Privacy Policy

This Privacy Policy applies to all products, services, and websites offered under FitFocus IO PTY LTD (ACN 661 231 330). This includes www.fitfocus.io and www.kiwihealth.io.

1. Introduction

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, use our services, and interact with our platform. We are committed to protecting your privacy in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988. Your trust is important to us, and we are dedicated to maintaining the confidentiality and security of your data.

2. Information We Collect

2.1 Types of Data Collected

We collect the following categories of personal information:

Personal Information: Name, email address, contact details, date of birth, gender.
Health & Fitness Data: Age, height, weight, health metrics, fitness-related data, nutritional information. Where you have separately agreed to take part in research, this data may also be used to produce aggregated, de-identified insights (see section 12).
Media: Photos and videos voluntarily uploaded by clients.
Usage Data: Device information, IP addresses, browser type, access times, and usage patterns.
Location and Time Zone Signals: An approximate country, derived from your IP address, and the time zone your browser reports.
Third-Party Data: Data obtained through integrations with third-party services (e.g., APIs).

We record an approximate country and a time zone when you sign in. They are used for two things: showing you times in your own time zone, and determining which privacy rules apply to you before we invite you to take part in market research (see section 12). We do not use them to determine a precise location. The country lookup runs on our own servers against a database file we hold, so your IP address is not sent to a geolocation service.

2.2 Methods of Collection

We collect information through:

Direct input provided by users during registration and when using our platform.
Automated technologies, including cookies and tracking technologies.
Optional market research surveys, where you have agreed to take part (see section 12).
Third-party integrations with services such as OpenAI API, OneSignal, AssemblyAI API, Sahha.ai, and others.

We collect data only with your explicit consent. By using our services, you agree to the collection, use, and disclosure of your personal information as outlined in this policy.

3. Purpose of Data Collection

3.1 Primary Purposes

We collect and process your data to:

Provide and improve our services.
Enable personal trainers and fitness professionals to manage their clients efficiently.
Offer AI-driven features, such as training insights and workout program generation.

3.2 Secondary Purposes

Product development and enhancement.
Customer support and communication.
Market research, including aggregated and de-identified health and fitness insights, but only for people who have agreed to take part (see section 12).
Compliance with legal and regulatory obligations.

3.3 Third-Party Services

We use third-party services (e.g., OpenAI, AssemblyAI, Sahha.ai, Google Analytics, OneSignal, PostHog, and others) to enhance our platform. Data shared with third parties is anonymised where possible and protected by industry-standard security measures. We do our best to use providers that are industry leaders and adhere to industry-leading security practices such as ISO, SOC, and HIPAA compliance.

PostHog is our product analytics provider, and also delivers the optional research surveys described in section 12. We additionally use a MaxMind GeoLite2 database to turn an IP address into an approximate country. That database is a file stored on our own servers; MaxMind does not receive your IP address or learn that a lookup took place.

4. Data Security

4.1 Security Measures

We implement robust security practices, including:

Password-protected databases.
IP address restrictions.
Secure data encryption and authorisation protocols.
Regular security testing and vulnerability assessments.
Data backup, archiving, and disaster recovery processes.

4.2 Data Storage

All data is stored using Microsoft Azure in Australian data centres. We have the capability to support data storage in other regions upon customer request.

4.3 Data Breach Response

In the event of a data breach, we will notify affected individuals and relevant authorities promptly, in accordance with legal requirements.

We do not sell, rent, or trade personal data to third parties.
We may disclose data to service providers under strict confidentiality agreements.
Data may be disclosed to comply with legal obligations or protect against fraud.
Data may be disclosed to potential acquirers in the event of a merger, acquisition, or asset sale.

6. Cookies & Tracking Technologies

6.1 Use of Cookies

We use cookies for:

User authentication.
Tracking user activity and preferences.
Improving user experience.
Analytics and performance monitoring.
Recognising you across visits for product analytics, and showing a research survey once rather than repeatedly.

6.2 User Control

You can manage cookie preferences through your browser settings. You may also opt out of certain tracking technologies where applicable.

7. Children's Privacy

Our platform is not intended for individuals under 16 years of age. We do not knowingly collect data from minors. Mechanisms are in place to prevent underage account creation.

8. International Data Transfers

While FitFocus primarily operates in Australia, some data may be processed or stored in other countries. We ensure that appropriate safeguards are in place for international data transfers. Data storage in regions outside Australia can be supported upon customer request.

Our product analytics provider, PostHog, stores data on infrastructure in the United States. Usage and interaction data, and the answers to any research survey you choose to take, are processed there. Where we transfer the personal data of individuals in the EU, the UK, or Switzerland to a country without an adequacy decision, we rely on Standard Contractual Clauses with the provider.

9. Data Retention & Deletion

9.1 Retention Periods

Active Accounts: Data retained as long as necessary for service delivery.
Closed Accounts: Data is retained unless a deletion request is submitted by the customer. Backup data may also be retained until a deletion request is received.
Legal Obligations: Certain data may be retained longer if required by law.

9.2 User Rights

You have the right to:

Request access to your data.
Correct inaccuracies.
Request deletion of your personal information.

9.3 Third-Party Data Deletion

We work with third-party service providers to ensure data deletion aligns with our policies upon user request.

10. Your Privacy Rights

Under the Privacy Act 1988, you have rights to:

Access personal data we hold about you.
Correct or update your personal information.
Withdraw consent at any time.

To exercise your rights, please contact us at support@fitfocus.io.

11. Additional Rights for Individuals in the EU and UK

If you are located in the European Union (EU) or the United Kingdom (UK), you have specific rights under the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

11.1 Legal Bases for Processing

We process your personal data based on the following legal grounds:

Performance of a contract with you.
Compliance with legal obligations.
Legitimate interests, such as improving our services.
Your explicit consent.

Market research is the one activity where we rely on your explicit consent and nothing else. We do not rely on legitimate interests to enrol anyone in the EU, the UK, or Switzerland in research. Where we cannot establish that you are outside those regions, we treat you as inside them and ask you first. Withdrawing that consent stops any further use of your data for research and has no effect on anything else about your account.

11.2 Your Rights

Individuals in the EU and UK have the right to:

Access their personal data.
Rectify inaccurate data.
Request erasure of data ("right to be forgotten").
Restrict or object to data processing.
Data portability.
Withdraw consent at any time without affecting the lawfulness of prior processing.

11.3 Data Transfers Outside the EU/UK

When transferring data outside the EU/UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or equivalent measures.

11.4 Contact for EU/UK Residents

For data-related inquiries, please contact support@fitfocus.io. You also have the right to lodge a complaint with your local data protection authority.

12. Market Research and Surveys

We run short market research surveys inside our platform. They ask about health and wellness brands: which ones you have heard of, which you use, and what you think of them. Results are reported to the brands who commission them as trends across a group of people. Your name, email address, and account never form part of what we hand over.

12.1 Taking Part Is Optional

Research is not part of the coaching service and has no effect on it. Nothing about your account, your plan, your clients, or your price changes because of whether you take part. Declining costs you nothing.

You will be asked before any of your data is used for research, and joining requires a clear yes.

There is one exception, and it never applies to anyone in the EU, the UK, or Switzerland. Where we have positively established that an adult account holder is outside those regions, we may instead tell them that they have been included and give them a standing way to opt out, rather than asking first. We record which of the two happened for every person. Where we cannot establish where somebody is, we ask them. Anyone who has ever declined is asked from then on, and is never simply told.

12.2 What We Use, and Why

Research answers are only useful if they can be reported by group, so we may use your date of birth and gender to describe the group your answers belong to (for example, women aged 35 to 44 in Australia). Both are optional to provide.

Where you have agreed to take part, we may also use the health and fitness data already held in your account to build those groups. That use is always aggregated and de-identified. The output is a trend across a group of people, of the form "women aged 25 to 34 who average 5,000 or more steps a day". The count is what leaves. The people behind it do not.

We do not hand over records. No brand or research partner receives your training history, your measurements, your logs, or any other health information attached to you, and none of them can ask us who is in a group or work backwards to find out.

We report a group only when it is large enough that nobody in it can be singled out. Where a group is too small for that, we suppress it rather than publish it.

If you have not agreed to take part, none of your data is used for this at all.

12.3 Changing Your Mind

You can turn research participation on or off at any time from your profile settings. We keep a dated record of every decision you make, including the version of this policy it was made against, so that we can demonstrate what you agreed to and when.

Turning it off stops any further use of your data for research. Answers already included in a finished, aggregated report cannot be extracted from that report, because the report no longer identifies anyone.

If the wording of what we ask changes in a way that matters, we ask again rather than relying on an earlier agreement.

12.4 Coaches, Athletes, and Organisations

A coach's decision covers that coach's own participation and nothing else. It does not enrol their athletes, a coach cannot answer on an athlete's behalf, and a coach agreeing does not place any athlete's health or fitness data into an aggregate. Each person's own decision governs their own data.

Where an organisation is under a contract that does not permit research, we switch it off for everybody in that organisation, and no one there is asked.

12.5 Who Sees the Results

Brands and research partners receive counts and percentages across groups, whether those come from survey answers or from aggregated health and fitness data. They do not receive anything attached to you, they cannot ask us who answered what or who sits inside a group, and we do not sell personal information to them. Section 5 applies here in full.

13. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. While we may notify users of significant changes, it is your responsibility to review this Privacy Policy periodically to stay informed. The "Last Updated" date will reflect the latest date of change. Your continued use of our services constitutes acceptance of any revised Privacy Policy regardless of whether we notify you of changes.

14. Contact Information

For questions, concerns, or complaints regarding this Privacy Policy, please contact our Privacy Officer:

Email: support@fitfocus.io