Privacy Policy

FitgenZ ("we," "us," "our," or "Company") operates the FitgenZ AI mobile application and website at fitgenz.live (collectively, the "Services").

We are committed to protecting your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), Information Technology Act, 2000 and its rules, and applicable international standards.

This Privacy Policy explains what data we collect, why we collect it, how we use it, who we share it with, and your rights as a Data Principal under Indian law.

By creating an account, you confirm you have read this policy and provided free, specific, informed, and unambiguous consent as required by the DPDP Act 2023.

Data You Provide Directly

Account Information: Full name, email address, password (stored as encrypted hash, never in plain text), profile photo (optional).

Health and Body Metrics: Age, height, weight (current and goal), fitness goals (weight loss, muscle gain, maintenance, endurance), dietary preferences (vegetarian, vegan, non-vegetarian), daily calorie and macro targets.

Fitness Activity Data: Workout sessions (exercises, sets, duration, calories burned), daily meal logs (food names, estimated macros, meal photos), water intake logs, daily weight logs.

Communication Data: Messages sent to Coach Riya (AI coach), feedback submitted through the app.

Data Collected Automatically

Device and Technical Data: Device type, operating system version, app version and crash logs, IP address (used only for security), FCM token for push notifications.

Usage Data: Features used and frequency, screens visited within the app, time spent in app sessions.

Data from Third-Party Integrations

Health Connect (Android Health Platform): Active calories burned and total calories burned (read only). This data stays on your device; we read it to calculate your daily calorie balance.

Location Data: Approximate location (when verifying proximity to a partner gym for gym discount eligibility). Precise location is requested only for gym verification and not stored after verification is complete.

Camera and Photos: Food photos (processed for meal identification, not permanently stored unless you save them to Progress Story). Progress photos (stored encrypted, visible only to you). Gym selfies for shareable cards (processed on-device, never uploaded unless you choose to share).

Audio (optional): Voice input to Coach Riya (processed via ElevenLabs API, not permanently stored).

Sensitive Personal Data

The following categories are classified as Sensitive Personal Data under Indian law and are handled with additional protections:

• ▹ Health and medical information (weight, body metrics, dietary data)
• ▹ Biometric data (progress photos processed for body transformation tracking)
• ▹ Location data

You provide explicit, separate consent for sensitive personal data collection during account setup. You may withdraw this consent at any time from Settings > Privacy.

Core Service Delivery (Lawful basis: Contract): Create and manage your account, calculate daily calorie and macro targets, identify food from photos, generate and track workout plans, calculate your Health Score, manage your streak and consistency points, display your rank on gym and global leaderboards (display name and points only).

AI Features (Lawful basis: Consent): Personalised coaching responses from Coach Riya, daily nutrition fact cards, meal suggestions based on your goals and mood, skin analysis (Glow Arc feature).

Social and Community Features (Lawful basis: Consent): Display your name and points on gym leaderboard (when you join a gym), enable FitgenZ Duo shared streaks with your chosen partner, enable trainer dashboard visibility (only when you accept a trainer connection).

Notifications (Lawful basis: Consent): Workout reminders, meal logging reminders, streak protection alerts, health score updates, achievement and badge notifications.

Service Improvement (Lawful basis: Legitimate interest): Analyse aggregate, anonymised usage patterns to improve the app, fix bugs and improve performance, train our food identification model using anonymised correction data (when you use the thumbs-down feedback button).

Legal Compliance (Lawful basis: Legal obligation): Comply with court orders, government requests, or applicable law, enforce our Terms of Service, protect against fraud and security threats.

We do not sell your personal data. Ever.

We share data only as described below:

AI and Technology Providers

xAI (Grok API): Food identification, exercise classification, Coach Riya responses. Data shared: food photos, activity descriptions, user messages. Retention per xAI's API terms. See x.ai/privacy.

Google (Gemini API): Food identification (primary model). Data shared: food photos. Retention per Google's API terms. See policies.google.com/privacy.

ElevenLabs: Voice responses from Coach Riya. Data shared: text for voice synthesis. See elevenlabs.io/privacy.

Supabase: Database, authentication, file storage, edge functions. All app data is stored on Supabase infrastructure (AWS); data may be stored outside India. See supabase.com/privacy.

Firebase (Google): Push notifications (FCM). Data shared: FCM token, notification content. See firebase.google.com/support/privacy.

Resend: Transactional email (welcome email, alerts). Data shared: email address, name. See resend.com/privacy.

Google Play Billing: Premium subscription processing. Data shared: purchase token only (we do not receive card details).

Gym Partners

When you join a gym's leaderboard on FitgenZ, your display name and consistency points are visible to other gym members. Your active streak days are visible to other gym members and the gym trainer. Specific meal logs, weight, and health score details remain private.

Gym partners are bound by a Gym Partnership Agreement that prohibits them from using member data for any purpose other than providing in-gym fitness services.

Legal Requirements

We may disclose your data when required by court order or legal process, requests from Indian government authorities under applicable law, or to protect the rights, property, or safety of FitgenZ, our users, or the public.

Business Transfers

If FitgenZ is acquired, merged, or its assets are transferred, your data may be transferred to the acquiring entity. We will notify you via email or in-app notification before any such transfer occurs.

We retain your data only as long as necessary for the purposes outlined in this policy.

• ▹ Account data: Until you delete your account, plus 30 days for recovery purposes.
• ▹ Health and fitness logs: Until account deletion.
• ▹ Food scan photos: Not stored after processing, unless saved to Progress Story.
• ▹ Progress Story photos: Until you delete them or your account.
• ▹ Notification logs: 90 days.
• ▹ Crash and error logs: 30 days.
• ▹ Anonymised aggregate data: May be retained indefinitely for product improvement.

After account deletion, we may retain limited data for up to 6 months for fraud prevention and legal compliance purposes, after which it is permanently deleted.

As a Data Principal under the DPDP Act 2023, you have the following rights:

Right to Access: Request a summary of what personal data we hold about you. Settings > Privacy > Request My Data.

Right to Correction: Correct inaccurate or incomplete personal data. Directly in the app (profile settings) or email support@fitgenz.live.

Right to Erasure: Request deletion of your personal data. We will delete your account and associated data within 30 days. Settings > Account > Delete Account or email piyush@fitgenz.live.

Right to Withdraw Consent: Withdraw any consent at any time. Withdrawal for core features will result in inability to use those features. Settings > Privacy > Manage Consents.

Right to Grievance Redressal: Contact piyush@fitgenz.live. Response within 48 hours.

Right of Nomination: Nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. Email piyush@fitgenz.live with a written nomination.

To exercise any of these rights, contact us at piyush@fitgenz.live. We will respond within 30 days.

• ▹ All data transmitted between the app and our servers uses TLS 1.3 encryption.
• ▹ Passwords are hashed using bcrypt and never stored in plain text.
• ▹ Progress photos are stored encrypted with row-level security.
• ▹ Supabase row-level security (RLS) ensures users can only access their own data.
• ▹ FCM tokens are stored securely and rotated on each app launch.
• ▹ Access to production databases is restricted to authorised personnel only.
• ▹ Regular security audits of edge functions and API endpoints.

Despite these measures, no system is 100% secure. In the event of a data breach that is likely to result in high risk to your rights and freedoms, we will notify you within 72 hours as required by applicable law.

FitgenZ uses global cloud infrastructure. Your data may be processed or stored outside India by our service providers (Supabase on AWS, Google, xAI, ElevenLabs).

Where data is transferred outside India, we ensure appropriate safeguards are in place through contractual data processing agreements with each provider and use of providers with recognised privacy certifications.

Our website fitgenz.live uses essential cookies (required for the website to function) and analytics cookies (to understand how visitors use the site — anonymised).

We do not use advertising or tracking cookies. You can disable non-essential cookies through your browser settings.

The FitgenZ Android app does not use browser cookies. We use Firebase for crash analytics only.

We access Android Health Connect to read active calories burned and total calories burned.

This data is used only to calculate your daily calorie balance within FitgenZ. It is not shared with any third party other than our Supabase backend for storage in your account.

You can revoke Health Connect access at any time through Android Settings > Health Connect > App permissions > FitgenZ.

We may update this Privacy Policy from time to time. When we make material changes we will notify you via in-app notification, update the "Last Updated" date at the top of this policy, and for significant changes affecting your rights we will request fresh consent.

Continued use of FitgenZ after notification of changes constitutes acceptance of the updated policy.

As required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and DPDP Act 2023:

Grievance Officer: Piyush Verma

Email: piyush@fitgenz.live

Address: Prayagraj, Uttar Pradesh, India

Response time: Acknowledge within 24 hours, resolve within 30 days.

Privacy questions, data requests, and consent withdrawal:

Email: piyush@fitgenz.live

Support: support@fitgenz.live

Website: fitgenz.live

FitgenZ AI — Prayagraj, Uttar Pradesh, India