Privacy
Privacy notice
Version 1.1 · 26 September 2026
RYTM uses your data to build your own plan — nothing else. We never sell it, never use your health data for advertising, and you can download or delete it at any time.
1.Who we are
The controller for your personal data is [Company name] ([Reg. no.]), [Street, postcode, city], Sweden, which runs RYTM and RYTM CLUB. Questions about your data: info@rytmclub.com.
2.What we collect and why
Items marked * are health data, a special category under the GDPR (Art. 9).
| Data | What | Why | Legal basis |
|---|---|---|---|
| Account | Email, display name, member number, time zone | Sign-in, your membership card | Contract |
| Membership | Tier, status, store customer id, subscription events | Your access and member prices | Contract |
| Health profile* | Year of birth, sex (optional), height, current weight, goals, body areas to go easy on (chosen from a list — no free text), allergies, diet, usual sleep and stress | Your calorie, protein and training targets | Explicit consent |
| Shift schedule | Shift types and times, sleep windows | Planning meals, training and sleep around your shifts | Explicit consent |
| Training* | Your programme, sessions and logged sets | Planning and progression advice | Explicit consent |
| Daily check-in* | Sleep, sleep quality, energy, soreness, stress | Your readiness score and adapted training | Explicit consent |
| Coach conversations* | What you write to RYTM Coach and its replies | Answering your questions | Explicit consent (separate) |
| Membership card | Name on card, member number, level, valid-until date | Your digital card and QR code. Anyone you show the QR to sees your name, level and whether you're active — nothing else | Contract |
| Invites | Your invite code; for friends who join with it: their store customer id, number of payments and your thank-you codes | Giving the friend's discount and your reward. You only see that a friend joined, never who | Contract / legitimate interest |
| Partner tips | Places you suggest to us and your note | Contacting them about a RYTM offer, and your reward if they join | Legitimate interest |
| Notifications | Your device's push address, which reminders you want and when they were sent | Sending the reminders you turned on | Consent (you turn them on, per device) |
| Saved recipes | Which recipes you saved | Your recipe list | Contract |
| Technical | Security and audit logs, message counts | Security, preventing misuse, cost control | Legitimate interest |
Legal bases: contract — GDPR Art. 6(1)(b); explicit consent — Art. 6(1)(a)/(b) with Art. 9(2)(a); legitimate interest — Art. 6(1)(f), for keeping the service secure. Orders and payments are handled in the RYTM store (Shopify) and kept for 7 years under the Swedish Accounting Act (Art. 6(1)(c)).
3.Health data and consent
We only process health data after you give explicit consent in the app. It is used solely to build and adapt your training, nutrition and recovery plan. It is never sold, never used for advertising, never shared with your employer or partners, and never shown to other members.
You can withdraw consent at any time under Profile → Your data → Delete my health data. This deletes the data at once. Your membership and member prices are not affected.
4.RYTM Coach (AI)
RYTM Coach is not yet available. When it launches it will be optional and need its own consent. When you ask a question:
- Only the parts of your RYTM profile the question needs (for example your goal, shifts, targets or today's plan) are sent to our AI provider, OpenAI. Your name, email and member number are never sent.
- OpenAI does not use it to train its models and deletes it within 30 days (it is kept only to detect abuse).
- RYTM stores the conversation for 90 days, then deletes it automatically. You can clear it, or turn the coach off and delete it, at any time.
- If a message suggests an emergency (for example chest pain or thoughts of self-harm), it is not sent to the AI; you get advice to contact 112 or healthcare.
- The coach gives general guidance, not medical advice. It can only suggest changes to your plan — nothing changes until you tap Apply.
5.Who we share it with
We use these service providers (processors). They may only process your data on our instructions, under a data processing agreement.
Supabase — Database and sign-in
EU (Ireland). Data processing agreement; SCCs for any support access from outside the EEA.
Netlify — Website hosting and server functions
USA. Data processing agreement with Standard Contractual Clauses.
OpenAI (OpenAI Ireland Ltd) — RYTM Coach answers — only if you turn the coach on
EU entity; processing may take place in the USA. Data processing agreement with Standard Contractual Clauses; no training on your data; deleted within 30 days.
Shopify — Store, payments and orders
EU (Shopify International Ltd, Ireland) and USA. Shopify's data processing terms with Standard Contractual Clauses.
Google (Google Wallet) — Your membership card in Google Wallet — only if you add it
EU (Google Ireland Ltd) and USA. Google's data processing terms with Standard Contractual Clauses / EU–US Data Privacy Framework.
Apple, Google or Mozilla push services — Delivering notifications to your device — only if you turn them on
EU/USA. Messages are encrypted end to end; they only see the device address.
Email provider — Sign-in links and service emails
EU/USA. Data processing agreement.
Where data is transferred outside the EU/EEA, it is protected by the EU Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. We never share your data with anyone else unless the law requires it.
6.How long we keep it
- Health data: until you delete it, and at the latest 12 months after your membership ends.
- Daily check-ins: 60 days.
- Weight: only your latest value — no history.
- Coach conversations: 90 days.
- Account and membership: as long as your account exists.
- Orders: 7 years (bookkeeping law), in the store.
- Security logs: 12 months; audit records of consent and deletion: 24 months.
7.Your rights
You have the right to access, correct, delete, restrict and object to the processing of your data, to data portability, and to withdraw consent at any time. In the app you can:
- Download all your data as a file — Profile → Your data → Download my data.
- Edit your profile, shifts and check-ins at any time.
- Delete your health data, or your whole account, in Profile → Your data.
For anything else, email info@rytmclub.com. We reply within one month. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or the authority in your country.
8.Security
Health data is kept apart from other data and protected so that each member can only reach their own records — checked on the server and in the database, and covered by automated tests. Data is encrypted in transit and at rest. Staff access is limited to what is needed to run the service. See our data protection impact assessment for details.
9.Automated decisions
RYTM calculates targets, a readiness score and plans from your data. These are suggestions for you only — they have no legal or similarly significant effect, and you can change or ignore them. We never make decisions about you based solely on automated processing (Art. 22).
10.Age
RYTM is for adults. You must be 18 or older to create a health profile.
11.Cookies
We only use cookies that are needed for the service to work: a sign-in session cookie. We do not use advertising or analytics cookies, so no cookie banner is needed. The RYTM store (Shopify) has its own cookie notice.
12.Changes
If we change how we use your data, we update this notice and tell you in the app. If a change needs new consent, we ask for it first.