FitSum Privacy Policy

Account data: email address, authentication identifiers (including Apple Sign-In and Google Sign-In identifiers where used).

Fitness and health data you provide or generate in-app:

• Workout logs: exercises, sets, weights, reps, RPE, timers, supersets.
• GPS routes and distance/pace data for outdoor activities.
• Body measurements, body weight, and measurement history.
• Progress photos.
• Training preferences, goals, targets, and coaching state (e.g. recovery/readiness estimates).
• Activity Points, step counts, and daily activity history.
• Heart rate data (from Bluetooth heart rate monitors, or from Apple Health / Health Connect if you grant access).
• Gym pass details you choose to store, including member IDs, PINs, and card photos.

Health platform data: with your permission, FitSum reads and/or writes data to Apple Health (HealthKit) and/or Health Connect, which may include steps, distance, calories burned, exercise sessions and routes, heart rate, resting heart rate, VO₂ max, weight, height, body fat percentage, lean body mass, bone mass, and basal metabolic rate. You control this access through your device's Health/Health Connect permissions at any time.

Device data and permissions: location (including background location while an outdoor workout is being tracked), motion and step data, camera and photo library access (for progress photos and gym pass images), Bluetooth (to connect to heart rate monitors), and notification permissions.

Biometric authentication: if you enable Face ID / Touch ID / fingerprint login, this is handled entirely by your device's secure hardware. FitSum never receives, transmits, or stores biometric data.

Usage analytics and crash reporting: with your consent, we collect pseudonymous product analytics (e.g. feature usage, session duration) and crash/error reports used to improve the app. When you grant analytics consent, this data is linked to your account identifier; we disable IP-address collection in our analytics provider, and our crash-reporting provider operates with personal data redacted by default. Analytics and crash data never includes the content of your workouts, weights, measurements, notes, or GPS routes. You are asked for consent when you first use the app (EU users receive no analytics until they opt in), and you can change your choice at any time in Profile → Data & Privacy → Analytics & Tracking.

Purchase data: subscription status and transaction identifiers are handled by our payment processor (RevenueCat) and the App Store / Google Play. We do not receive or store your payment card details.

• To provide core app functionality: logging workouts, tracking activity, generating coaching recommendations, and syncing your history.
• To calculate personalised recommendations (e.g. workout suggestions, muscle readiness, recovery estimates) based on your training data.
• To sync with Apple Health / Health Connect where you've granted permission.
• To provide customer support.
• To detect, diagnose, and fix crashes and errors.
• To understand feature usage and improve the app (analytics, only if you have opted in).
• To manage subscriptions and entitlements.
• To comply with legal obligations.

We do not sell your personal data to third parties, and we do not use your health or fitness data for advertising.

We process your data on the following bases: performance of a contract (providing the app's core features to you), consent (e.g. health platform access, analytics, biometric login — all of which you can withdraw), and legitimate interest (e.g. crash reporting, security, fraud prevention).

Each of these providers processes data under its own privacy policy and only accesses what's necessary to perform its function for us. We do not sell data to data brokers or use it for third-party advertising.

Your account data is stored on Supabase infrastructure hosted in London, United Kingdom (AWS eu-west-2). Progress photos and gym pass card images are stored on Cloudflare's EU-jurisdiction infrastructure (Cloudflare R2, EU region).

Some of the processors listed in Section 4 are based outside the UK (for example, Amplitude and RevenueCat are based in the United States). Where your data is transferred outside the UK or the European Economic Area, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement and/or the EU Standard Contractual Clauses — to ensure your data remains protected to UK/EU standards.

The FitSum app itself is a native mobile application and does not use cookies. The Website at fitsum.app uses cookies and similar technologies for essential functionality (such as remembering your preferences) and, where you consent, for analytics to understand how the site is used. You can manage or withdraw cookie consent through the Website's cookie banner at any time.

We retain your account data for as long as your account remains active. If you delete your account, your data is permanently deleted as described in Section 10, except where we're required to retain certain records by law (e.g. financial/transaction records for tax purposes). Deleted data is removed from our primary database immediately; any remaining copies in our infrastructure provider's backups age out and are removed in the ordinary course under that provider's backup retention schedule.

If Evovi Ltd is involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of all or part of its assets, your data may be transferred to the party involved in that transaction, subject to the commitments in this Privacy Policy. We will notify you (in-app or by email) of any such transfer that materially changes how your data is used, and of any change in controller.

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Export your data in a portable format (JSON or CSV) via Profile → Data & Privacy → Export My Data.
• Delete your account and data (see Section 10).
• Withdraw consent for optional processing (analytics, health sync, biometric login) at any time.
• Object to or restrict certain processing.
• Lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk).

To exercise any of these rights, contact admin@fitsum.app.

You can permanently delete your account and all associated data at any time:

In the app: go to Profile → Data & Privacy → Delete My Account, review the data summary shown, type DELETE to confirm, and tap Delete permanently. This requires an internet connection.

From the web (if you no longer have the app installed): visit fitsum.app/delete-account and follow the instructions there, or email admin@fitsum.app with the subject "Account Deletion Request" from your registered email address. We will process web/email requests within 30 days and confirm once complete.

Account deletion is permanent and irreversible. All workouts, measurements, photos, preferences, and history are permanently deleted and cannot be recovered.

Deleting your account does not automatically cancel an active subscription. Cancel separately through the App Store or Google Play if applicable (see our Terms of Service).

We use algorithms to generate workout recommendations, coaching guidance, recovery/readiness estimates, and progress insights based on the data you log. These are informational and intended to support your own training decisions; they are not decisions that produce legal or similarly significant effects about you, and you remain in control of what to follow.

FitSum is not directed at children under 13, and we do not knowingly collect personal data from anyone under 13. If we become aware that we've collected data from a child under 13 without appropriate consent, we will delete it. If you believe a child has provided us with personal data, contact admin@fitsum.app.

We use industry-standard measures (encryption in transit, access controls, secure authentication) to protect your data. No system is 100% secure, and we cannot guarantee absolute security.

This section supplements the rest of this policy for residents of certain US states (including California) and describes the rights that may apply to you under US state privacy laws.

Categories of personal information we collect: identifiers (email address, account identifier), commercial information (subscription/purchase history), internet or network activity (analytics and crash data), geolocation data (workout GPS routes, if you enable tracking), and health/fitness information (workout, measurement, and health-platform data), all as described in Section 1.

Purposes: as described in Section 2.

Disclosure: we disclose the categories above to the service providers listed in Section 4, only to perform functions on our behalf and subject to contractual confidentiality requirements.

Sale / sharing: we do not sell your personal information, and we do not "share" it for cross-context behavioural advertising (as defined under California law). We have not sold personal information in the preceding 12 months.

Sensitive personal information: we do not use or disclose health or fitness information for any purpose other than providing the services, or as otherwise permitted by law.

Your rights: subject to legal exceptions, you may have the right to know, access, correct, delete, and obtain a portable copy of your personal information, and to opt out of certain processing. We do not discriminate against you for exercising these rights.

To exercise any of these rights, contact admin@fitsum.app with the subject "Privacy Rights Request".

Residents of Washington, Nevada, and other US states with dedicated consumer health data laws (such as Washington's My Health My Data Act) are covered by our separate Consumer Health Data Policy, which sets out in full what consumer health data we collect, how we use it, our no-sale and no-geofencing commitments, and how to exercise your rights over it.

See the Health & Fitness Disclaimer in our Terms of Service. In short: FitSum is not a medical device and does not provide medical advice.

We may update this Privacy Policy from time to time. Material changes will be notified in-app or via email before they take effect.

Evovi Ltd

Registered in England & Wales, Company No. 16985656

Email: admin@fitsum.app

© 2026 FitSum. Built in Britain.