Fytkit Privacy Policy

Draft for legal review. Not yet in force. Bracketed items must be completed before publication.

Effective date: [EFFECTIVE DATE]

1. Who we are

1.1 Fytkit is software that fitness studios use to coach their members online. This policy explains how [FYTKIT LEGAL ENTITY] ("Fytkit", "we", "us"), company number [COMPANY NUMBER], of [REGISTERED ADDRESS], uses personal information when we decide how and why it is used — that is, when we are the controller.

1.2 You can contact us about privacy at [DPO OR PRIVACY CONTACT] or [CONTACT EMAIL].

2. If you are a member of a studio

2.1 If you train with a studio that uses Fytkit, the studio is the controller of your member record — your profile, training logs, check-ins, nutrition, measurements, progress photos, messages, health information and subscription with that studio. The studio decides how that information is used, and its own privacy policy explains this.

2.2 Fytkit processes your member record on the studio's behalf, as its processor, under a data processing agreement. We do not use it for our own purposes, and we do not sell it.

2.3 Contact your studio first about your member record, including to access, correct or delete it. You can also do much of this yourself in the app: see, export and correct your data, delete your health information, and close your account.

2.4 If you send us a request about your member record, we will forward it to your studio and let you know we have done so.

2.5 Your Fytkit login is different. Your account (your sign-in email, password, sessions and two-factor settings) is not tied to one studio — you can use it with any studio on Fytkit. Fytkit is the controller of this account-level information, and this policy applies to it.

3. Who this policy covers

This policy covers:

• account holders — anyone with a Fytkit login, whether studio staff or member;
• studio staff — Owners, Admins and Trainers using the dashboard;
• studio billing contacts — the people who manage a studio's Fytkit plan and payments;
• visitors to fytkit.com and our documentation; and
• people who contact us for support, sales or anything else.

4. What we collect

4.1 Account information. Email address, name, password (stored only as a secure hash), sign-in sessions, two-factor authentication settings, and which studios you are staff or a member of.

4.2 Staff information. Your role in each studio, invitations sent and received, and a record of significant actions you take, such as changes to settings and who spent the studio's AI credits.

4.3 Billing information. For studios' Fytkit plans and credit packs: billing contact name and email, business name and address, VAT number, plan, invoices and payment status. Card details are collected and held by Stripe; we see only limited details such as card brand and last four digits.

4.4 AI assistant use. The messages staff send to the assistant and its replies, kept for 90 days after the conversation's last activity, and usage records showing what each request cost. Member health data is never sent to the assistant.

4.5 Acceptance records. When you accept a document — our terms, or a studio's terms, privacy policy, or a health or photo consent — we record which version you accepted, when, and from which app.

4.6 Website and device information. IP address, browser and device type, pages viewed, and error and security logs.

4.7 Support and correspondence. What you tell us when you contact us.

5. Why we use it and our lawful bases

[Lawyer: confirm lawful bases, particularly for staff data where the contract is with the studio rather than the individual.]

6. Who we share it with

6.1 Studios. If you are staff, the studio you work for sees your name, email, role and actions in that studio. If you are a member, a studio sees your account email as part of your member record.

6.2 Service providers. We use these providers as of [EFFECTIVE DATE]:

They may use the information only to provide their service to us.

6.3 Fytkit staff. Our support staff may access a studio's dashboard, acting as one of its staff members, to help with support or security. This is logged.

6.4 Legal and safety. We may share information if the law requires it, to enforce our terms, or to protect people's safety or rights.

6.5 Business changes. If we sell or reorganise our business, information may pass to the new owner, who must respect this policy.

6.6 We do not sell your personal information or share it for cross-context behavioural advertising.

7. International transfers

Our providers may process information outside the UK and EEA, including in the United States. Where they do, we use safeguards recognised by law, such as adequacy decisions (including the EU-US Data Privacy Framework and its UK Extension), the EU Standard Contractual Clauses, and the UK International Data Transfer Addendum or Agreement. Contact us for more detail.

8. How long we keep it

Backups are overwritten on a rolling cycle of [NUMBER] days.

9. Security

We protect information with encryption in transit and at rest, access controls and tenant isolation between studios, password hashing, optional two-factor authentication, logged staff access, and monitoring. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

10. Your rights

10.1 UK and EU. You have the right to:

• access a copy of your information;
• have inaccurate information corrected;
• have your information deleted;
• restrict or object to our use of it, including for direct marketing at any time;
• receive it in a portable format;
• withdraw consent where we rely on it;
• complain to a data protection authority — in the UK the Information Commissioner's Office (ico.org.uk), or in the EU the authority where you live or work.

10.2 US states. Depending on where you live (including California, Colorado, Connecticut, Virginia, Washington and other states with privacy laws), you may have rights to know what we collect, access it, correct it, delete it, obtain a portable copy, and opt out of sale, sharing for targeted advertising, and certain profiling. We do not sell or share personal information for targeted advertising. We will not treat you differently for exercising your rights. You may use an authorised agent, and you may appeal a refusal by replying to our decision. [Lawyer: confirm state-specific wording, e.g. CCPA notice at collection and categories.]

10.3 How to exercise them. Email [DPO OR PRIVACY CONTACT]. We may need to verify your identity. We aim to reply within one month (or 45 days where US law applies).

10.4 Closing your account. You can close your account yourself in the app. If you are staff and the Owner of a studio, you must close or transfer the studio first.

11. Cookies

11.1 We use essential cookies and similar storage to sign you in, keep you signed in, protect against attacks and remember basic settings. These are needed for the Service to work, so we do not ask for consent for them.

11.2 [Lawyer: confirm whether analytics cookies or tools are used on fytkit.com or studio sites; if so, add consent and details here.]

12. Children

Fytkit is not for anyone under 18. We do not knowingly collect information from children. If you believe a child has created an account, contact us and we will delete it.

13. Changes to this policy

We will post any changes here and update the effective date. If changes are significant, we will tell account holders by email or in the app.

14. Contact

[FYTKIT LEGAL ENTITY], [REGISTERED ADDRESS]. Privacy contact: [DPO OR PRIVACY CONTACT]. Email: [CONTACT EMAIL].

[Lawyer: confirm whether an EU representative (GDPR Art. 27) or UK representative is needed, depending on where the Fytkit entity is established.]