Data processing agreement

This data processing agreement (the “agreement”) forms part of the terms of service between MoonBoots Consultancy UK Ltd (“MoonBoots”, “we”, “us” or “our”) and the business that uses Apogee Coach (“you” or “your”). It sets out how we process personal data on your behalf, as Article 28 of the UK GDPR requires. You accept it when you accept the terms of service.

1. Definitions

1.1 “Data protection law” means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any other law about personal data that applies in the UK, as amended or replaced from time to time.

1.2 “Client data” means the personal data described in schedule 1 that we process on your behalf in providing Apogee.

1.3 “Controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing” and “special category data” have the meanings given in data protection law.

1.4 “Sub-processor” means a third party we engage to process client data.

1.5 Other words have the meanings given in the terms of service.

2. Roles and scope

2.1 You are the controller of client data, and we are your processor.

2.2 We are a controller, not a processor, of the personal data we use to run your account and bill you, as our privacy notice describes. This agreement does not apply to that data.

2.3 Schedule 1 describes the processing.

3. Your instructions

3.1 We process client data only on your documented instructions, unless the law requires us to do otherwise. In that case we will tell you before we process it, unless the law prohibits us from doing so.

3.2 Your instructions are the terms of service and this agreement; your set-up and use of Apogee, including the actions you, your team and your clients take in the app; and any other written instructions you give us that are consistent with the terms of service. An instruction that would change how Apogee works is treated as a request for a change, which may need to be agreed separately.

3.3 We will tell you promptly if, in our opinion, an instruction infringes data protection law.

4. Your responsibilities

4.1 You are responsible for:

having a lawful basis for the client data you put into Apogee, and for each use you make of it;
giving your clients a privacy notice. The app provides a template filled in with your details, which you should check and adapt;
for health information, which is special category data, having a condition under Article 9 of the UK GDPR, normally your client’s explicit consent, which the app’s forms are designed to collect;
where you coach under-18s, involving a parent or guardian through the app’s parent accounts, and following safeguarding good practice;
sending marketing only to people who have agreed to receive it, using the consent records the app keeps;
the accuracy of the client data you enter;
keeping your team’s sign-in details secure, and removing access for people who leave.

4.2 You confirm that your instructions comply with data protection law.

5. Our responsibilities

5.1 Confidentiality. We make sure that everyone we authorise to process client data is bound by a duty of confidentiality.

5.2 Security. We take appropriate technical and organisational measures under Article 32 of the UK GDPR, including those described in schedule 2, and review them as Apogee develops.

5.3 No use for our own purposes. We do not use client data for our own purposes, we do not sell it, and we do not use it to train AI models. We may produce anonymised, aggregated statistics that do not identify anyone, to run and improve Apogee.

5.4 Access by our people. Our people access client data only where they need to in order to provide, support or secure Apogee, for example when you ask us for help, or to investigate a fault or misuse.

5.5 Records. We keep the records of processing that Article 30(2) of the UK GDPR requires.

6. Sub-processors

6.1 You give us general authorisation to engage sub-processors. The sub-processors we use are listed in schedule 3.

6.2 We will give you at least 14 days’ notice by email before we add or replace a sub-processor that processes client data, and update schedule 3. If you object on reasonable data protection grounds, tell us within that period. We will try to address your objection. If we cannot, you may cancel your subscription, and we will refund anything you have paid in advance for the period after cancellation.

6.3 We impose data protection obligations on each sub-processor that are no less protective than those in this agreement, and we remain responsible to you for how they perform them.

7. Transfers outside the UK

7.1 Client data is hosted in the European Union. Some sub-processors are based in, or access data from, the United States or other countries outside the UK. We transfer client data outside the UK only where data protection law allows it, for example under UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it), or under the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

8. Helping you

8.1 Your clients’ rights. The app lets you and your clients view, export, correct and delete client data, including a full download of a client’s records and a deletion process that you confirm. If one of your clients sends a request to us directly, we will pass it to you without undue delay and will not respond to it ourselves, except to say that we have passed it on. We will give you further reasonable help if you need it.

8.2 Security, breaches and impact assessments. Taking into account the nature of the processing and the information available to us, we will help you meet your obligations under Articles 32 to 36 of the UK GDPR, which cover security, personal data breaches, data protection impact assessments and prior consultation with the Information Commissioner’s Office.

9. Personal data breaches

9.1 We will tell you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting client data.

9.2 We will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the measures we have taken or propose to take. We will provide more information as it becomes available.

9.3 We will take reasonable steps to contain and investigate the breach and to reduce its effects, and will help you with any notification to the Information Commissioner’s Office or to the people affected. Whether to notify them is your decision as controller.

10. AI features

10.1 Some features use an AI service provided by Anthropic, listed in schedule 3:

when a client asks for food figures from a description, the description is sent;
when a client asks for a screenshot to be read, the screenshot is sent;
when you use the marketing writing assistant, your notes for the draft are sent.

10.2 Medical forms, PAR-Q answers and wearable data are never sent to the AI service. We record that an AI request was made, with its task and size, but not its content. Anthropic’s commercial terms do not allow it to use this data to train its models.

10.3 AI figures are estimates, and you and your clients can correct them.

11. Keeping, returning and deleting client data

11.1 While you use Apogee, client data is kept according to how you use the app and the retention rules built into it, which you instruct us to apply:

data about a client who has left is anonymised 12 months after they leave, or straight away when you delete them at their request;
signed forms are kept for seven years after a client leaves, and payment records for six years, and are then deleted;
clients’ feedback videos are kept for 12 months and then deleted, and you are told 30 days beforehand;
screenshots and drafts that a client does not confirm are deleted after a day.

11.2 You can export client data at any time using the app’s export tools.

11.3 When your subscription ends, your account becomes read-only, so that you and your clients can still sign in and export data.

11.4 At your choice, we will return or delete client data. To have it deleted, email hello@apogee.coach, and we will delete it within 30 days of your request, except where the law requires us to keep it. Copies in our backups are removed as those backups expire in the normal cycle, and are kept secure until then.

12. Information and audits

12.1 We will make available to you the information reasonably necessary to show that we meet our obligations under Article 28 of the UK GDPR, such as a description of our security measures and our sub-processors.

12.2 If that information is not enough to show that we comply, you may audit our compliance yourself or through an independent auditor bound by confidentiality. Audits may take place no more than once a year, unless a regulator requires one or a personal data breach has occurred, on at least 30 days’ notice, during working hours, and in a way that does not disrupt our business or put other customers’ data at risk. You pay the cost of any audit.

13. Liability and how long this agreement lasts

13.1 Each party’s liability under this agreement is subject to the limits and exclusions in the terms of service, except where data protection law does not allow them to apply.

13.2 This agreement lasts for as long as we process client data on your behalf, including after your subscription ends, until the data has been returned or deleted.

14. Changes

14.1 We may update this agreement to reflect changes in data protection law, guidance from the Information Commissioner’s Office, or changes to Apogee. We will give notice in the same way as for changes to the terms of service, and we will not reduce the overall protection given to client data.

Schedule 1: details of the processing

Subject matter. Providing Apogee, a white-label coaching platform, to you.

Duration. The length of your subscription, and afterwards until the data is returned or deleted.

Nature and purpose. Hosting, storing, organising, displaying, transmitting, summarising and deleting personal data, to provide coaching, plans, bookings, classes, memberships, payments, forms, messaging, marketing and website features, as you set them up.

Data subjects. Your clients, including class members and young clients; parents and guardians of young clients; people on your mailing list; your team members; and other people mentioned in client data.

Personal data.

Identity and contact details: name, email address, mobile number, postal address, date of birth and sex.
Account and sign-in details.
Training plans, workout logs, check-ins (steps, sleep, mood, hydration and bodyweight), food logs, photos, voice notes, videos and screenshots.
Messages and coach feedback.
Bookings, attendance, packages, memberships, credits and payment records. Card and bank details are held by Stripe.
Form answers and signatures.
Marketing preferences and consent records.
Wearable data, where a client connects a device: steps, sleep, resting heart rate, heart rate variability and workouts.

Special category data. Health information, including PAR-Q and other screening answers, injuries and health conditions, bodyweight and other measurements, food logs and wearable data.

Children. Data about clients under 18, where you coach them.

Schedule 2: security measures

Data is encrypted in transit using HTTPS.
Each coach’s data is kept apart from every other coach’s: every database query is limited to the coach it belongs to, and every client route checks that the client belongs to that coach or is the signed-in client.
Access in the app depends on role: clients see only their own data, parents only their child’s, and coach notes are never shown to clients or parents.
Passwords are stored only as salted hashes, sign-in sessions are held in secure cookies that page scripts cannot read, and sign-in, AI and messaging routes are rate limited.
Uploaded files are served through signed links that expire after 15 minutes, and videos through signed playback tokens.
Card and bank details are entered into Stripe’s own forms and held by Stripe. We do not store full card or bank account numbers.
Signed forms cannot be edited, and are protected from deletion until their retention period ends.
Databases are backed up automatically every day.
Hosting is in the European Union.
Access to production systems and our admin tools is limited to authorised people, and every action in our operator admin is logged.
Data is shared with sub-processors only as far as needed for the service each one provides.

Schedule 3: sub-processors

Sub-processor	What it does	Where
Railway	Hosting, databases and file storage	Data held in the European Union; company based in the United States
Stripe	Card and Direct Debit payments	United Kingdom, European Union and United States
Resend	Sending emails	United States
Twilio	Sending group texts	United States
Mux	Storing and streaming videos	United States
Anthropic	AI for food figures, screenshot reading and marketing drafts, only when asked	United States

Wearable data is collected through software we run on our own hosting. When a client connects a wearable device, the device’s maker, such as Garmin, Whoop, Oura, Polar or Google for Fitbit, sends the data under its own terms with the client, and is not our sub-processor.