Privacy Policy

1. Who we are and in what capacity we process data

MyFitnessClient is operated by Vasco José Cardoso Correia, sole trader, tax identification number (NIF) 262045630, with address at Rua de Campezinhos, 27, Lomba, 4600-663 Amarante, Portugal (“we”). For privacy questions, contact [email protected]. This policy applies to the myfitnessclient.com website, the web application (including the installable/PWA version), the MyFitnessClient apps for iOS and Android (including the versions bearing a professional's brand) and the associated services.

We act in two roles:

• Data controller: accounts and authentication, subscriptions and billing, security and abuse prevention, usage analysis and platform reliability, the website, the directory and public profiles, coaching requests until they are accepted and visitor contacts until they are delivered to the professional, the referral program and communications with us, as well as the data a client records in their own account while they are not connected to a professional or after the professional deletes their account
• Data processor: the data each professional records or receives about their clients in the course of coaching (including assessments, anamnesis and other health data, plans, logs and messages). In that case the professional is the data controller and we process the data only on their instructions, under the Data Processing Agreement (DPA)

If you are a client of a professional, you should address requests about coaching data to that professional. If you contact us, we forward the request to the professional without delay.

2. What data we process

2.1 Account

• Name, email and password
• For client accounts, date of birth and gender, which the registration form requires (in the app, people who register with Google or Apple give only their date of birth); the date of birth is also used to apply the age rules in the Terms
• Optional: phone, photo, height, weight and NIF (provided by the client so that the professional can invoice them)
• Language, time zone, currency and app preferences
• Presence status (“online”, “last seen”), which professionals can hide in settings
• Sign-in with Google or Apple: the identifier and email of the account with that provider (with Apple, this may be a forwarding address created by Apple) and, with Google, when you create the account, the Google profile photo, which becomes the account's photo and remains hosted by Google
• Two-factor authentication: the chosen method and the secret, stored encrypted
• The record of the acceptance of the Terms and of the confirmation that you have read the Privacy Policy (version, date, method of acceptance, text shown, IP address and browser), of the declaration, made by anyone under 16 at registration or when they give their date of birth in their account, that they have the authorisation of their parents or legal representative and, for professional accounts, of the declaration of qualifications and, when you publish the public profile, of the declaration that you act as a professional; the account creation date

2.2 Professionals and public profile

• Public profile information, when you activate it (for example biography, professions, specialities, location, indicative prices, services, gallery, frequently asked questions, social networks and public contact details). The public profile is open on the internet: search engines and third-party artificial intelligence services can read, index, cite and use it to train models, because we do not stop them. We show it at the professional's request, when they activate the profile (performance of the contract). If they deactivate it, we stop showing it, but we cannot delete what third parties have already collected. When the profile is published, changed or deactivated, we normally notify Microsoft's Bing search engine, sending it only the page address; this notice does not guarantee that Bing removes it straight away, because Bing decides when to visit it again.
• Subscription and billing: plan, status, invoices, tax details (name, NIF, address), when you provide them, and the type and last 4 digits of the payment method (full card details stay with Stripe only)
• Supporter badge, when awarded

2.3 Clients (including health data)

• Body measurements and body composition, physical tests and assessments, progress and assessment photos and videos
• Health and anamnesis questionnaires, which may include clinical and family history, diseases, pregnancy, mental health and eating disorders, medication, allergies and intolerances, injuries and limitations, alcohol and tobacco use, sleep and stress
• Values calculated from the measurements, such as BMI, estimated body composition and energy requirements, to support the professional (section 10); we do not calculate scores or disease risk classifications
• Training, nutrition, supplementation and habit plans and logs, goals, the professional's notes and form responses
• Clients without an account: the professional may record people who do not have an account (for example name, phone and email). In that case it is up to the professional to inform them about the processing

2.4 Communications and calls

• Chat messages, files, audio messages, reactions, GIFs and link previews, which are fetched by our servers
• Metadata of video and audio calls (participants, type, start time, duration and whether the call was answered)
• Support requests and messages you send us

2.5 Payments between professional and client

• Amounts, currency, dates, statuses, method and notes of the payments recorded by the professional, and confirmations submitted by the client
• For online payments, Stripe's technical identifiers, the status, the method type, the receipt and the amounts of each payment (including refunds, disputes and fees). The client's email is sent to the Stripe account of the professional, who is the seller. Full card or bank account details remain with Stripe

2.6 Marketplace: requests and visitor contacts

When a client with an account asks to be coached by a professional, we record the request and the message and notify the professional, as well as the members of their team with access to clients, on the platform. For requests made through the directory or the public profile, we also notify them by email, with a reminder if there is no reply within 3 days, and the request expires after 14 days without a reply, is not kept and the client is notified. We let the client know when the request is accepted or declined. Once the request is accepted, the data is processed by the professional, as data controller. People without an account can leave their name, email, phone number (if they provide it) and a message on a public profile: we store that contact in the professional's account, send the professional an email with those details so that they can reply directly, and delete it after one year, or earlier if the professional deletes it or deletes their account. When the professional uses the contact to reply, the professional is the controller of that processing.

2.7 Registration and title numbers

If a professional provides on their public profile the number of their professional registration (cédula) with the Portuguese Order of Nutritionists (Ordem dos Nutricionistas) or the type and number of their professional title issued by IPDJ (the Portuguese Institute for Sport and Youth), we store those details and show them on the profile, with a link to the official register.

• We store the number provided; for the registration (cédula), the profession presented (nutritionist or dietitian) is derived from the letter in the number (N or D)
• We do not copy data from the registers of the Order or of IPDJ to the profile and we only consult them manually, in a specific case, when we review a report about a profile or on our own initiative
• If someone tries to provide a number that is already on another profile, we log the account that tried, the account that holds the number, the type and the number, and the date, to prevent the misappropriation of numbers. Only administrators have access to this log, which is deleted after 12 months

2.8 Platform use and technical data

• IP address, browser, device and operating system; sign-in history (including failed attempts); session tokens
• The country from which the account was created, as Cloudflare infers it from the IP address at registration
• Usage analysis: when you are signed in, we record, linked to your account, the pages you open and the actions you take on the platform, without storing the content of the pages or what you type, to find errors and provide support. Our team can consult this record, including while the session is open. On the public pages of the website, only with your consent
• Performance metrics (loading times, network type, operating system and country) and daily usage time
• Error reports, which may include a screenshot taken at the moment of the error with the content that was visible (on the website, images are hidden and password fields are omitted; in the mobile apps, no screenshot is taken on the home, workouts, nutrition, habits, supplements, calendar, progress, assessments, anamnesis, questionnaires, messages, food diary, files, payments, notifications, support, account and sign-in screens, and the report is sent without an image); only the technical team has access to them
• In the mobile apps, you can turn off in Settings → Privacy (“Share errors and performance”) the sending of error reports and screenshots, performance metrics, usage analysis and usage time. The choice is stored on each device: if you use the app on more than one, turn it off on each
• Notifications: browser push subscriptions and, in the apps, the device token, the platform and the provider
• In the mobile apps, device integrity verification (Google Play Integrity on Android and App Attest on iOS) at registration and sign-in, and the app version
• Source of professional account registrations: the channel you indicate in the form and, only with your consent to ad measurement, the landing page, the referring site, the campaign parameters and the ad click identifiers
• Audit logs: sensitive actions and copies of each change to accounts, to relationships between professional and client, to plans, to assessments and to payments
• Data stored on the device: preferences, session and, in the apps, a copy of the coaching content for offline use

2.9 Other data

• Referral program: the email of the person you invite, so that we can send them the invitation on your behalf, and that person's refusal, if they refuse, so that they do not receive invitations again
• Partnership with AAUTAD: student number and institutional student email, confirmed by a code sent to that email, and whether they appear on the list of members that AAUTAD provides to us
• Offer for UMAIA students: the @umaia.pt email, confirmed by a code sent to that address, so that each address activates the offer only once and on a single account
• Waitlist: if you signed up before the launch and later created an account, we keep the email, the sign-up date and the language for as long as the account exists, to recognise early supporters with the supporter badge
• Marketing emails to professionals: for each message, its sending and clicks, the request to stop receiving messages and, if you pay for a plan within the following 60 days, the date and amount of that payment
• Public forms created by professionals: the IP address and browser of the person responding, to prevent abuse
• Reports: the address of the reported profile, the reason, the explanation and, if you provide them, your name and email, as well as the IP address and your account, if you are signed in or, for a report by email, if you have an account with that address. We use them to handle the report and reply to you and, in the case of the IP address, to prevent abuse. We only disclose your identity to the professional concerned where strictly necessary

2.10 My app (the app bearing the professional's brand)

• App listing: when a professional subscribes to the “My app” add-on service, we store the name, icon, description, screenshots and support email they give for the app, which we publish on the App Store and Google Play
• The professional's Apple account: the iOS app is published in the professional's own Apple Developer account. We store that account's Team ID and the App Store Connect API key the professional creates for us with Admin access (Key ID, Issuer ID and the .p8 file). The .p8 key is stored encrypted on our servers. The professional also invites our address [email protected] with the Admin role to their team in App Store Connect
• What for: with the key and that access we register the app, create the certificates and the notification key, build the app, submit it to Apple, handle the review and find the app on the App Store to store the store link. We do not use them for anything else
• Who has access: only our administration team. The key is only decrypted to find the app in App Store Connect and to build and submit the app; each download is logged with the key's identifier (section 8.3), and the copy used for the build is deleted at the end
• Expo: we build and submit the app with Expo's EAS service (section 5.1), which stores, encrypted, the App Store Connect key, for later submissions, and the certificates and notification key created in the professional's Apple account. The professional can revoke them at any time in App Store Connect and the Apple Developer portal; without them we can no longer update the app
• Google Play: the Android version is published in our own Google Play account, with no Google credentials from the professional. We read the app's signature there, a technical value, for the apps' integrity check (section 2.8)
• When we delete it: the Key ID, the Issuer ID and the .p8 key are deleted from our servers when the add-on service ends for good, when the app is discontinued, when we ask the professional for new credentials and when the account is deleted. In those cases we also remove the key stored at Expo and ask the professional to revoke it in App Store Connect; when the service ends, they can also remove our address's Admin access. The Team ID is kept until the account is deleted, because it is inside every installed version of the app and is what we check the iOS app against; the app's name, description, screenshots and support email are deleted from our servers with the account, and in that case we remove the app from Google Play
• Legal basis: performance of the contract for the add-on service (section 3). Without the Apple account and the key we cannot publish the app on the App Store

3. What we use data for and on what legal basis

Providing the Service (performance of the contract): creating and managing accounts, platform features, the connection between professional and client, integrations you enable, the app bearing the professional's brand (section 2.10), support, public profiles, coaching requests, the AAUTAD and UMAIA partnerships and the record of the acceptance of the Terms and of the declarations made at registration and when publishing the profile, which we keep after the end of the contract in our legitimate interest in proving what was accepted.

Visitor contacts and referral invitations (legitimate interest): delivering to the professional the message a visitor leaves for them on a public profile and sending, at the request of the person inviting, an invitation to the person they indicate, at most one per address and with a link to refuse.

Professional numbers on the public profile (performance of the contract and legitimate interest): showing on the profile the numbers the professional provides, with the link to the official register, is part of the public profile they asked for. Providing a number is optional, but without the registration number the professional is not presented as a nutritionist or dietitian. The log of attempts to use a number that is already on another profile is based on our legitimate interest in preventing the misappropriation of numbers. When we review a report or check a case on our own initiative, we may consult the official register and report the facts to the Order of Nutritionists, IPDJ or the authorities, in our legitimate interest in the directory not misleading people who are looking for a professional.

Billing and legal obligations (legal obligation): subscriptions, invoices, tax and accounting obligations, handling of reports (Article 16 of the Digital Services Act and Terms, section 14), whose relevant content may be communicated to the person concerned, and responding to authorities.

Security and abuse prevention (legitimate interest): authentication, access and audit logs, technical limits, anti-bot protection and device integrity verification.

Platform reliability and improvement (legitimate interest): usage analysis in the signed-in areas, performance and error reports (section 2.8). You can object via [email protected] and, in the mobile apps, by turning off “Share errors and performance” in Settings → Privacy.

Service communications (performance of the contract and legitimate interest): account, security, subscription, invitation, reminder and notification emails.

Website statistics and ad measurement (consent): see section 11 and the Cookie Policy.

Marketing information to professionals (consent; for older accounts that have already paid for a plan, legitimate interest): see section 12.

Supporters wall (legitimate interest in recognising those who supported the launch): you can ask to be removed at any time.

Clients' health data: see section 4.

4. Health data

The health data that a professional records or receives about their clients is processed in the context of the coaching and in accordance with the professional's instructions. The health data that a client records in their own account, without being linked to a professional, is processed by us to provide the Service to that client. We do not use it for advertising, we do not sell it and we do not use it to train artificial intelligence models.

The professional, as data controller, must have a legal basis under Article 9(2) of the GDPR: as a rule, the client's explicit consent; health professionals bound by professional secrecy, such as nutritionists registered with the Order of Nutritionists, may also process it under point (h) and paragraph 3 of the same article and Article 29 of Law no. 58/2019. The client gives that consent when connecting with the professional, through a dedicated checkbox that is recorded, and may withdraw it at any time by ending the connection in the app or on the website, or by asking the professional.

Those who access this data on our behalf are subject to a duty of confidentiality and secrecy.

5. Who we share data with

We never sell personal data. We share it only:

Between professional and client: the professional, and the members of their team to whom they grant permission, access their clients' data in the course of coaching; the client accesses what is assigned to them and, in group conversations created by the professional, the other participants see the client's name, photo and messages. With the authorisation you give when you connect, a professional you connect with also sees the training, food, supplement and habit history you recorded in your account, including what came before the connection, and the anamnesis you answered for a previous professional you disconnected from or who deleted their account; a professional whose relationship with you has ended no longer sees what you record after it ended.

With the public: the professional's public profile, when activated, and the supporters wall (name, photo and badge).

With our providers: the providers listed in section 5.1, which process the data on our behalf, or as independent controllers where indicated.

With the Order of Nutritionists and IPDJ: if a number provided on a profile appears to be false or to belong to someone else, we may report the facts to those bodies or to the authorities (Terms, section 12).

With authorities: when required by law or for the defence of rights in legal proceedings.

In transactions involving the business: if the operation of MyFitnessClient passes to another entity, under section 28 of the Terms, the data goes with it, with the same safeguards.

5.1 Providers and recipients

This list is kept up to date on this page. Conversations with us on WhatsApp go through the WhatsApp (Meta) service.

5.2 Google Calendar integration

If you voluntarily connect your Google account, the app creates a dedicated calendar (“MyFitnessClient”) in your Google account and accesses only that calendar, to create, update and remove the events corresponding to your sessions on the platform (dates, titles, descriptions, locations and technical identifiers), and the email of the Google account. The use of data obtained through Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements: this data is not used for advertising, is not sold or transferred to third parties and is not used to train artificial intelligence models. You can disconnect the integration at any time on the platform or in your Google account.

5.3 Access by our team

Access to production data is limited to authorised staff, who are bound by confidentiality. To resolve a support request, an error or a security problem, those staff may enter an account and use it as the account holder, for a maximum of 4 hours, and each access is logged. During such access, private files (progress and assessment photos and documents) are not shown; whatever the staff save is recorded in the account, like any other change. The administration tools show that private files exist, never their content; the exception is a photo that was on the mobile app screen when an error occurred, on a screen where screenshots are taken, and which may appear in the screenshot of that report (section 2.8).

6. International transfers

The main servers are in the European Union (Germany). Some providers listed in section 5.1 operate global networks and may process data outside the European Economic Area. In those cases, we rely on the safeguards in Chapter V of the GDPR: adequacy decisions of the European Commission, including the EU-U.S. Data Privacy Framework where the provider is certified, and/or Standard Contractual Clauses. You can request a copy of the applicable safeguards via [email protected].

7. Security

• Encryption in transit (HTTPS/TLS) for connections over the Internet
• Passwords stored as hashes; two-factor secrets and connections to external services encrypted on our servers
• Two-factor authentication, by email or authenticator app, with recovery codes
• Separation of data by account and by team, with permissions
• Attempt limits, anti-bot protection and access monitoring
• Audit logs of sensitive actions and of support access
• Database backups

In the event of a personal data breach affecting data we process as controller, we notify CNPD and the affected persons when the law requires it (Articles 33 and 34 of the GDPR). Where the data belongs to a professional's clients, we notify the professional without delay, so that they can meet their obligations.

8. Retention and deletion

8.1 Deleting your account

If you are a client, you can delete your account in the mobile app (Settings → Delete account); if you are a professional, you can close it on the website (Settings → Profile → “Close account”); anyone can also request deletion by email to support, as explained on the account deletion page. In the app, the account is deactivated immediately. If you are a professional who has clients with periods already paid, the account is only deleted on the last day of those periods, at most 3 months after the request, so that they receive what they paid for; until then, the data remains as it was. Your name, email, contact details, profile, public profile (the username remains reserved), the files in your personal area, sessions, the Google or Apple sign-in link and the connection to Google Calendar are deleted or replaced with meaningless values within a maximum of 30 days. The photos and files you sent to a professional, and the deletion notice with your name that they receive, remain with that professional (section 8.2). We keep, for the periods in section 8.3, invoicing documents, audit logs (which include copies of the changed data), the history of sign-ins and administrative access, error reports, backups and the record of the acceptance of the Terms and of the declarations, as well as a record of the deletion with the name and email the account had, for as long as necessary for us to prove that we carried it out. Other data that remains associated with the anonymised account, such as the records you made without a link to a professional and support requests, is deleted at your request. If you are a professional who sold courses, those courses, with the videos, files, workouts and plans they use, remain available to those who bought them until the end of each buyer's access guarantee, with no new sales, and are deleted afterwards (Terms, section 10); we also keep your name and contact email for 2 years after the deletion, only for buyers' complaints and refunds (Article 17(3)(e) of the GDPR), and the billing details for the period required by law. If you are a client and delete your account with outstanding payments owed to a professional, your name and email remain linked to those payments for 2 years counted from the deletion, visible only to that professional and to the members of their team with access to payments, so that they can collect them, and are deleted earlier if the debt is paid or cancelled (Article 17(3)(e) of the GDPR).

8.2 Data managed by a professional

The coaching data that a professional recorded or received (assessments, anamnesis, training and food logs, check-ins, messages) forms part of that professional's records, and the professional is the data controller. When you delete your account, that data is no longer associated with your name, email and contact details, but it remains in the professional's account until they delete it. You can ask the professional to delete it, or ask us to forward the request to them. Each professional with whom you had ongoing or scheduled coaching receives, on the platform and, depending on their settings, by email and push notification, a notice with your name saying that the account was deleted and that the coaching has ended. On the platform, the notice is deleted once it has been read and 90 days have passed since it was sent; until it is read, it stays in their account. The email stays in their mailbox. If it is the professional who deletes their account, what they created (plans, the assessments they made, notes and their messages) is deleted within 30 days; what you recorded in your account stays with you, except the photos and files you sent them, which are deleted with their account, and, if you are connected to them, we let you know by email. The photos and files you sent to a professional may also be deleted 1 year after they stop having a paid plan; in that case, only the professional is notified. The data of people recorded by a professional without an account of their own is managed by that professional and is deleted if they delete their account.

8.3 Retention periods

Inactive accounts: an account with no activity at all for 12 months may enter a deletion process, with email notices, deactivation, with immediate deletion of the hosted files, and, after a 30-day recovery window, deletion. Simply signing in stops it. This does not apply to accounts with an active subscription or with payments in the last 12 months, nor to professionals with active clients.

9. Your rights

Access: obtain confirmation and a copy of your data.

Rectification: correct inaccurate or incomplete data.

Erasure: request the deletion of your data.

Portability: receive the data you provided to us in a structured, commonly used and machine-readable format.

Objection: object to processing based on legitimate interest and, in any case, to marketing communications.

Restriction: restrict processing in certain circumstances.

Withdrawal of consent: at any time, without affecting processing already carried out.

To exercise these rights, write to [email protected]. We respond within one month, which may be extended by a further two months where the complexity or number of requests so requires (Article 12(3) of the GDPR). For data managed by a professional, contact that professional (section 1). You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt).

To create an account we need your name, your email and a password (or sign-in with Google or Apple) and, for client accounts, also your gender and date of birth (in the app, with Google or Apple, only your date of birth); without them we cannot create the account. The remaining data is optional or recorded by the professional. The data you did not give us directly comes from the professional who coaches you or who invited you, from Google and Apple (sign-in), from Cloudflare (the country from which you created the account), from Stripe (payment status), from AAUTAD and, when we review a report or check a case on our own initiative, from the person who submitted the report and from the public registers of the Order of Nutritionists and IPDJ.

10. Automated decisions

• Inactive accounts: the process in section 8 is automatic; you receive notices before deactivation, and simply signing in stops it
• Values calculated from the measurements (BMI, estimated body composition, energy requirements): these are calculations to support the professional and do not produce decisions about you or disease risk classifications; coaching decisions are always the professional's

We do not take any other decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

11. Cookies and measurement

On the website, cookies and browser storage that are not essential (statistics, ad measurement and the source of visits coming from ads) are only used with your consent, which you can give, refuse or withdraw at any time in “Cookie settings”, in the website footer. With consent, we use Google Analytics 4 for statistics on visits to the public website and OpenAI's and Meta's ad measurement pixels. If you create a professional account after accepting ad measurement, we also send OpenAI and Meta, from our server, the registration event with your email and account identifier hashed (SHA-256), your IP address, your browser and, for Meta, the browser and click identifiers, to find out whether the registration resulted from one of our ads on ChatGPT, Facebook or Instagram. For collecting this data and sending it to Meta, we are joint controllers with Meta Platforms Ireland Limited, which then processes it as an independent controller under Meta's privacy policy. This measurement does not run in the signed-in areas. Usage analysis of the platform itself is described in section 2.8. The list of cookies, with their names and durations, is in the Cookie Policy.

12. Notifications and marketing communications

We always send the emails that the account and the contract require: account verification, security, subscription and billing (including failed payments), inactivity and file deletion notices, changes to the Terms and moderation decisions. Other service emails, such as reminders, messages, activity and notices about the operation of the app, and push notifications can be turned off in settings; push notifications require your permission.

In the mobile apps, notifications pass through the Expo service and then through the Apple (iOS) or Google (Android) service, which receive the device token and the notification text. That text may include, for example, the name of the person who wrote to you and the beginning of the message, the name of a meal or event, the amount of a payment or the text of a habit reminder. On the website, the content travels encrypted to your browser. You can hide previews on the lock screen in the device settings.

We only send professionals who have an account MyFitnessClient tips, news, special offers and other promotional emails if they ask for them: in the sign-up checkbox, which is left unticked, or at any time in Settings → Notifications. For accounts created before this option, we ask first in the app: if you have already paid for a plan, we send them until you refuse them; if you have never paid, only if you ask. You can stop receiving them at any time, free of charge, in Settings → Notifications, through the link included in each message or through support. Refusing them does not affect service emails. We do not send marketing communications to professionals' clients. In the referral program, we send an invitation on your behalf to the address you provide; each address receives at most one invitation, with a link to refuse further invitations.

13. Video and audio calls

One-to-one calls are established directly between the participants (WebRTC) whenever possible; to establish them we use Google STUN servers, which receive the participants' IP addresses. When a direct connection is not possible, audio and video pass, encrypted, through a relay server of ours, and group calls pass through a media server of ours, both hosted in Germany. We do not record or store the content of calls (section 2.4).

14. Mobile apps

The apps access the camera (photos and barcode scanning), the microphone (audio messages), the files and photos you choose and notifications only when you use those features and with your permission. They do not carry out advertising tracking.

Noise suppression in website calls and barcode scanning in the apps use machine learning models that run only on your device; images and sound do not leave the device for that purpose. We do not have generative artificial intelligence features.

15. Changes to this policy

We may update this policy. When there are material changes, we will notify you by email or on the platform before they take effect. The date of the last update is shown at the top of this page.