Privacy policy
Last updated: 21 October 2026
The short version. We collect what we need to coach you well. Health data from Apple Health or Health Connect is read only with your explicit permission. It is never sold and never used for advertising. You can export or delete your data any time from Profile → Privacy & data in the app. Questions: privacy@fiitmit.com.
1. Who we are
Fiitmit (the mobile app and fiitmit.com) is run by Fiitmit, a company registered in India (“Fiitmit”, “we”, “us”). Registered office: [full registered office address], Lucknow, Uttar Pradesh, India.
We decide how and why your personal data is used. That makes us the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the controller under the UK GDPR and, where it applies, the EU GDPR. This policy also explains your rights under US state privacy laws.
2. What we collect
We only collect what we need to run Fiitmit and make it useful to you.
| Type | Examples |
|---|---|
| Account | Name, email address, mobile number, login method, password (stored only as a secure hash), app language, country. |
| Fitness profile | Age or date of birth, sex, height, weight, goals, activity level, training experience, gym or home, equipment, diet preference, region, food budget, wake and sleep times, and any injuries or medical conditions you choose to tell us. |
| Health and wearable data (only with your explicit consent) | From Apple Health or Health Connect: steps, heart rate, resting heart rate, heart-rate variability (HRV), sleep and workouts. Live heart rate during a workout if you connect a device. |
| Mood and mind | Daily mood check-ins, meditation, breathing and yoga sessions, and daily ritual activity. |
| Activity and logs | Workouts, sets and reps, plans, progress, streaks, food you log, messages you send to the AI coach and the “memory” the coach keeps about you. |
| Emergency contacts | Names and phone numbers you add for the SOS feature. If an SOS is sent, the text includes your name, the time, your last heart rate and your location (if you allowed location). Please only add people who are happy to be contacted. |
| Purchases | Your plan, subscription status, trial dates and transaction IDs. Card, UPI and bank details are handled by Razorpay, Google Play or the App Store. We never see or store your full card number. |
| Device and technical | Device model, operating system, app version, device and installation identifiers, push-notification token, advertising ID (free plan only, see section 7), IP address (used to estimate your country; not stored with your profile), crash and performance logs. |
| Approximate location | Your approximate country or region, worked out from your IP address at the time. We don't store your IP address with your profile. We use it to set your country, currency, emergency number and local content. We do not track your precise GPS location. A feature may ask for your precise location only if it clearly needs it (for example, to include it in an SOS alert), and only if you allow it. |
| Usage | Screens you visit and features you use, so we can see what works and fix what doesn't. |
| Support | What you tell us when you email or message us. |
3. How we use it
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Create your account and provide the app: plans, day planner, workout player, nutrition, Mind and rituals | Performance of our contract with you |
| Personalise your coaching using your fitness profile, logs and the coach's memory | Performance of contract |
| Use health, wearable and medical-condition data to adapt plans and show safety notices | Your explicit consent (Art. 9(2)(a)) |
| Safety features such as SOS alerts to your emergency contacts | Consent; vital interests in an emergency |
| Send reminders and notifications you've turned on | Performance of contract; consent where required |
| Take payments and manage subscriptions and free trials | Performance of contract; legal obligation (tax and accounting) |
| Understand usage, fix bugs and improve Fiitmit | Legitimate interests; consent where required |
| Show ads in the free plan and measure our marketing | Consent where required by law; otherwise legitimate interests |
| Prevent fraud and abuse, keep Fiitmit secure, and meet legal obligations | Legitimate interests; legal obligation |
In India, we process your personal data on the basis of your consent, which you give in the app, or for the legitimate uses allowed under section 7 of the DPDP Act (for example, to meet a legal obligation or to respond to a medical emergency).
4. Health data: our promises
- We read data from Apple Health or Health Connect only after you grant permission, and only the types you approve.
- Health data is never sold, never used for advertising or ad targeting, and never shared with advertisers, ad networks or data brokers.
- We use it only to run Fiitmit features for you: adapting plans, heart-rate zones, recovery and sleep insights, and data-quality checks.
- Our data-quality checks look for gaps and implausible readings so a faulty sensor doesn't throw off your plan.
- You can stop sharing any time in Apple Health or Health Connect settings, or in the app. You can also ask us to delete what we have already received.
- Data from Apple HealthKit and Health Connect is handled in line with Apple's and Google's rules for health data.
5. AI features
The AI coach, AI-written meditations, adaptive plans and AI nutrition estimates are powered by Hidrogen, our own AI gateway. To answer you, the relevant parts of your profile, recent activity and coach memory are sent through Hidrogen along with your message.
Where Hidrogen relies on underlying AI model providers, we require them by contract to process your data only to generate responses for you, and not to use it to train their own models. AI output can be wrong. It is not medical advice (see section 14).
6. Who we share it with
We don't sell your personal data. We share it only with service providers who help us run Fiitmit, under contracts that limit what they can do with it, plus a few other cases listed below.
| Provider | What for |
|---|---|
| Hostinger | Hosting our servers, database and website |
| Hidrogen (our own AI gateway) | AI coach, plans, meditations and nutrition estimates |
| PostHog | Product analytics (how the app is used). Health data is not sent to PostHog. |
| Google (Google Analytics, AdMob) | Usage analytics and marketing measurement; ads in the free plan. No health data. |
| Meta | Measuring our marketing campaigns, app installs and website visits (Meta SDK in the app, Meta Pixel on fiitmit.com). No health data. |
| Razorpay | Processing payments in India (UPI, cards, wallets) |
| Google Play and Apple App Store | In-app subscriptions and free trials |
| Twilio and MSG91 | Sending SMS: login codes and, if you use SOS, alerts to your emergency contacts |
We may also share information:
- With your emergency contacts, when you trigger SOS.
- When the law requires it, for example in response to a valid court order, or to protect someone's safety.
- If our business changes hands, for example in a merger or acquisition. Your data would stay protected by this policy.
- With your permission, for anything else.
7. Ads in the free plan
The free plan shows ads served by Google AdMob, which may use your device's advertising ID. In the UK, EEA and other places where the law requires it, we ask for your consent before showing personalised ads. Elsewhere you can turn off personalised ads in your device settings (Android: Settings → Privacy → Ads; iPhone: Settings → Privacy & Security → Tracking). Fiitmit Pro has no ads.
US residents: some state laws treat personalised advertising as “sharing” or “targeted advertising”. You can opt out by turning off personalised ads as described above or by emailing privacy@fiitmit.com. We honour Global Privacy Control signals on our website. Health and consumer-health data is never used for advertising.
8. International transfers
We are based in India, and our providers may process data in India and other countries, including the US and the EU. When we transfer personal data from the UK or EEA, we rely on adequacy regulations or approved safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses. Transfers from India follow the DPDP Act and any restrictions the Government of India notifies.
9. How long we keep it
- Account and app data: while your account is active. When you delete your account, we delete or anonymise your personal data within 30 days. Encrypted backups are overwritten within a further 90 days.
- Health data: while you keep the connection on. When you disconnect or delete your account, we stop collecting it and delete what we hold on the schedule above.
- Purchase records: as long as tax and accounting laws require (in India, usually up to 8 years).
- Analytics: up to 25 months, then deleted or aggregated.
- Inactive accounts: if you don't use Fiitmit for 3 years, we may delete your account after warning you by email.
10. Your rights and choices
In the app. Go to Profile → Privacy & data to download a copy of your data or delete your account and data. You can turn off health sync, notifications and personalised ads at any time.
Everyone
You can ask us to access, correct, update or delete your personal data, or to withdraw any consent you've given. Withdrawing consent doesn't affect anything we did lawfully before. Email privacy@fiitmit.com. We may need to verify it's you.
India (DPDP Act)
You have the right to a summary of the personal data we process and who we've shared it with, to correction, completion, updating and erasure, to grievance redressal, and to nominate someone to exercise your rights if you die or become incapable. Contact our Grievance Officer first (see section 16). If you're not satisfied, you can complain to the Data Protection Board of India.
UK and EEA (UK GDPR / EU GDPR)
You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interests. We respond within one month. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
United States
Depending on your state (for example California, Colorado, Connecticut, Virginia, Texas or Washington), you may have the right to know, access, correct and delete your data, to opt out of sale, “sharing” or targeted advertising, and to limit the use of sensitive data. We don't sell personal data, and we don't use health data for anything other than providing Fiitmit to you. We won't discriminate against you for using your rights. We respond within 45 days. If we deny your request, you can appeal by replying to our decision.
11. Children
Fiitmit is not for children. You must be 16 or older to use it. In India, where the DPDP Act treats anyone under 18 as a child, users aged 16 or 17 may use Fiitmit only with the verifiable consent of a parent or lawful guardian. We don't knowingly collect data from children under 16. If we find out we have, we'll delete it. If you think a child is using Fiitmit, email privacy@fiitmit.com.
12. Security
We protect your data with encryption in transit (HTTPS/TLS), hashed passwords, access controls, least-privilege access for our team, and regular reviews. No system is perfectly secure. If a personal-data breach affects you, we'll tell you and the relevant regulators as the law requires.
13. This website and cookies
fiitmit.com uses the Meta Pixel to measure our advertising: it records page visits and clicks on the download / Google Play links, and Meta may set a cookie for this. No health data is ever sent. The pixel does not load if your browser sends a Global Privacy Control signal, and you can also block it with your browser's cookie or tracker settings. We use no other analytics cookies on this website.
14. Medical disclaimer
Fiitmit is a fitness and wellbeing app. It is not a medical device and does not diagnose, treat, cure or prevent any disease. It never recommends medicines. If your profile mentions a medical condition, Fiitmit shows a “see a doctor” notice. Always talk to a qualified doctor before starting a new exercise or diet programme, especially if you are pregnant, have a health condition or take medication. In an emergency, call your local emergency number (112 in India, 999 in the UK, 911 in the US).
15. Changes to this policy
We'll update this policy as Fiitmit changes. If the changes are significant, we'll tell you in the app or by email before they take effect. The date at the top shows the latest version.
16. Contact and complaints
Privacy questions and requests: privacy@fiitmit.com
Grievance Officer (India): [name], Fiitmit, [full registered office address], Lucknow, Uttar Pradesh, India, privacy@fiitmit.com. We acknowledge grievances within 48 hours and aim to resolve them within 30 days.
General support: support@fiitmit.com