Privacy Policy

This Privacy Policy describes how Fitney Tecnologia Ltda. ("Fitney", "we") collects, uses, shares, and protects personal data from users ("Users", "you") of our fitness and nutrition SaaS platform.

This Policy applies to all services offered by Fitney, including:

• Institutional website (fitneyapp.com);
• Mobile application for iOS and Android;
• Administrative panel for professionals (backoffice);
• White-label applications generated for Premium plan professionals;
• APIs and backend services.

It is supplemented by our GDPR page and our Cookie Policy.

We recommend reading this Policy in full. By using the Platform, you confirm that you understand our data processing practices.

For the purposes of this Policy and applicable data protection laws:

• Fitney Tecnologia Ltda. is the controller of personal data of Professionals (personal trainers, nutritionists) who subscribe to the Platform;
• The Professional is the controller of their Clients' personal data, and Fitney acts as processor of such data;
• The Data Protection Officer (DPO) can be reached at suporte@fitneyapp.com.

This distinction is important for exercising rights: Clients should primarily direct requests to the Professional managing their data, although they may also contact Fitney directly.

We collect the following categories of personal data:

Registration Data

• Full name, email, phone number (with country code);
• CPF/CNPJ (for billing in Brazil);
• Professional registration or certification, when voluntarily provided by the User (e.g., CREF, CRN in Brazil; NASM, ACE, NSCA, RD in the USA; REPs, EREPS in Europe). This data is optional and is not verified by Fitney;
• Business address and billing information.

Health and Fitness Data (Sensitive Data)

• Body measurements (weight, height, circumferences);
• Health and fitness goals;
• Workout and exercise history;
• Nutritional data and meal plans;
• Progress photos (when voluntarily provided);
• Dietary restrictions and declared health conditions;
• Data imported from health platforms (Apple HealthKit on iOS and Health Connect on Android), including steps, heart rate, calories burned, distance traveled, and exercise sessions — only with the data subject's explicit consent, granted directly through the device's operating system;
• Health questionnaire (anamnesis): medical history, lifestyle, physical activity level, goals — voluntarily filled in by the Client or Professional.

Usage and Device Data

• IP address, browser type, and operating system;
• Pages accessed, time spent, and interactions;
• Geolocation data (IP-based on the website; GPS on the mobile app, when authorized, to record workout location);
• Device identifiers: device model, operating system version, app version, and unique device identifier;
• Push notification tokens (Firebase Cloud Messaging) for sending reminders and communications;
• Performance and diagnostic data collected by Firebase Crashlytics (crash reports, without personally identifiable data);
• Cookies and similar technologies — see our Cookie Policy.

Local Storage Data (Mobile App)

• API response cache (stored locally for up to 3 days for offline functionality);
• Offline operations queue (exercises, check-ins, and running sessions performed without a connection, automatically synced upon reconnection);
• Notification preferences and User settings;
• Recent notification history (last 10 received).

Payment Data

• Transaction data (amount, date, status);
• Last 4 digits and card brand (for identification);
• In-app purchase data via Apple App Store or Google Play, including transaction identifiers and subscription periods;
• Note: complete card data is processed directly by Stripe or local processors (Asaas in Brazil) and is never stored on our servers.

Communication Data

• Messages exchanged between Professionals and Clients on the Platform;
• Support communications and feedback.

Health data (nutrition/health professionals). When the professional uses the laboratory tests feature, we collect sensitive health data of the student/patient (requested tests, values and results, clinical indication) and, where provided, the patient's tax ID (CPF). This processing is detailed in the “Health Data (Laboratory Tests)” section.

Data from Integrations Connected by the User

If — and only if — the User authorises the connection (OAuth), we receive and store the following data on our servers. The connection can be removed at any time in the account settings, which stops any new data from arriving:

• Strava, Garmin, Polar, Fitbit, Oura and Whoop: workouts and activities (type, duration, distance, pace, route where available), heart rate, calories, steps, sleep and recovery metrics, as far as each provider exposes them;
• Google Calendar: events, times and availability, to sync the Professional’s appointment schedule.

Website Visitor and Lead Data

People who fill in a form on the website without creating an account also have data processed by us: name, email, phone, country, profession and the source of the visit (campaign, search term or referring site). We use this to reply to the enquiry and present the Platform, on the basis of legitimate interest and, for marketing communications, consent. Deletion can be requested at any time via the DPO email.

We process personal data based on the following legal grounds:

For sensitive data (health and fitness data), we primarily use specific and prominent consent from the data subject, as required by Art. 11 of the LGPD and Art. 9 of the GDPR.

We use your personal data for the following purposes:

• Service provision: creating and maintaining your account, providing contracted features, processing payments;
• Personalization: adapting the experience, workout recommendations, and features to your profile;
• Communication: sending service notifications, updates, security alerts, and (with consent) marketing communications;
• Security: detecting, preventing, and investigating fraud, unauthorized access, and malicious activities;
• Service improvement: analyzing usage patterns (in aggregate and anonymized form when possible) to improve features;
• Legal compliance: fulfilling tax, regulatory, judicial, and competent authority obligations;
• Support: responding to requests, complaints, and providing technical assistance.

Consultation reminders. The Platform may generate follow-up/consultation reminders that the professional can send to the student via WhatsApp; the message is sent by the professional.

We share personal data only in the situations below, always with appropriate safeguards:

Service Providers (Processors/Sub-processors)

• Infrastructure and hosting: Amazon Web Services (AWS — application and database), Cloudflare (CDN, hosting of the website and the web panels, file storage and protection), Upstash (queues and cache) and Sentry (error monitoring);
• Analytics and monitoring: Google Analytics 4 (via Google Tag Manager, with Consent Mode v2), Firebase Analytics and Firebase Crashlytics (stability reports), Microsoft Clarity (heatmaps);
• Push notifications: Firebase Cloud Messaging (Google);
• File storage: Cloudflare R2 (exercise photos, check-ins, assessments, documents and images uploaded by the User);
• Health: Apple HealthKit and Google Health Connect (local read/write only on device, data not transferred to Fitney servers);
• Payments: Stripe (international) and Asaas (Brazil — PIX and Boleto); Apple App Store and Google Play (in-app purchases);
• Transactional email: MailerSend and Resend (confirmations, billing notices and service notifications);
• Integrations connected by the User: Strava, Garmin, Polar, Fitbit, Oura, Whoop and Google Calendar. These connections only exist if the User authorises them (OAuth) and can be revoked at any time in the account settings;
• Support: customer service tools.

All providers are contracted with Data Processing Agreements (DPAs).

Professional-Client Sharing

Professionals have access to their Clients' data as necessary for service provision. Clients should review their Professional's privacy policy.

Legal Obligations

We may disclose data when required by law, court order, legal proceedings, or request from a competent governmental authority.

Corporate Transfers

In the event of a merger, acquisition, reorganization, or asset sale, data may be transferred, with prior notice and maintenance of protections.

Fitney does not sell personal data to third parties, as defined by the LGPD, GDPR, and CCPA/CPRA.

Professional's public page. If the professional enables the public presentation page, the data they choose to display (name, professional registration, specialties, service locations and contact) becomes publicly accessible while the page is active.

Third-party services and sub-processors

For some features, data may be shared with third-party services, strictly for the stated purpose:

• OpenStreetMap / Nominatim — map display and address geocoding (may involve the provided address and the visitor's IP).
• ViaCEP and Zippopotam.us — address auto-fill by postal code.
• Google Maps / Waze — when the visitor requests directions to a work location.
• WhatsApp (Meta) — when choosing to start contact/booking via WhatsApp.

These services have their own privacy policies, outside Fitney's control after the redirect/sharing.

The Professional’s team

The Professional may grant account access to members of their team (assistant, receptionist, intern or another professional) with permissions they define. Those people can view Student data according to the permissions granted. Fitney logs these accesses, but it is the Professional — as controller — who decides who gets in and who answers for confidentiality.

Fitney may transfer personal data outside the data subject's country of origin, in compliance with applicable laws:

Brazil to Abroad (LGPD, Arts. 33-36)

• To countries or organizations providing an adequate level of protection, as recognized by the ANPD;
• Through standard contractual clauses approved by the ANPD;
• With specific and prominent consent from the data subject;
• When necessary for contract performance.

EU/EEA to Abroad (GDPR, Arts. 44-49)

• To countries with an adequacy decision from the European Commission;
• Through EU Standard Contractual Clauses (SCCs);
• To the USA, under the EU-US Data Privacy Framework, where applicable;
• Transfer impact assessment (TIA) is conducted when necessary.

Canada, Australia and New Zealand

• Personal information of users in Canada, Australia and New Zealand is stored and processed outside those countries, mainly in the United States and Brazil;
• Fitney remains accountable for that information (PIPEDA Principle 4.1.3; Australian Privacy Principle 8; New Zealand Privacy Act 2020, IPP 12) and requires its service providers, by contract, to protect it to a comparable standard;
• Information held abroad may be accessible to courts and authorities of the country where it is stored.

Our primary servers are located in the United States (Amazon Web Services), with file storage and CDN on Cloudflare’s global network, always under appropriate technical and organizational security measures.

We retain personal data only for the period necessary to fulfill the purposes described in this Policy:

At the end of the retention period, data is deleted or irreversibly anonymized.

Depending on your location, you have the following rights over your personal data:

Rights under the LGPD (Brazil)

Under Arts. 17-22 of the LGPD, you have the right to:

• Confirmation of data processing;
• Access to personal data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary or excessive data;
• Data portability;
• Deletion of data processed based on consent;
• Information about sharing with third parties;
• Withdrawal of consent;
• Objection to processing.

Rights under the GDPR (EU/EEA)

Under Arts. 15-22 of the GDPR, you have the right to:

• Access (Art. 15);
• Rectification (Art. 16);
• Erasure / "right to be forgotten" (Art. 17);
• Restriction of processing (Art. 18);
• Portability (Art. 20);
• Objection (Art. 21), including objection to direct marketing;
• Not to be subject to automated decisions (Art. 22);
• Lodge a complaint with the competent supervisory authority.

Rights under CCPA/CPRA (California, USA)

• Right to know what data is collected and how it is used;
• Right to delete personal data;
• Right to correct inaccurate data;
• Right to opt-out of the sale/sharing of data;
• Right to limit the use of sensitive data;
• Right not to be discriminated against for exercising your rights.

Rights in Canada, Australia and New Zealand

Under PIPEDA (Canada), the Australian Privacy Principles (Privacy Act 1988) and the New Zealand Privacy Act 2020, you have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate, incomplete or outdated information;
• Withdraw consent, subject to legal or contractual restrictions;
• Know how your information is used, disclosed and stored outside your country;
• Complain about how we handle your information.

Health and fitness information (weight, measurements, photos, meal plans, health questionnaires) is treated as sensitive information and is collected only with your consent and for the services you use.

Fitney does not sell or share personal data for cross-context behavioral advertising purposes, as defined by the CPRA.

To exercise your rights, contact us at suporte@fitneyapp.com. We will respond within 15 days (LGPD), 30 days (GDPR), or 45 days (CCPA); requests from Canada, Australia and New Zealand are answered within 30 days.

How to request a copy or the portability of your data: email suporte@fitneyapp.com with the subject “Data export” and the email registered on the account. Once we have verified your identity, we deliver a file in a structured, machine-readable format (JSON or CSV) within the timeframes above, free of charge.

There is no automated export. The Platform currently has no button that generates this file: the request is handled manually by our team, from the email address above. The reports and PDFs the Professional generates in the dashboard (workout, diet, assessment) are not a substitute for this full export.

We implement technical and organizational measures to protect your personal data, including:

• Encryption: data in transit protected by TLS 1.3; sensitive data encrypted at rest (AES-256);
• Access control: multi-factor authentication, principle of least privilege, access logs;
• Infrastructure: servers in certified data centers (SOC 2 Type II, ISO 27001);
• Monitoring: intrusion detection, 24/7 monitoring, and automatic alerts;
• Backup: encrypted backups with regular retention and restoration testing;
• Staff: regular security and privacy training for all employees;
• Testing: periodic vulnerability assessments and security reviews.

No system is 100% secure. In the event of a security incident, we will notify competent authorities (ANPD, European data protection authorities) and affected data subjects within legal timeframes.

The Platform is not directed at minors under 18 years of age. Minors under 18 may only use the Platform with verifiable consent from a legal guardian.

• Brazil (LGPD, Art. 14): children's data (up to 12 years) only with specific and prominent consent from at least one parent or legal guardian. Adolescents (12-17): consent from legal guardian;
• EU (GDPR, Art. 8): consent of minors under 16 (or lower age defined by the Member State, minimum 13) requires authorization from the holder of parental responsibility;
• USA (COPPA): we do not knowingly collect data from minors under 13. If we become aware, we will delete the data immediately.

If you believe a minor's data has been collected without authorization, contact suporte@fitneyapp.com.

We use cookies and similar technologies to operate the Platform, analyze usage, and personalize the experience. For detailed information, please see our Cookie Policy.

Summary:

• Essential cookies: necessary for website operation (no consent required);
• Analytics cookies: to understand how the Platform is used (require consent);
• Marketing cookies: to personalize ads (require consent).

You can manage your cookie preferences at any time through the cookie banner or your browser settings.

Fitney may use automated processing to:

• Recommend workouts and meal plans based on the Client's profile;
• Detect anomalous usage patterns for security;
• Personalize the experience on the Platform.

These recommendations are auxiliary and always subject to Professional review. We do not make decisions that produce legal effects or significantly affect the data subject based solely on automated processing.

Under Art. 20 of the LGPD and Art. 22 of the GDPR, you have the right to request a review of automated decisions and to obtain information about the criteria and procedures used.

When using the laboratory tests feature, the Platform processes sensitive personal data relating to the health of the student/patient, in accordance with applicable data protection laws (including the EU GDPR and Brazil's LGPD – Law No. 13.709/2018). Such data may include: requested tests, test values and results, clinical indication/notes and, where provided, the patient's tax ID (CPF).

Purpose and legal basis. This data is processed exclusively for the provision of nutritional/clinical follow-up services by the professional linked to the student, based on the data subject's consent and/or the protection of health.

Access. The student's health data is accessible only to the professional(s) linked to them on the Platform and to authorized Fitney personnel, strictly for operation and support.

Sharing. Fitney does not sell or share health data with third parties for marketing purposes. Any attached files are stored in a restricted manner.

Retention and rights. The data is retained for as long as the professional-student relationship lasts or as legally required. The data subject may exercise the rights provided by applicable law (access, correction, deletion, portability, withdrawal of consent) as described in the Contact/DPO section.

When using the lab exam features, the Platform may store and process sensitive personal health data of the student/patient (requests, results and exam values), under art. 11 of the LGPD and art. 9 of the GDPR where applicable.

• This data is processed on behalf of the professional (controller), with Fitney acting as processor, for the purpose of monitoring the student/patient.
• Processing requires an appropriate legal basis, including, where required, the data subject's specific, highlighted consent.
• Technical and organizational safeguards apply, and data is retained only for as long as necessary or as legally required.

Roles. This data is processed on behalf of and under the instructions of the Professional, who is the controller, with Fitney acting as processor — including for the purposes of Art. 9 GDPR where applicable. Technical and organisational safeguards are applied and the data is retained only for as long as the purposes or a legal obligation require.

The Platform offers a consultation reminders feature, which uses the Student's registered phone number to help the Professional remind them of their appointments and ongoing follow-up.

Manual sending. By default, Fitney generates a message and a link (WhatsApp) that allows the Professional to contact the Student; the message is sent by the Professional themselves, from their own account.

Automatic sending. When the Professional enables automatic sending and connects their WhatsApp Business account, reminder messages may be sent to the Student on the Professional's behalf, processed by the Platform. In this case, the Student's prior consent is mandatory and is recorded, and may be revoked at any time in the account settings.

You can manage your preference for receiving these reminders at any time in your account settings. The processing of the phone number for this purpose follows the legal bases described in the legal bases section.

If the professional enables their public page, the information they choose to publish (name, photo, bio, specialties, registrations, certifications, work locations and social networks) becomes public and accessible to anyone, including search engines. The office address is only shown if the professional enables that option.

We may update this Policy periodically. Substantial changes will be communicated with 30 days' advance notice via:

• Email to registered Users;
• Notification on the Platform;
• Update of the "Last updated" date on this page.

For changes requiring new consent (e.g., new purposes for sensitive data processing), we will request specific consent before implementation.

We recommend reviewing this Policy periodically.

For questions, requests, or complaints about this Policy or the processing of your personal data:

• Data Protection Officer (DPO): suporte@fitneyapp.com
• Address: Fitney Tecnologia Ltda., CNPJ 69.612.408/0001-10, R. Paulo Setubal, 5081, Casa 54 — Boqueirão, Curitiba, PR, CEP 81750-190, Brazil

If you are not satisfied with our response, you may file a complaint with the competent data protection authority:

• Brazil: National Data Protection Authority (ANPD) — gov.br/anpd
• EU: Data protection authority of your country of residence
• USA (California): Office of the Attorney General of California
• Canada: Office of the Privacy Commissioner of Canada — priv.gc.ca
• Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
• New Zealand: Office of the Privacy Commissioner — privacy.org.nz