Last updated: 27 October 2026
FitApp is run by David Owen, a sole trader in the UK, who is the data controller for your information under UK data protection law (UK GDPR and the Data Protection Act 2018). For anything about your data, email [email protected].
FitApp is for adults aged 18 and over.
We don't use advertising, tracking or analytics tools, and we never sell your data.
Some features send your data to an AI model to work:
These go to Anthropic under the app's own account. If you connect your own ChatGPT (OpenAI) or Gemini (Google) key, the coach chat sends the same summary to that provider instead, under your own agreement with them; some free plans let the provider use what you send to improve its products, so check their terms. AI answers are suggestions, not medical advice.
You can turn every AI feature off in Settings > AI. Nothing more is then sent to an AI, and the rest of the app works as before (the weekly check-in keeps its numbers and suggestions, without the written summary).
If you link with a personal trainer, they see only what you choose to share in Settings (training, food, weight, check-ins, photos, supplements and cycle day each have their own switch; photos, supplements and cycle day are off until you turn them on). They always see messages you send them and answers to plans they send you, and they can record assessment results and sessions you trained with them. They never see your medication, your AI coach chat or its nutrient analysis. Ending the link stops their access. Your trainer is responsible for how they use what you share with them.
These companies process data for us to run the app:
Where data goes outside the UK, it's covered by the safeguards UK law requires, such as the UK–US data bridge or the UK's international data transfer agreement.
If you connect Google Health, we read (never write) your steps, sleep, weight, body fat, resting heart rate and heart rate variability through the Google Health API, to fill in your daily log. You can disconnect it in Settings, which deletes the stored access tokens.
In the FitApp Android app you can allow FitApp to read steps, sleep, weight, body fat, resting heart rate and heart rate variability from Health Connect on your phone. FitApp only reads this data, never writes it, and only the permissions you allow. It's used to fill in your daily log, readiness check and progress, the same as if you typed it in, and is stored with the rest of your FitApp data. It isn't sold, used for advertising, or shared with anyone except a personal trainer you choose to share it with in Settings. You can remove FitApp's access at any time in Health Connect.
We keep your data while you have an account. When you delete your account in Settings, it's removed from the live database straight away (within 30 days if you ask us by email instead). Copies in our backups are deleted as the backups expire: nightly backups are kept for 14 days on the server and for 90 days in a second backup copy in the UK, and an offline copy on our own computer in the UK is kept for 12 months for recovering from a disaster. Server logs roll over within a few weeks. One thing is kept after you delete your account: the record of when you gave or withdrew consent and which version of this policy it was, stored against a one-way hash of your email address rather than the address itself, so we can show that we asked.
Connections are encrypted (HTTPS), passwords are stored only as hashes, AI keys you save are encrypted, the server accepts administrator access by key only behind a firewall, and the database is backed up every night.
FitApp uses only cookies it needs to work: a sign-in cookie, a short-lived cookie while you connect Google Health, and, for personal trainers, one that remembers which side of the app was open. It also stores preferences, and sets saved while you're offline, on your device. There are no tracking or advertising cookies.
You can ask to see, correct, delete or get a copy of your data, to restrict or object to how we use it, and to withdraw consent. You can do two of these yourself: Settings > Import and export > Your Data downloads a full copy (a zip of everything we hold about you, photos included), and Settings > Account > Delete account deletes your account and everything in it. For anything else, email [email protected]. We'll reply within a month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd like the chance to put it right first.
If this policy changes in a way that matters, we'll tell you in the app before it takes effect. See also the terms of use.