PRIVACY POLICY

1. Controller

The controller within the meaning of the Datenschutz-Grundverordnung (GDPR) is:

Nikhil Dingra
Lassallestr. 51
21073 Hamburg
Germany

Phone: +49 152 03285557
E-mail: info@fitwithnikhil.de

2. Overview of processing activities

FitWithNikhil is an app for individual fitness and nutrition coaching. In order to create and continuously adapt your personal training and nutrition plan, we necessarily process information about your body, your training, your diet and - if you upload them - photos of your progress. This statement describes in detail what this data is, what we use it for and to whom it may be disclosed.

3. Registration and user account

When you register, we collect your name, your e-mail address and a password chosen by you (stored in encrypted form). Alternatively, you can sign in via Google (OAuth) - in this case we receive the name and e-mail address of your Google account from Google, but no further data and no access to your Google account itself.

The technical basis for login and data storage is the service Supabase (Supabase Inc.). A data processing agreement with Supabase is in place. The legal basis is Art. 6(1)(b) GDPR (performance of a contract - use of the app would not be possible without an account).

4. Coaching by independent coaches

FitWithNikhil can also be used by other, independent trainers who coach their own clients through this app. You can tell whether this applies to you by the fact that your coach's name and, where applicable, logo appear in the app and that you registered via their invitation link.

If you are coached by such a coach, the following applies:

• Your coach can view the data generated in the course of the coaching relationship: your name and e-mail address, your onboarding information, your training, nutrition and supplement plans, your logged training and nutrition data, weight and body measurements, progress photos you have uploaded, your feedback, and your chat history.
• Other coaches have no access to your data. Access is technically restricted to each coach's own clients.
• In this case, payments are processed via your coach's Stripe account. Your e-mail address is transmitted to that account in the process.
• If your coach schedules an online appointment with you, it is created in their Google Calendar (see section 12).

Your coach is responsible for the coaching itself - that is, the advice given, the creation and adjustment of your plans, and the decision as to which information is collected for this purpose. We provide the technical platform for this and process your data in this context on their behalf. If you have any questions about your data, you can contact either your coach or us.

If you are not coached via such an invitation link but directly by FitWithNikhil, we are your point of contact and sole controller - this section then does not apply to you.

5. Health and training data (special category of personal data)

As part of onboarding and ongoing use, you provide, and we store, among other things: age, height, weight, estimated body fat percentage, training goal, training experience, training location, injuries/limitations, diet type, intolerances, sleep and stress levels, and all logged training and nutrition data (sets, weights, repetitions, meals, calories, water intake). If you voluntarily upload progress photos, these are also stored.

Some of this information constitutes health data within the meaning of Art. 9 GDPR and is subject to special protection. We process it exclusively on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give upon registration and which you can withdraw at any time with effect for the future (e.g. by e-mail to us or by deleting your account).

Cycle mode (voluntary). If you switch it on, we store the type of your cycle (natural, hormonal contraception, irregular, menopause), your usual cycle and period length, the start of the periods you have logged, and the symptoms you mark on a given day. From this, the app calculates your cycle phase, adjusts your calorie target during the luteal phase, contextualises weight fluctuations and evaluates your training data by phase. When you switch this on, we obtain a separate, explicit consent for this purpose (Art. 9(2)(a) GDPR). Your coach only sees your current phase and a note if no period has been logged for a very long time - and only for as long as you allow this in the cycle settings; they never see your symptoms. You can switch off the mode at any time and permanently delete all cycle data on the cycle page.

6. AI-powered features

For some features we use AI services. We use two providers for this, which perform different tasks and in doing so receive different data.

Anthropic (Claude) - Anthropic PBC, San Francisco, USA. This is used for all features in which personal information about you plays a role:

• Recipe suggestions - your calorie and macronutrient targets as well as your diet type, intolerances and cooking-time preference are transmitted
• Calorie estimation based on food photos - the photo you take, together with your additional information, is transmitted
• Feedback on your progress photos - the photos you have uploaded (current and, where applicable, previous ones for comparison) as well as your first name are transmitted
• Your personal welcome message after onboarding - information from the questionnaire is transmitted, including goal, training volume and any injuries or limitations mentioned
• AI body scan - the front-facing photo and, if you add one, a side photo are transmitted. From this, the AI estimates body fat percentage and muscle development. We store the photos and the result in your account (not publicly) so that you can see the progress over time and do not need to upload the photos again. The estimate is not a medical diagnosis
• Summary of your weekly check-in for your coach - your answers (well-being, free-text responses), your first name and goal, as well as your weekly figures from the app (training, calories and protein, weight trend, steps) compared to your plan are transmitted; if cycle mode is switched on and you have granted access to your coach, your cycle phase is additionally included

Some of this information constitutes health data within the meaning of Art. 9 GDPR (in particular progress photos and information about injuries). The transfer takes place to the USA. The legal basis is Art. 6(1)(b) GDPR (provision of the feature you requested) in conjunction with your explicit consent under Art. 9(2)(a) GDPR for the underlying health data. According to Anthropic, it does not use data submitted via the API to train its models.

Google (Gemini) - Google Ireland Limited or Google LLC. Used exclusively for translating exercise instructions and (once, in the creation of our recipe photos) for images. In this process, only the name of the recipe or exercise is transmitted - no personal data about you.

7. Payment processing

The management of subscriptions and payment processing is carried out via Stripe (Stripe Payments Europe, Ltd.). Your payment details (e.g. credit card data) are collected and processed exclusively directly by Stripe - we ourselves never receive or store complete payment data at any time. We only receive the subscription status (e.g. active, in trial period, cancelled) and an internal customer reference from Stripe. The legal basis is Art. 6(1)(b) GDPR.

8. Communication (coach chat and e-mail)

Messages that you exchange in the chat with your coach (including optional image, video, audio or document attachments) are stored so that the conversation history remains traceable. We send transactional e-mails (e.g. registration confirmation, password reset, confirmation codes for access to the coach portal) via our e-mail provider IONOS SE (Montabaur, Germany). The legal basis is Art. 6(1)(b) GDPR.

9. Exercise database

To display movement sequences (animations) for individual exercises, we use the external database WorkoutX. Only exercise names are queried in this process - no personal data about you is transmitted to WorkoutX.

10. Hosting and cookies

This app is hosted via Vercel Inc.When you access the app, technically necessary server log data (including IP address, time of access) is automatically processed, which is required to deliver and secure the service.

We use technically necessary cookies that maintain your login session (e.g. whether you want to "stay signed in", or who invited you to a coach). For coaches, this includes a security cookie that, after confirming the code from the e-mail, grants access to the coach portal for the current session. These cookies do not require consent, as the app would not function without them.

During registration and password reset, we use Cloudflare Turnstile (Cloudflare, Inc.) to protect against automated access by bots. When the form is loaded, technical characteristics of your browser and your IP address are transmitted to Cloudflare in order to verify that the request originates from a human. No cookies are set for advertising purposes. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security of the service and protection against misuse). A data processing agreement is in place with Cloudflare; the transfer to the USA is based on the EU-US Data Privacy Framework adequacy decision or standard contractual clauses.

When you set a password (registration, reset), we check in the browser whether it appears in known data breaches. For this we use the service Have I Been Pwned (Pwned Passwords). Only the beginning (5 characters) of a hash value of your password is transmitted, never the password itself or the full hash; the comparison is then performed locally in your browser. For technical reasons, your IP address is transmitted to the service in this process. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting your account).

Only with your explicit consent (cookie banner on first visit) do we additionally set analytics cookies from Google Analytics/Google Ads(Google Ireland Limited) to understand how the site is used and to measure the effectiveness of our advertising. These cookies are only set after your consent and may be withdrawn at any time.

You can change your decision at any time:

11. Push notifications

If you allow push notifications (e.g. training and supplement reminders or new chat messages), we store the push address generated by your browser or device and the associated encryption keys. Delivery is, for technical reasons, carried out via the push service of your browser or device manufacturer (e.g. Google, Apple or Mozilla). You grant this permission actively and can withdraw it at any time in the settings of your browser or device. The legal basis is your consent under Art. 6(1)(a) GDPR.

12. Appointments (video check-in, Google Calendar)

If your coach schedules an online check-in with you, a video conference room is created. Depending on your coach's setup, this happens either via their Google Calendar (Google Meet) or via the video service Daily (Daily.co, Inc., USA). With Google, your e-mail address is transmitted as a participant to Google Ireland Limited or Google LLC so that you receive the invitation. With Daily, only a room name and the time slot are transmitted, no information about your account or your health; the room automatically expires after the appointment. In-person appointments are only noted in the app and are not disclosed to any third party. The legal basis is Art. 6(1)(b) GDPR.

13. Food database

For searching for food items and scanning barcodes, we query the public Open Food Facts database. Only your search term or the scanned barcode number is transmitted in this process - no information that identifies you as a person.

14. Contact and inquiries

Via the contact form on the website and the prospective-coach inquiry form, we collect the information you enter (name, e-mail address, optionally phone number and message, or information about your clients). We store this information in order to respond to your inquiry, and we notify ourselves about it via push notification and e-mail (via IONOS). You give your consent to this processing when you submit the form. The legal basis is Art. 6(1)(a) and (b) GDPR (responding to your inquiry or pre-contractual measures).

15. Referral programme

If you use the referral programme, every account receives a personal referral code. If someone registers via your link, we store the association between your account and the referred account in order to determine whether the conditions for a reward have been met. The referred person does not see your name in this process. The legal basis is Art. 6(1)(b) GDPR.

16. Security and protection against misuse

To prevent misuse, we limit how often public forms can be submitted from the same IP address, and for this purpose we store the IP address and the time of the attempt. During registration, login and password reset, Cloudflare Turnstile (see section 10) protects us from automated access. For coaches, there is an additional confirmation procedure via an e-mail code at every login. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security of the service and the protection of your data).

17. Storage period

We store your data for as long as your account exists. After you cancel your account, your data is deleted, unless statutory retention obligations (e.g. under commercial or tax law for invoicing data) prevent this. You can delete your account and all associated data yourself at any time within the app (profile, at the very bottom). Alternatively, please contact info@fitwithnikhil.de.

18. Your rights

You have the following rights:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
• Lodging a complaint with a data protection supervisory authority, e.g. the Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information)

To exercise these rights, an informal message to info@fitwithnikhil.de is sufficient.