Medaly

Privacy Policy

Effective 1 October 2026

The short version. We collect what Medaly needs to plan and track your workouts, and nothing for advertising. We don't sell your data or track you across other apps. Your trainer sees what they need to coach you. You can delete your account and data at any time from inside the app.

1. Who we are

Medaly is operated by Dragana Ristić, Serbia ("we", "us"). We are the controller of the personal data described here. Questions or requests: rstc.dragana@icloud.com.

2. What we collect

Account information. Your email address, which is how you sign in (we send you a one-time code; there is no password), and the role you choose (exerciser or trainer).

Profile information you give us. Your first and last name. As an exerciser: height, weight, fitness goals, preferred training time, and any health notes you choose to add. As a trainer: experience and certifications. Optionally, a profile photo you choose from your photo library; we only receive the one photo you pick, resized and stored with your profile, and anyone with its link can open it.

Health and fitness information. Measurements, health notes, the workouts you plan and complete, the sets, reps, weights and durations you log, and your answers to post-workout surveys (how hard it felt, soreness). Health notes and measurements are optional; you decide what to add.

Training activity. The groups you belong to or lead, sessions you join, attendance, workout plans and templates, medals and statistics, and in-app notifications.

Crash and diagnostic data. When the app crashes or something goes wrong, we receive a technical report: device model, operating system and app version, what the app was doing, performance timings, and your IP address.

What we don't collect. Your location, contacts, the rest of your photo library, microphone or camera, or any advertising identifier. Workout reminders are scheduled on your device only and never leave it.

3. How we use it

We do not use your data for advertising, we do not sell it, and we do not track you across other companies' apps or websites.

4. Who can see your data

Your trainer. If a trainer adds you to one of their groups, they can see your name, measurements, goals, health notes, the sessions you sign up for and attend, the plans they write for you and what you log in them, and your survey answers. That is what lets them coach you safely. If you leave or are removed from a group, the trainer no longer sees your new activity.

Exercisers in your groups. If you are a trainer, the members of your groups can see your name and the sessions and plans you share with them.

Nobody else using Medaly can see your data.

5. Service providers

We use a small number of providers who process data only on our instructions:

Some of these providers may process data outside Serbia. Where they do, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. Legal basis

7. How long we keep it, and deleting your account

We keep your data for as long as you have an account. You can delete your account at any time in the app: Profile → Delete account. This immediately and permanently removes your account and the data tied to it from our database, including your profile, measurements, health notes, workouts, medals and notifications. If you are a trainer, the groups you lead and their sessions and plans are deleted too.

Copies may remain in encrypted backups for up to 30 days before they are overwritten. Crash reports are kept for up to 90 days.

8. Your rights

Under the Serbian Law on Personal Data Protection and, where it applies, the EU General Data Protection Regulation (GDPR), you have the right to access your data, correct it, delete it, restrict or object to its processing, receive a copy in a portable format, and withdraw your consent at any time. Email rstc.dragana@icloud.com and we will reply within 30 days.

You can also lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of Serbia (poverenik.rs), or with the data protection authority where you live.

9. Children

Medaly is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

10. Security

Data is encrypted in transit, and access rules in our database make sure each person can only read what they are allowed to see. No system is perfectly secure, but we work to protect your data and will tell you promptly if a breach affects you.

11. Changes

If we change this policy, we will update the date at the top and, for significant changes, let you know in the app.

12. Contact

Dragana Ristić, Serbia
rstc.dragana@icloud.com