This Privacy Policy explains how FitClients processes personal data when you visit fitclients.com, when you use the FitClients platform as a coach, and when you use the FitClients mobile app as a client of a coach. It also describes the rights you have over your data and how to exercise them.

1. Who we are and how to contact us

The controller responsible for the processing described in this policy (except where Section 2 says otherwise) is SIA FitClients (referred to as “FitClients,” “we,” or “us”), a limited liability company registered in the Republic of Latvia.

• Registration number: 40203729651
• VAT number: LV40203729651
• Registered address: Beberbeku Street 46, Riga, LV-1029, Latvia
• Privacy inquiries: developer@fitclients.com

When processing personal data, FitClients complies with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”), as well as other applicable laws in the field of privacy and data protection.

2. Who this policy covers and our role

FitClients is used by three groups of people, and our GDPR roles differ slightly between them.

Website visitors

If you browse fitclients.com, submit a contact or demo form, or interact with our marketing, FitClients is the data controller for that data.

Coaches

Coaches are personal trainers and coaching businesses that subscribe to the FitClients platform. For the coach account, billing, and usage data, FitClients is the data controller.

Clients of coaches

Clients are the people who train with a coach and use the FitClients mobile app. FitClients was built so that your coach can see and work with the data you record – your profile, training plans, workout and nutrition logs, health metrics, progress photos, and messages are visible to the coach you are connected to.

For this coaching data, your coach decides how it is used in your training and acts as a data controller, while FitClients processes it on the coach’s behalf as a data processor. For the data needed to run the app itself – your account, in-app purchases, app analytics, security, and legal compliance – FitClients acts as an independent data controller.

If you have questions about how your coach uses your data, contact your coach directly. You can always contact us, and we will help or pass your request to your coach where appropriate.

3. Personal data we collect

3.1 Website visitors

• Forms. When you submit a contact, demo, or sales form, we collect your name, email address, the details you choose to share about your coaching business (for example, how many active clients you have), and your message.
• Cookies and tracking. With your consent, we collect usage and advertising data through cookies and similar technologies, described in Section 9.
• Server logs. Our hosting infrastructure records technical data, such as IP addresses, browser types, and requested pages, for security and troubleshooting.

3.2 Coaches

• Account and business data. Name, email address, password (stored hashed), business name, branding assets such as your logo, and settings.
• Billing data. Coach subscriptions are billed through Stripe. We receive your subscription status, invoicing details, billing country, and VAT number where applicable. Full card numbers are handled by Stripe and never reach or get stored on FitClients systems.
• Content. Training programs, exercise videos, nutrition plans, and other materials you upload, plus your messages with clients.
• Support communications. Messages you exchange with us by email or through the platform.

3.3 Clients using the FitClients app

• Account and identity. Email address, first name, avatar photo, timezone, password (hashed before it leaves your device and stored hashed on our servers), and the coach your account is connected to. If you sign in with Google or Apple, we receive your Google or Apple user ID, email address, and given name.
• Onboarding questionnaire. Gender, age, height, current weight, target weight, fitness goal, activity level, diet type, workout frequency, and desired weekly weight change. We use this to estimate your recommended calorie intake.
• Health and fitness data you log. Body weight history, water intake, food diary entries with optional food photos, completed workouts (including duration, estimated calories, and intensity), per-exercise strength logs (repetitions and weights), and habit completions.
• Data from connected health services. With your permission, the app reads data from Apple HealthKit (step count, active energy burned, heart rate, resting heart rate, heart rate variability, VO2 max, workouts, and sleep analysis) or Android Health Connect (steps, calories burned, exercise sessions, and sleep). This data is uploaded to FitClients’ servers so it can be displayed in your dashboards and shared with your coach. Section 11 explains the rules we apply to this data.
• Photos, media, and voice. Progress photos you upload, your avatar, food photos taken for calorie estimation, and the messages you exchange with your coach – including text, images, videos, and voice recordings.
• Barcode scans. When you scan a food product, the barcode number is used to look up the product (see Section 5), and the product name and brand are saved to your food diary.
• Purchases. App subscriptions are purchased through the Apple App Store or Google Play. Apple or Google processes the payment; we receive a receipt or purchase token to verify your subscription. We never receive your card details.
• Technical and usage data. App usage events such as screens viewed, buttons tapped, and sign-in method (via Google Firebase Analytics); crash and error reports including app version, operating system, and the failing request (via Sentry); your push notification token; and your device language and timezone.

4. Why we process data and on what legal basis

We process personal data only where a legal basis under the GDPR applies. The table below summarizes our purposes and the corresponding bases.

Purpose	Legal basis
Creating and managing accounts, delivering the platform and app, and enabling coach–client messaging	Performance of a contract – Article 6(1)(b)
Processing health and fitness data for tracking, coaching, calorie estimation, and progress dashboards	Your explicit consent – Article 9(2)(a), together with Article 6(1)(b)
AI-based food analysis and barcode product lookups	Performance of a contract – Article 6(1)(b); consent where required
Subscriptions, billing, invoicing, and VAT handling	Performance of a contract – Article 6(1)(b); legal obligation – Article 6(1)(c), including the Latvian Accounting Law
Responding to inquiries submitted on the website	Steps prior to entering a contract – Article 6(1)(b); legitimate interests – Article 6(1)(f)
Measuring and improving how the app is used	Legitimate interests – Article 6(1)(f)
Website analytics and advertising measurement (cookies)	Your consent – Article 6(1)(a)
Sending service and transactional emails	Performance of a contract – Article 6(1)(b)
Security, abuse prevention, and troubleshooting	Legitimate interests – Article 6(1)(f)
Complying with legal obligations and lawful requests from authorities	Legal obligation – Article 6(1)(c)

Where we rely on legitimate interests, we have assessed that our interest in running a secure, reliable, and improving service does not override your rights and freedoms. You can object to processing based on legitimate interests at any time (see Section 10).

5. AI features and barcode lookups

Food photo and description analysis. When you photograph a meal or describe it in the food diary, the image or text is sent from our servers to OpenAI, which returns an estimated nutritional breakdown. Under our agreement with OpenAI, this data is not used to train OpenAI’s models.

Barcode lookups. When you scan a product barcode, the barcode number is sent to OpenFoodFacts and UPCitemdb to identify the product. Only the barcode number is shared with these services.

No automated decision-making. FitClients does not make automated decisions about you that produce legal or similarly significant effects. Calorie and nutrition estimates are for informational purposes, and your coach can review and adjust your plan at any time.

6. Who receives your data

We do not sell or share personal data with data brokers. Beyond your coach – the core recipient the service is built around – we share personal data only with service providers that help us run FitClients, under contracts that restrict how they may use it.

Recipient	Purpose	Location
Your coach	Coaching – sees your profile, plans, logs, health metrics, progress photos, and messages	The coach’s own location
Amazon Web Services	Hosting and media storage	EU (Ireland)
Google (Firebase)	App analytics, sign-in, and push notifications	EU / US
Google (Analytics and Ads)	Website analytics and advertising measurement	EU / US
Meta Platforms	Advertising measurement on the website (Meta Pixel)	EU / US
Stripe	Coach subscription payments and EU VAT handling	EU / US
Apple and Google	Sign-in and in-app purchases in the mobile app	EU / US
OpenAI	Food photo and description analysis	US
OpenFoodFacts and UPCitemdb	Barcode product lookups	EU (France) / US
Sentry (Functional Software)	Crash and error reporting	US
Twilio SendGrid	Transactional email delivery	US

We may also disclose personal data to professional advisers, or to courts and public authorities, where the law requires it or where necessary to establish, exercise, or defend legal claims. If FitClients is involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to this policy.

7. International data transfers

Our servers and media storage are located in the European Union (AWS, Ireland). Some of the service providers listed in Section 6 process data in the United States – including Google, Meta Platforms, OpenAI, Sentry, Twilio SendGrid, UPCitemdb, Apple, and Stripe’s US entities.

Where personal data is transferred outside the European Economic Area, we rely on safeguards recognized by the GDPR: an adequacy decision such as the EU–US Data Privacy Framework, where the recipient is certified, or the European Commission’s Standard Contractual Clauses, together with additional measures where needed. You can request a copy of the relevant safeguards by contacting us at developer@fitclients.com.

8. How long do we keep personal data

We keep personal data only for as long as it is needed for the purposes described in this policy, or for as long as the law requires.

Data	Retention period
Account and profile data (coaches and clients)	While your account is active, then deleted within 30 days of account deletion
Health and fitness logs, progress photos, chat history, and media	While your account is active; removed as part of account deletion
Backup copies	Overwritten or purged within 90 days of deletion
Website inquiries (contact and demo forms)	Up to 2 years after our last exchange
Invoices and accounting records	5 years, as required by the Latvian Accounting Law
Website analytics data (Google Analytics)	Up to 14 months
Crash and error reports (Sentry)	90 days

To determine retention periods, we apply the following criteria: how long the data is needed to perform the contract with you, how long a storage obligation set out in laws and regulations applies, and how long consent remains valid where consent is the legal basis and no other basis applies.

9. Cookies and website tracking

Cookies are small files placed on your device when you visit a website. On fitclients.com, we use both first-party and third-party cookies. Non-essential cookies are set only after you give consent through the cookie banner, and you can change or withdraw your choice there at any time.

Category	What it does	Basis
Essential	Keeps the site working – sessions, security, form submission, and remembering your cookie choices	Not consent-based; required for the site to function
Analytics	Google Analytics 4 measures visits, traffic sources, and how pages are used, in aggregated form. IP addresses are used briefly to derive approximate location and are not logged or stored by Google Analytics 4.	Consent
Advertising	The Meta Pixel measures conversions from Meta ads and supports audience building. Google Ads tags measure conversions and enable remarketing.	Consent

For data collected and transmitted through the Meta Pixel, FitClients and Meta Platforms Ireland Limited act as joint controllers for the collection and transmission stage; Meta is independently responsible for its subsequent processing, as described in Meta’s Privacy Policy.

You can control cookies in several ways: through our cookie banner, in your browser settings, with the Google Analytics opt-out add-on, in your Google Ads Settings, in your Meta ad preferences, and at youronlinechoices.eu. General information about cookies is available at aboutcookies.org.

The FitClients mobile app does not show ads and does not use cookies. App analytics are described in Sections 3.3 and 4.

10. Your rights

These rights apply to any natural person whose personal data FitClients processes, regardless of how the data was provided – on the website, in the app, by email, or otherwise. Under the GDPR, you have the right:

• to access your personal data and receive information about how it is processed, free of charge;
• to have inaccurate or incomplete data rectified – most profile and log data can be edited directly in the app;
• to have your data erased, including through the in-app account deletion described in Section 13;
• to restrict processing in the situations set out in Article 18 of the GDPR;
• to receive your data in a structured, commonly used, machine-readable format and to have it transmitted to another controller (data portability);
• to object to processing based on our legitimate interests;
• to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. For health data, Section 11 describes how.

To exercise these rights, email developer@fitclients.com. We will verify your identity before releasing your personal data, so that your information is not disclosed to anyone else. We respond within one month of receiving your request. If your request is complex or we receive a large number of requests, we may extend it by up to 2 further months, and we will inform you of the extension within the first month.

You also have the right to lodge a complaint with a supervisory authority – in Latvia, the Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv) – or with the supervisory authority in the EU member state where you live or work.

11. Health data and connected services

Much of the data described in Section 3.3 – body weight, food diaries, workout logs, heart rate, sleep, and progress photos – is health data, a special category of personal data under Article 9 of the GDPR. We process it only with your explicit consent, which you give in the app, and only to provide the tracking, coaching, and estimation features described in this policy.

Connecting Apple HealthKit or Android Health Connect is optional. If you connect them, the data types listed in Section 3.3 are uploaded to FitClients servers so they can appear in your dashboards and be visible to your coach. We do not use data obtained from Apple HealthKit or Android Health Connect for advertising, marketing, or use-based data mining; we do not sell it, and we do not share it with third parties other than your coach and the processors listed in Section 6 acting on our instructions.

You can withdraw consent at any time: disconnect HealthKit access in your iPhone’s Settings under Privacy & Security → Health, manage permissions in the Health Connect app on Android, or stop logging data in FitClients. You can also delete individual entries in the app or delete your account entirely (Section 13).

12. Children

FitClients is not directed at children. You must be at least 16 years old to create a FitClients account. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us at developer@fitclients.com, and we will delete it.

13. Deleting your account

Clients can delete their account directly in the FitClients app under Settings → Delete Account. Deleting your account removes your profile, health and fitness logs, progress photos, chat history, and uploaded media from our production systems within 30 days; backup copies are purged within 90 days. Coaches can request deletion of their account and workspace by writing to developer@fitclients.com. Both clients and coaches can also submit a request on our account deletion page.

Some records are kept longer where the law requires it – for example, invoices and accounting records under the retention periods in Section 8.

14. How we protect data

We protect personal data with technical and organizational measures appropriate to the risk, taking into account the state of the art and the nature of the data we process. All traffic between the app, the website, and our servers is encrypted in transit. Access to our systems is authenticated with signed tokens; passwords are stored hashed and additionally hashed before they leave your device; and on your device, credentials are kept in the operating system’s secure keychain. Data and media are hosted with AWS in the European Union, and access to personal data is limited to authorized personnel who need it to operate the service.

No method of transmission or storage is completely secure. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you directly where possible, publish the information on our website, and report the breach to the supervisory authority as required by the GDPR.

15. Changes to this policy

We may revise this Privacy Policy from time to time to reflect changes in our practices, features, or legal requirements. The current version, with its “Last updated” date, is always published on this page. If a change materially affects how your personal data is processed, we will notify you through the app, by email, or through another appropriate channel before the change takes effect.

16. Contact

If you have any questions or comments about this policy or about how your personal data is handled, contact us at developer@fitclients.com or by post at SIA FitClients, Beberbeku Street 46, Riga, LV-1029, Latvia. Section 10 describes the timelines for our responses to privacy requests.