Mywellness Coaching

GDPR overview

Implementation is explicit and unusually detailed. The privacy policy is built on EU Regulation 2016/679 and cites legal bases article by article, including Article 6(1)(b) for contractual processing and Article 9(2)(a) for health data. A Data Protection Officer is appointed and reachable at dpo@technogym.com, with a postal route to the Cesena head office. Data subject rights are enumerated: access, rectification, erasure, portability, restriction and objection, the latter available at any time against marketing and legitimate-interest processing. Transfers outside the European Union are said to rely on specific safeguards, although no country, mechanism or standard clause is named. As the publisher is established in Italy, no Article 27 representative is required or designated. Under-16s may hold an account only with parental authorisation.

Who owns the data?

Technogym S.p.A., based in Cesena, Italy, is named as the data controller, but its role shifts with the relationship. For someone who simply trains at a facility using the platform, Technogym acts only as a processor on that facility's behalf, and the member's relationship is with the facility itself. For someone holding a Technogym Account, or who links facility data through the optional Join Facility feature, Technogym becomes an independent controller. Local branches and distributors act as joint controllers for sales and service matters. Deleting a Technogym Account does not withdraw data already shared with a facility; that has to be requested from the facility under its own policy.

Reuse rights

Training data feeds the personalisation engine directly rather than being handed back to the user. Technogym analyses physical characteristics, workout performance, the equipment available and the goals declared, and generates programmes automatically from stated criteria: age and gender, current fitness and training frequency, interests, and results already achieved. Health-related data such as weight, body composition and heart rate is processed on the basis of consent under Article 9(2)(a) of the GDPR. Marketing profiling is kept separate, rests on explicit consent, can be withdrawn at any time and looks back over seven years of interactions, with minors' data excluded from it. Declining training profiling is not a partial opt-out: the personalised training ecosystem then becomes unavailable, because the service is described as inherently individualised.

Data retention & training

Hosting summary

The site publishes no hosting jurisdiction. Neither a country nor a broad region is named anywhere in the privacy policy, the cookie policy or the terms of use, and there is no trust or security page. The only relevant statement is that transfers of data to third parties based outside the European Union are made in compliance with EU Regulation 2016/679, by adopting specific measures to legitimise the transfer to third countries. No standard contractual clauses, adequacy decision or named mechanism is cited, and no subprocessor list is published. What can be said with confidence is limited: the publisher is established in Italy, the data controller is an EU entity, and a Data Protection Officer is appointed. Buyers with a hosting-location requirement should treat this as an open point to settle contractually, since nothing on the public site answers it.