Privacy Policy

1. Who we are

FitCoach Online Limited, a company registered in England and Wales under company number 17354789, is the data controller for the personal data described in this policy. Questions, requests or complaints: support@fitcoach.online.

2. The data we collect

What we hold depends on how you use FitCoach:

• Account data — your name, email address, password (stored only as a secure hash), role (client or coach) and, for clients, which coaching business you belong to.
• Intake answers — your goal, schedule, equipment and experience, plus any injuries and dietary requirements you choose to tell us about. Answers about injuries, health conditions and medically driven dietary needs are special-category health data, and we only process them with your explicit consent — you can decline, and you can withdraw consent at any time from your settings or by contacting us.
• Health and fitness data you log — workouts, sets, reps and weights, food and macro logs, steps, body weight, check-ins and any progress photos you choose to upload.
• Messages — conversations between you and your coach in the app.
• Payment data — handled by Stripe, our payment processor. Your card details are entered on Stripe's secure forms and never touch our servers; we hold your membership type, subscription status and billing history.
• Technical data — IP address, device and browser information, strictly necessary cookies for login sessions, and a push subscription token if you turn notifications on.

3. Why we use it, and our lawful bases

We use your data to:

• provide the service — build and adapt your plan, show your logs and trends, deliver messages and notifications, and take payment (performance of our contract with you, UK GDPR Article 6(1)(b))
• process health-related intake answers and the fitness data you log about your body — with your explicit consent (Article 9(2)(a)), which you can withdraw at any time
• share your training data with your coach where you train with one (performance of the contract)
• keep the service secure, prevent abuse, and fix faults (our legitimate interests, Article 6(1)(f))
• meet legal obligations, such as keeping billing records for tax (Article 6(1)(c))
• improve the service using aggregated, de-identified usage information (legitimate interests).

We never sell personal data, and we don't use it for third-party advertising.

4. AI features

Some features — plan drafting, message suggestions and nutrition insight tips — are powered by Anthropic's Claude models. When these run, we send only de-identified inputs: computed metrics (for example calorie and protein adherence numbers), short lists of your most-logged food names, and dietary preferences from your intake. We do not send your name, contact details, messages or raw diaries. Anthropic acts as our processor and does not use this data to train its models.

5. Who we share it with

Your coach: if you train with a coach on FitCoach, they (and any team members in their coaching business) can see your intake answers, logs, progress and messages — that is what lets them coach you. Coaches are independent businesses and are responsible for how they use client information outside the platform.

Our processors, who act under contract on our instructions:

• Supabase — database, authentication and hosting
• Stripe — payment processing
• Anthropic — AI features, on the de-identified inputs described in section 4
• browser push services (operated by Apple, Google and Mozilla) — deliver the push notifications you opt in to

We may also disclose data where the law requires it, or as part of a business sale or restructure (in which case this policy continues to apply).

6. International transfers

Where a processor handles data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum with that provider so your data keeps equivalent protection.

7. How long we keep it

We keep your data while your account is active. Delete your account in the app and your personal data is deleted or irreversibly anonymised within 30 days (up to 90 days in encrypted backups). Where a record must be kept — billing records for tax (up to six years), or the integrity of a coach's business history — we keep the minimum necessary, anonymised where possible.

8. Your rights

Under UK GDPR you can ask us to:

• access the personal data we hold about you, and receive a copy in a portable format
• correct inaccurate data
• delete your data, or restrict or object to our processing
• withdraw consent at any time where consent is our basis (this doesn't affect processing before withdrawal)

To exercise any right, email support@fitcoach.online — we respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

9. Cookies

The marketing site sets no tracking cookies. We use localStorage for one thing: remembering that you dismissed the announcement bar. The app uses strictly necessary cookies for login sessions only.

10. Children

FitCoach is for adults — you must be 18 or over to hold an account, and we do not knowingly collect children's data.

11. Changes and contact

We may update this policy as the service evolves; material changes are notified by email or in the app before they take effect. Data controller: FitCoach Online Limited, registered in England and Wales, company number 17354789. Contact: support@fitcoach.online.