Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (“DPA”) is between FitxOS Technologies [Private Limited] (“FitxOS”, the processor) and the customer that has accepted our Terms of Service (the “Coach”, the Data Fiduciary or controller). It forms part of the Terms and applies whenever FitxOS processes personal data about the Coach’s Clients (“Client Data”). It is designed to meet the requirements of India’s DPDP Act, 2023 and, where they apply, the EU and UK GDPR.

2. Instructions

FitxOS processes Client Data only to provide the Services and on the Coach’s documented instructions, which are the Terms, this DPA and the Coach’s settings and use of the Services. We will tell the Coach if we believe an instruction breaks the law.

3. Data and people covered

• Clients of the Coach, and the Coach’s team members.
• Types of data: identity and contact details; program, activity, check-in and habit data; messages, community posts and photos; nutrition logs; and, with the Client’s explicit consent, health data such as menstrual cycle dates and phase, symptoms and body measurements.
• Duration: for as long as the Coach’s Subscription lasts, plus the export and deletion period in section 10.

4. Confidentiality

Everyone at FitxOS who can access Client Data is bound by confidentiality and accesses it only where needed to provide or support the Services.

5. Security

FitxOS maintains appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls separating each Coach’s data, least-privilege staff access, security logging, regular security reviews and backups.

6. Sub-processors

The Coach authorises FitxOS to use the sub-processors listed in our Privacy Policy. We bind each sub-processor to data protection terms at least as protective as this DPA and remain responsible for them. We will give at least 30 days’ notice of a new sub-processor by email or in the product. If the Coach objects on reasonable data protection grounds and we cannot resolve the concern, the Coach may cancel the affected Services.

7. Client requests

If a Client contacts FitxOS directly, we will pass the request to the Coach. FitxOS will help the Coach respond to requests to access, correct, erase or export Client Data, mainly through the tools in the Services.

8. Personal data breaches

FitxOS will notify the Coach without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Client Data. We will share the information we have so the Coach can meet their own obligations, including informing the Data Protection Board of India and affected Clients, and we will take reasonable steps to contain the breach.

9. International transfers

Client Data is stored in Singapore and some sub-processors are in the United States. FitxOS will not transfer Client Data to a country restricted by the Government of India and will use the European Commission’s Standard Contractual Clauses, or another valid mechanism, where the GDPR or UK GDPR applies.

10. Return and deletion

When the Subscription ends, the Coach can export Client Data for 30 days. FitxOS then deletes Client Data within a further 30 days, including from backups as they expire, unless the law requires us to keep some of it.

11. Information and audits

On request, FitxOS will provide the information reasonably needed to show compliance with this DPA. The Coach may carry out an audit, or appoint an independent auditor, once a year with 30 days’ notice, at the Coach’s cost and in a way that protects other customers’ data and our confidential information.

12. The Coach’s responsibilities

The Coach is responsible for having a lawful basis for Client Data, giving Clients a privacy notice, obtaining required consents (including explicit consent for health data), and giving FitxOS only lawful instructions.

13. Liability and precedence

Each party’s liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms about Client Data, this DPA prevails. It is governed by the laws of India, and the courts of New Delhi have exclusive jurisdiction. Questions: privacy@fitxos.com.