Data processing agreement
Last updated: 25 October 2026
Download the PDFThis agreement sets out how Iterative Bits SAS, 60 rue François 1er, 75008 Paris (“Goodform”, the processor) processes personal data on behalf of each coach who uses Goodform (the coach, the controller), as required by article 28 of the General Data Protection Regulation (GDPR). It forms part of the terms of use. The coach accepts it when creating their account, and can download it at any time from Settings → Privacy & data.
1. Subject and roles
The coach decides why and how the data of their clients and prospects is processed: they are the controller. Goodform processes this data only to provide the platform to the coach: it is the processor.
Goodform remains the controller of the data it processes for its own purposes (coach accounts, the Goodform subscription and its invoices, sign-in security, the website). That processing is described in the privacy policy, not in this agreement.
2. Description of the processing
- Nature and purpose: hosting, organising, storing, displaying and sending the data the coach and their clients enter in Goodform, to run the coaching business: bookings, payments and invoices, programs and workouts, nutrition, check-ins, messages, reminders and notifications; and, when the coach asks for it, reading and formatting the records the coach imports with the AI-assisted import (Anthropic), before the coach checks and confirms what is saved.
- People concerned: the coach’s clients and prospects (applicants from the coach’s page included), and the people who buy a gift card or leave a review.
- Data: identity and contact details; bookings, purchases, payments and invoices; goals; answers to the coach’s application form; the health questionnaire; measurements and progress photos; programs, workouts and their results; meal plans and food logs; check-ins; messages, voice notes, form-check videos and comments; reviews; reminders and notification preferences.
- Sensitive data: the health questionnaire and the health answer of an application (GDPR art. 9) are stored only with the person’s explicit consent, recorded with its date, its wording version and who gave it.
- Duration: as long as the coach’s account is open, then until the data is deleted as described in “End of the agreement”.
3. What the coach commits to
- Have a legal basis for each processing, and tell their clients how their data is used (the coach’s own privacy notice; Goodform’s privacy policy can help).
- Collect health information only through the questionnaire, with the client’s explicit consent, and never write sensitive data that is not needed in free-text fields (notes, messages).
- Answer their clients’ requests (access, correction, deletion, withdrawal of consent), with the tools Goodform provides.
- Before an AI-assisted import, send only the data needed, include health information only with the client’s explicit consent, and check the result before confirming it.
- Use Goodform lawfully and keep access to their account to themselves.
4. Documented instructions
Goodform processes the data only on the coach’s documented instructions: this agreement, the terms of use, and what the coach does in Goodform (creating a client, sending a message, deleting a client, and so on). If Goodform believes an instruction breaks the GDPR or another data protection law, it tells the coach straight away. Goodform never uses the coach’s data for its own purposes, never sells it and never uses it for advertising.
If a law of the European Union or of a member state requires Goodform to process the data otherwise, Goodform tells the coach first, unless that law forbids it.
5. Confidentiality
Only the people at Iterative Bits SAS who need the data to run, support or secure Goodform can access it. They are bound by confidentiality, and their access is limited to what their task requires.
6. Security
Goodform takes the technical and organisational measures of article 32 of the GDPR, in particular:
- encrypted connections (HTTPS) and encrypted storage at rest by the hosting providers;
- sign-in with a single-use code sent by email or with Apple or Google, so no password can be stolen;
- each coach’s data kept apart from other coaches’ data in the database (row-level access rules, tested automatically), and health answers readable only by the client and their coach;
- signed, short-lived links for files and videos;
- regular backups, and restoring them tested;
- error monitoring, connection logs kept for one year, and updates of the software it relies on.
7. Sub-processors
The coach gives Goodform a general authorisation to use the sub-processors below. Each is bound by a contract that gives the same data protection guarantees as this agreement. Goodform remains responsible to the coach for them.
Before adding or replacing a sub-processor, Goodform tells every coach in the app and by email at least 30 days in advance. A coach who objects for a legitimate reason can say so to privacy@goodform.coach; if no solution is found, they can end their subscription at once, without paying for the periods that follow.
List last updated: 23 October 2026.
Sub-processors of Goodform Company What for Where the data is Transfer safeguards Supabase Database, sign-in and file storage European Union Standard contractual clauses Cloudflare Website and application hosting European Union and United States Data Privacy Framework and standard contractual clauses Stripe Online payments (clients’ purchases and the Goodform subscription) European Union and United States Data Privacy Framework and standard contractual clauses Brevo Emails and text messages European Union No transfer outside the EU Bunny.net Video hosting and playback European Union No transfer outside the EU Google Firebase Phone notifications European Union and United States Data Privacy Framework and standard contractual clauses Sentry Error reports European Union and United States Data Privacy Framework and standard contractual clauses WorkoutX Exercise library (receives no personal data) Not applicable No personal data sent Anthropic Data import and formatting United States and other countries Standard contractual clauses List of sub-processors last updated: 23 October 2026
8. Transfers outside the European Union
The database and the files are hosted in the European Union. When a sub-processor established outside the European Union may access data, the transfer is covered by an adequacy decision of the European Commission (EU–US Data Privacy Framework) or by the Commission’s standard contractual clauses.
9. Helping the coach with clients’ requests
Goodform gives the coach the tools to answer clients’ requests: a client can download their data and withdraw their health consent from the app; the coach can export their data and delete a client. If a client writes to Goodform directly about the coach’s data, Goodform forwards the request to the coach within 5 working days and does not answer it in the coach’s place, except to confirm that it was forwarded.
10. Personal data breaches
Goodform tells the coach of any personal data breach affecting their data without undue delay, and at most 48 hours after becoming aware of it, by email and in the app. The notice says, as far as known: what happened, the data and the number of people concerned, the likely consequences, the measures taken or proposed, and a contact. Goodform then helps the coach notify the CNIL within 72 hours and, if needed, inform the people concerned.
11. Other help
Goodform gives the coach the information they need for a data protection impact assessment or a prior consultation of the CNIL, about the processing Goodform carries out.
12. End of the agreement
This agreement lasts as long as the coach’s account. When the account is closed, the coach can export their data for 30 days. Goodform then deletes the data within 30 days, and its backups are erased automatically within a further 30 days. Goodform keeps only what the law obliges it to keep: invoices and credit notes, 10 years (article L123-22 of the French Commercial Code), with the client details printed on them.
13. Records and audits
Goodform keeps a record of the processing it carries out as a processor (GDPR art. 30.2), and gives the coach, on request to privacy@goodform.coach, the information needed to show that it meets its obligations. The coach can carry out an audit, or have an independent auditor bound by confidentiality carry one out, once a year, with 30 days’ written notice, at their own cost, without access to other coaches’ data.
14. Liability and applicable law
Each party is liable for its own breaches of the GDPR, as set out in article 82 of the GDPR and in the terms of use. This agreement is governed by French law. If this agreement and the terms of use disagree on data protection, this agreement prevails.