Privacy Policy

1. Who we are

This Privacy Policy explains how FitxOS Technologies [Private Limited] (“FitxOS”, “we”, “us”) collects, uses and protects personal data. Our registered office is at [Full registered address], New Delhi, India. It covers our website at fitxos.com, the FitxOS web platform and the FitxOS mobile apps, including client apps that coaches publish under their own brand (“white-label apps”), together the “Services”.

FitxOS is a business-to-business platform. Our customers are fitness coaches, studios and other businesses (“Coaches”) who use FitxOS to run programs, nutrition, community and payments for their own clients (“Clients”).

2. Our two roles

When we decide how data is used

For website visitors and for Coaches (their account, billing, support and our marketing to them), FitxOS decides why and how personal data is processed. Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) we act as a Data Fiduciary, and under the EU and UK GDPR as a controller.

When we act for a Coach

Client data (for example a Client’s program activity, check-ins, messages and health information) belongs to the Coach. The Coach decides what is collected and why, and FitxOS processes it only on the Coach’s instructions, as a Data Processor under the DPDP Act and a processor under the GDPR. The Coach’s own privacy notice applies to that data, and our Data Processing Agreement governs how we handle it. Clients should send privacy requests to their Coach first; if they contact us, we will pass the request to the Coach and help them respond.

3. Personal data we collect

Website visitors

• Device and usage data such as IP address, browser, pages viewed and referring site, collected through cookies and similar tools (see section 7).
• Details you submit in forms, such as your email address when you start a free trial or request our playbook.

Coaches

• Identity and contact details: name, email address, phone number and business name.
• Account details: login credentials, team members you invite and your settings.
• Billing details: plan, invoices and payment confirmations from Razorpay. We do not receive or store full card numbers.
• Content you add: programs, videos, recipes, messages, website and app branding.
• Support conversations and feedback.
• Usage and security data: log-ins, feature use, device information and IP address.

Clients (processed for the Coach)

• Account details: name, email address and profile photo.
• Program and activity data: sessions, sets, habits, check-ins, community posts, messages and progress photos.
• Nutrition data: meal logs, targets and preferences.
• Health data, only with explicit consent: menstrual cycle dates and phase, symptoms, body measurements and similar wellbeing information (see section 5).
• Video sessions: live classes and one-to-one calls are connected through Daily.co.
• Device data: app version, device type and a push notification token so we can send notifications.

4. How we use personal data

In India we process personal data on the basis of consent or a legitimate use permitted by the DPDP Act. Where the GDPR applies, the legal bases above are those set out in Article 6 and, for health data, Article 9.

5. Health and menstrual cycle data

Health information is sensitive, so we handle it with extra care:

• It is collected only after the Client gives explicit, separate consent in the app, and the Client can withdraw consent at any time in the app’s privacy settings. Withdrawing consent stops further collection; it does not affect processing that already happened.
• It is used only to provide the features the Client agreed to, such as cycle-aware programs and nutrition targets.
• It is never sold, never used for advertising and never shared with advertising partners.
• It is not used to train artificial intelligence models.
• Coaches see a Client’s health data only when the Client has consented and the Coach has switched the feature on.

FitxOS is a coaching tool, not a medical device, and does not provide medical diagnosis or treatment.

6. AI features

Some features use artificial intelligence, for example to tag content, draft replies or suggest a day’s plan. These features send the minimum information needed to Anthropic’s Claude API, which returns a result to us. Under Anthropic’s commercial terms, content sent through its API is not used to train its models, and FitxOS does not use your data to train AI models either. AI suggestions are reviewed and approved by the Coach before they reach a Client.

7. Cookies and analytics

Our website uses cookies and similar technologies:

• Essential cookies keep the site working and secure, and remember your cookie choices.
• Analytics: Google Analytics helps us understand how the site is used.
• Marketing: the Meta Pixel and Meta Conversions API help us measure our advertising.

In the EU, UK and similar regions, analytics and marketing cookies are used only after you opt in. In the United States you can opt out at any time. You can change your choice using the cookie settings link on our website, or through your browser settings. Marketing tools are not used inside the client apps to track health information.

8. Who we share data with

We do not sell personal data. We share it only with the service providers below, who process it for us under contract and only as needed to provide their service:

We may also share personal data when the law requires it, to protect the rights and safety of our users or of FitxOS, with a buyer if our business is sold or merged (under the same protections), or with your consent. A Coach’s team members can see the data that the Coach gives them access to.

9. International transfers

Our database is in Singapore and some providers above are in the United States, so personal data may be processed outside your country. We transfer data only to countries that are not restricted by the Government of India, and we use contractual safeguards such as the European Commission’s Standard Contractual Clauses where the GDPR or UK GDPR applies.

10. How long we keep data

11. How we protect data

We use encryption in transit and at rest, row-level access controls so each Coach and Client sees only their own data, least-privilege access for our staff, security logging and regular security reviews. No system is perfectly secure. If a personal data breach occurs, we will notify affected users and the Data Protection Board of India, and other regulators where the law requires, without undue delay.

12. Your rights

India

Under the DPDP Act you can ask for a summary of your personal data and how it is used, ask us to correct, complete, update or erase it, withdraw consent, nominate someone to exercise your rights if you die or become incapacitated, and have your grievances addressed by our Grievance Officer.

European Union and United Kingdom

You can access, correct, delete, restrict or port your data, object to processing based on legitimate interests, withdraw consent at any time, and complain to your local data protection authority.

United States

Depending on your state, you can ask to know, access, correct or delete your personal information, opt out of the sale or sharing of personal information and of targeted advertising, and limit the use of sensitive personal information. We do not sell personal information for money. Advertising cookies may count as “sharing” under some state laws; you can opt out using the cookie settings link or by emailing us. We will not treat you differently for using these rights.

Asia-Pacific, Middle East and other regions

Laws such as Singapore’s PDPA, Australia’s Privacy Act, the UAE’s Personal Data Protection Law and Saudi Arabia’s Personal Data Protection Law may give you similar rights. We honour requests in line with the law that applies to you.

How to use your rights

Email privacy@fitxos.com. We may need to confirm your identity first, and we respond within 30 days or sooner if the law requires. If you are a Client, please contact your Coach first; we will support them.

13. Age requirement

The Services are for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it.

14. Payments

Subscription payments are processed by Razorpay. Card and bank details are entered on Razorpay’s secure checkout and are never stored by FitxOS; Razorpay’s own privacy policy applies to that data. Coaches collect payments from their Clients through their own payment accounts, and FitxOS does not charge a commission on those payments.

15. Marketing messages

We may email Coaches about product updates and offers. Every marketing email has an unsubscribe link. We send WhatsApp or SMS marketing only if you have agreed to it.

16. Changes to this policy

We may update this policy. If we make material changes, we will tell Coaches by email or in the product before the changes take effect, and update the date at the top of this page.

17. Contact and Grievance Officer

FitxOS Technologies [Private Limited]
[Full registered address], New Delhi, India
Privacy: privacy@fitxos.com · Support: support@fitxos.com

Grievance Officer:[Grievance Officer name], email privacy@fitxos.com. We acknowledge grievances within 7 days and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India or, in the EU and UK, to your data protection authority.