Movement App
Privacy policy
Version 1.2 · valid from 2 October 2026
This policy explains what personal data the Movement App ("the app") uses, why, where it is kept, for how long, and what rights you have. It applies to everyone who uses the app. I wrote it to be read, not to be skimmed past: if anything is unclear, write to me.
1. Who is responsible
The controller of your data is:
Dominik Koch, entrepreneur individuel (régime micro-entrepreneur)
148 Chemin Petit Frère, 97432 St Pierre, La Réunion, France · SIRET 983 102 781 00017
Email: dominik@decrypt-bodywork.com
I have not appointed a data protection officer (not required for a business of my size). For any question about your data, write to the email address above.
2. What the app is for
The app supports your 1:1 movement education with me: your programme and exercise videos, your practice log, your journal, the videos and photos you share for feedback, my replies, and your sessions with me (dates, a link to join the video call, and the option to cancel or move a session).
The app is designed for movement and biomechanics education, not medical diagnosis or treatment, and it is not a substitute for medical care. Please do not upload medical documents or other medical records to the app.
3. What data I use, why, and on what legal basis
| What | Examples | Why | Legal basis |
|---|---|---|---|
| Account | Name, email address, access level (e.g. "1:1 client"), when you last used the app | To give you access and send your sign-in codes | Performance of the contract (Art. 6(1)(b) GDPR) |
| Programme | The exercises, videos, sessions and notes I write for you, and earlier versions of your programme | The teaching itself | Contract (Art. 6(1)(b)) |
| Practice log | Sessions and movement snacks you mark as done, optional one-tap feelings ("calmer", "looser"…), finished breathing sessions (rhythm and length), your saved breathing rhythm, your favourites | Your weekly and monthly overview and calendar; lets me follow your practice | Contract (Art. 6(1)(b)) |
| Sessions | Your name and email address; date, time and length of your sessions; an optional note in the invitation; the video-call link; if you cancel or move a session in the app: when you did it, your optional message, and whether it was less than 24 hours before the session | Booking your sessions (Google sends you the invitation and any change); showing your sessions and a "Join" button; handling cancellations | Contract (Art. 6(1)(b)) |
| Journal and messages | What you noticed, quick chips ("more ease", "couldn't do"…), questions to me, replies in both directions | Feedback and communication between sessions | Contract (Art. 6(1)(b)) |
| Your videos and photos | Videos/photos of you moving, which exercise they show | My feedback on your movement | Contract (Art. 6(1)(b)); where the content constitutes health data, explicit consent (Art. 9(2)(a)), given separately before your first upload; you can withdraw it at any time |
| My feedback | Feedback videos (my voice, possibly my face, drawings over your video) and photos of yours that I drew on | Feedback | Contract (Art. 6(1)(b)); the consent above for the parts showing you |
| Technical and security data | IP address, browser type, time of requests, error logs, sign-in attempts | Keeping the app secure and working, preventing misuse | My legitimate interest in a secure service (Art. 6(1)(f)) |
| Your acceptance and consents | Date and version of the terms and this policy you accepted; date of your video/photo consent and of any withdrawal | Proof of what you agreed to | Legal obligation / legitimate interest (Art. 6(1)(c) and (f)) |
You don't have to provide videos, photos, journal notes or questions: they are optional. Your name and email address are needed to have an account.
No automated decisions, no profiling, no advertising, no analytics, no selling of data.
4. Videos and photos of you
Videos, photos and written observations are personal data. Depending on their content and context, they may also contain information concerning your health and therefore constitute health data under the GDPR. So:
- Before your first upload, the app asks for your explicit, separate consent. Without it, you can use everything else.
- Only I see your videos and photos. They are never public, never used for marketing, and never shown to other clients.
- Photos are made smaller on your phone before they are sent, which also removes hidden information such as the location where the photo was taken. They are stored in Paris (France).
- Videos are stored in the EU (Frankfurt and Stockholm), kept in at most 1080p quality (the original file is not kept), and played through private, time-limited links.
- An upload only reaches me when you press Save to journal. If you don't save it, it is deleted automatically by the next nightly clean-up (within 2 days at most).
- You can withdraw your consent at any time in the app (Profile & settings) or by email. Your videos and photos, my feedback videos and the photos I drew on are then deleted immediately, and you can no longer upload new ones unless you give your consent again.
5. Who receives your data
- Me (Dominik Koch).
- A small number of service providers that operate the app for me. They process personal data only on my instructions and under a data processing agreement ("processors"):
| Provider | What it does | Where the data is |
|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Database, sign-in, storage of your photos and all other app data (programmes, practice logs, journal, messages, consents) | Paris, France (EU). Supabase may use subprocessors and process data outside the EEA where needed, with appropriate safeguards (section 6). |
| Vercel (Vercel Inc., USA) | Runs the app (web server) | Functions in Paris, France; Vercel's global network may be involved in delivery and support |
| Bunny.net (BunnyWay d.o.o., Slovenia) | Private storage, processing and delivery of client videos and my feedback videos | Storage in Frankfurt (Germany) and Stockholm (Sweden); copies may be cached on delivery servers near the viewer |
| Brevo (Sendinblue SAS, France) | Sends your sign-in codes, and short notifications to me (for example when you cancel a session or delete your account) | EU. Brevo may use subprocessors and process data outside the EEA with appropriate safeguards. |
| Google Workspace (Google Ireland Ltd.) | Calendar (session invitations, changes and cancellations) and Google Meet (video calls). Google processes the information needed for these services, such as names, email addresses, calendar information and call connection data. Calls are not recorded unless we both agree beforehand. | EU and other countries where Google operates, with appropriate safeguards (section 6) |
- Other recipients (not processors; they handle the data under their own terms):
- Apple (Apple Distribution International Ltd., Ireland): my Google Calendar is synchronised to my Apple Calendar (iCloud) on my own devices, so your session events (your name, date and time) also appear there.
- YouTube (Google): my exercise videos are hosted on YouTube. They load only when you press Play, in YouTube's privacy-enhanced mode (youtube-nocookie.com). When you play one, Google receives your IP address and technical data and handles them under its own privacy policy, as a separate controller.
- Authorities, only where the law requires it.
I never sell or rent your data.
6. Transfers outside the European Union
Your app data is stored in the EU. Some providers are companies based outside the EU (Vercel Inc. in the USA, Supabase Pte. Ltd. in Singapore), Google and Apple may process calendar information outside the EU, and Bunny may deliver cached video copies from servers outside the EU when a video is watched from there. Where data can be accessed from outside the EU, it is protected by the European Commission's Standard Contractual Clauses, or by an adequacy decision such as the EU–US Data Privacy Framework for certified US companies. You can ask me for a copy of these safeguards.
7. How long I keep your data
I keep personal data only for as long as it is needed for the purposes described in this policy, subject to legal retention requirements.
| Data | Kept |
|---|---|
| Account, programme, practice log, journal, messages | While you keep using the app, also after our sessions have ended, so you can keep practising with your programme. If you haven't used the app for 12 months, I send you a warning email; if you don't use it in the following 30 days, your account and everything in it is deleted. You can delete your account yourself at any time (section 8). |
| Your videos and photos, my feedback videos and the photos I drew on | While we continue to have sessions; deleted automatically 6 months after your last session with me (a session booked for the future counts as continuing). Deleted immediately if you withdraw your consent. |
| New video and photo uploads | Switched off 6 months after your last session with me; switched on again when we book a new session. Your programme and other content stay available. |
| Uploads you didn't save | Deleted automatically by the next nightly clean-up (within 2 days at most) |
| Session events in my calendar | While you are a client, then deleted 6 months after your last session, unless needed longer for my business records |
| Technical and security logs | At my providers, usually a few days and at most 90 days |
| Backups | Overwritten automatically by my providers, usually within 7 days after deletion from the app |
| Proof of acceptance and consents | For as long as the account exists, plus 5 years (limitation period), as a minimal record |
Some information may need to be kept longer where the law requires it, for example accounting and tax records.
8. Your rights
You have the right to:
- access your data and get a copy;
- correct it;
- delete it ("right to be forgotten");
- restrict how it is used;
- receive it in a portable format;
- object to uses based on my legitimate interest;
- withdraw your consent at any time (this doesn't affect what was done before);
- give instructions about your data after your death (French law, Loi Informatique et Libertés, art. 85).
In the app (Profile & settings) you can do some of this yourself, straight away:
- Download my data: a file with your programme, practice log, journal and messages, with links to your videos and photos (valid for 7 days).
- Withdraw your video/photo consent (section 4).
- Delete my account: your account and everything in it is deleted immediately. I receive an email that you left.
For anything else, write to dominik@decrypt-bodywork.com. I normally respond within one month. Where permitted by law, this period may be extended by up to two further months; if this happens, I will tell you why. I may ask you to confirm your identity.
If you think I don't respect your rights, you can complain to the French data protection authority, the CNIL (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), or to the authority of the country where you live (for example the ICO in the UK).
9. Security
- Sign-in with a one-time code by email (no passwords to steal); sessions expire.
- All connections are encrypted (HTTPS).
- The database uses row-level security: each client can only ever read their own data; only my account can see all clients.
- Videos and photos are private and only playable or viewable through signed links that expire.
- Two-factor authentication on all my service accounts.
- Development and tests use made-up data only.
10. Cookies and similar technologies
The app only uses what is strictly necessary for it to work:
- a sign-in cookie that keeps you logged in (set by the sign-in system of my database provider);
- storage on your device (local storage) for small conveniences, for example the length and rhythm you last chose for breathing.
These don't track you and don't need consent (Art. 82 Loi Informatique et Libertés; CNIL guidelines). No analytics, advertising or social-media cookies.
Some of my exercise videos are hosted on YouTube. The YouTube player is not loaded until you press Play. When you press Play, the player loads and YouTube may place or read cookies and other trackers on your device and process technical information such as your IP address, as described in its own privacy policy. If you do not press Play, the YouTube player is not loaded.
11. Age
The app is for adults (18 and over).
12. Changes to this policy
If I change this policy in a way that matters, I tell you in the app before it applies, and ask you to confirm where the law requires it. The version and date are shown at the top.