Privacy Policy

FitFloww is a client relationship management platform for fitness professionals. It is operated as a sole proprietorship based in California, United States.

This policy explains what we do with personal data. It applies to our website, the coach application, and the client portal.

This distinction decides who you should contact, and it is the part most privacy policies get wrong. FitFloww plays two different roles depending on whose data is involved.

Coaches subject to GDPR need a written processing agreement with us. Our Data Processing Agreement satisfies Art. 28 and applies automatically to every account.

What we do not collect

• We do not collect precise GPS location. Location is inferred from IP address at city level only, for security.
• We do not collect biometric identifiers. Progress photos are stored as images and are never converted into a faceprint or other biometric template.
• We do not buy personal data from data brokers.
• We never see or store your password — our authentication provider hashes it.
• We never store payment card numbers. Stripe handles them directly.
• We do not use advertising cookies or run cross-site behavioural advertising.

Account and business data

• Name, email address, phone number.
• Professional credentials, certifications, business name, specialisations.
• Profile photo and branding you upload.
• Subscription plan, billing history, and invoices.

Client records (we process these for your coach)

• Client contact details and profile information.
• Fitness goals, body measurements, workout history, and assessment results.
• Progress photos.
• Nutrition plans and food logs.
• Session notes, injury notes, and messages.

Technical and usage data

• IP address, browser and device type, operating system.
• Pages visited and features used — collected by PostHog only if you accept optional cookies.
• Error reports and stack traces when something breaks, with text and media masked.
• Server access logs.

Marketing and lead data

If you fill in a form on our website, request a demo, or subscribe to updates, we collect the contact details you provide and use them to send you information about FitFloww. Every marketing email has an unsubscribe link, and unsubscribing takes effect immediately.

We use Anthropic (Claude) for generating marketing and content copy through internal tooling.

• Your data is not used for training. Data sent to our AI provider through the API is not used to train their models.
• Health records are not sent to AI providers. Client health records, progress photos, and private messages are not sent to any AI provider.
• No automated decisions about you. No automated decision with a legal or similarly significant effect is made about you. Scheduling suggestions and programme recommendations are suggestions — a human chooses whether to act on them.
• Output can be wrong. AI models are probabilistic. Anything they generate should be checked before you rely on it.

Data sent to our AI provider is also subject to their privacy policy.

Essential cookies are set because the service cannot work without them. Everything else stays off until you accept it in the cookie banner. You can change your mind at any time from the Cookie Policy.

We do not use advertising cookies, and we do not track you across other websites. We do not currently respond to browser Do Not Track signals, because there is no agreed standard for what a site should do when it receives one. We do honour Global Privacy Control signals as an opt-out of sale or sharing, as California requires.

These are every third party that processes personal data on our behalf:

The current list always lives at Sub-processors, where you can also subscribe to notice of changes. We give 30 days’ notice before adding a new processor that handles customer data.

Beyond those processors, we disclose data only when:

• The law requires it — a valid court order, subpoena, or equivalent legal process. We tell you unless legally prohibited from doing so.
• It is necessary to protect someone’s safety or to investigate fraud or abuse.
• The business is sold or merged. You will be told before your data moves, and the new operator is bound by this policy until it gives you notice of a change.
• You have asked us to.

Deletion is not instant, because encrypted backups roll over on a schedule. The table below is what we can actually honour.

Wherever you live, you can ask us to:

• Access — get a copy of the personal data we hold about you.
• Correct — fix anything inaccurate. Most account and client fields can be edited directly in the app.
• Delete — remove your account and its data, subject to the retention table above. You can start this yourself from Settings.
• Port — receive your data in a structured, machine-readable format.
• Object or restrict — challenge processing we base on legitimate interests, or ask us to pause it.
• Withdraw consent — for cookies, from the Cookie Policy; for marketing email, from the unsubscribe link in any message.

FitFloww is operated from the United States, and most of our processors are US-based. If you are in the EEA, the UK, or Switzerland, your data is transferred outside your country.

We rely on:

• The European Commission’s Standard Contractual Clauses, incorporated into our agreements with each processor that needs them.
• The UK International Data Transfer Addendum for UK transfers.
• The EU–US Data Privacy Framework, where the processor is certified under it.

You can ask us for a copy of the safeguards that apply to a particular transfer by emailing privacy@fitflowwcrm.com.

You must be 18 or over to open a FitFloww account. We do not knowingly collect personal data directly from children.

If you believe a child’s data has reached us without proper consent, email privacy@fitflowwcrm.com and we will delete it.

What is in place:

• TLS 1.3 for all data in transit
• AES-256 encryption at rest, applied by our database and storage provider
• Session tokens mirrored into HttpOnly cookies so page scripts cannot read them
• Row-level security policies so one coach cannot read another coach’s records
• Passwords hashed by our authentication provider — we never see or store them
• Card details handled by Stripe and never stored on FitFloww systems
• Automated dependency and secret scanning on every build
• Encrypted database backups with point-in-time recovery

If a breach affects your personal data and creates a risk to you, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where GDPR requires, and tell affected users without undue delay. To report a vulnerability, email security@fitflowwcrm.com.

• The "Last updated" date at the top changes whenever this policy does.
• For changes that materially reduce your rights, we give 30 days’ notice by email or in-app notice before they take effect.
• Continued use after a change takes effect means you accept the updated policy. If you do not accept it, you can delete your account before the effective date.
• Where a change requires your consent under applicable law — for example a genuinely new purpose for existing data — we will ask for it rather than relying on notice.

We respond within 30 days. We have not appointed a statutory Data Protection Officer, because we do not meet the criteria in GDPR Art. 37 that make one mandatory; privacy questions go to the address above.

This section applies in addition to the rest of the policy if you are in the EEA or the UK.

• Legal bases. Set out per purpose in §4.
• Your rights. Articles 15 to 22 — access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions.
• Special category data. Health data is processed on the instruction of the coach who is the controller for it. The coach is responsible for the Art. 9(2) condition, which is normally the client’s explicit consent.
• Complaints. You can lodge a complaint with your national supervisory authority — in the UK, the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to resolve it first.
• Article 27 representative. We have not yet appointed EU and UK representatives. Until we do, direct all enquiries to privacy@fitflowwcrm.com.

This section is our notice at collection under the CCPA as amended by the CPRA. It applies to California residents.

We disclose the categories above to the service providers listed in §7 for the business purposes described there. We keep each category for the periods in §8.

Do Not Sell or Share My Personal Information

FitFloww does not sell personal information and does not share it for cross-context behavioural advertising. Because we do not, there is nothing to opt out of — but we still honour Global Privacy Control signals. No financial incentive is offered in exchange for personal information.

Sensitive personal information

We collect health and fitness data, which is sensitive personal information under the CPRA. We use it only to deliver the service at the coach’s direction — never to infer characteristics about you. That means the right to limit its use does not arise, but you can still ask us to delete it under §9.

Your California rights

• Know what we collect, use, disclose, and how long we keep it.
• Delete personal information we collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of sale or sharing — not applicable, as we do neither.
• Not be discriminated against for exercising any of these rights.

Submit a request to privacy@fitflowwcrm.com. An authorised agent may act for you with written permission that we can verify. We respond within 45 days and may extend once where the request is complex.

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have rights to access, correct, delete, and port personal data, and to opt out of targeted advertising, sale, and profiling with legal effects. We do not conduct any of those three activities.

Some of these states give you a right to appeal a refused request. If we decline your request, our response explains how to appeal, and we answer appeals within 45 days.

Washington and Nevada residents: see the Consumer Health Data Privacy Notice, which carries additional rights over health data.