Privacy Policy

Effective: 19 October 2026

MyoStats is operated by Kieser Group, trading as MyoStats ("MyoStats", "we", "us"), in South Africa. We are the responsible party for your personal information under the Protection of Personal Information Act, 2013 (POPIA). This policy explains what we collect, why, where it goes, and the choices you have.

Questions or requests: [email protected]. Our Information Officer can be reached at the same address.

1. What we collect

Your account

• Name and email address.
• Your password, stored only as a salted hash. We cannot see it.
• A profile photo, if you add one.

What you log

• Cycles, compounds, doses and dose check-offs.
• Blood work results.
• Workouts, routines and personal records.
• Food, meal plans, water and body weight.
• Body measurements, date of birth, gender and your app preferences.

Payments

Payments are processed by PayFast. We receive your plan, subscription status, payment references and amounts. We never receive or store your card or bank details.

Coaching

If you work with a coach on MyoStats we keep: the link between you and your coach, what you chose to share with them, and a record of which areas of your data your coach changed and when.

Technical and usage information

• Your IP address and browser details are processed by our hosting provider to deliver the service and protect it from abuse.
• We count how often a handful of features are used (for example "a workout was finished" or "a meal was logged"). These counts are stored per day with no user ID, email or IP address attached, so they cannot be linked to you. You can switch them off in Profile → Preferences, and we don't send them if your browser signals Do Not Track or Global Privacy Control.
• We do not use advertising trackers, third-party analytics or tracking cookies.

2. Health information

Much of what you log is health information, and information about substances you use may in some cases relate to the use of controlled or scheduled substances. POPIA treats both as special personal information. We process it only because you ask us to, with your explicit consent (POPIA section 27(1)(a)), which you give by creating an account and entering it. You can withdraw that consent at any time by deleting the entries or your account (section 7). Withdrawing consent does not affect processing that already happened.

3. How we use it

• To run MyoStats for you: store and sync your data across your devices, and show charts, estimates and summaries.
• To send account emails: password resets and coach invites. We don't send marketing email without your separate consent.
• To handle billing.
• To keep the service secure, and to prevent fraud and abuse.
• To decide what to improve, using the anonymous feature counts.

We do not sell your information, rent it, or use it for advertising. We make no automated decisions that have legal or similarly significant effects on you. The calculators and estimates in the app are tools for you, not decisions about you.

4. Where it is stored and how it is protected

• On your device: the app keeps a copy of your data in your browser's storage, so it loads fast and works offline.
• In the cloud: your account and synced data are stored with Cloudflare (D1 database and R2 file storage). Cloudflare runs a global network, so your information may be processed outside South Africa. We rely on Cloudflare's contractual data protection commitments to provide an adequate level of protection, as section 72 of POPIA requires, and on your consent.
• How it is protected:
  • All traffic is encrypted in transit (HTTPS), and Cloudflare encrypts stored data at rest.
  • Passwords are hashed.
  • Sign-in tokens are short-lived.
  • Coach access is checked on our server for every request.
• What we can see: MyoStats is not end-to-end encrypted. Our systems can read your data in order to provide the service. We only access individual accounts when you ask for support, to investigate abuse or security issues, or where the law requires it.

5. Who we share it with

• Service providers that run the service for us, under contract:
  • Cloudflare: hosting, storage and email delivery.
  • PayFast: payments.
• Your coach, only if you accept their invite.
  • A coach you accept can see and update your training, nutrition, body stats and profile details, and log entries for you.
  • Your blood work, cycles and dose log stay hidden from your coach unless you choose to share them as view only or full control.
  • You can change what you share, or remove a coach, at any time in Profile → Coach. Their access ends straight away.
• Accounts created by a coach. A coach can create a profile for a client who doesn't use the app. The coach is responsible for having that client's consent. When the client sets up their own login, the account and its data are theirs and they control what the coach can see.
• The law. We disclose information where the law requires it, or to protect someone's safety or our legal rights.
• A change of ownership. If MyoStats is sold or merged, your information would move under this policy, and we would tell you first.

6. How long we keep it

• While your account exists: we keep your data until you delete it.
• Deleting your account (Profile → Preferences) immediately removes:
  • your account and all synced data;
  • your profile photo;
  • your coach links;
  • for a coach, the profiles of clients who never set up their own login.
• Backups: copies in database backups expire within 30 days.
• Payment records: kept for as long as tax law requires (currently five years).
• Invite links: expire after 14 days.
• Anonymous feature counts: contain no personal information and may be kept indefinitely.

7. Your rights

Under POPIA you may:

• Access your information. You can also download all of it yourself from Profile → Preferences.
• Correct it. Most of it you can edit directly in the app.
• Delete it, or your whole account.
• Object to processing, or withdraw your consent.
• Complain to the Information Regulator (South Africa) at inforegulator.org.za. We'd appreciate the chance to fix things first at [email protected].

If you are in the European Union or the United Kingdom, you have equivalent rights under the GDPR, including data portability. Our legal bases are your consent (for health data) and our contract with you (to provide the service).

We answer requests within 30 days and may need to confirm your identity first.

8. Age

MyoStats is for adults aged 18 and over. We do not knowingly collect information from anyone younger. If you believe a minor has an account, contact [email protected] and we will delete it.

9. Security problems

If we become aware of unauthorised access to your personal information, we will notify you and the Information Regulator as POPIA requires. To report a vulnerability, email [email protected].

10. Changes

If we make a material change to this policy, we will tell you in the app or by email before it takes effect. The date at the top shows when it last changed.

11. Contact

• Privacy and data requests: [email protected]
• Help with the app: [email protected]
• Legal notices: [email protected]

Kieser Group, trading as MyoStats · myostats.com