Where the data is kept
The app and its database run in Germany, in the EU. Photos, videos and documents are stored with Cloudflare, encrypted at rest. The host in Germany is Hetzner.
The coach terms say the same thing in their own words: "Our servers and database are in Germany (Hetzner). Photos, videos and documents are stored with Cloudflare." Encryption at rest is Cloudflare's own. Its storage documentation says: "All objects stored in R2, including their metadata, are encrypted at rest." R2 is the Cloudflare storage Evobody uses, and that encryption is automatic, with no setting to forget.
The database is backed up, and the terms list "regular backups of the database, kept in a separate location" among Evobody's security measures. Some of the companies Evobody works with are based outside Europe, and the privacy policy covers that: "Some providers may be located outside the EEA. Where we transfer data internationally we rely on appropriate safeguards, such as adequacy decisions or Standard Contractual Clauses."
Who can see a client's data
The privacy policy answers it for the client in two lines: "Who can see it: you, and your own coach." Then: "It is never visible to other members, and never visible to other coaches on the platform. The only exceptions are the specific items you choose to share to your community (such as a completed workout, a win, or a before/after photo), which are visible to the other members of your coach's community."
That community is each coach's own private group, and nothing in it reaches another coach's clients. A client can also choose an accountability partner, found by name or paired by their coach, and only once both of them accept. Partners then see each other's training and habits for the last two weeks and food for the last ten days, while the rest of the group still sees only what a client chooses to share.
On the coach's side, the policy's security list puts it in one line: "Each coach can reach only their own clients' data". On Studio, which opens later, a coach can add up to three assistant coaches, and the terms name them as the only other people who see a client's health data: "only the coach and the assistant coaches named in the coach's account can see it".
How it is protected
The coach terms list Evobody's technical and organisational measures in a single line. Here it is, item by item, exactly as written:
- "encrypted connections for all data in transit"
- "each coach and their assistants can reach only their own clients' data"
- "our access to servers and the database is limited to the people who run Evobody"
- "two step sign in is available to every coach"
- "regular backups of the database, kept in a separate location"
- "files stored with Cloudflare are encrypted at rest"
- "a written plan for handling breaches"
- "these measures are reviewed at least once a year"
The privacy policy adds how signing in works and what is kept for it. "You can sign in three ways: a one-time code emailed to you, your Google account, or a password you set." If a password is set, "we never store the password itself", only "a scrambled version of it (a salted scrypt hash), which cannot be turned back into your password by us or by anyone who obtained it". And: "You can switch on two-factor sign-in with an authenticator app. We store the shared secret that app needs and nothing else about your device".
The rest of its list: "Session tokens are hashed at rest, and tokens for connected devices and apps are encrypted at rest; media is served through an authenticated proxy". That last part means a progress photo never sits at a public web address: it is served through Evobody, to someone who is signed in. The policy is honest about the limit, too: "No method of transmission over the Internet is 100% secure, so we cannot guarantee absolute security."
What Evo SI sees, and where it goes
Evo SI is the assistant in a client's app. SI stands for Super Intelligence, previously known as Artificial Intelligence. It works for the coach too, trained on the coach's philosophy and methods, set up in the app. The coach terms describe it plainly: "It is software, not a coach. Your clients are told in the app that Evo SI is an AI system, not a person." The privacy policy sets out when anything leaves Evobody for it: "Evo SI is optional, and it asks your permission before anything is sent." It goes to Anthropic, the company that makes the Claude AI, only when the client uses it, and it carries what an answer needs: what the client writes and any photo they give it, their name, their goals and their coach's targets and notes, their logs and tracked numbers, their food details and their meal plan. "Photos go as the picture only, without where or when they were taken."
Two lines from the policy matter most. "Anthropic uses this only to produce Evo SI's reply. It does not train its AI on it, and it normally deletes it within 30 days." And: "You can turn Evo SI off at any time in Settings. After that, nothing more is sent to Anthropic."
Evo SI reads one client's data and nobody else's. Which account it may read is fixed by the server before the model runs, and no tool it can call accepts a person, so it cannot be pointed at anyone else. Every reply is also checked against the names of the coach's other clients and held back if it names one. A question about pain, injury or medication gets no medical advice: Evo SI flags it for the coach, who sees that the client needs a look.
Watches and connected apps
A client can connect a tracker from any phone or browser, and Apple Health in the Evobody iPhone app, which is in beta. Each connection is the client's own choice, approved on the device maker's own page, and in the policy's words: "We request read-only access and receive only the data you authorize". Evobody never writes anything back to Apple Health. A client can disconnect any device from Settings at any time: what already synced stays, and nothing new arrives.
What Evobody does with the data, and what it never does
For the client data in Evobody, the coach and Evobody are joint controllers, and the coach terms set out that arrangement "under Article 26 of the UK GDPR and the EU GDPR". Their promise on use is the line coaches ask about most. Evobody will "use your clients' data only to run and secure Evobody for you and them, and to improve Evobody only with data that no longer identifies anyone, or with the client's consent. We do not sell it, use it for advertising, or use it to train AI models."
Health data needs consent first. The terms commit Evobody to "ask each client in the app, before they enter any health data, for their explicit consent to its use, keep a record of it, and stop using that data if they withdraw it". The privacy policy names the legal basis the same way: health and training data is "special category" health data under the GDPR, processed "on the basis of your explicit consent and to perform the coaching contract with you".
Nothing in the app follows anyone for advertising. From the policy: "On the website we use essential cookies plus analytics (Google Analytics, Lucky Orange). The app uses only the cookies required to keep you signed in." And, under its list of service providers: "The app itself carries no analytics, no advertising and no cross-app tracking of any kind."
If something goes wrong
The coach terms say what Evobody does if a breach in its own systems affects a coach's clients: "tell you without undue delay, tell the regulator within 72 hours where the law requires it, and tell the affected clients where the law requires it". A written plan for handling breaches is one of the measures listed above.
A coach has a part in this too, which is keeping their own sign in, and any assistant's, safe. If something happens on the coach's side, such as a lost phone or a shared password, the terms ask the coach to tell Evobody at [email protected] "without undue delay, and in any case within 24 hours of becoming aware of it".
Found a security problem in Evobody itself? Email [email protected]. It reaches a person.
How long data is kept, and deleting it
From the privacy policy, health and training data is "kept while your coaching account is active and for up to 7 years afterwards (client records), or deleted sooner on request". Cancelling a paid plan deletes nothing. In the terms' words: "Cancelling does not delete your data."
Deleting an account starts with a request. For a coach, the terms say: "You can ask us to delete your account in Settings, Account, or by email." For a client, the policy says: "You can request full deletion of your data at any time." Either can also write to [email protected], and every request is answered within 30 days.
Rights under the GDPR
From the privacy policy: "Under the GDPR you have the right to access, correct, erase, restrict, port and object to the processing of your personal data, and to withdraw consent at any time." Because the coach and Evobody are joint controllers, a client can use those rights with either of them. The terms: "Your clients can use their data rights with either of us." The policy asks people to write to Evobody, and says "we will handle it".
"If you think we have handled your data wrongly, you can complain to the data protection authority in the country you live in. You are welcome to raise it with us first". And Evobody is for adults: "The Service is not intended for anyone under 18."
Questions about security
Where is Evobody's data kept?
The app and its database run in Germany, in the EU, on Hetzner's servers. Photos, videos and documents are stored with Cloudflare, encrypted at rest, and every connection is encrypted in transit.
Can another coach see my clients?
No. Each coach can reach only their own clients' data, and the privacy policy says a client's health data is never visible to other coaches on the platform. Evo SI is held to the same line: the server fixes whose data it reads before it runs.
Does Evobody sell client data or use it to train AI?
No. The coach terms say Evobody uses client data only to run and secure Evobody, and does not sell it, use it for advertising, or use it to train AI models. Anthropic, which powers Evo SI, does not train its AI on it either.
Is two factor sign in available?
Yes, for coaches and for clients. Anyone can switch on two factor sign in with an authenticator app, and Evobody keeps only the shared secret that app needs. A password, if one is set, is kept only as a salted scrypt hash.
Who can see a client's progress photos?
The client and their own coach. Photos are served through an authenticated proxy rather than from a public address, and other members see one only if the client chooses to share it with their coach's community.
What happens if there is a data breach?
The coach terms commit Evobody to tell the coach without undue delay, tell the regulator within 72 hours where the law requires it, and tell the affected clients where the law requires it. A written plan for handling breaches is one of the measures in the terms.
How do I delete my Evobody account?
Ask in the app, in Settings, or by email to [email protected]. Every request is answered within 30 days, and cancelling a plan on its own deletes nothing, so a coach who only wants to stop paying keeps everything they built.
The full text is in the privacy policy and the coach terms. Related: who owns my client data, and what Evo SI can do.