FitFocus IO PTY LTD (ACN 661 231 330) uses the following subprocessors to operate the FitFocus platform and the marketing website. Each vendor is bound by contractual data-protection terms, and standard contractual clauses or equivalent transfer mechanisms are in place where personal data leaves Australia, the European Economic Area or the United Kingdom.
Hosting and infrastructure
| Vendor | Purpose | Personal data processed | Primary location |
|---|---|---|---|
| Microsoft Azure | Hosting for the FitFocus API, databases (Azure SQL Database) and file storage (Azure Blob Storage). | All platform data: account details, coaching content, health and fitness data, messages, bookings and uploaded files. | Australia. |
| Vercel | Hosting and content delivery for the FitFocus web app and marketing website. | IP addresses, request logs, user agents. | Global edge network. |
Payments
| Vendor | Purpose | Personal data processed | Primary location |
|---|---|---|---|
| Stripe | Platform subscriptions, and payments between coaches and their clients through Stripe Connect. | Billing contact details, payment metadata. Card data is held by Stripe (PCI DSS Level 1). | United States. |
| Ezidebit | Direct debit billing. | Billing contact details and bank account details, collected on Ezidebit's hosted pages. | Australia. |
Communications
| Vendor | Purpose | Personal data processed | Primary location |
|---|---|---|---|
| SendGrid (Twilio) | Transactional email from the platform. | Recipient names and email addresses, message contents, delivery metadata. | United States. |
| Resend | Transactional email from the platform, and notification emails for marketing-website enquiries. | Recipient names and email addresses, message contents, delivery metadata. | United States. |
| OneSignal | Push notifications to the FitFocus mobile apps. | Device identifiers, user identifiers, notification contents. | United States. |
| Intercom | In-app support messenger and help centre for coaches and administrators. Clients are not connected to it. | Name, email address, user identifier, support conversations. | United States. |
| Klaviyo | Account lifecycle emails to coaches who start a trial or subscribe. | Coach name, email address, organisation, subscription events. | United States. |
Features and data
| Vendor | Purpose | Personal data processed | Primary location |
|---|---|---|---|
| OpenAI | AI features: session note summaries, client summaries, referral letters, and workout and rehabilitation program generation. | The notes, program details and client context a coach submits to those features. OpenAI does not use API data to train its models. | United States. |
| AssemblyAI | Transcription of audio notes recorded by coaches. | Audio recordings and their transcripts. | United States. |
| Sahha | Health and wellness data from connected phones and wearables. | Activity, sleep and other health metrics, linked to a pseudonymous identifier. | United States. |
| FatSecret | Food database search, barcode lookup and meal photo recognition for nutrition tracking. | Search terms, barcodes and meal photos submitted for recognition. No account details are sent. | United States. |
| Typeform | Surveys and forms that coaches send to their clients. | Survey responses and the respondent details a form asks for. | European Union. |
| Fivetran | Connections to a coach's social media accounts for content insights. | Account and post data from the social media accounts a coach connects. | United States. |
| PostHog | Product analytics, and the optional research surveys described in the Privacy Policy. | Usage and interaction data, device information, survey responses. | United States. |
Marketing website
| Vendor | Purpose | Personal data processed | Primary location |
|---|---|---|---|
| Cloudflare | Receives, stores and filters spam from enquiry and demo-request forms on the marketing website. Submissions and uploaded files are deleted after 90 days. | Submission contents (name, email, form fields and any attached files), IP address, user agent. | Global edge network. |
| PostHog | Cookieless web analytics for the marketing website: pages visited, buttons clicked, whether forms are started and sent, and when calculators are started and finished. No cookies are set and nothing is stored in the visitor's browser. | IP address and user agent (used to count visitors with a hash that changes daily, and to estimate country), pages visited, referrer and campaign tags. What visitors type into forms or calculators is not sent. | United States. |
Marketing-website hosting (Vercel) and enquiry notification emails (Resend) are listed above.
Services your organisation connects
Some features send data to a service that a coach or organisation connects using its own account, such as Google Calendar or a Slack workspace. Those services act under the organisation's own agreement with them and are not subprocessors of FitFocus. See section 8 of the Data Processing Addendum.
Notification of changes
FitFocus gives at least 30 days' notice before a new subprocessor begins processing personal data on a customer's behalf, by updating this page and emailing each customer's account owner. Objections are handled as set out in section 7 of the Data Processing Addendum.
Contact
Questions about subprocessors should be directed to support@fitfocus.io.