Security and privacy
You are holding health data. So are we.
Injuries, medications, screening answers, clinical notes and progress photographs are special-category personal data under UK GDPR. GymRally treats the Vault as a different class of thing from the rest of the product, with controls that a coach can point at when a client asks.
How it is protected
Four things that are structural rather than procedural
Each of these is enforced by the database or the infrastructure. None of them relies on an engineer remembering a rule during a code review.
Isolation the database enforces
Every table belonging to an organisation is protected by a row-level policy with no exceptions and no role escapes. The rule is applied from the catalogue at migration time, so a new table cannot ship without it.
Encryption keyed per organisation
Health free text, screening answers and coach notes are encrypted with a key belonging to that organisation alone, wrapped by a separate secrets service rather than sitting in the database beside the data.
No standing administrator access
There is no support role that can read a health record on a whim. Access requires a stated reason, a second administrator’s approval and an expiry, and it appears in the client’s own access log.
Every read of the Vault is logged
Not a sample, not the writes only. A client can see who opened their record and when, and the screen that shows it to a coach says out loud that the view is being recorded.
Two separate questions
Who may read it, and who should see it
Most systems confuse security with visibility. GymRally keeps them apart, because they fail in different ways.
Security is whether a request is permitted at all: the organisation the data belongs to, and the capability the person holds. That is enforced in the database, on every query, without exception.
Visibility is whether a record is meant for the client to read. A clinical annotation marked coach-only is not hidden behind an interface decision — the client application does not query for it, so there is no version of that screen, on any device, that could render it.
Being assigned to a client does not grant access to their health records either. That requires the Vault capability as well as a live coaching relationship, and the two are checked independently.
What a client can do
- See every coach who currently has access to them, and end a relationship.
- Choose, scope by scope, what one coach may see of another coach’s work.
- Withhold health records from that sharing entirely — the default, and it requires an explicit act to change.
- Read their own access log.
- Export their history, and keep it if they leave you or you leave GymRally.
Data protection
Who is responsible for what
GymRally holds two roles at once, and being clear about which applies decides where a subject access request goes.
- Your organisation
- Controller for coaching and health data. You decide what is collected, why it is held and how long for, within the retention period configured for your organisation.
- GymRally, as processor
- Processes coaching and health data on your documented instructions under a data processing agreement, and assists with subject access requests routed to you.
- GymRally, as controller
- Independently the controller for account, security, telemetry and its own marketing data. Requests about those go to GymRally directly rather than to you.
- Sub-processors
- A published register, covering hosting, transactional email, messaging, payment processing and the named AI provider, each under contract with retention and training restrictions.
Operations
How it is run
- Where it runs
- GymRally-operated infrastructure in the United Kingdom, with full-disk encryption on the host and TLS terminated at the edge with modern protocols only.
- Backups
- Continuous write-ahead archiving with weekly full and daily incremental backups, pushed encrypted to a second physical location every night. A restore is executed and timed every month, because a backup nobody has restored is not a backup.
- Retention
- Health records are retained for seven years from the last session by default, configurable per organisation. Purge destroys the organisation’s encryption key, which makes the encrypted records unrecoverable rather than merely deleted.
- Photographs
- Progress and meal photographs have their embedded location metadata stripped on upload. A photograph taken at home should not carry the address of the home.
- Minimum age
- Sixteen and over only, checked at signup and enforced by a database constraint. GymRally holds no children’s data and operates no parental consent flow.
- Analytics
- Engagement, adherence and any health-adjacent metric is computed first-party and never sent to a third-party analytics product, including in aggregate.
Being straight about it
What GymRally does not claim
A security page that lists only strengths is a marketing page. These are the limitations we would rather you heard from us.
- No formal certification yet. GymRally is not ISO 27001 certified or SOC 2 audited. The controls described here are real and testable; the badge is not there, and we will not imply it is.
- Planned downtime is normal. The platform runs on a single host, which means there is no automatic failover. Maintenance windows are announced, and an unplanned outage is total until it is fixed.
- Backup is the whole disaster-recovery story. There is no hot standby. Recovery means restoring from an encrypted off-site backup, which is why a restore is executed and timed every month rather than assumed to work.
- Content on a device is not encrypted by us. The client app caches today’s workout for offline use. A browser offers no real key custody, so we do not describe that cache as encrypted.
- Qualifications are self-declared at launch. They are verified only before a public marketplace profile can be published, and until then a stated qualification is a claim rather than a check.
Questions
What people ask us
Who is the data controller for my clients’ health data?
You are. Your organisation is the controller for coaching and health data, and GymRally is your processor for it. GymRally is an independent controller only for account, security and telemetry data, and both roles are stated in the data processing agreement.
Can GymRally staff read my clients’ health records?
Not by default, and not quietly. There is no standing platform-administrator access to Vault content. Reaching a health record requires a break-glass grant with a stated reason, a second administrator’s approval and an expiry, and it appears in the client’s own access log.
Where is the data hosted?
On GymRally-operated infrastructure in the United Kingdom, with full-disk encryption on the host and encrypted off-site backups taken nightly to a second physical location.
What happens to health data when an organisation leaves?
A 30-day read-only grace period with a full export, then archival for the agreed retention period, then purge. Purge destroys the organisation’s encryption key, which makes encrypted records unrecoverable rather than merely deleted from a table.
Is anything sent to an AI provider?
Only what a specific task genuinely requires, and only to a named sub-processor under terms that forbid retention and training on your data. Vault fields are excluded from prompts unless the task cannot be performed without them.
Send us your security questionnaire
If you are moving a client base with health records onto a new platform, bring the questions your insurer or your governing body asks. We would rather answer them before you sign than after.