Data Processing Agreement

Last updated: 2026-10-26

This Data Processing Agreement applies to coaches who use SunCoach with their clients. It sets out how SunCoach processes the client data a coach manages in the app, as required by Article 28 of the EU General Data Protection Regulation (GDPR) and Article 9 of the Swiss Federal Act on Data Protection (revFADP). It is part of our Terms of Service for every coach account and sits beside our Privacy Policy; for coach-managed data, this agreement governs.

1. Parties and definitions

This agreement is between the Coach — the person or business using SunCoach's coach features — and the operator of SunCoach (SunCoach):

• Client: a person the Coach coaches through SunCoach, whether they have their own app account or exist only as an offline record the Coach created.
• Offline record: a client profile the Coach creates and fills in themselves, for a person with no app account.
• Coach-managed data: personal data the Coach enters, creates or instructs SunCoach to process for their practice (section 2).
• Personal data, processing, controller, processor, personal data breach: as defined in Art. 4 GDPR and Art. 5 revFADP.
• Sub-processor: a provider SunCoach engages to process coach-managed data (section 5).

2. Roles

SunCoach acts as the Coach's processor for coach-managed data, and as an independent controller for what clients put into their own accounts. A client with an app account signs up with SunCoach directly, accepts its Privacy Policy and gives recorded consent before any coach sees their data; the Coach then receives that data as a controller in their own right, for their coaching.

The Coach is responsible for having a lawful basis for their own processing, including explicit consent for health data (Art. 9(2)(a) GDPR, Art. 6(7) revFADP) for offline records they create.

3. Subject matter, purpose and data

SunCoach hosts, stores, displays and analyses coach-managed data so the Coach can run a nutrition coaching practice, for as long as the Coach's account exists.

• Nature of processing: storage, retrieval, display, structuring, transmission to the client's app, PDF generation, and AI analysis where the Coach asks for it (session briefs, meal plans, guides).
• Data subjects: the Coach's clients, including people with no app account (offline records).
• Categories of data: name, email and contact details; age, sex, height, weight; goals and targets; meals and food logs; habits; body measurements; check-in answers; session dates, notes, fees and payments; invoice details.
• Special categories: health data (Art. 9 GDPR; sensitive data, Art. 5(c) revFADP), including diet restrictions, pregnancy or breastfeeding, and progress photos of the body.
• Never processed for the Coach: progress photos are not sent to any AI service, and chat messages are not used by Coach AI or session briefs.
• Duration: the term of this agreement (section 10), plus the deletion periods in section 9.

4. SunCoach's obligations

SunCoach processes coach-managed data only on the Coach's documented instructions, which are this agreement and the Coach's use of the app.

1. Instructions. No processing for any other purpose. If an instruction appears to break data protection law, SunCoach tells the Coach without delay.
2. Confidentiality. Everyone with access is bound to confidentiality.
3. Security. The measures in Annex 1, kept at least at that level for the term.
4. Sub-processors. Only as in section 5, each bound by obligations no weaker than these.
5. Assistance. Help with data subject requests (section 8), breach notices (section 7), and data protection impact assessments or prior consultations where the Coach needs them.
6. Deletion or return at the end, as in section 9.
7. Information. Everything needed to show compliance with Art. 28 GDPR, as in section 10.
8. Records. A record of processing activities carried out for coaches (Art. 30(2) GDPR, Art. 12 revFADP).

5. Sub-processors

The Coach authorises the sub-processors below. SunCoach gives at least 30 days' notice of a new one, by email or in the app; the Coach may object in that time and, if no solution is found, end this agreement.

RevenueCat, and Apple and Google as app stores, process the Coach's own subscription, not client data, and are covered by the Privacy Policy. Open Food Facts is not a sub-processor: it receives only a scanned barcode number, never personal data.

6. International transfers

The database and file storage are hosted in the EU (Ireland). Server functions run in Supabase's data centre nearest to whoever calls them. Some sub-processors are in the United States. Each transfer there rests on the EU-US Data Privacy Framework or its Swiss-US extension where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (as recognised by the Swiss FDPIC), with the provider's supplementary measures.

The Coach may ask for a copy of the safeguards for any sub-processor.

7. Personal data breaches

SunCoach tells the Coach without undue delay, and within 48 hours of becoming aware, of any breach affecting coach-managed data. That leaves the Coach time for their own 72-hour notice to a supervisory authority (Art. 33 GDPR) or a notice "as soon as possible" to the FDPIC (Art. 24 revFADP).

The notice says, as far as then known: what happened, which data and roughly how many people are affected, the likely consequences, what SunCoach has done and recommends, and a contact. SunCoach adds to it as it learns more.

8. Requests from clients

The Coach answers requests from their clients about coach-managed data; SunCoach helps. A request that reaches SunCoach but concerns the Coach's processing is passed to the Coach within 5 working days, unanswered.

Most requests the Coach can handle in the app:

• Correction: notes, measurements, sessions, check-in settings and offline records are editable by the Coach.
• Deletion: the Coach can delete notes, pages, sessions, measurements, and an offline record with everything in it.
• End of the relationship: when a client disconnects, the Coach's access to their logged data ends at once; progress photos become invisible to the Coach immediately.

Where the app has no button for it (for example a full export of one client's coach-managed data), SunCoach provides it on request within 30 days, free of charge.

9. Deletion and return

When the Coach deletes their account, SunCoach deletes coach-managed data at once: offline records and everything on them, notes and notebook pages with their files, sessions, packages, invoices, check-in forms, templates, saved replies and the practice logo. Clients with their own accounts keep their accounts and what they logged.

Before deleting, the Coach can export their revenue (CSV or PDF) and save any PDF the app makes. On request made before deletion, SunCoach returns coach-managed data in a machine-readable format within 30 days.

Copies in the providers' backups expire with those backups' retention period. SunCoach keeps nothing it is not required to keep by law.

10. Audits, liability, term and law

• Information and audits. SunCoach answers the Coach's written questions about its processing within 30 days and shares its sub-processors' certifications and reports where they allow it. An on-site audit is possible once a year, with 30 days' notice, at the Coach's cost, under confidentiality.
• Liability. As in the Terms of Service, except where Art. 82 GDPR or Swiss law does not allow a limit.
• Term. From when the Coach first uses SunCoach with a client until their coach account is deleted. Sections 7 to 9 continue while any coach-managed data remains.
• Priority. For coach-managed data this agreement prevails over the Terms of Service and the Privacy Policy.
• Changes. SunCoach announces changes at least 30 days ahead, by email or in the app; continued use after that is acceptance, unless the law requires more.
• Languages. This agreement is published in English, German, Turkish and Spanish. If the versions differ, the English version prevails.
• Governing law and courts. Swiss law. Courts of Winterthur, Switzerland, subject to mandatory consumer or data protection rules that give the Coach another forum.

Annex 1: Technical and organisational measures

The measures in place as of 2026-10-26: