1. Who is responsible and how to contact us

The Service is developed and operated by Bloom Board. For any privacy question or anything about your data, write to contacto@bloomfitness.es.

Legal entity: Bloom Fitness
Tax ID: ESB24973398
Registered address: Pl. Músico Ibars, 5, Mislata, 46920, Valencia

Bloom Board is offered to businesses (gyms, studios and sports centers), so there are two roles:

Your sports center is the data controller for the data it manages about its clients and staff (your profile, bookings, routines, results and your trainers' notes). Bloom Board processes that data as a data processor, on the center's instructions and under a contract compliant with Article 28 GDPR.
Bloom Board is the data controller for the technical and security data needed to run the Service (access and audit logs, notification tokens) and for this website's data.

You can always contact us: if your request is for your center, we will forward it and help you with it.

2. What data we process

Identification and contact data

First name, last name and nickname (the name your center knows you by).
Email address and phone number.
Gender and date of birth, when your center has them on record.
Profile photo, when your center has one on record.

Account data

Password, stored only as an irreversible hash (bcrypt); we never store it in plain text.
Session tokens that keep you signed in on your device, and single-use account activation links that expire after 24 hours.
The center(s) you belong to, your role (client, trainer, admin) and your account status.
App preferences, such as light or dark theme.

Training and center activity data

Sessions and classes you are enrolled in, bookings, attendance and check-in.
Routines, training plans, goals and workouts assigned by your trainers.
Progress on each exercise (completed or skipped) and per-set results: weight, reps, rate of perceived exertion (RPE) and notes.
Notes your trainers take about your sessions.
Attendance statistics (last visit and number of sessions) that help the center find your profile.

Information that may relate to your health. Some notes and metrics (for example body weight, or discomfort or injuries mentioned in a note) may reveal information about your physical condition or health. They are only processed when your center or you enter them to plan and track your training; they are never used for advertising or shared with third parties outside the Service. Your center is responsible for having the appropriate legal basis, such as your explicit consent.

Device data

If you allow notifications, the push notification token issued by your operating system (Apple Push Notification service or Firebase Cloud Messaging), the platform (iOS or Android) and the date of last use.

Technical and security data

IP address, browser or app type (user agent), date and time of each action that changes data, the action performed and its outcome.
Failed sign-in attempts, including the email address used.

Data we do not collect

The app does not access your location, contacts, photos or files, camera, microphone, SMS, call log or your device's advertising ID, and it contains no ads. We do not process payment card data through the app.

If you are a trainer or center admin, we also process the data you enter to run your business (centers, services, schedules and, if your plan includes it, expenses, invoices and sales).

3. Where the data comes from

Your sports center, which creates your account and records your profile, sessions and routines.
Timp, the gym-management software, when your center has enabled the integration: we sync your client profile (name, email, phone, gender, date of birth and photo), classes and your bookings.
You, when you activate your account, sign in or log your results in the app.
Automatically, when you use the Service (technical, security and device data).

4. What we use the data for

Providing the Service: showing your sessions, routines and workouts, and saving your results so you and your trainers can track your progress.
Managing your account: creating it, sending the welcome email to activate it, authenticating you and keeping you signed in.
Center screens: during a session your center may show your name or nickname, your photo and your workout on the room's TVs, visible to people at the center.
Sending you notifications about your training, only if you have allowed them.
Security: protecting accounts, preventing unauthorized access and abuse, and keeping an audit log of who changes what.
Handling your requests for support and for exercising your rights.
Complying with legal obligations.

We do not sell your data, we do not use it for advertising and we make no automated decisions that produce legal effects on you.

Bloom Board uses artificial intelligence (Google Gemini) only to help trainers draft an exercise description from its name. No personal data is sent to that service.

5. Legal basis

Performance of a contract: providing the Service you have with your center and that your center has with Bloom Board.
Consent: push notifications and, where applicable, processing health-related information. You can withdraw it at any time.
Legitimate interest: Service security, fraud prevention and the audit log.
Legal obligation: when the law requires us to keep or disclose data.

6. Who we share data with

We only share data in the following cases:

Your sports center and its trainers, who access your data to train you. Each center only sees its own clients' data.
People present at the center, who may see your name or nickname, photo and workout on the TVs during the session.
Timp, when your center has enabled the integration, to sync clients, classes and bookings.

And with the providers that help us run the Service (data processors), who only process data on our instructions and under contract:

Amazon Web Services (Ireland, EU): servers, file storage and content delivery.
Supabase (EU region, Ireland): database.
Resend: transactional emails, such as account activation.
Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging): push notification delivery.
Google (Google Analytics): visit statistics for this website. Not used inside the app.

We may also disclose data to public authorities when required by law and, in the event of a merger, acquisition or asset sale, to the new owner, who will be bound by this policy.

7. International transfers

Service data is stored on servers in the European Union. Some providers (such as Resend, Apple or Google) may process data in the United States or other countries; those transfers rely on the EU-U.S. Data Privacy Framework or on the Standard Contractual Clauses approved by the European Commission.

8. How we protect data

All traffic between the app, the web and our servers is encrypted with HTTPS/TLS.
Passwords are stored as bcrypt hashes; activation links are stored hashed and expire.
Third-party integration keys are stored encrypted (AES-256-GCM).
Role- and center-based access control: each person only accesses the data they are entitled to.
Rate limiting on sign-in and other sensitive endpoints, and an audit log of changes.
Infrastructure on providers with encryption at rest and access restricted to authorized staff.

No system is completely infallible. If a security breach affected your data, we would notify your center, the competent authority and, where required, you, within the legal deadlines.

9. How long we keep data

Account and training data: while your account is active and your center remains a Bloom Board customer.
After account deletion (requested by you or your center): we delete or anonymize your personal data within 30 days.
Audit and security log: automatically deleted after 6 months.
Notification tokens: deleted when you sign out, delete your account or when they become invalid.
Backups: deleted data may remain in encrypted backups until they are overwritten in their normal rotation cycle, and is not used for any other purpose.
Legal obligations: we keep, restricted, any data the law requires us to retain (e.g. tax records) for the required period.

10. How to delete your account and data

You can delete your Bloom Board account and all its associated data at any time — yourself, instantly — or ask us to:

In the Bloom Board mobile app (Android and iOS): go to Profile › Delete account, review what will be deleted, enter your password and tap Delete my account.
On the web: sign in at app.bloomboard.pro, open Profile and, at the bottom of the page, click Delete account; confirm with your password.
By email, if you cannot sign in: write to contacto@bloomfitness.es from the address linked to your account, with the subject “Delete account” and the name of your center, if you train at one.
Through your center: ask your sports center to close your account.

From the app or the web, deletion is immediate and permanent. By email or through your center, we will verify that the request comes from the account holder and complete it within 30 days.

What is deleted: your account and sign-in (identification and contact data, credentials and device tokens); your own routines, workouts and exercises, and the routines your centers prepared for you; everything you have trained (sets, results, records and progress); your bookings and your presence on the TV screens; your session notes; and your preferences.

What is kept, in a limited way and only for the period described in the previous section: security and audit logs (up to 6 months, where you appear only as an internal identifier), data we are legally required to retain, and encrypted backups until they are overwritten in their normal cycle.

This cannot be undone. Note that if you keep training at a center that uses Bloom Board, the center may create a new profile for you.

11. Your rights

Under the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), you have the right to:

Access your data and get a copy.
Rectify inaccurate data.
Erase your data.
Restrict or object to its processing.
Data portability: receive your data in a structured format.
Withdraw your consent at any time, without affecting prior lawful processing.

To exercise them, write to contacto@bloomfitness.es. We will reply within one month. If you are not satisfied, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) or the supervisory authority in your country.

12. Children

The Service is not directed at children under 14 and we do not knowingly collect their data on our own behalf. If a center registers a child under 14, the center is responsible for obtaining consent from their parents or guardians. If you believe we hold a child's data without that consent, contact us and we will delete it.

13. App permissions and notifications

The app only needs an Internet connection to work. Push notifications are optional: the system will ask for your permission and you can turn them off at any time in your device settings. When you sign out, that device's notification token is unlinked from your account.

14. This website

On bloomboard.pro we use Google Analytics 4 for aggregated visit statistics (page views, button clicks, device type and approximate location). Google Analytics uses first-party cookies.

“Request a demo” form

If you request a demo, we process the data you give us — name, email, phone, whether you are a company or self-employed, company name, address, number of centers and your message — together with the language and page you submit it from, your IP address and browser type (to prevent abuse). We use it only to contact you and send you commercial information about Bloom Board, based on your consent and on steps taken at your request before entering into a contract.

The data is stored in Bloom Board's database (Supabase, EU) and, when it arrives, we send an internal email notification to our sales team through Resend. It is not shared with third parties. We keep it for as long as the sales conversation lasts and, if we do not reach an agreement, for at most 12 months after the last contact. You can ask us to delete it at any time at contacto@bloomfitness.es.

15. Changes to this policy

We may update this policy when the Service or the law changes. We will publish the new version on this page with its update date and, if the changes are significant, let you know through the app or by email.

16. Contact

For any question about this policy or your data, email contacto@bloomfitness.es.