Version: Fitr - Privacy Policy V3.1
Publish date: 19-Dec-2024
Effective date: 16-Jul-2026
Last updated: 28-Jul-2026
Welcome to the Fitr privacy policy.
Fitr respects Your privacy and is committed to protecting Your personal data. This privacy policy will inform You as to how We look after Your personal data when You visit Our Site (app.fitr.training) or install our App regardless of where You visit it from and tell You about Your privacy rights and how the law protects You. This privacy policy applies to clients of Fitr and coaches registered with Fitr.
The aim of Our Privacy Policy is to clearly outline to You:
We are the controller and We are responsible for Your personal data.
Our Site and our App is not intended for under 16s and We do not knowingly collect data relating to anyone under 16 years of age.
Inside this Privacy Policy We identify which information is optional to provide to use Our service, and which information is critical.
To use the Fitr service We have made it easy for You to view which information We will store, and You can change Your preferences at any time at within Your account settings.
It is important that the personal data We hold about You is accurate and current. Please keep Us informed if Your personal data changes during Your relationship with Us.
You can delete Your account at any time and You can unsubscribe from email communication via the ‘unsubscribe’ link at the bottom of each email.
We use industry standard efforts to safeguard the confidentiality of Your personal identifiable information, such as firewalls and Secure Socket Layers where appropriate.
If You have any questions about this Privacy Policy, including any requests to exercise Your legal rights (as listed below), please contact Us at support@fitr.training.
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with Your concerns before You approach the ICO so please contact Us in the first instance.
Third-party links
Our Site may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about You. We do not control these third-party websites and are not responsible or liable for their privacy statements. When You leave Our Site, We encourage You to read the privacy policy of every website You visit before you submit any personal data to these websites or use their services.
We have separated the remainder of the Policy into the following sections:
Fitr is an online health and fitness management tool where professionals can manage training plans sent to their clients. The full feature set for both parties can be seen on Our Site.
We require certain information from You in order to run the Fitr service. The following information in the table below is deemed as critical to Our business, depending on how much You interact with Us (for example: We need more information from You if You purchase from Us, compared to if You simply sign up for an account). For avoidance of doubt, this information does not include instances where Fitr may need to use Your data to comply with legal and/or regulatory purposes.
Information We Use (relating to our Site and our App)
How & Why We May Use the Data Provided
When Does This Become Critical?
Lawful Basis for Processing (Including Basis of Legitimate Interest)
To log in, notify You about account changes, customer service verification, fraud detection, account verification, manage relationship with You.
(a) Notifying You about changes to Our terms or privacy policy (b) Asking You to leave a review or take part in a survey
When You sign up for the service, ongoing management of Our relationship.
Performance of Our contract with You.
Your Full Name
Allow You to be found by other users, customer service verification, fraud detection.
When You sign up to the service.
Performance of Our contract with You.
Your Date of Birth
Ensure You are of legal age (16+), fraud detection.
When You sign up to the service.
Performance of Our contract with You.
Necessary to comply with a legal obligation.
Gender (optional)
Help Us identify relevant product deals, filter training performances.
When You sign up to the service.
Necessary for Our legitimate interests (to study customer usage, develop, grow Our business, and inform Our marketing strategy).
Product purchase details
Help customer service with verification and support, fraud detection.
When You sign up to the service.
Performance of Our contract with You.
Necessary for Our legitimate interests (to study customer usage, grow Our business).
Credit card information
(Collected by Our payment service provider), processed by a secure 3rd-party service (Stripe). We do not keep credit card information.
When You make an order (Stripe processes payment).
Performance of Our contract with You.
Necessary for Our legitimate interests (to recover debts due to Us).
Anonymous Aggregate data
Internal reports, IT system testing, research, data analysis, site improvement, developing new products/services.
We use anonymous aggregated data at all times on Our service.
Necessary for Our legitimate interests (to study customer usage, grow Our business, and inform Our marketing strategy).
We will only use Your personal data when the law allows Us to. Most commonly, We will use Your personal data in the following circumstances:
Generally, We do not rely on consent as a legal basis for processing Your personal data although We will get Your consent before sending third party direct marketing communications to You, and before collecting the health and fitness data described in "Health and Fitness Data" below. You have the right to withdraw consent to marketing at any time by contacting Us.
For more information, please see the Glossary below.
We will only use Your personal data for the purposes for which We collected it, unless We reasonably consider that We need to use it for another reason and that reason is compatible with the original purpose. If You wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact Us.
If We need to use Your personal data for an unrelated purpose, We will notify You and We will explain the legal basis which allows Us to do so.
Please note that We may process Your personal data without Your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Technical information, including the Internet protocol (IP) address used to connect Your computer to the Internet, Your login information, browser type and version, time zone setting, GPS location, device, browser plug-in types and versions, operating system and platform.
Information about Your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from Our site (including date and time); products You viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.
Marketing and Communications Data including Your preferences in receiving marketing from Us and Our third parties and Your communication preferences.
We may combine this information with information You give to Us and information We collect about You. We may Us this information and the combined information for the purposes set out above (depending on the types of information We receive).
We do not collect any Special Categories of Personal Data about You (this includes details about Your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, and genetic and biometric data), except for the health and fitness information described in "Health and Fitness Data" below, which You choose to provide or connect. Nor do We collect any information about criminal convictions and offences.
Where You use certain features of Our App, We collect health and fitness information as follows:
We only collect this health and fitness data with Your explicit consent, given when You first enable habittracking or connect Apple Health/Google Health Connect within the App. You may withdraw this consent at any time by disabling the relevant habit, disconnecting Apple Health or Google Health Connect from the App's Integrations screen, or via Your device's Health app settings; withdrawing consent will stop further collection and remove previously synced data from Our systems. This data is stored under thesame security measures described in Section 8 and can be deleted on request as set out in "Right To Be Forgotten" above.
Where We need to collect personal data by law, or under the terms of a contract We have with You, and You fail to provide that data when requested, We may not be able to perform the contract We have or are trying to enter into with You (for example, to allow You to access Our services). In this case, We may have to cancel Your application for that service but We will notify You if this is the case at the time.
We do not sell or intend to share any of Your personal details to or with third parties, excluding instances and purposes listed in this section.
We share some data with the following third parties in order for Us to carry out business, deliver a great customer service experience to You and improve Our business. As the service evolves We may add services to this list.
Further information about 3rd parties that may store data about You (either anonymous or identifiable) about You can be found in Our Cookie Policy.
3rd Party
URL
Why we use this service
Coaches
If you are a client: We may share your email address, and, where relevant, Your logged habit-tracking and nutrition-sync health and fitness data (see "Health and Fitness Data" in Section 1), with any Coach that you engage with using our service, so they can support your training. You may at any time ask us not to share your email address with Your Coach using the option available in your Account.
reCAPTCHA (Google)
If you are a client or a coach, we use Google reCAPTCHA on certain forms to prevent automated abuse. It sends your IP address and interaction signals to Google.
Stripe
If you are a client or a coach: Stripe is a payment processor who stores and manages Our online transactions. We send data to Stripe on checkout. However, We do not keep all the information provided by the client or the coach at checkout. For example, the payment method is shared with Stripe, but We do not keep the full card number. We keep only the last 4 numbers, the card type, and billing address information. When someone pays, we use the payment method ID, that does not contain any personal information. Stripe identifies the client or the coach by that ID, and proceeds with the payment.
Analytics and advertising partners
We use Google Tag Manager to manage the analytics and advertising tags on Our website and App. Through these, and only in line with the cookie preferences You set, We share standard usage and device information with analytics and advertising providers including Google (Analytics and Ads), Meta, Microsoft (Bing), LinkedIn, TikTok and Reddit, so that We can measure and promote Our service. We do not share Your health and fitness data with any of these providers. You can see the full list and change Your choices at any time through Our cookie consent tool; further detail is in Our Cookie Policy.
Cloudflare
If you are a client or a coach: We use Cloudflare to enhance Domain Name System (DNS) management.
AWS
If you are a client or a coach: We use AWS for data hosting, infrastructure services and to send automated email messages.
PagerDuty
If you are a client or a coach: PagerDuty powers immediate notifications for effective incident response.
Firebase Cloud Messaging (FCM
If you are a client or a coach using the Android app, we use FCM to deliver push notifications. FCM receives your device push token and the notification text.
Apple Push Notification service (APNs)
If you are a client or a coach using the iOS app, we use Apple's APNs to deliver push notifications. APNs receives your device push token and the notification text.
Firebase Crashlytics
We use Crashlytics to monitor app stability and diagnose crashes. When the App crashes it sends an internal user identifier (not Your name or email), diagnostic information about Your device and operating system (such as device model, available memory, screen orientation, OS version and whether the device is jailbroken), the app version and time of the crash, and technical error logs and stack traces. It does not receive Your health and fitness data.
Firebase Analytics
The Firebase SDK is initialised in our apps. Fitr does not send custom analytics events through it; only Google's default automatic collection (basic device and app information) applies.
Intercom
If you are a client or a coach, we use Intercom for customer communications and support. Intercom receives your email address, name, internal user identifier, sign-up date and subscription status/plan. For coaches, it may also receive onboarding survey answers.
Zapier
If you are a client or a coach: Zapier facilitates seamless app integrations, allowing users to automate tasks and improve productivity effortlessly.
Mixpanel
If you are a client or a coach, we use Mixpanel to understand how our service is used and to improve it. We link this usage to an internal user identifier, and hold your email address and name against your Mixpanel profile so we can recognise you and tailor communications. The event data we send records your activity in the app (for example sign-up, purchases and feature use), together with device information and IP address, and does not include the content of your health and fitness logs.
Sentry
If you are a client or a coach, we use Sentry for error tracking and to diagnose faults. When an error occurs, Sentry receives Your user identifier, email address and technical context about the request.
Churnkey
If you are a coach, when you cancel or downgrade a subscription we use Churnkey to present retention options. Churnkey receives your Stripe customer and subscription identifiers to do this.
Customer.io
If you are a client or a coach, we use Customer.io to manage our email, push and in-app messages to you. It receives your email address, name and account details, and information used to decide which messages to send you. We do not send the content of your health and fitness logs to Customer.io.
Datadog
If you are a client or a coach, we use Datadog to monitor the performance and reliability of Our service and to diagnose technical issues. Datadog processes technical and operational information about requests to Our systems (such as timing, errors and system metrics); it does not receive Your name, email, or health and fitness data.
We may provide further data to third parties not listed above, but before We do so We ensure that all data is anonymous meaning it cannot be identified as You.
There are three reasons where We may share Your data with 3rd parties that We have not listed here:
We require all third parties to respect the security of Your personal data and to treat it in accordance with the law. We do not allow Our third-party service providers to use Your personal data for their own purposes and only permit them to process Your personal data for specified purposes and in accordance with Our instructions.
Part of the role of the Fitr team is to market Our products and services to enable more people to register with Our service. To do so We use a number of different 3rd parties to help Us with these initiatives. Those third parties are listed in Section 2. Some of them receive only anonymised or aggregated information, but others necessarily receive information that identifies You (for example Your email address, name, or details of Your account activity) so that they can provide their service to Us. Section 2 sets out, for each provider, what it receives and why. Some of these transfers are essential to operating Fitr and cannot be opted out of while You use the service; others, such as marketing, are optional and rely on Your consent as described below.
In addition to the anonymised data We send to 3rd parties, We may ask permission from You to use extended data to help give You a better service. A better service may include (but is not limited to) the ability for Us to personalise Our email communication to You based on identifiable information (e.g. name, DOB).
For this We will ask You to opt-in to Our marketing initiatives; You will automatically be opted-out of these services when You join Fitr. If at any stage You would like to opt in or out You can do so in Your account settings.
The additional data We will request permission to use to send to 3rd parties is as follows:
Data provided by You as a client or as a coach
Use
Email address
To identify You on 3rd party services and internally.
Name
To improve user experience with email and advertising personalisation and re-targeting.
Date of birth
Helps Us identify product deals more relevant to You based on purchases of other people in Your age demographic.
Gender (optional)
Helps Us identify product deals more relevant to You and improve service based on learnings of others similar to You.
We keep Your information for as long as it is seen necessary to uphold Our obligations to: deliver Your training plan order, keep Your historic training data, fulfil Our obligations to You in connection with Our service, meet government regulations (for example: relating to accountancy) improve Our service to You, prevent fraud and for law enforcement purposes.
We keep back-ups of Our Site for 30 days.
If reasonably necessary or required to meet legal or regulatory requirements, resolve disputes, prevent fraud and abuse, or enforce Our terms and conditions, We may also keep hold of some of Your information as required, even after You have closed Your account, or it is no longer needed to provide the services to You.
To give You a better understanding, We usually keep financial records (including information about orders & transactions) for 7 years. We will keep top-level information (for example relating to the total quantity of sales transacted in any year) for as long as We as a business deem it useful.
You have the following rights when it comes to Your personal information
If You want to exercise Your rights, or have any questions or concerns please contact Us at support@fitr.training.
Right To Be Forgotten
Users also have the legal right to request deletion of any personally identifiable information. We will adhere to this request where the deletion of information does not impact Our commitment to uphold any financial or legal requirements We must undertake to operate.
We may require to keep anonymous training plan detail, such as the schedule of all a coach’s plans that have been purchased by other users. We do so, so those users that have purchased this information do not lose access to their historic data when You close Your account. Your name, DOB and email will not be linked to this stored data.
What We may need from You
We may need to request specific information from You to help Us confirm Your identity and ensure Your right to access Your personal data (or to exercise any of Your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact You to ask You for further information in relation to Your request to speed up Our response.
Time Limit To Respond
We try to respond to all legitimate requests within one month. Occasionally it could take Us longer than a month if Your request is particularly complex or You have made a number of requests. In this case, We will notify You and keep You updated.
No Fee Usually Required
We do not anticipate that You will have to pay a fee to access Your personal data (or to exercise any of the other rights). However, We may charge a reasonable fee if Your request is clearly unfounded, repetitive or excessive. Alternatively, We may refuse to comply with Your request in these circumstances.
We may need further data from You
We may need to request specific information from You to help Us confirm Your identity and ensure Your right to access Your personal data (or to exercise any of Your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
Fitr stores and processes the personal data that We collect from You within the European Economic Area ("EEA"); however, Your personal data is subject to transfer outside of the EEA in accordance with Section 7 below. We will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this privacy policy.
We always ensure that Your data is only transferred in full accordance with UK data protection laws. In particular, that means Your data will only be transferred to a country that the UK has determined provides an adequate level of protection, or to service providers who have entered into specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK.
In the event that we are processing or transferring personal data relating to EU data subjects, we shall ensure that data is only transferred to a country that the European Commission has determined provides an adequate level of protection, or to service providers who have entered into suitable specific standard contractual terms approved by the EC, such as The International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers.
All information You provide to Us is stored on Our hosting provider’s secure servers. Where We have given You (or where You have chosen) a password which enables You to access certain parts of Our site, You are responsible for keeping this password confidential. We ask You not to share a password with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although We will do Our best to protect Your personal data, We cannot guarantee the security of Your data transmitted to Our site; any transmission is at Your own risk. Once We have received Your information, We will use strict procedures and security features to try to prevent unauthorised access.
Some of Our external third parties are based outside the EEA so their processing of Your personal data will involve a transfer of data outside the EEA.
Whenever We transfer Your personal data out of the EEA, We ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
Please contact Us if You want further information on the specific mechanism used by Us when transferring Your personal data out of the EEA.
We have put in place appropriate security measures to prevent Your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, We limit access to Your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process Your personal data on Our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify You and any applicable regulator of a breach where We are legally required to do so.
We keep Our privacy policy under regular review. This version was last updated on 19/11/2024.
We will make changes to Our Privacy Policy from time to time. We suggest You always take time to read any changes before continuing to use Our service.
We have a separate Cookie policy, this can be found here.
Legitimate Interest means the interest of Our business in conducting and managing Our business to enable Us to give You the best service/product and the best and most secure experience. We make sure We consider and balance any potential impact on You (both positive and negative) and Your rights before We process Your personal data for Our legitimate interests. We do not use Your personal data for activities where Our interests are overridden by the impact on You (unless We have Your consent or are otherwise required or permitted to by law). You can obtain further information about how We assess Our legitimate interests against any potential impact on You in respect of specific activities by contacting Us.
Performance of Contract means processing Your data where it is necessary for the performance of a contract to which You are a party or to take steps at Your request before entering into such a contract.
Comply with a legal obligation means processing Your personal data where it is necessary for compliance with a legal obligation that We are subject to.
Change History:
Fitr - Introduction To Privacy Policy v1
Fitr - Privacy Policy v2
Fitr – Privacy Policy v3.1 – added Health and Fitness Data disclosure; clarified EEA storage and transfer position in Section 6