Professional Data Processing Agreement

This Data Processing Agreement ("DPA") applies to every professional (doctor, dietician, nutritionist, or personal trainer — "you," "Professional") who is verified to use the Trainr professional dashboard. It supplements the Terms of Service and forms part of your agreement with Helord Studios S.R.L. (CUI 48354541), a company registered in Ploiești, Romania, which operates Trainr ("Trainr," "we," "us"). It governs how personal data — including health data — is handled when a patient chooses to share it with you. By accepting a professional account, you agree to this DPA.

1. Roles under the GDPR

Trainr provides the platform that, at the patient's instruction and with the patient's explicit consent, transmits and displays the patient's data to you. With respect to that data:

• The patient is the data subject and controls the sharing.
• Trainr (HelordStudios) is the controller of the platform account data and acts, in respect of the transmission of patient data to you, as a conduit/processor on the patient's and your behalf. Trainr does not interpret health data and is not a medical device.
• You, the Professional, are an independent controller of the patient data you access and of any assessment, plan, or guidance you produce from it. You determine the purposes and means of your own clinical/professional processing.

2. Lawful basis & scope

You may access a patient's data only while that patient's consent for you is active, and only for the purpose of providing your professional services to that patient. Health data is special-category data under Article 9 GDPR; you must ensure you have a valid Article 9 basis for your processing (for example, explicit consent, or the provision of health care under Article 9(2)(h) where you are a health professional subject to a duty of professional secrecy). You must not use the data for any other purpose, including marketing, research, or profiling, without a separate lawful basis and, where required, the patient's explicit consent.

3. Your obligations

• Process patient data lawfully, fairly, and only as necessary for the patient's care.
• Keep the data confidential and observe any professional-secrecy and medical-confidentiality obligations that apply to you under Romanian and EU law.
• Respect the patient's rights (access, rectification, erasure, restriction, objection, portability) for the data you hold as a controller, and cooperate promptly with any request Trainr forwards to you.
• Access data only through your own verified account; never share credentials; access only patients who have an active consent for you.
• Do not download, copy, or retain patient data beyond what is necessary, and delete it when the patient revokes access or when it is no longer needed for the care you provide, subject to any legal record-keeping duty that applies to you.
• Provide all guidance yourself. Trainr does not generate medical advice; you are solely responsible for any interpretation, diet, or recommendation you author.
• Maintain appropriate technical and organisational security for any data you export or store outside Trainr.

4. Trainr's commitments

Trainr restricts your access to a patient's data to the period their consent is active (enforced server-side), encrypts data in transit and at rest, limits access to production systems, and does not use patient health data for advertising or to train advertising profiles. Trainr transmits and displays the patient's data and your authored guidance; it does not evaluate, flag, or interpret lab results or other health data. Details of the sub-processors Trainr uses to operate the platform are in our Privacy Policy.

5. Revocation & termination

A patient may revoke your access at any time, which takes effect immediately for future access. This DPA continues for as long as you hold a professional account and, for the survival of confidentiality and data-handling obligations, after it ends. On termination of your account, or on revocation, you must stop processing the affected patient's data except as required by a legal record-keeping duty.

6. Personal-data breach

If you become aware of a personal-data breach affecting patient data you accessed through Trainr, you must notify us without undue delay at privacy@trainr.club and, where you are the controller concerned, comply with your own breach-notification duties under Articles 33–34 GDPR. Trainr will likewise notify you without undue delay of a breach affecting the platform that concerns your patients.

7. Verification

Verification of your professional status is an administrative check to enable access; it is not an endorsement, certification, or guarantee of your qualifications or competence, and it does not transfer any clinical responsibility to Trainr. You represent that you are duly qualified and licensed where required to provide your services.

8. Liability & governing law

You are responsible for your own processing and for the professional services and guidance you provide, and you will indemnify Trainr against claims arising from your breach of this DPA or of applicable law. This DPA is governed by the laws of Romania and the European Union, and disputes are subject to the courts of Romania, without prejudice to mandatory law.

Questions about this agreement: privacy@trainr.club.