Privacy and cookie notice
Last updated: 23 October 2026
Vivisfera is the platform a studio (personal trainers, nutritionists and collaborators) uses to follow its clients: training programmes, meal plans, wellbeing questionnaires, sleep, measurements and messages. At this stage it is in a trial with a small number of studios. Here we explain what data the platform processes, who is responsible for it, how long we keep it and how you can exercise your rights.
1. Who is the controller and who is the processor
There are two roles, depending on the type of data.
- Line33 is the data controller for your account data (name, email, encrypted password, sign-ins, security) and for the data we use to manage our relationship with the studio using the platform.
- The studio that invited you is the controller for the data about your programme with them: training, nutrition, wellbeing, sleep, measurements, medical history and messages. Line33 processes it on the studio’s behalf as a data processor (Art. 28 GDPR), under a written agreement and only to make the service work. The studio’s own privacy notice also applies to this data, and you can contact the studio directly.
Controller: Line33 [legal form to be confirmed], [registered office to be confirmed], [VAT number to be confirmed]. For any privacy request, write to privacy@line33.org: it is our dedicated address and it is read by people, not an automated system. Line33 has not appointed a data protection officer (DPO); if we do, their contact details will be given here.
2. What data we process and where it comes from
- Account: name, email, password (stored only as a hash, never in plain text), role (client, personal trainer, nutritionist, studio owner), language and time zone. You enter them when you sign up or accept the studio’s invitation.
- Programme data, entered by you or by the professionals in your team, only for the areas you have consented to: completed sessions with loads, reps and perceived effort (RPE/RIR); meal plan and food diary; wellbeing and recovery questionnaires; sleep, resting heart rate and HRV entered manually; measurements and progress photos; medical history; messages and exercise videos sent to the coach.
- Health data. Medical history, measurements, sleep, HRV and some questionnaires are data concerning health (Art. 9 GDPR). We process them only with your explicit consent for each area, which you give and withdraw from the Consents page in the app.
- Calculated indices: from the data entered, the platform calculates training load, wellbeing trends and a recovery index, and flags to the coach any changes that last several days.
- Technical and security data: IP address, browser, date and time of requests in the server logs; a log of which professional opened which area of your data and when (without the content of the data), which you can view in your profile.
- Notifications: if you turn them on, your browser’s notification identifier. Notifications never contain health data.
We do not use analytics or advertising tools, we do not embed third-party content (maps, videos, social media) and we do not connect wearable devices during the trial.
3. Purposes, legal bases and retention
| Why | What data | Legal basis | How long |
|---|---|---|---|
| Create and manage your account, let you sign in | Account, session | Contract (Art. 6(1)(b)) | As long as you have the account; when you delete it from the app, the data is erased within a few minutes |
| Follow your programme with the studio | Programme data | Contract with the studio (Art. 6(1)(b)) and, for health data, explicit consent per area (Art. 9(2)(a)) | As long as consent for the area is active; after withdrawal, 30 days, then deletion |
| Exercise videos sent to the coach | Video, exercise, date | Consent for the training area (Art. 9(2)(a)) | 90 days from sending, then automatic deletion |
| Exporting your data on request | ZIP file with your data | Legal obligation, right to data portability (Art. 6(1)(c)) | 7 days, then automatic deletion |
| Service emails (invitation, sign-in link, password reset) | Name, email | Contract (Art. 6(1)(b)) | The time it takes to send them; unused invitations expire and are deleted |
| Security and abuse prevention | Technical logs | Legitimate interest in protecting the service and clients’ data (Art. 6(1)(f)) | Up to 7 days |
| Log of access to your data | Who, which area, when | Security obligation (Art. 32) and legitimate interest in being able to check access (Art. 6(1)(f)) | 24 months |
| Backups | All data in the database | Legitimate interest in not losing data (Art. 6(1)(f)) | Up to 7 days, on a rolling basis |
End of the trial. If the studio continues with Vivisfera, the data is moved to the production environment with the same safeguards, and we will let you know beforehand. If the studio does not continue, we delete it within 30 days of the end of the trial, after giving the studio and you the chance to export it.
4. Who receives the data
The data is seen only by the people in your team at the studio, for the areas you have consented to, and by authorised Line33 staff when needed for support or security. We do not sell data and we do not use it for advertising. We rely on these providers, appointed as processors under a written agreement:
- Cloudflare, Inc.: application servers, file storage (in the EU jurisdiction), job queues and email sending. Cloudflare’s privacy policy.
- Neon, Inc.: database, hosted in Frankfurt (Germany). Neon’s privacy policy.
- Your browser’s notification service (Google for Chrome, Apple for Safari, Mozilla for Firefox), only if you turn notifications on: it receives an encrypted message with no health data.
Stored data stays in the EU. Cloudflare and Neon are US companies, and requests may be processed on the Cloudflare server closest to you; any transfers outside the European Economic Area take place on the basis of the EU-US Data Privacy Framework, where the provider participates in it, and of the European Commission’s standard contractual clauses.
5. Social networks and third-party content
The platform does not embed social network content (buttons, feeds, videos) or any other third-party content, and does not link to social profiles: no data reaches these platforms through Vivisfera.
7. How we protect the data
- Encrypted connection (HTTPS/TLS) across the whole platform; data is also encrypted in the providers’ storage.
- Access by role and by consent, enforced directly by the database: a professional sees only the clients in their team and only the permitted areas; a nutritionist can write a meal plan only with a verified qualification.
- Passwords stored only as hashes; files can be downloaded only through the platform, after an access check.
- EXIF data, including location, is removed from photos before they are sent.
- Log of access to clients’ data, which the studio and each client can view.
- No health data in notifications, logs or emails.
- Providers bound by data processing agreements (Art. 28) and database backups.
8. Your rights
At any time you can ask for:
- access to your data and a copy of it (Art. 15);
- correction of inaccurate data (Art. 16);
- erasure (Art. 17), which you can also do yourself in the Your data section of your profile;
- restriction of processing (Art. 18);
- portability, meaning your data in a readable format (Art. 20), which you can also get yourself in the Your data section of your profile;
- to object to processing based on legitimate interest (Art. 21);
- to withdraw your consent at any time, for each area, from the Consents page (Art. 7(3)): withdrawal does not make what was done before unlawful;
- not to be subject to decisions based solely on automated processing (Art. 22).
Write to privacy@line33.org. We reply within one month (Art. 12(3)); if the request concerns your programme data, we pass it on to the studio as controller and help you get an answer. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (garanteprivacy.it, Art. 77), or with the supervisory authority of the EU country where you live or work.
9. Required data and automated decisions
Name and email are needed to create the account: without them you cannot use the platform. The data for each area is optional: if you do not give consent, the team will not see that area and will not be able to support you on that front.
The indices and alerts calculated automatically are information for your coach, who always decides in person. They do not produce decisions with legal effects on you, they are not a diagnosis, and Vivisfera is not a medical device.
10. Changes
If we change this notice substantially, we will update the date at the top and tell you in the app before the changes take effect. For questions, privacy@line33.org.