This policy takes effect October 1, 2026. Current policy is available here: https://www.hevyapp.com/legal/privacy-policy/
Effective date: October 1, 2026
Preliminary notice – Minimum Age:
HEVY STUDIOS services are intended exclusively for users aged 16 or over. Users under 16 may not register or use the application. This requirement will apply to existing accounts in accordance with the notification arrangements set out in the Hevy Terms and Conditions.
HEVY STUDIOS reserves the right to suspend or delete any account where it has reasonable grounds to believe that the user is below the minimum age set out in the Hevy Terms and Conditions.
If you are the parent or legal guardian of a child under 16 who has created an account with HEVY STUDIOS, please contact us at [email protected] so that the account and associated data can be deleted.
General information:
The purpose of this personal data protection policy is to inform you about how HEVY STUDIOS, S.L. (hereinafter, “HEVY STUDIOS”) obtains, processes and protects the personal data you provide to us or that we collect, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data — the General Data Protection Regulation (GDPR) — and all other legislation applicable to the features of this website or application.
Data controller:
The controller of the personal data you provide to us or that we obtain by other means is HEVY STUDIOS, with Spanish tax identification number (N.I.F.) B01834811, registered at Calle del Pinetell, número 10, 17252 Calonge i Sant Antoni, Girona, and contact email address [email protected]
HEVY STUDIOS has appointed a Data Protection Officer, whose email address is [email protected].
Data subjects, data categories, processing purposes and legal bases:
Data subjects
This Privacy Policy applies to users, customers, prospective customers and prospective employees who interact with HEVY STUDIOS.
Data subjects are informed of the categories of personal data that may be collected, the purposes for which the data are processed and the legal bases that permit such processing.
Purposes of personal data processing
HEVY STUDIOS processes personal data for the following purposes:
● Service security and operational integrity: ensuring the security, availability, stability and proper functioning of our services (“Security purposes”).
● Handling requests and communications: addressing and responding to enquiries, requests for information or complaints submitted through contact forms or any other communication channel, including managing the press centre (“Contact purposes”).
● Participation in interactive environments: enabling the publication of profiles, workouts, comments and other contributions chosen by the user in articles, blogs, forums or any other interactive space available on our platforms (“Interactive purposes”).
● User registration and account management: managing the creation of user accounts in our applications or platforms, including administering account features, preferences, support requests and technical assistance (“User account purposes”).
● Candidate selection and management: processing information submitted through job applications, assessing candidates and managing recruitment or selection processes (“Recruitment purposes”).
● Marketing and promotional communications: sending advertising materials, promotional content, newsletters, announcements or similar communications, and running marketing campaigns and measuring their performance (“Marketing purposes”).
● Providing and maintaining contracted services: providing updates, notifications and communications necessary to administer the services to which the user has subscribed or which the user has contracted (“Maintenance purposes”).
● Other purposes: before processing data for a different purpose, HEVY STUDIOS will provide the relevant information, determine the legal basis and, where necessary, request fresh consent.
● Analysing behaviour within the application and generating statistical reports to improve our services and advertising operations (“Statistical purposes”).
● Processing physical and physical activity data voluntarily entered by the user to suggest personalised training programmes and track their progress (“Personalised training purposes”).
● Nearby gyms: at the user’s request, HEVY STUDIOS may use the user’s location to show gyms in the area (“Gym location purposes”).
HEVY STUDIOS does not create commercial profiles based on the information provided or make automated decisions based on such profiles. However, the Hevy application includes a programme which, at the user’s request, automatically suggests personalised workouts based on the user’s physical data and physical activity records.
Legal bases for processing personal data
HEVY STUDIOS processes personal data on the following legal bases, depending on the relevant purposes:
● Data subject’s consent: processing based on clear, informed and explicit consent, in particular for marketing communications or activities requiring prior authorisation. Users may withdraw their consent at any time (Article 6(1)(a) GDPR). The processing activities and purposes based on the data subject’s consent are: Marketing purposes; Recruitment purposes, where personal data are retained for future recruitment processes; Statistical purposes requiring consent, including non-exempt cookies and similar technologies; Personalised training purposes; and Gym location purposes. Optional connections that allow data to be disclosed to AI services are based on the user’s consent (Article 6(1)(a) GDPR). Where the processing includes health data, the user’s explicit consent for the specific purpose will also be obtained (Article 9(2)(a) GDPR). Accepting the Terms and Conditions or merely reading this Policy does not replace these consents.
● Performance of a contract: processing necessary to perform, manage or fulfil contractual relationships with data subjects (Article 6(1)(b) GDPR). The processing activities and purposes based on performance of a contract are: User account purposes, including logging and tracking workouts and the interactive features requested; Maintenance purposes; and Recruitment purposes, to negotiate pre-contractual terms.
● Compliance with legal obligations: processing necessary to comply with obligations imposed by applicable laws and regulations (Article 6(1)(c) GDPR). This basis applies to processing required by specific legal provisions, including legal obligations concerning security and the handling of rights requests, where applicable.
● Legitimate interests (Article 6(1)(f) GDPR): HEVY STUDIOS may process the data necessary to respond to general enquiries and protect the security and integrity of the service where the processing is not required by a legal obligation or for performance of a contract. These interests will be balanced against the user’s rights and freedoms, especially where the user is a minor. This basis does not replace any consent required for cookies, similar technologies or marketing communications.
Data categories
Depending on the features used, we process identification, contact and account access data; profile data and preferences; workouts and published content; information relating to enquiries and job applications; and the physical and location data described in this Policy. If the user registers through Apple or Google, we receive the data that the relevant service provides for registration in accordance with the applicable permissions. In addition to data provided directly by the user, HEVY STUDIOS may process the user’s browsing behaviour within the application for Statistical purposes. These data may be collected through cookies or other measurement technologies on the website or in the application, with consent where required. To learn more about the cookies we use and choose your preferences, please consult our Cookie Policy: https://www.hevyapp.com/legal/cookie-policy/.
Special categories of data:
Personal data relating to physical characteristics and physical activity records provided by the user, such as body weight and height, combined with the type of workout for Personalised training purposes, may constitute health data, which are a special category of personal data under Article 9 GDPR. Hevy also records heart rate data from Apple Watch and WearOS devices, depending on the features used and the permissions granted. Heart rate data are health data; other activity data may reveal information about health depending on their content, combination and use.
Health and physical activity data: physical activity records, including workouts, exercise routines, sets, repetitions and weights; and performance indicators derived from the user’s activity history.
Body data provided voluntarily: the user may voluntarily enter data such as height, body weight and body measurements in the application. Completing these fields is entirely optional and does not affect access to the application’s core features.
Collection of personal data and records of processing activities
HEVY STUDIOS processes your personal data lawfully, fairly and transparently and limits processing to the purposes for which the data were collected.
Personal data collected from data subjects are processed as part of the activities for which HEVY STUDIOS is responsible. These activities are documented in its Records of Processing Activities.
These personal data will be processed confidentially and in a manner that ensures appropriate security for their protection.
HEVY STUDIOS does not access or store the full card or bank account details used to pay for subscriptions, which are handled by the relevant billing provider. It may receive the purchase and subscription status information necessary to manage access to the service.
Data sharing and international transfers
Personal data may be shared with other companies that provide support services to HEVY STUDIOS in order to manage the services provided through our website or application, or with providers that may be located within or outside the EU.
These service providers may include hosting, infrastructure, analytics, communications, technical support, security and other technology providers acting as processors or subprocessors on behalf of HEVY STUDIOS.
HEVY STUDIOS uses Amplitude, Inc. as an analytics provider to analyse the use and performance of the Hevy application and improve its services. Depending on the configuration of HEVY STUDIOS’ Amplitude account, data may be hosted and processed in the European Union or the United States. Any associated international transfers must have the safeguards described in this section.
HEVY STUDIOS may disclose personal data to law enforcement agencies or public authorities where required by applicable law or a court order, or to prevent serious harm.
Providers and integrated services may process data outside the European Economic Area, including in the United States. In addition to the legal basis applicable to the processing, transfers made by HEVY STUDIOS must rely on a valid mechanism under Articles 44 et seq. GDPR. Consent to connect an account does not, by itself, constitute a safeguard for an international transfer.
Where applicable, transfers will rely on a European Commission adequacy decision or appropriate safeguards, such as standard contractual clauses, together with any necessary supplementary measures. The EU–US Data Privacy Framework will apply only where the recipient entity has a valid certification covering the transfer. You may request information about the destinations and a copy of the applicable safeguards by writing to [email protected]
Third-party integrations:
The Hevy application allows users to connect their account to ChatGPT (OpenAI) or Claude (Anthropic) and may add other compatible AI services to provide features relating to their workouts and routines. These connections are optional. For consumer services in the European Economic Area, OpenAI Ireland Limited and Anthropic Ireland, Limited act, respectively, as controllers of the processing they carry out in their own services.
When the user expressly connects their account, the connected AI service may query information through Hevy’s API: when the user makes a query about workouts, the model requests the necessary data and Hevy provides the information permitted by the connection. Access may extend to all workouts in the account, rather than only a workout shared individually; this does not mean that the entire history is sent with every query. Workout data may include exercises, dates, sets, repetitions, loads, distance and duration, depending on the information recorded and the fields enabled, to obtain personalised responses or recommendations. The connection is not activated merely by using Hevy. The ChatGPT integration may also allow users to create plans and save them in Hevy, depending on the features and permissions enabled. The user may also share a specific workout with another application; in that case, the selected content is disclosed, including any accompanying data or links, depending on the option used.
Each AI service is governed by its own terms and privacy policy. The privacy policies for ChatGPT and Claude are available, respectively, at https://openai.com/policies/eu-privacy-policy/ and https://www.anthropic.com/legal/privacy. HEVY STUDIOS remains responsible for the processing and disclosures of data that it carries out. Subsequent use by these services is governed by their terms, policies and privacy settings, including those relating to retention and improvement of their models; it should not be assumed that every provider acts on behalf of HEVY STUDIOS.
Depending on the features available and the permissions granted, workout data accessible through AI integrations may include heart rate data recorded in Hevy through Apple Watch, WearOS or other compatible devices, to respond to the user’s queries and provide analysis or recommendations about their workouts. Before enabling access to personal data, HEVY STUDIOS will inform the user of the data that can be accessed, the recipient and the purpose, and will obtain the specific authorisation required. Access to health data, such as heart rate, will require the user’s prior explicit consent, including for accounts that are already connected. Connecting the account, accepting the Terms and Conditions, publication of this Policy and permissions for Apple Watch, WearOS or other health integrations do not replace that consent. The user may withdraw authorisation to prevent further access, although this does not, by itself, erase data already disclosed to the third party. Refusing or withdrawing consent will not prevent the use of Hevy features that do not require that processing.
The Hevy application allows users to connect to Apple Health and Apple Watch, services provided by Apple Inc., 1 Apple Park Way, Cupertino, CA 95014, USA. This integration allows HEVY STUDIOS to read physical activity data stored in Apple Health, such as heart rate, calories and daily activity, in order to display them to the user within the application and improve workout tracking.
Depending on the permissions granted, the Apple Health connection allows data to be read for use in Hevy and Hevy workouts to be saved in Apple Health. The data obtained are processed in accordance with this Privacy Policy.
Apple Health data may include health data as defined in Article 9 GDPR. HEVY STUDIOS processes these data on the basis of the user’s explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR), which must be expressly given when activating the integration.
Use of Apple Health is subject to Apple Inc.’s terms and privacy policy, available at https://www.apple.com/legal/privacy/.
Health Connect:
The Hevy application also allows users to connect to Health Connect. Subject to the permissions expressly granted by the user, this integration may allow Hevy to read health and physical activity data stored in Health Connect and send Hevy workout data to Health Connect.
Data received by Hevy through Health Connect may have been recorded by the user’s device or provided by other applications connected to Health Connect, within the categories and permissions enabled. HEVY STUDIOS processes these data in accordance with this Privacy Policy and on the basis of the user’s explicit consent where the data constitute health data under Article 9 GDPR. Strava: if the user expressly connects their account and enables synchronisation, Hevy sends completed workouts to Strava for display in that service. Synchronisation is from Hevy to Strava and does not import workouts from Strava into Hevy. This optional disclosure is based on the user’s consent, which must be explicit where health data are included. Strava processes the data received in accordance with its own privacy policy (https://www.strava.com/legal/privacy) and the visibility settings of the Strava account.
Public profile and application notifications:
When an account is created, the profile is public by default. Workouts set to “Everyone” are visible to all Hevy users. The user can set their profile to private and manage workout visibility through the application’s settings menu.
The available controls include:
— Profile visibility: public or private.
— Workout visibility: individual control over which workouts are visible to other users. Changing the default visibility of new workouts does not change the visibility of workouts already published. There is a separate control for displaying heart rate and calories.
— Integration management: control over which third-party applications and devices have access to your data. You may withdraw authorisation for a connection to prevent further access, although this does not, by itself, erase data already disclosed to the third party. Public profile visibility settings are separate from the permissions granted to an integration.
— Communication preferences: the ability to subscribe to or unsubscribe from marketing communications at any time.
The user can manage push notifications in their device settings and email preferences in their account settings.
For Gym location purposes, if the user consents to making their gym’s location public in the Hevy application, and provided that their profile is public, the Hevy application may suggest that other users of the same gym follow the user’s profile.
Data retention
HEVY STUDIOS will retain the user’s personal data for the following periods:
— Account and profile data: for as long as the account remains open, even if the user stops using the application, without prejudice to their rights to erasure.
— Physical activity and workout data, including recorded heart rate: for as long as the account remains open or until the user requests erasure, without prejudice to legal retention obligations.
— Voluntary body data, such as height, body weight and measurements: for as long as the account remains open or until the user requests their deletion. They will be deleted within thirty (30) days of the user’s request or deletion of the account, without prejudice to any legal requirement to retain them with access blocked.
— Data for Recruitment purposes: where the candidate has given consent, HEVY STUDIOS may retain their data for a maximum of 2 years after the recruitment process.
As a general rule, personal data processed by HEVY STUDIOS will be retained for as long as necessary to fulfil the purpose for which they were collected, taking account of the periods established by applicable law and any need to make them available to the competent authorities or to respond to claims. In that case, the data will be retained with access blocked until the relevant limitation period expires, at which point they will be deleted.
For data collected by our cookies for Statistical purposes, the retention period can be found in the Cookie Policy: https://www.hevyapp.com/legal/cookie-policy/.
Location data used to show nearby gyms will be processed for as long as necessary to fulfil the user’s request. If the user chooses to publish their gym on their profile, information about that gym will be retained until they remove it or delete the account, without prejudice to legal retention obligations. Publishing a gym does not authorise continuous tracking of the user’s location.
Withdrawal of consent will end the processing based on that consent, without affecting the lawfulness of processing carried out beforehand. Data will be erased without undue delay and, in accordance with the period specified by HEVY STUDIOS, within 30 days of withdrawal, except for information that must be retained to comply with legal obligations or address liabilities, subject to the applicable limitations and access blocking requirements. This period does not authorise continued processing based on the withdrawn consent during those 30 days.
Confidentiality
HEVY STUDIOS guarantees, on the terms established by applicable law, that it will use users’ personal data confidentially and that it has adopted appropriate technical and organisational security measures in its facilities and systems. This protection covers all matters relating to the collection and use of information provided over the internet.
We therefore undertake to maintain and apply the necessary levels of security, taking account of the state of technology, the nature of the data stored and the existing risks, to protect your personal data against accidental loss and unauthorised access, processing or disclosure, and not to disclose information except for the purposes and disclosures described in this Policy, with the appropriate legal basis and safeguards. We undertake to process your data in accordance with applicable data protection law.
HEVY STUDIOS provides users with appropriate technical means to access the privacy policy notice or other relevant information before providing their personal data and, where applicable, to consent to the processing of their personal data.
Data protection rights
Data subjects may, where applicable, exercise their rights of access, rectification, erasure, portability, restriction and objection by writing to [email protected], and may use “Data Protection Rights” as the reference. You may also withdraw your consent through that channel or through the controls provided for each purpose, as easily as it was given. We will generally respond within one month. If an extension of up to two further months is warranted by the complexity or number of requests, you will be informed within the first month. Additional identity information will be requested only where there are reasonable doubts and only to the extent necessary.
Access to your personal data: the right to request and obtain information about the personal data we process about you, including data from the website, application and integrations used, and about the processing carried out, its purpose and the specific uses involved.
Right to rectification: the right to have your personal data corrected where they are inaccurate or incomplete.
Right to erasure (right to be forgotten): the right to request the erasure of your personal data where they are inadequate, excessive or unnecessary, where they are retained for longer than appropriate, or where they are processed in breach of the GDPR.
Right to object: you may object, on grounds relating to your particular situation, to processing based on legitimate interests under Article 21 GDPR. You may object at any time to the processing of your data for direct marketing purposes.
Right to restriction of processing: the right to have personal data stored by the controller or processors marked in order to limit their future processing.
Right to data portability: the right to receive personal data you have provided to the controller in a structured, commonly used and machine-readable format and to transmit them to another controller, where the processing is based on consent or a contract and is carried out by automated means.
Right not to be subject to automated individual decision-making: the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
You may also lodge a complaint with the Spanish Data Protection Agency (https://www.aepd.es) or the competent supervisory authority, in particular the authority for your habitual residence or place of work, if you consider that the processing of your data infringes the applicable rules.
Registration
Users are informed that they may also create an account. To register, users will be asked to provide personal data. At registration, users will also be duly informed of the data they must provide and the legal basis for processing their personal data. This is explained in our Hevy Terms and Conditions and in this Policy. Mandatory fields will be identified as such; without the necessary data, registration cannot be completed or the requested feature provided. Optional data will be distinguished from mandatory data.
Changes to this notice
If we change the way we process personal data, we will update this Policy and indicate the date of the updated version. We will inform users of significant changes by email or other appropriate means and, before starting any processing that requires it, provide the relevant information and obtain the necessary consent. Merely notifying users of an update or their continued use of Hevy does not replace that consent.
Further information
We will be happy to provide further information about how we protect and use your personal information. Please contact us at [email protected].