In short: DNI Studios is software sold to personal training studios. When a studio uses it to manage its clients, the studio decides what happens to that client data — we only hold and process it on the studio's instructions. This policy explains what we collect, why, who we share it with, and the rights you have.
1. Who we are
DNI Studios is operated by DNI Ltd, trading as DNI Analytics, a company registered in England and Wales under company number 15630271, with its registered office at 78a Deacon Road, London NW2 5QJ ("we", "us", "our"). We can be contacted at darshan.mashru@dnianalytics.com.
This policy covers our website at dnianalytics.com and our application at app.dnianalytics.com (together, the "Service").
2. Two different roles we play
Data protection law distinguishes between the party that decides why personal data is processed (the "controller") and the party that processes it on someone else's instructions (the "processor"). We are one or the other depending on whose data it is:
| Data | Our role | What that means |
|---|---|---|
| Studio account data — the studio owner and their trainers, billing details, website visitors, enquiries | Controller | We decide how this is used, and this policy governs it. |
| Client data — the training clients a studio manages inside the app, including their health and fitness records | Processor | The studio is the controller. They decide what is collected and why. We act on their instructions. If you are a training client, ask your studio for their privacy notice — it, not this one, governs their use of your data. |
3. What we collect
Account information
- Name, email address and role (studio owner, trainer, or client)
- Password — stored only as a secure one-way hash, never in readable form
- The studio you belong to, and your permissions within it
- Profile photo or avatar, if you upload one
Health and fitness information
Where a studio uses the relevant features, the app stores information about training clients that may include:
- Date of birth, gender, height and body weight
- Body measurements, body composition and progress photos
- Workout logs, exercise history, form-check video clips and voice notes
- Daily wellness logs — steps, sleep, mood, energy, water intake
- Food and nutrition logs, including calories and macronutrients
- Training goals, and any notes a trainer records, which may include injuries or medical limitations
Most of the above is special category data (health data) under UK GDPR, which carries extra protection. We process it only on the documented instructions of the studio that holds the client relationship. It is the studio's responsibility to obtain the client's explicit consent, or establish another lawful basis, before entering it.
Operational information
- Session bookings, attendance and schedules
- Payment records — amounts, dates and status. We never see or store full card numbers; card payments are handled by Square (see section 6)
- Leads and enquiries a studio records in its CRM
- Messages between a client and their trainer, and conversations with the in-app AI Coach
- Community feed posts, comments and follows, where a studio enables that feature
Technical information
- IP address, browser type, device type and operating system
- Pages visited, features used and approximate timing, via our analytics provider
- Error and crash diagnostics
- Push notification subscription tokens, if you enable notifications
Marketing information
If you join the waitlist or contact us through the website, we collect your name, email address and anything you choose to tell us.
4. Why we process it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the Service, authenticating you, and keeping your account working | Performance of a contract |
| Sending service emails — password resets, booking confirmations, account notices | Performance of a contract |
| Security, fraud prevention, abuse detection and rate limiting | Legitimate interests — protecting the Service and its users |
| Product analytics to understand which features are used and fix problems | Legitimate interests — improving the Service |
| Non-essential cookies and similar technologies | Consent |
| Marketing emails to prospective customers | Consent, or legitimate interests for existing business contacts |
| Meeting our legal, tax and accounting obligations | Legal obligation |
| Health and fitness data held for a studio | Processed on the studio's instructions; the studio is responsible for the lawful basis, normally explicit consent |
Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that already took place.
5. Artificial intelligence features
The app includes an AI Coach. When you use it, the content of your message and relevant context from your account are sent to Anthropic, our AI provider, to generate a response.
- Anthropic acts as our sub-processor and is contractually restricted in what it may do with the data.
- Your data is not used to train AI models.
- AI output is generated automatically and is not medical, nutritional or professional advice. See our Terms of Service.
- No decision producing legal or similarly significant effects is made about you by automated means alone.
If you would rather not have your information sent to an AI provider, simply do not use the AI Coach feature. The rest of the app works without it.
6. Who we share data with
We do not sell personal data, and we never have. We share it only with service providers who help us run the Service, each bound by a contract that limits them to our instructions:
| Provider | What they do | Where |
|---|---|---|
| MongoDB Atlas | Database hosting — stores your account and app data | EU / UK region |
| Render | Application hosting | EU / US |
| Vercel | Marketing website hosting | Global edge network |
| Anthropic | Powers the AI Coach | US |
| PostHog | Product analytics | EU / US |
| Resend | Sends transactional email | EU / US |
| Square | Card payment processing, where a studio connects its own Square account | US / EU |
| Open Food Facts | Food and nutrition database lookups. Only your search term is sent — never your identity or logs | EU |
We may also disclose personal data where we are legally required to, to enforce our agreements, or to protect the rights and safety of any person. If our business is sold or merged, data may transfer to the buyer, who will remain bound by this policy.
7. International transfers
Some providers above are located outside the UK, principally in the United States. Where personal data leaves the UK, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy decision. You can request details of the safeguards used by emailing us.
8. How long we keep it
- Account data — for as long as the account is active, then up to 90 days after closure to allow recovery.
- Client data held for a studio — for as long as the studio instructs. On termination we delete or return it within 90 days, unless the law requires otherwise.
- Payment and invoice records — 7 years, to meet UK tax and accounting requirements.
- Analytics data — up to 24 months.
- Marketing contacts — until you unsubscribe, then we keep a suppression record so we do not contact you again.
9. How we protect it
- All traffic is encrypted in transit using TLS.
- Passwords are stored as salted one-way hashes and are never recoverable in readable form.
- Access is controlled by role-based permissions, so trainers only see what their studio allows.
- Studio data is logically separated, so one studio cannot access another's records.
- Rate limiting and standard security headers guard against common attacks.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours, and you directly where the risk is high.
10. Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you
- Rectify data that is inaccurate or incomplete
- Erase your data, in certain circumstances
- Restrict or object to processing, including direct marketing, which you can object to at any time
- Portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time where consent is the basis we rely on
Email darshan.mashru@dnianalytics.com to exercise any of these. We respond within one month. We do not charge a fee unless a request is manifestly unfounded or excessive.
If you are a training client, send your request to your studio first — they control your data and we are obliged to refer you to them. If you contact us directly we will pass your request on and tell you we have done so.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve it first.
11. Children
The Service is not intended for anyone under 16, and we do not knowingly collect their data directly. A studio training an under-16 client is responsible for obtaining appropriate parental or guardian consent before entering that client's information. If you believe a child's data has been provided to us improperly, contact us and we will delete it.
12. Cookies
See our Cookie Policy for what we store on your device and how to control it.
13. Changes to this policy
We may update this policy as the Service develops or the law changes. The "last updated" date at the top always reflects the current version. If a change materially affects your rights we will notify account holders by email or in-app notice before it takes effect.
14. Contact
DNI Ltd (trading as DNI Analytics), registered in England and Wales, company number 15630271.
Registered office: 78a Deacon Road, London NW2 5QJ.
Email: darshan.mashru@dnianalytics.com