaches you work with.
- To review coach identities and profiles.
- To send sign-in codes and the notifications and emails described above.
- To take payment and process refunds and disputes.
- To find and fix bugs, and to understand which features are used.
- To keep the service secure and to prevent fraud and abuse.
- To meet legal obligations and to enforce our Terms of Service.
5. Our legal bases
Where the UAE Personal Data Protection Law, the GDPR or a comparable law applies, we rely on the following bases.
- Performance of a contract: to provide the service you signed up for.
- Consent: for health and fitness information, step data and progress photos. You decide whether to provide these, and you can withdraw consent by removing the information, turning off Health access in your phone's settings, or closing your account.
- Legitimate interests: security, fraud prevention, crash reporting and improving the product.
- Legal obligation: where a law requires us to keep or disclose something, most often for tax and accounting.
6. Who processes data for us
We use a small number of service providers, each for a stated purpose. None of them receives your data for advertising.
| Provider | What it does | What it receives |
|---|---|---|
| Hetzner (Finland) | Hosts our servers, including the uploaded files: progress photos, chat attachments and coach identity documents | Everything stored on our servers, held on our behalf |
| MongoDB Atlas, on Amazon Web Services (Singapore) | Hosts our database | Account, profile, health, coaching, chat and payment records, held on our behalf |
| Google (Gmail) | Sends sign-in codes and service emails from a Koapath Google account | Your email address and the content of the email |
| Expo | Delivers push notifications | Your device push token and the content of the notification |
| Sentry | Crash and error reporting | Error details, device model, operating system and app version, with passwords, tokens and other secrets removed before sending |
| PostHog | Usage analytics | App events tied to a random install identifier, not to your name or email |
| Stripe | Processes purchases made on the coach website | Payment amounts and status and transaction identifiers |
| RevenueCat | Manages subscriptions bought in the apps or on the coach website | Your Koapath user id, store transaction identifiers and subscription status |
| Apple and Google | Process App Store and Google Play purchases, deliver push notifications, and provide Sign in with Apple and Google sign-in | Purchase and subscription data under your Apple or Google account, notification payloads and device tokens, and sign-in requests |
| Vercel | Hosts koapath.com and the coach website | Standard web request data, such as your IP address and browser |
| Metricool | Counts visits to koapath.com (website analytics only, not the apps) | Pages you view, the site that sent you, your browser and device type, and your approximate location from your IP address |
Food-photo recognition is not switched on. If we turn it on, we will name its provider here first, because it would send the meal photos you choose to scan to that provider.
8. Where your data is stored
Our servers and your uploaded files are in Finland, and our database is in Singapore. Some of the other providers above operate in the United States or elsewhere. Your data may therefore be processed outside your country. Where a transfer requires a safeguard, we rely on an appropriate one, such as standard contractual clauses.
9. How long we keep it
| Data | How long we keep it |
|---|---|
| Account, profile, health data, photos, check-ins, chat and coaching content | For as long as your account is open. When you close your account it is disabled straight away, and this data is permanently erased within 30 days, unless a specific legal hold applies. |
| Coach identity documents and selfies | For as long as the coach account is open, then erased with the rest of the account. |
| Payment records | For as long as tax, accounting, anti-fraud and card-scheme rules require. We detach or pseudonymise your profile data from these records where we can. |
| Crash reports and usage events | Kept by Sentry and PostHog for their standard retention period, and not linked to your name or email. |
| Website form submissions | Until the waitlist or pilot they were for is over, or sooner if you ask us to delete them. |
| Backups | Erased data ages out of our database backups on their normal rotation. |
10. Your rights
Depending on where you live, you have the right to:
- Access your data and receive a copy of it in a machine-readable format.
- Correct anything that is wrong. Most of it you can edit in the app yourself.
- Delete your account and your data.
- Withdraw consent to optional processing at any time.
- Object to or restrict certain processing.
- Complain to your data protection regulator.
To exercise any of these, email us at team@koapath.com. We will verify that the request really comes from you, respond within the deadline the law sets, and tell you plainly if a financial record has to be kept.
11. Closing your account
You can close your account from inside the app, at Profile → Account → Delete account. Closing your account ends any active coaching billing before the account is disabled.
Full instructions, including what to do if you cannot sign in, are on our account deletion page.
12. How we protect your data
- Every request is checked against who is signed in and what they are allowed to see, so one account cannot reach another's data.
- Private files, such as progress photos, chat attachments and identity documents, are served only to the people allowed to see them.
- All traffic is encrypted in transit over HTTPS.
- Session tokens are held in your device's secure store, not in ordinary app storage.
- Payment secrets stay on our servers; only a publishable key ever reaches the app.
No system is perfectly secure. If a breach affects your data, we will tell you and the relevant regulator as the law requires.
13. Children
Koapath is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will remove it.
14. Changes to this policy
If we change this policy in a way that materially affects you, we will tell you in the app before the change takes effect. The effective date at the top of this page always reflects the current version.
15. Contact us
Questions, requests or complaints about privacy go to team@koapath.com, and a person will read them.