ATLAS is operated by Ahmed Hossam Hassan Faris Imparez as a natural person, who is the controller of your personal data within the meaning of Law No. 151 of 2020. A registered company for the service is not yet in place; when it is, this paragraph will be updated and you will be notified before the change takes effect, under section 18. Your rights in section 13 apply in full either way.

We process personal data in accordance with Law No. 151 of 2020 on the Protection of Personal Data and its executive regulations, and — where they apply to you — the EU General Data Protection Regulation and the UK GDPR.

Our data protection contact is privacy@atlascoaches.com. If you prefer to write, use the registered address above marked “Data Protection”.

This policy covers the ATLAS mobile and web applications and every service delivered through them. It applies to you whether you use ATLAS as an athlete, a coach, or a visitor who has not created an account.

Your coach is a separate professional, not our employee. In respect of records your coach lawfully keeps for their own professional and regulatory obligations, your coach is an independent controller and answerable to you directly. In respect of everything that happens inside ATLAS, we are the controller and your coach acts on our documented instructions under a written agreement.

Data you give us directly

• Account: email address, display name, profile photograph, language preference, password credentials (handled by our authentication provider — we never see your password).
• Intake survey: age, sex, height, weight, training history and experience, goals, injuries and medical history, medications and supplements you disclose, sleep, stress, dietary habits, allergies and intolerances, and body measurements including arms, chest, waist, hips, thigh, calf and neck.
• Progress: weight and measurement logs over time, workout completion records, and progress photographs if you choose to upload them.
• Messages: the text, photographs, videos and voice notes you exchange with your coach inside ATLAS.
• Payment claims: the amount you say you sent, the reference, and any screenshot of the transfer you choose to attach.
• Reviews: the rating and written review you leave for a coach.
• If you apply to coach: your full legal name in Arabic and English, your national ID number and the date of birth it contains, your mobile number and home address, photos of the front and back of your national ID and a photo of you holding it, your certificates, whether you hold professional insurance, whether you train under-18s, any clients you already train outside ATLAS, and the wallet or account your subscribers pay into, with the name on it. When you accept the Coach Agreement we record the version, a fingerprint of the exact text you were shown, the time, the name you typed, the obligations you ticked, your IP address and your device type.

Data we generate

• Booking and subscription records: amount, currency, package, dates, status, the reference shown to you, which payment destination you were shown, what each side said was sent and received, refund records, and the commission your coach owes us on the sale.
• Derived health metrics calculated from what you enter: basal metabolic rate, total daily energy expenditure, macronutrient targets, and an estimate of body fat percentage from your tape measurements.
• Adherence and streak statistics derived from your workout logs.
• Support tickets, problem reports, dispute records and moderation decisions.
• Video calls: that a call happened, who was on it, when it started and ended, and how long it lasted. Not the call itself — no audio, no video, no transcript. We keep the fact of a call for the same reason we keep messages: it is evidence a service was delivered.
• Nightly automated checks of our own records, which flag inconsistencies — a subscription marked active with no matching payment, for example. A flagged entry names the booking and the amount so a person can look at it, and never changes anything about your account by itself.

Data collected automatically

• Device and connection metadata: device model, operating system, app version, browser type, language, IP address, and approximate location derived from IP address.
• Security and diagnostic logs: sign-in events, failed sign-in attempts, error reports.
• Product analytics events: the screens you open and a few named actions, such as signing up, applying to coach or confirming a payment. They are sent to our analytics provider, PostHog, only if you have accepted analytics, and never include your name, email, messages, health answers or payment details; see section 16.
• A push notification token, if you enable notifications, so we can deliver alerts to your device. An iPhone also has a second, calling token, which iOS issues without asking and which we use for one thing only: to ring your phone when someone calls you on ATLAS.
• If you use the map view, your browser contacts Google Maps directly and Google receives your IP address under its own privacy policy.

What we do not collect. We do not collect your card number, CVV or bank credentials, because you never enter them here — you pay your coach from your own bank or wallet app and ATLAS is not part of that transfer. We do not collect precise GPS location in the background. We do not buy personal data from data brokers, and we do not run third-party advertising trackers.

Your intake answers, injury and medical history, body measurements, body-composition estimates and progress photographs are sensitive personal data under Article 1 of Law No. 151 of 2020, and special category data under the GDPR.

• We process them on the basis of your explicit, specific consent, which you give when you complete the intake survey or upload a photograph.
• The intake survey is only presented after you have subscribed to a coach. You are never required to answer any particular question, and you may leave any field blank.
• Progress photographs are entirely optional. They are stored in a private bucket, are never public, are served only through short-lived signed links, and are visible only to you, to the coach you are currently subscribed to, and — where a specific safeguarding or abuse investigation requires it — to a named senior member of our staff.
• A coach may never publish, share, download or reuse your photographs or body data, in any form, including cropped or anonymised, without your separate written consent. This is a contractual prohibition on every coach and a ground for immediate removal from the platform.
• You can withdraw consent and delete this data at any time from your Profile, without losing access to the rest of the service, though your coach may then be unable to programme effectively for you.

ATLAS is not a medical service. The metrics we calculate are estimates for training purposes and are not a diagnosis, a medical assessment, or a substitute for advice from a qualified physician.

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms, and you may object at any time under section 13. Where we rely on consent, you may withdraw it at any time, which does not affect processing carried out before withdrawal.

We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use your health data for marketing.

Messages inside ATLAS are private between you and your coach — they are not private from us, and we want to be direct about that rather than bury it.

• Message text, attachments and voice notes are stored on our systems so that both sides keep a record and so that we can resolve disputes.
• Messages are subject to automated pattern detection that looks for attempts to move payment or contact off the platform — for example, phone numbers, payment handles, or external links — and for indicators of abuse or harm.
• A small number of authorised administrators can read conversations in full, including attachments, where there is a legitimate reason: investigating a complaint, a payment dispute, a safeguarding concern, suspected fraud, or a suspected breach of our coach agreement, or where the law requires it.
• Administrative access is limited to named staff bound by confidentiality obligations and is logged.
• Our lawful basis for this monitoring is our legitimate interest in protecting users, preventing fraud and enforcing our contracts, together with our legal obligations. We have assessed this as proportionate because the platform is the record of what was paid and the mechanism through which health data is exchanged.
• Video calls are different, and this is the one exception worth knowing. A call is not recorded, not stored and not reviewable by anyone — including us. We know a call happened and how long it lasted, and nothing else. If you want something off the record, say it on a call rather than in chat.
• Please do not use ATLAS chat for anything you would not want reviewed under those circumstances — including sending identity documents, card details, or unrelated medical records.

A coach can only see the data of clients who have actually paid to subscribe to them. This is enforced in the database itself, not merely in the interface. A coach cannot browse, search or export other users’ data.

Once you subscribe, your coach can see:

• your name and profile photograph;
• your intake survey answers and the metrics calculated from them;
• your measurement and weight logs, and your workout adherence;
• your progress photographs, if you uploaded any;
• your messages with them;
• the amount you said you paid and any screenshot you attached; and
• your subscription status, package and renewal date.

Your coach never sees:

• your bank or card credentials — we do not hold them either;
• your conversations with any other coach;
• your email address, telephone number or home address; or
• your data after your subscription has ended and the retention period has run.

Coaches are contractually prohibited from downloading, screenshotting, exporting or storing your data outside ATLAS, and from contacting you off-platform.

No payment processor appears in this table, and that is deliberate. You pay your coach directly from your own bank or wallet app, so no card network, acquirer or payment service provider receives your data through ATLAS. Your bank and your coach’s bank see that transfer; we only see what the two of you tell us about it.

Every processor is bound by a written contract requiring confidentiality, appropriate security, and processing only on our instructions. We do not permit any of them to use your data for their own purposes.

Calculations. We automatically calculate energy expenditure, macronutrient targets and an estimated body fat percentage from the measurements you enter. These are estimates produced by published formulae, they are always reviewed by your coach before anything is issued to you, and they produce no legal or similarly significant effect.

AI plan drafting. Your coach may ask for an AI-generated first draft of a training or nutrition programme. If they do, your intake answers and recent measurements are sent to Anthropic’s API to produce that draft. We send this without your name, email address, photographs or contact details. The draft is never delivered to you automatically — your coach must review, edit and approve it. Your data is not used to train any AI model.

Abuse detection. Automated rules flag messages that appear to contain contact details or payment handles, and flag patterns that can indicate manufactured subscriptions. A flag alone never results in a penalty; a person reviews before any action is taken.

We do not make any decision producing a legal or similarly significant effect on you by automated means alone. Suspensions, refund determinations, payment-dispute rulings and account removals are decided by a person, and you may contest them under section 13.

One thing that does happen automatically, and you should know it. If you tell us you have paid and your coach does not respond within 48 hours, your subscription activates on its own. That is a decision in your favour, taken because an unresponsive coach should not cost you the plan you paid for. It can be reversed only by a person, and only if your coach disputes it within 7 days.

Our application data is hosted on servers located in the European Union. Push notification delivery and AI drafting involve providers operating outside Egypt, including in the European Union and the United States.

Transferring personal data outside Egypt requires a lawful basis under Articles 14 and 15 of Law No. 151 of 2020. We rely on your explicit consent to the transfer where required, on the necessity of the transfer for the performance of our contract with you, and on contractual safeguards with each recipient — including EU Standard Contractual Clauses where the recipient offers them — that impose a level of protection no lower than that required under Egyptian law.

You may request a summary of the safeguards applying to any specific transfer by writing to privacy@atlascoaches.com.

When a retention period expires, data is deleted or irreversibly anonymised. Encrypted backups are overwritten on their own rolling cycle, which may briefly outlast the periods above; data in expired backups is not restored into live systems.

• All traffic is encrypted in transit using TLS 1.2 or higher.
• Data is encrypted at rest, including backups.
• Access to your data is enforced at the database level by row-level security policies — a coach is technically incapable of reading a non-subscriber’s records, not merely discouraged from doing so.
• Progress photographs, payment screenshots and chat media are stored in private buckets and served only through short-lived signed links that cannot be shared or guessed.
• Administrative access is restricted to named accounts, requires elevated privileges, and is logged.
• We never hold card numbers, CVVs or bank credentials, because they are never entered here.
• Where we need to know whether an identifier has been banned, we store only a one-way fingerprint of it, never the number or address itself.
• Coach applicants' ID photos are deleted once the application is decided. The one sealed copy we keep is encrypted to a key held offline — not on our servers — so neither we, in normal operation, nor anyone who breaks into our systems can open it. Every opening is logged with its reason.
• Passwords are handled by our authentication provider and are never visible to us.

No system is perfectly secure. Please use a unique password, enable device lock, and tell us immediately at security@atlascoaches.com if you believe your account has been accessed by someone else.

Under Article 2 of Law No. 151 of 2020 — and, if they apply to you, the GDPR — you have the right to:

• Know what data we hold and how we use it;
• Access a copy of your data;
• Correct data that is inaccurate or incomplete;
• Delete your data, subject to the retention we are legally obliged to keep;
• Withdraw consent at any time, including for health data and progress photographs;
• Object to processing based on legitimate interests;
• Restrict processing while a dispute about accuracy or lawfulness is resolved;
• Port your data to another service in a structured, machine-readable format; and
• Contest any decision we have taken about your account and ask that a person review it.

How to exercise them. Most of this is self-service in your Profile page: you can edit your survey answers, delete individual measurements and photographs, export your data, and delete your account. Deleting your account removes your profile, health data, photographs and reviews at once; records of payments, refunds, messages and calls are kept for the periods in section 11 with your name removed, because they are the evidence in any dispute with a coach. For anything else, email privacy@atlascoaches.com.

We respond within 30 days, and will tell you if we need a further 30 days for a complex request. We may ask you to verify your identity first. Exercising a right is free; we may charge a reasonable fee only for a manifestly excessive or repetitive request, and we will tell you before we do.

If a personal data breach occurs, we will notify the Egyptian Personal Data Protection Centre within 72 hours of becoming aware of it, as required by Law No. 151 of 2020, and we will notify you directly and without undue delay where the breach is likely to result in a high risk to your rights. Where EU or UK users are affected, we will notify the relevant supervisory authority within 72 hours.

Our notification will describe what happened, what data was involved, what we have done, and what you should do.

ATLAS is intended for people aged 18 and over. We do not knowingly create accounts for anyone under 18 without the verifiable consent of a parent or guardian, and coaches are contractually prohibited from requesting progress photographs from any client under 18 in any circumstance.

If you believe a minor has created an account or that we hold a minor’s data, contact privacy@atlascoaches.com and we will verify and delete it promptly.

• Strictly necessary: session and authentication tokens, security tokens, and your language preference. These cannot be switched off without breaking the app, and we do not ask consent for them.
• Analytics: product usage events, sent to PostHog. These run only if you accept them in the cookie banner, and you can change your choice at any time from the banner or the Usage analytics switch in your Profile. PostHog keeps its identifier in your browser's local storage and sets no cookie.
• No advertising or third-party tracking cookies are set by ATLAS.

We also use your device’s local storage to keep drafts and cached content so the app works offline. You can clear it from your browser or by reinstalling the app.

If you are in the European Economic Area, the United Kingdom or Switzerland, the rights in section 13 apply to you under the GDPR, and you additionally have the right to lodge a complaint with your local supervisory authority.

Our legal bases are those set out in section 5. For special category data — your health and body data — we rely on Article 9(2)(a) explicit consent. Where we transfer personal data out of the EEA or the UK, we rely on Standard Contractual Clauses or an adequacy decision, together with supplementary technical measures.

We will announce any material change by email and by in-app notice at least 14 days before it takes effect, and — where a change extends processing of your health data or relies on your consent — we will ask for your consent again rather than assume it. Previous versions are available on request.

• Privacy and data rights: privacy@atlascoaches.com
• Security reports: security@atlascoaches.com
• Anything else: legal@atlascoaches.com

If you are not satisfied with our response, you may complain to the Personal Data Protection Centre of the Arab Republic of Egypt under Law No. 151 of 2020, or, if you are in the EEA or the UK, to your local data protection authority. We would appreciate the chance to put things right first.