Privacy Policy
How Fitness Pro collects, encrypts, processes, and safeguards your personal identity, workout performance, progress photos, and biometric health metrics.
Your fitness journey is deeply personal. Fitness Pro does not sell, rent, monetize, or broker your personal information, workout history, progress photos, or biometric health metrics to third-party data brokers, insurers, or advertising networks. We process your data exclusively to deliver your athletic dashboard, coach collaboration, and precision tracking.
1. Data Controller & DPO Identity
For the purposes of the General Data Protection Regulation (EU GDPR), the UK Data Protection Act 2018, and the California Consumer Privacy Act (CCPA/CPRA), the data controller is Fitness Pro Inc., operating in Dublin, Ireland.
We have appointed a designated Data Protection Officer (DPO) who can be contacted directly regarding all data protection, consent, or erasure inquiries at dpo@fitnesspro.app.
2. Categories of Information We Collect
A. Account & Profile Identity
Full name, email address, encrypted authentication credentials (managed via Firebase Auth), profile photo, user role (Athlete, Personal Trainer, Superadmin), and invite code redemption records.
B. Special Category Health & Biometric Data (GDPR Art. 9)
Under European privacy law, fitness and biometric telemetry are classified as special category data requiring your explicit opt-in consent:
- Physical Metrics: Current body weight, target weight, age, height, body fat percentage, and historical weight trend logs.
- Performance Telemetry: Workout logs, sets, reps, load in kilograms/pounds, RPE intensity ratings, completion timestamps, and exercise notes.
- Nutrition & Habits: Daily calorie intake, macro breakdowns (protein, carbohydrates, fats), barcode scan history via OpenFoodFacts, water intake (litres), sleep hours, and step counts.
- Progress Imagery: Visual front/side/back physique photos uploaded for coach check-in reviews.
C. Device, Wearables & Network Telemetry
IP addresses, device model, operating system, browser user-agent, Firebase Cloud Messaging (FCM) web push notification tokens, and simulated or connected Apple HealthKit / Google Fit daily sync metrics.
3. Legal Bases for Processing Data (GDPR)
We process your data under the following lawful bases:
- Explicit Consent (Art. 9(2)(a)): You give explicit consent for us to store and process your health metrics, weight logs, and progress check-in photos when you track them in the app.
- Contractual Performance (Art. 6(1)(b)): Necessary to deliver your account, sync workouts assigned by your coach, and maintain real-time chat.
- Legitimate Interests (Art. 6(1)(f)): Securing the application against bot attacks, detecting fraud, maintaining server performance, and diagnosing software crashes.
- Legal Compliance (Art. 6(1)(c)): Retaining transaction and billing records for tax and statutory accounting obligations.
4. Artificial Intelligence & Google Gemini Integration
Fitness Pro utilizes Google Gemini API models to deliver AI features, such as estimating nutritional macros from meal descriptions and assisting coaches with template suggestions.
- No Public Foundation Model Training: Your private fitness logs, weight trends, and progress photos are NOT used to train, retrain, or improve public foundation AI models.
- Stateless Prompts: Information sent to Google Gemini is transmitted via encrypted enterprise API endpoints strictly for inference execution, following Google Cloud's enterprise data governance standards.
5. Third-Party Service Providers & Sub-Processors
We work with trusted infrastructure providers who adhere to strict data security agreements:
6. Data Security & Encryption Standards
We employ defense-in-depth technical and organizational measures to ensure a level of security appropriate to the sensitivity of health data:
- Encryption in Transit: All web traffic is enforced over TLS 1.3 encryption with HTTP Strict Transport Security (HSTS).
- Encryption at Rest: Database records in Firestore and uploaded photos in Firebase Cloud Storage are encrypted using 256-bit Advanced Encryption Standard (AES-256).
- Granular Security Rules: Strict server-side security rules enforce role-based access control, ensuring athletes only access their own data and coaches only access their assigned roster.
7. Data Retention & Permanent Deletion
We retain your fitness records and photos for as long as your account remains active. If you discontinue using Fitness Pro, you may request complete account deletion at any time.
Upon an account deletion request, our automated purge protocols permanently erase your user profile, assigned workouts, weight logs, check-in records, and delete all stored progress photo files from Cloud Storage within thirty (30) days, except where legal or financial audit retention is strictly required by law.
8. Your Legal Rights (GDPR & CCPA/CPRA)
Under international privacy regulations, you have enforceable legal rights regarding your personal data:
To exercise any of these rights, email our Data Protection Officer at dpo@fitnesspro.app with the subject line "Data Rights Request". We respond within thirty (30) days without fee.
9. Children's Privacy
Fitness Pro does not knowingly collect or solicit personal information from children under the age of 16 without parental authorization. If we discover we have inadvertently received data from a minor without verifiable parental consent, we will promptly delete that information.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect technological enhancements, operational changes, or new regulatory requirements. If we make material modifications, we will notify you through an in-app banner or via email prior to the changes taking effect.