Privacy policy

Last updated 22 October 2026

Vasbyt is the app and website your personal trainer uses to plan your training and nutrition and to follow your progress. This policy explains what personal information is collected, why, and your rights under the Protection of Personal Information Act, 2013 (POPIA).

Who is responsible for your information

Your trainer's business is the responsible party: [business name], [physical address], [email], [phone]. Its Information Officer is [name and contact details].

What we collect

• Contact details: your name, email address and cell number.
• Profile details your trainer adds: goal, start date, date of birth, gender and notes.
• Health information, which POPIA treats as special personal information: your answers to the intake questions (such as injuries and medical conditions), body measurements, progress photos, and the workouts and meals you log, including any meal photos and notes.
• Messages between you and your trainer, including photos you send.
• Technical information needed to run the service: sign-in times, and the phone's notification settings for reminders. We don't use advertising or analytics trackers.

Why we collect it

Only so your trainer can coach you safely and effectively: to plan suitable workouts and meal plans, to check your progress, and to stay in touch with you. Your information is never sold or used for advertising.

Our legal basis

Your consent. The app asks for it before any health information is collected, and records the date and the version of the consent you accepted. You can withdraw consent at any time (see "Your rights" below); your trainer will then stop using your health information.

Who can see it

Only you and your trainer. Vasbyt runs on your trainer's own server in South Africa; your information is not shared with other trainers, other clients or third parties, except where the law requires it. Emails (invites and password resets) are sent through [email provider].

How long we keep it

For as long as you train with your trainer, and afterwards only as long as needed for the purpose it was collected for or as the law requires - at most [e.g. 3 years] after your last session, after which it is deleted. Photos you delete in the app are removed from the server within a few days. Backups are kept for 30 days.

How we protect it

• All traffic between the app, the website and the server is encrypted (HTTPS).
• Photos and other uploads are kept in private storage and can only be opened through links that expire within 15 minutes.
• Photos you take in the app are kept in the app's private storage, not your phone's gallery.
• Passwords are stored hashed, accounts lock after repeated failed sign-ins, and views of your health information are logged.

Your rights

Under POPIA you may, at no cost:

• ask what information is held about you and get a copy of it;
• ask for it to be corrected or deleted;
• object to it being used, or withdraw your consent;
• complain to the Information Regulator if you believe your information has been mishandled - inforegulator.org.za.

To use these rights, contact your trainer or the Information Officer above.

Children

Vasbyt is not meant for anyone under 18 unless a parent or guardian has given consent on their behalf.

Changes to this policy

If this policy changes in a way that affects how your information is used, the app will ask you to read and accept the new version.

Contact

[business name] · [email] · [phone]