Gym terms and data processing agreement

Part A — General terms

1. Parties and acceptance

1.1RxApp is provided by Dicabrio.com, Dijkwacht 114, 2353 EL Leiderdorp, the Netherlands; support@rxapp.io. The gym is the business subscribing to the software. A subscription is between RxApp and the gym; a membership is between the gym and its member.

1.2The accepting representative confirms authority to bind the gym. Acceptance includes these terms and the data processing agreement in sections 9–14. We record the representative, gym, document type, version, date, time and available IP address. Personal accounts also have athlete terms. The gym's own terms do not govern the RxApp subscription.

2. Service and responsibilities

2.1RxApp provides member administration, classes, bookings, workouts, reporting and collections support depending on selected modules. The gym is responsible for its classes, staff, safety, membership terms, prices, cancellations and member communications.

2.2Keep business information accurate, secure staff accounts and revoke access when staff leave. The gym is responsible for valid debit mandates, correct amounts and advance notices. RxApp processes technical instructions; member payments are not RxApp revenue or balances.

2.3The gym receives a non-exclusive, non-transferable right to use the service for its own business. Software rights remain with RxApp; rights in supplied content remain with their holders. RxApp may process that content only to provide the service.

3. Trial, payment and cancellation

3.1The free trial duration is shown during registration. A paid subscription requires subscribing; expiry of a trial alone does not create one. Features may become restricted or read-only without a paid subscription.

3.2Selected modules and prices are shown when ordering and on the pricing page, excluding VAT unless stated otherwise. Stripe bills monthly according to the subscription's billing cycle. Bank and payment-provider fees are separate and disclosed at the relevant choice.

3.3Cancel through Billing at any time, effective at the end of the current billing period. Amounts already paid are not refunded solely for mid-period cancellation. Statutory remedies for failures, undue payments or termination remain available.

3.4Price increases are announced at least thirty days in advance, with the option to cancel as of their effective date. For late payment we send a reminder with a reasonable opportunity to pay before restricting access.

4. Availability and changes

4.1RxApp takes reasonable care to deliver a secure service but provides no guaranteed uptime or repair time without a separate written agreement. Planned maintenance is announced in advance where possible.

4.2We may improve the service. If paid functionality is materially reduced, we give advance notice and an appropriate price adjustment or an opportunity to cancel the affected service before the change.

5. Privacy and independent athlete accounts

5.1GDPR roles follow processing purposes, not simply who entered data. For gym administration, bookings, staff management and collections performed on gym instructions, the gym is controller and RxApp processor under sections 9–14.

5.2RxApp is an independent controller for its own account management, security, gym billing and personal or social features whose purposes it determines. The privacy policy applies. The gym does not acquire unrestricted access to an athlete's personal account data.

5.3The gym informs individuals and ensures lawful grounds, including an applicable Article 9 GDPR exception for health data. Acceptance here is not a member's consent. If it sees the need, the gym may make members who have not chosen discoverable to other members of the gym. The gym informs its members in advance. Members can always change their own choice. The gym cannot make members discoverable outside the gym.

6. Liability and confidentiality

6.1The gym is responsible for its own classes, facilities, staff and member arrangements. RxApp remains responsible for its own supplier and processor obligations.

6.2To the extent permitted by law, RxApp's liability for attributable breaches is limited to subscription charges paid by the gym in the twelve months before the event causing damage. Indirect loss, including lost profits, is excluded. These limits do not apply to intent or deliberate recklessness of management or where mandatory law prohibits them. Individuals' GDPR rights are not limited.

6.3Each party keeps the other's confidential information secret, sharing it only with persons bound to confidentiality who need it for performance, or as required by law.

7. Ending the subscription and data access

7.1Ending the RxApp subscription does not end gym memberships or automatically delete independent athlete accounts. It concerns the gym's software rights and administrative processing.

7.2During the subscription the gym can use available exports and request its administration in a commonly used machine-readable format via support@rxapp.io. At termination the parties arrange export and closure; a request within thirty days after termination is included in that process. Export access does not extend paid functionality.

7.3Data processed solely on gym instructions is returned or deleted under section 14. Independent account data and statutory retention are handled separately. Serious or repeated breaches may lead to suspension or termination after a reasonable remedy opportunity; urgent security risks may require immediate action.

8. Changes and disputes

8.1Material changes are announced at least thirty days in advance and require renewed acceptance by an authorised representative. The gym may cancel as of the change date if it declines. A privacy notice is information, not blanket GDPR consent.

8.2Dutch law applies. Parties first try to resolve complaints together, then may refer disputes to the legally competent court in the district of The Hague.

Part B — Data processing agreement

9. Data processing agreement: instructions and scope

9.1Sections 9–14 form the Article 28 GDPR processing agreement and prevail over other gym terms for processing on instructions. Processing lasts for service delivery and agreed closure.

9.2Individuals include members, leads, contacts and staff. Depending on features, data includes identity and contact details, memberships, bookings, attendance, communications, payments, mandates and gym-recorded training data or notes. Operations include collection, storage, organisation, access, alteration, instructed disclosure, export and erasure.

9.3Documented instructions comprise the agreement, selected features, settings and lawful gym instructions. RxApp does not process this data for its own advertising or sale and notifies the gym if an instruction appears to infringe privacy law. Legally required processing outside instructions is notified beforehand unless prohibited.

10. Security and confidentiality

10.1RxApp applies risk-appropriate technical and organisational measures: role- and need-based access, secure connections, password hashing, secrets management, security updates, recovery and incident handling. The gym secures its devices, accounts and exports. Information needed to assess measures is available on request; sensitive security details are shared securely.

10.2Persons acting for RxApp are bound by confidentiality and process only as needed for their task. Additional measures are agreed where special-category data or specific risks require them.

11. Providers and international transfers

11.1The gym grants general written authorisation for subprocessors for hosting, storage, email and push notifications. Technical providers include Vercel (hosting), Amazon Web Services (storage), Mailgun (email) and OneSignal (push), where used for the processing concerned. Stripe provides payments and may be an independent controller for its own legal and payment purposes.

11.2RxApp keeps a current specification of providers, services, processing locations and transfer safeguards available via support@rxapp.io. New or replacement subprocessors are notified at least thirty days ahead. The gym may raise a reasoned privacy objection within that period. Parties seek a suitable solution; if none is possible, the affected service can end before the change.

11.3RxApp imposes equivalent protection duties on subprocessors and remains responsible for their processor obligations. Transfers outside the EEA require an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses and supplementary measures where necessary. Information on applicable safeguards is available on request.

12. Breaches and assistance

12.1RxApp notifies the gym contact without undue delay of personal data breaches affecting data processed for the gym. Available information includes nature, affected categories and numbers, likely consequences, measures and a contact point. Missing information follows when available.

12.2The gym decides on notifications to authorities and individuals. Taking account of processing and available information, RxApp assists with data rights, security, breaches, impact assessments and prior consultation. Requests about gym-controlled data are forwarded without independent substantive decisions unless law requires otherwise.

13. Audit

13.1RxApp provides information necessary to demonstrate Article 28 compliance and cooperates with reasonable audits by the gym or an independent auditor. Scope, security, confidentiality and timing are agreed beforehand, without restricting statutory investigative powers or necessary urgent audits after serious incidents.

14. Return and deletion

14.1After processing ends, RxApp returns or deletes the gym's personal data at the gym's choice and deletes copies unless legal retention is required. Closure arrangements and timing are documented when termination is requested. Backups remain outside ordinary use and are overwritten under the applicable backup cycle; restoration must not undo erasure requests.

14.2Data for which RxApp is an independent controller is not automatically subject to a gym's deletion instruction. It is assessed under the privacy policy and athlete rights. A gym cannot end an athlete's independent account relationship on their behalf.