Last updated: February 2026
Privacy Policy
1. Overview
- This Privacy Policy explains how MyFitHub ("we", "us", "our") collects, uses, stores, and protects personal information when trainees, trainers, and gyms use the platform.
- By creating an account and accepting our Terms of Service, you consent to the data practices outlined here. If you disagree with any part of this policy, please discontinue use of the service.
- This policy complies with the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable data protection laws.
2. Data Controller
- MyFitHub is the data controller responsible for your personal data.
- Contact email: hello@myfithub.co
- If you have any questions about how your data is processed, or wish to exercise your rights, please contact us at the email above.
3. Information We Collect
- Account Information: name, email address, password hash, mobile number, and profile details provided during signup and onboarding.
- Professional Details (trainers & gyms): documents (certifications, licenses), availability schedules, pricing, gym descriptions, qualifications, and social media URLs.
- Booking & Transaction Data: session bookings, cancellations, payment records, wallet transactions, and Stripe payment method details.
- Communications: messages exchanged between users on the platform, support interactions, and notification preferences.
- Device & Log Data: browser type, IP address, pages visited, and timestamps used to maintain platform security and performance.
- Consent Records: timestamps of when you accepted the Privacy Policy, Terms of Service, and cookie preferences.
4. Legal Basis for Processing
- We process your personal data under the following legal bases as defined by GDPR Article 6:
- Consent (Art. 6(1)(a)): You give explicit consent at signup by accepting our Terms of Service and Privacy Policy. You may withdraw consent at any time through your account settings.
- Performance of a Contract (Art. 6(1)(b)): Processing is necessary to provide the MyFitHub service — including account management, booking sessions, processing payments, and facilitating communication between trainees, trainers, and gyms.
- Legal Obligation (Art. 6(1)(c)): We may process data to comply with tax, accounting, or other legal requirements.
- Legitimate Interests (Art. 6(1)(f)): We process certain data for platform security, fraud prevention, service improvement, and analytics, where these interests do not override your fundamental rights.
5. How We Use Your Information
- Operating the platform, including authentication, onboarding, scheduling, messaging, and payment facilitation.
- Sending booking confirmations, reminders, and essential account notifications via email.
- Improving product performance, developing new features, and supporting customer service.
- Verifying trainer and gym credentials during the approval process.
- Enforcing our Terms of Service, addressing fraud, and protecting the rights of MyFitHub users.
7. Sub-processors
- We use the following third-party sub-processors to deliver our service. Each operates under a Data Processing Agreement (DPA):
- Supabase (database & authentication) — EU/US, processes account data, authentication tokens, and all platform data.
- Stripe (payment processing) — EU/US, processes payment information, card details, and transaction records.
- Resend (transactional email) — US, processes email addresses and notification content.
- Vercel (hosting & deployment) — Global CDN, processes request data and serves the application.
- Google Maps Platform (location services) — Global, processes location/address data for gym and trainer locations.
8. International Data Transfers
- Some of our sub-processors operate outside the European Economic Area (EEA). Where personal data is transferred internationally, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- Data Processing Agreements with each sub-processor.
- Sub-processors certified under relevant data protection frameworks where applicable.
9. Data Retention
- Active accounts: Your data is retained as long as your account is active and you continue to use the service.
- Account deletion: When you request account deletion, there is a 7-day grace period during which you can cancel. After the grace period, your personal data is irreversibly anonymized.
- Anonymized records: After deletion, we retain anonymized booking and transaction records (with no personally identifiable information) for accounting and legal compliance purposes.
- Legal obligations: We may retain certain data beyond deletion to meet tax, legal, or regulatory requirements.
11. Your Rights Under GDPR
- Under the General Data Protection Regulation, you have the following rights:
- Right of Access (Art. 15): You can request a copy of all personal data we hold about you. Use the "Download My Data" feature in Privacy settings.
- Right to Rectification (Art. 16): You can update or correct your personal information at any time through your profile settings.
- Right to Erasure (Art. 17): You can request deletion of your account and personal data through the "Delete Account" feature in Privacy settings. Deletion is subject to a 7-day grace period.
- Right to Data Portability (Art. 20): You can export your data in a structured, machine-readable JSON format using the data export feature.
- Right to Restrict Processing (Art. 18): You can request that we restrict the processing of your data in certain circumstances. Contact us at hello@myfithub.co.
- Right to Object (Art. 21): You can object to processing based on legitimate interests. Contact us at hello@myfithub.co.
- Right to Withdraw Consent (Art. 7): Where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
- Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority (Data Protection Authority) in your country of residence if you believe your data protection rights have been violated.
12. Security
- We implement administrative, technical, and physical safeguards to protect your data, including:
- Encrypted data transmission (HTTPS/TLS) for all communications.
- Secure password hashing and token-based authentication.
- Row Level Security (RLS) policies on our database to ensure users can only access their own data.
- Regular security reviews and monitoring.
- No system is completely secure, so please use strong passwords and notify us immediately of any suspicious account activity.
13. Children's Privacy
- MyFitHub is not directed to children under 16. We do not knowingly collect data from minors. If you believe a child has provided personal information, contact us so we can investigate and remove the data where appropriate.
14. Updates to this Policy
- We may revise this Privacy Policy periodically. Updated versions will be posted on this page with the revision date.
- For significant changes, we will notify you via email or an in-app notification.
- Continued use after changes indicates acceptance of the updated policy. If you do not agree with the changes, you should stop using the service and may request account deletion.
15. Contact Us
- If you have questions or concerns about privacy at MyFitHub, or wish to exercise any of your data protection rights, please contact us:
- Email: hello@myfithub.co
- We aim to respond to all data protection requests within 30 days.
We are committed to keeping your fitness journey secure and transparent.