Privacy Policy

Data controller

The data controller for the purposes of Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPD-GDD) is:

• ·Company name: NEXUSVIBE SL
• ·NIF: B70966650
• ·Registered office: Avenida del Cantábrico 249, 28939 Arroyomolinos, Madrid, Spain
• ·Commercial Registry of Madrid, Volume 46502, Folio 135, Section 1, Sheet M-816510
• ·Privacy and data-protection email: privacidad@fitconnect.pro
• ·Company contact: gestion@nexusvibe.net

Personal data we collect

We collect information you provide directly, information generated automatically when you use the platform, and limited information from third parties. Depending on whether you are a trainer or a client, we process the following categories:

• ·Account data: first and last name, email address, authentication credential protected by the authentication provider, profile photo, role (trainer or client), language, timezone, acceptance date, and accepted versions of the Terms of Use and Privacy Policy.
• ·Trainer profile data: public name, biography, speciality, qualifications and verification documents, services offered and pricing.
• ·Trainer-client relationship data: hires, the speciality of each trainer, the status of the relationship and assignments.
• ·Training data: training plans, exercises, sets, repetitions and session logs.
• ·Nutrition data: diet plans, planned meals, meal check-ins, meal photos and comments.
• ·Communication data: trainer-client chat messages and their attachments (photos, documents, videos and voice notes).
• ·Payment data: billing address, Stripe customer and payment-method identifiers, and Apple App Store subscription transaction, product and status identifiers. We never store full card numbers or Apple payment credentials.
• ·Technical data: IP address, browser type, operating system, device identifiers and timezone.
• ·Usage data: pages visited, features used and activity frequency.
• ·Support data: emails, bug reports and feedback.

Health data (special categories): while you keep your consent and the relationship with your trainer. When you withdraw consent or ask for erasure, the data immediately stops being available to you, to your trainers and to our staff: it is blocked under art. 32 LOPDGDD and destroyed for good after 5 years, the period in which a claim arising from the relationship could still be brought.

FitConnect Pro processes special-category personal data within the meaning of Article 9 of the GDPR. Because of its nature, this data receives enhanced protection.

The legal basis for this processing is your EXPLICIT CONSENT (Art. 9(2)(a) GDPR), which you give separately and unambiguously before entering any health data. Without that consent we do not process this information.

This data is shared only with the trainer or trainers you have personally hired, and only to the extent necessary to provide your service. It is not shared with other clients or with trainers you have not hired.

Health data is stored encrypted and under strict access controls, so that only you and your hired trainers can access it. You can withdraw your consent and request its deletion at any time, without affecting the lawfulness of processing carried out before withdrawal.

• ·Physical activity readiness questionnaire (PAR-Q): injuries, chronic conditions, medications, pregnancy and postpartum.
• ·Progress photos uploaded by the client.
• ·Body measurements (weight, girths and body composition).
• ·Medical documents the client chooses to upload.

Purposes and legal bases for processing

We process your personal data for the following purposes, each supported by a GDPR legal basis:

• ·Service delivery and evidence of the agreement (contract performance, Art. 6(1)(b)): create and manage your account, record the date and versions of the legal documents you accepted, connect clients with trainers, deliver training programs and meal plans, enable chat and progress tracking.
• ·Payment processing (contract performance, Art. 6(1)(b)): handle client-to-trainer payments and payouts through Stripe Connect, where the trainer is the seller and FitConnect Pro charges 10% of the net amount plus applicable VAT on that commission; Stripe processing fees are separate. Trainer subscriptions use Stripe on the web or Apple In-App Purchase on iOS. Web support handles Stripe subscription requests, Apple cancellation and refund requests are managed through the Apple account and reportaproblem.apple.com, and coaching refunds follow the trainer-client agreement without limiting non-waivable rights.
• ·Health data (explicit consent, Art. 9(2)(a)): process the PAR-Q questionnaire, progress photos, body measurements, and medical documents to tailor your training and nutrition. This permission is requested separately from general acceptance of the Terms and this Policy.
• ·AI-assisted features (contract performance and, where health data is involved, explicit consent): apply deterministic rules first and use Anthropic to prepare drafts or explanations for trainer review. We send only structured, minimized, and pseudonymized context; we do not send names, email addresses, or raw internal identifiers.
• ·Security and fraud prevention (legitimate interest, Art. 6(1)(f)): maintain platform security, detect abuse and ensure the integrity of the service.
• ·Service improvement and analytics (legitimate interest, or consent for analytics cookies, Art. 6(1)(f) / 6(1)(a)): understand how the platform is used and improve its features.
• ·Advertising campaign measurement (marketing consent, Art. 6(1)(a)): measure visits, registrations, hire requests and onboarding completion originating from Meta ads. With consent, Meta receives the event name, the site origin or an allowlisted public acquisition URL, the IP address, browser User-Agent and Meta's _fbp/_fbc browser identifiers. We do not send names, email, phone, internal account identifiers, free text, or health, workout, nutrition, progress, photo or document data.
• ·Transactional communications (contract performance, Art. 6(1)(b)): send confirmations, receipts and operational notices.
• ·Compliance with legal obligations (Art. 6(1)(c)): tax, accounting and regulatory obligations under Spanish and EU law.

Processors and third parties

We do not sell your personal data. We share data only to the extent necessary to operate FitConnect Pro. Some providers act as processors for NEXUSVIBE SL and others, where stated, as independent controllers under their own terms:

• ·Supabase: database, authentication and file storage. Data is hosted in EU data centers.
• ·Vercel: application hosting and edge layer; processes IP addresses and request metadata.
• ·Stripe (including Stripe Connect): processing of client-to-trainer payments, web trainer subscriptions and payouts. Stripe acts as an independent controller for payment data. We never store full card numbers.
• ·Apple App Store: processing of trainer subscriptions purchased in the iOS app. Apple processes the payment; FitConnect Pro receives signed transaction, product and subscription-status identifiers, but not your Apple payment credentials.
• ·Anthropic: direct generation, through our AI gateway, of drafts and explanations that require trainer review. It receives only structured, minimized, and pseudonymized context; health data is included only where the corresponding explicit consent is in place.
• ·Resend: transactional email delivery; receives email addresses and message content.
• ·Google Analytics: web analytics (usage data and cookies; requires your consent).
• ·Meta Platforms: Meta Pixel and Conversions API to measure Facebook and Instagram ads; only with marketing consent. Meta receives network/browser identifiers (IP address, User-Agent, _fbp/_fbc) and minimised event/source data, but not names, email, phone, internal account identifiers, free text, or health and fitness data.
• ·OpenFoodFacts: barcode-based product macro lookup. Only the barcode number is sent; no personal data is transmitted.
• ·YouTube / Vimeo: trainer-provided embedded videos; may set third-party cookies on playback.

International data transfers

Some of our providers may be located outside the European Economic Area (EEA). When we transfer personal data outside the EEA, we ensure an adequate level of protection through:

• ·The EU-US Data Privacy Framework (for certified providers).
• ·Standard Contractual Clauses (SCCs) approved by the European Commission.
• ·European Commission adequacy decisions, where applicable.

Data retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, unless a longer period is required by law.

• ·Account data: while the account is active and for up to 3 years after deletion, unless a legal obligation requires otherwise.
• ·Health data (special categories): while you keep your consent and the relationship with your trainer. When you withdraw consent or ask for erasure, the data immediately stops being available to you, to your trainers and to our staff: it is blocked under art. 32 LOPDGDD and destroyed for good after 5 years, the period in which a claim arising from the relationship could still be brought.
• ·Financial and transaction data: 6 years, as required by Spanish tax law (Ley General Tributaria).
• ·Training, nutrition and chat data: while the trainer-client relationship exists and for a reasonable period afterwards needed to handle claims.
• ·Technical and usage data: up to 12 months, after which it is anonymized or deleted.
• ·Support communications: 2 years after the last interaction.

Your rights

Under the GDPR and LOPD-GDD, you have the following rights regarding your personal data:

• ·Right of access: obtain confirmation of whether we process your data and request a copy.
• ·Right to rectification: correct inaccurate or incomplete data.
• ·Right to erasure: request deletion of your data when it is no longer necessary or when you withdraw your consent.
• ·Right to data portability: receive your data in a structured, commonly used and machine-readable format.
• ·Right to object: object to processing based on legitimate interest.
• ·Right to restriction: request that we limit processing in certain circumstances.
• ·Right to withdraw consent: withdraw at any time any consent you have given, including the explicit consent for your health data, without retroactive effect.
• ·Right to lodge a complaint: file a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

How to exercise your rights

To exercise any of these rights, write to us at privacidad@fitconnect.pro. We will respond within one month as required by the GDPR, extendable under the terms provided by law.

If you believe your data-protection rights have been infringed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Security measures

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), encryption and access control for health data, restricted access policies and secure infrastructure hosting.

No system is 100% secure. If we become aware of a data breach that poses a risk to your rights, we will notify the AEPD within 72 hours and inform affected individuals without undue delay.

Children

FitConnect Pro is not directed to individuals under 18 years of age, and we do not knowingly collect data from minors. If we discover that we have processed a minor's data without an appropriate legal basis, we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version at https://fitconnect.pro with an updated date. Continued use of the service after changes constitutes acceptance of the updated policy.

Contact

NEXUSVIBE SL, Avenida del Cantábrico 249, 28939 Arroyomolinos, Madrid, Spain.

Privacy and data protection: privacidad@fitconnect.pro · Company contact: gestion@nexusvibe.net · Support: support@fitconnect.pro.