Privacy Policy

Who we are

Fitnesta is operated by Bheema Network (“we”, “us”). This policy explains how we handle personal information in the Fitnesta apps for iPhone and Android and on this website. You can contact us at support@fitnesta.com.

It applies to members, trainers, business owners and staff, and to people whose information a business or trainer adds to Fitnesta, such as gym members, clients and enquiries.

The short version

• We collect what you give us, what the people you train with or belong to a gym with record about you, and technical information needed to run and secure the service.
• Some of it is sensitive: assessments can include health information, and progress photos and body measurements are personal.
• Trainers and businesses can send client and member information to our AI provider, Anthropic, to draft content.
• We use service providers to host, secure and operate the service. We do not sell personal information, show third-party advertising or use advertising trackers.
• You can control visibility, notifications and marketing in the app, and you can delete your account. See Privacy choices.

Information we collect and why

What we collect depends on how you use Fitnesta. For each kind of information, here is what it is and why we use it.

Account and sign-in information

What: your name, username, email address, phone number, and how you sign in — email and password, a one-time code sent by SMS, Sign in with Apple, or Google Sign-In. Passwords are stored only as a one-way hash. When you use Apple or Google, we receive an account identifier and, where the provider shares them, your email address and name. We also record when you accepted the Terms of Use and this policy, whether you agreed to marketing, and the devices where you are signed in.

Why: to create your account, sign you in, verify your phone number, keep your account secure and prevent abuse.

Profile information

What: your profile photo, bio, date of birth, gender (optional), city and area, languages, fitness level, interests, goals, availability and training preferences, and the kind of workout partner you are looking for (for example an age range, genders and fitness levels).

Why: to show your profile to other people according to your settings, to confirm you are 18 or over, and to suggest workout partners, trainers, gyms, classes and communities.

Location

What: if you allow it, your device's location while you are using the app, and the city and area you enter. The app does not request location in the background.

Why: to find people, gyms, classes and events near you. Exact coordinates stay on our servers: other people see your area and a distance range, never your precise location.

Trainer and business information

What: for trainers, your professional profile, services, specialisations, certifications, availability and training locations. For businesses, the business and branch details, opening hours, facilities, photos, membership plans, classes, staff and their roles, and information submitted for verification.

Why: to publish your listings, let people book and contact you, review verification requests and run your workspace.

Fitness, health and progress information

What: information you or a trainer you work with record, including:

• Assessments — answers to intake and review questionnaires. These can include health screening questions, such as whether you have a heart condition, feel chest pain during activity, have a chronic medical condition, take prescribed medication, or have injuries or pain to work around.
• Body measurements — such as weight, body-fat percentage and waist, chest, arm, thigh, hip and neck measurements.
• Progress photos.
• Training records — assigned workouts and programmes, workout logs, perceived effort, notes, goals, and class attendance.

Why: so you and the trainers you work with can plan training and track progress. Progress photos are visible only to you and, if you choose to share them, the trainers you work with. We treat this information as sensitive: it is never sent to our analytics provider, and it is sent to our AI provider only when a trainer asks the assistant for a draft that needs it (see AI features).

Information businesses and trainers add about people

What: gyms, studios and trainers can keep records about their members, clients and enquiries, including people who do not have a Fitnesta account. These records can include name, phone number, email address, member code, membership plan, join and expiry dates, status, notes, tags, attendance, and dues and payments the business records as received. Businesses can add these records one at a time or by importing a CSV or Excel file.

Why: so the business or trainer can manage their members and clients, run classes, follow up on enquiries and send payment reminders. The business or trainer decides what to add and is responsible for having the right to add it and to contact those people. We process these records to provide the service to them. Uploaded import files are deleted automatically after a limited period.

Posts, comments, messages and community content

What: posts (text, images and polls), comments, likes, saved posts and poll votes; communities, events and activities you create or join; reviews and ratings; connections, follows and blocks; and direct and group messages.

Why: to provide these features and show content to the people you choose. Messages are stored on our servers so they can be delivered to the people in the conversation and synced across your devices. Content, including messages, may be reviewed when someone reports it.

Bookings and enquiries

What: sessions, classes, events and activities you book or join, cancellations, and enquiries you send to trainers or businesses.

Why: to make the booking or enquiry and share it with the trainer or business involved.

Reports and safety

What: reports you make (the reason and any description), the content or account reported, and the moderation actions we take, including suspensions and bans.

Why: to review reports, enforce the Terms of Use and keep people safe.

Subscription and purchase information

What: for trainer and business subscriptions, the plan, status, trial and renewal dates, and the transaction identifiers and notifications that Apple or Google send us about the purchase. Payments are made through the App Store or Google Play; we do not receive your card or bank details.

Why: to unlock the features you paid for, restore purchases and handle renewals, cancellations and billing issues.

Notifications, SMS and WhatsApp

What: push notification tokens with your device platform, app version, language and time zone; your notification settings; your phone number when we send a sign-in code by SMS; and, for gym members, the phone number a business has recorded so it can send payment reminders over WhatsApp, with delivery status and any STOP or START replies.

Why: to deliver notifications and codes, send reminders a business has set up, and honour opt-outs.

Device, usage and diagnostic information

What: the IP address, device and browser details of requests to our servers; records of the devices where you are signed in; product usage events (for example which feature was used, with record identifiers — never free text you typed, exact location or health information); error reports and performance traces; and server and security logs.

Why: to keep the service secure, detect abuse, fix problems and understand which features are used.

Support and account requests

What: the messages you send us and our replies, and, if you give one, the reason you deleted your account.

Why: to answer you and to act on requests such as account deletion.

AI features

Trainers and businesses on Fitnesta can use an AI assistant to draft content. Members do not use it, but information about a trainer's clients or a business's members can be part of a request.

What the assistant drafts. For trainers: workout and programme drafts, exercise substitutions, assessment summaries, progress summaries and client follow-up messages. For businesses: performance summaries, messages to a member, lead summaries, attendance patterns, re-engagement campaigns and trainer utilisation summaries.

Who receives the information. Requests are processed by Anthropic, PBC, which provides the AI model that writes the draft.

What may be sent. Only what the chosen draft needs:

• the kind of draft and any instructions the trainer or business types;
• for trainer drafts: a client’s first name, status, fitness level, goals, days since their last session, workout completion counts, answers to a selected assessment (which can include health information), body measurements, a summary of logged exercises, and exercises from the library;
• for business drafts: business and branch names, and figures about the business such as membership, retention, attendance, class, trainer, lead and revenue totals; and for member or lead drafts, a member’s first name, status, plan and membership dates, or an enquiry’s name, status and message.

The assistant is designed not to receive surnames, phone numbers, email addresses, street addresses or photos, unless someone types them into the instructions.

Why. To produce the draft the trainer or business asked for. The request and the draft are stored in their workspace.

Accuracy. AI-generated drafts can be inaccurate, incomplete or unsuitable. They are starting points, not advice: the trainer or business must review and edit a draft before using it or sending it to anyone. A draft is not medical advice.

Automated image checks

Images attached to posts are sent to Sightengine, which checks them automatically for nudity, weapons, alcohol, drugs and offensive content shortly after they are posted. A post whose image fails the check is hidden from other people. Anyone can also report content, and reports are reviewed by our moderators.

How information is shared

With other people on Fitnesta

• Your profile, posts and activity are shown to other people according to your privacy settings and the visibility you choose for each post.
• Trainers and businesses you book with, enquire with or are a member or client of can see the information needed to serve you — for example your bookings and attendance, and for trainers, the assessments, measurements, progress photos and workouts connected to your client relationship.
• People in a conversation can see the messages sent in it.

With service providers

We use service providers to run Fitnesta. They process information for us, for the purposes below:

• Supabase — hosts our database and stores uploaded files such as profile, post and progress photos.
• Railway — runs our application servers and background jobs.
• Anthropic — generates AI drafts for trainers and businesses, as described above.
• Sightengine — checks images attached to posts for nudity, weapons, alcohol, drugs and offensive content.
• Sentry — collects error reports and performance traces from our servers so we can fix problems. These can include details of the request that failed.
• PostHog — receives product usage events from our servers to help us understand which features are used.
• Apple Push Notification service and Firebase Cloud Messaging (Google) — deliver push notifications to iPhone and Android devices.
• MSG91 — sends sign-in codes by SMS, and sends WhatsApp payment reminders on behalf of businesses and reports their delivery.
• Apple and Google sign-in — if you choose Sign in with Apple or Google Sign-In, the provider confirms your identity to us.
• Apple App Store and Google Play — process subscription payments and tell us the status of a purchase.
• Apple Maps and Google Maps — display maps in the app (Apple Maps on iPhone, Google Maps on Android). The map provider receives the area of the map being shown.
• Google Workspace — hosts our support email.

For legal and safety reasons

We may disclose information where we reasonably believe it is required by law or legal process, or needed to protect the safety, rights or property of our users, the public or Bheema Network.

If the service changes hands

If the Fitnesta service is reorganised or transferred, information may be transferred as part of that, and this policy will continue to apply to it.

We do not sell personal information.

Where information is processed

Our service providers operate infrastructure in several countries. Your information may be stored and processed outside the country where you live, and we rely on those providers to protect it.

How long we keep information

• We keep your account information while your account is open.
• When you delete your account, it is disabled immediately and some information is deleted straight away, but most account information is not yet deleted automatically. Account deletion explains exactly what is removed today and how to ask us to erase the rest.
• Records a business or trainer keeps about its members, clients and enquiries stay until that business or trainer deletes them.
• Temporary files, such as uploaded member import files and generated report exports, and the history of WhatsApp reminders, are deleted automatically after a limited period.
• A record that a phone number has opted out of WhatsApp reminders is kept so that the opt-out keeps working.
• We may keep information for longer where we need it to meet legal obligations, resolve disputes, prevent fraud or abuse, or enforce our terms.

Your choices and rights

You can view and update most of your information in the app, change who can see your profile, control notifications and marketing, and delete your account. Privacy choices lists every control.

Depending on where you live, you may have rights to access, correct or erase your personal information, to withdraw consent, and to complain to a data protection authority. To make a request, email support@fitnesta.com. We may need to confirm that the account is yours before we act, and we will respond in line with applicable law.

If a business or trainer holds a record about you, you can also ask them directly, as they decide what that record contains.

Consent and withdrawing it

• Location: allow or deny it in your device settings at any time.
• Push notifications: turn them off in your device settings, or per category in the app.
• Marketing: off unless you agree at sign-up; turn it off at any time with the Marketing switch in notification settings.
• WhatsApp payment reminders: reply STOP to stop reminders from that business, STOP ALL to stop all reminders sent through Fitnesta, and START or START ALL to receive them again.
• Withdrawing consent does not affect processing that already took place.

Security

We take reasonable measures to protect personal information, including encrypted connections (HTTPS) between the app and our servers, one-way hashing of passwords, access controls that limit who can see each record, private storage for sensitive files, rate limiting, and the ability to see and sign out the devices where you are signed in. No service can guarantee complete security, so please use a strong password and tell us at support@fitnesta.com if you think your account has been compromised.

Children

Fitnesta is only for people aged 18 and over, and you must be 18 or over to create an account. The app is not directed at children. If we learn that an account belongs to someone under 18, we will disable it. If you believe a child has created an account, contact support@fitnesta.com.

Businesses and trainers must not add information about a child to Fitnesta unless they are legally permitted to, for example with a parent's or guardian's consent.

Changes to this policy

We will update this policy when our practices change, and change the date at the top of the page. If a change is significant, we will take reasonable steps to let you know, for example in the app.

Contact

Bheema Network, operator of Fitnesta: support@fitnesta.com.