Back to Homepage
Legal

Privacy Policy

Last updated:

SIC-FIT Privacy Policy

Effective Date: January 1, 2026
Last Updated: September 1, 2026
Version: 2.4

Welcome to SIC-FIT (referred to herein as "SIC-FITNESS," "the Platform," "we," "us," or "our"). We are committed to upholding the highest standards of data privacy, security, and transparency. This Privacy Policy governs your use of the entire SIC-FIT digital ecosystem, which includes:

  • The SIC-FIT User Application (available for iOS, Android, and Web at sic-fit-web-app.pages.dev and sic-fitness.com) designed for athletes, clients, and trainees.
  • The SIC-FIT Coach Application (available for iOS, Android, and Web at sic-fit-coach-app-web-build.pages.dev) designed for certified personal trainers, wellness coaches, and nutrition specialists.
  • Our backend APIs, cloud databases, live coaching video/audio infrastructure, automated messaging, and customer support channels.

Please read this Privacy Policy thoroughly. By creating an account, downloading, accessing, or using any part of the SIC-FIT Platform, you acknowledge that you have read, understood, and consent to the collection, storage, use, and disclosure of your personal and health information as described in this policy.

1. Information We Collect

To provide personalized fitness programming, accurate biomechanical tracking, intelligent nutrition targets, and direct coach-to-client communication, we collect several categories of information:

A. Information Provided Directly by Trainees / Athletes

  • Account & Identity Credentials: Full name, username, email address, password hash, phone number, gender/biological sex, date of birth, profile picture, timezone, and preferred measurement units (metric/imperial).
  • Physical & Physiological Assessments: Height, body weight, target weight, baseline questionnaires, genetic profile assessments, injury history, medical limitations, daily activity level, and specific fitness goals (e.g., hypertrophy, strength, endurance, fat loss, athletic conditioning).
  • Workout & Exercise Performance Data: Strength workout logs (exercise name, custom exercises created, number of sets, repetitions, resistance/weight lifted, Rate of Perceived Exertion (RPE), estimated 1-Rep Max (1RM), rest times, total volume load), Cardio workout logs (activity type, distance, duration, pace, speed, elevation gain, heart rate, calories burned), workout completion timestamps, and adherence to assigned training plans.
  • Nutrition & Dietary Records: Daily meal logs (breakfast, lunch, dinner, snacks, pre/post workout), food items searched and logged, macronutrient breakdown (protein, carbohydrates, dietary fats, fiber), total caloric intake, daily water and hydration intake, supplement consumption logs, supplement goals, and dietary restrictions or food allergies.
  • Daily Check-Ins & Biometrics: Morning fasted body weight, body composition measurements (body fat percentage, lean muscle mass, visceral fat rating, bone mass, BMR), resting heart rate, blood glucose readings (fasting and postprandial), perceived daily stress levels, symptom tracking (muscle soreness, joint pain, energy levels, digestion, sleep quality), and weekly check-in summaries.
  • Visual Progress Media: Progress photos (front, side, and back poses), photo comparison timelines, and workout form videos shared with your coach for biomechanical feedback.
  • Communications & Coaching Interactions: 1-on-1 direct chat messages, voice notes, image/video attachments, session notes, coaching consultation bookings, feedback submissions, and coach reviews/ratings.
  • E-Commerce & Payment Data: Delivery addresses, cart items, order history for physical goods, therapy bookings, and subscription purchases. All credit/debit card transactions are processed directly by our PCI-DSS compliant payment gateways (Stripe, Apple App Store StoreKit, Google Play Billing). We do not store raw credit card numbers or CVVs on our servers.

B. Information Provided Directly by Coaches & Trainers

  • Professional Profile & Credentials: Full legal name, coaching bio, specialized certifications, educational credentials, verification documentation, years of training experience, intro videos, and branding assets (splash images, icons).
  • Business & Offering Management: Custom coaching packages, session rates, offering descriptions, training plan templates, nutrition guidelines, and custom purchase/gift policy terms (text or PDF documents).
  • Client Management & Coaching Logs: Trainee assignment records, customized workout and nutrition assignments, weekly check-in evaluations, private coach notes, and calendar availability for live appointments.
  • Financial & Payout Information: Stripe Connect account IDs, payout bank account details (tokenized and managed securely via Stripe), earnings reports, transaction history, and tax-related identification as required by law.

C. Health App Ecosystems & Connected Devices (Apple HealthKit & Google Health Connect)

With your explicit, in-app permission, the SIC-FIT User App integrates with Apple HealthKit (on iOS) and Google Health Connect / Google Fit (on Android) to synchronize biometric data seamlessly. This synchronized data may include:

  • Step counts, walking/running distance, active energy expenditure (calories burned), and basal metabolic energy.
  • Sleep analysis (sleep duration, deep sleep, REM sleep, core sleep, and awake intervals).
  • Heart rate metrics (resting heart rate, walking heart rate, and Heart Rate Variability (HRV)).
  • Blood glucose measurements and body weight/body composition biometrics.
  • Workout sessions recorded via connected smartwatches (Apple Watch, Garmin, Fitbit, WHOOP).

Strict Apple HealthKit & Google Health Connect Data Protection Commitment:

  • No Advertising or Marketing: We will NEVER use data obtained through Apple HealthKit, Google Health Connect, or third-party health APIs for marketing, advertising, promotional campaigns, or behavioral profiling.
  • No Third-Party Resale: We will NEVER sell, lease, rent, or disclose your health data to data brokers, advertising networks, pharmaceutical companies, or insurance providers.
  • Limited Operational Use: Health data is strictly processed to compute fitness analytics, populate personal progression dashboards, and allow your authorized personal coach to optimize your fitness and nutrition regimen.
  • Granular User Control: You maintain full control over what data types are synchronized. You can enable, adjust, or revoke health data permissions at any time via your device's operating system settings (iOS: Settings > Health > Data Access & Devices > SIC-FIT; Android: Settings > Security & Privacy > Privacy > Health Connect > App permissions > SIC-FIT).

D. Information Collected Automatically

  • Device & Technical Identifiers: Device model, hardware make, operating system version, unique device identifiers (UUID, IDFV, Android ID), IP address, browser type, screen resolution, and preferred language.
  • Push Notification Tokens: Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs) device tokens required to deliver real-time chat messages, workout reminders, coach feedback notifications, and daily check-in alerts.
  • App Performance & Diagnostic Logs: Crash logs, error diagnostics, API response latency, and usage telemetry to ensure platform stability and prevent technical outages.

2. How We Use Your Information

We process your personal and health data under legitimate business purposes, contractual necessity, and explicit consent to deliver our comprehensive fitness platform:

  • Fitness & Nutrition Delivery: To generate personalized workout schedules, calculate macronutrient targets, track exercise progression, and provide data-driven wellness insights.
  • Coach-Client Engagement: To facilitate seamless collaboration between athletes and coaches, including training plan assignments, progress photo reviews, form checks, chat messaging, and scheduled video/audio consultations.
  • Real-Time Analytics & Visualizations: To calculate 1RM progressions, volume tonnage, body composition trends, active energy burn, recovery metrics, and weekly compliance summaries.
  • Transaction & Subscription Processing: To manage digital memberships, coach offerings, physical merchandise orders, invoice generation, subscription renewals, and gifted plan invitations.
  • Platform Security & Fraud Prevention: To authenticate user sessions, secure password resets, prevent duplicate accounts, enforce our Terms & Conditions, and maintain cloud infrastructure integrity.
  • Customer Care & Service Communication: To respond to technical support tickets, notify you of platform updates, and provide essential account administration messages.

3. Legal Bases for Data Processing (GDPR & International Standards)

For users located in the European Economic Area (EEA), United Kingdom, Switzerland, and other relevant jurisdictions, we process personal information under the following lawful bases:

  • Contractual Necessity: To deliver the core features of the SIC-FIT platform that you requested upon registration, including workout tracking, coaching services, and subscription access.
  • Explicit Consent: For processing special category personal data (health metrics, biometrics, progress photos, HealthKit/Health Connect syncing), and for sending optional marketing updates. You may withdraw consent at any time.
  • Legitimate Interests: To improve app functionality, safeguard system security, analyze performance bottlenecks, and prevent fraudulent activities.
  • Legal & Regulatory Compliance: To comply with tax obligations, financial accounting laws, consumer protection requirements, and lawful legal process.

4. How We Share Your Information

We strictly protect your confidentiality. We do not sell or monetize personal information. We disclose data solely in the following structured scenarios:

  • With Your Authorized Coach: When you subscribe to, book, or connect with a coach on SIC-FIT, that specific coach is granted access to your profile, workout logs, nutrition tracking, body composition, progress photos, and check-in history to provide coaching services.
  • Authorized Service Providers: We partner with industry-leading third-party service providers who process data strictly on our behalf under rigorous Data Processing Agreements (DPAs):
    • Cloud Hosting & Database Infrastructure: Amazon Web Services (AWS) and secure PostgreSQL database clusters.
    • Payment Processors: Stripe, Apple StoreKit, Google Play Billing.
    • Communication & Media Relays: Socket.io servers and WebRTC / Agora video calling infrastructure.
    • Push Notifications: Google Firebase Cloud Messaging and Apple APNs.
    • Email Delivery: Transactional email providers for OTP verification and password recovery.
  • Legal & Protective Disclosures: We may disclose information if required by a valid court order, subpoena, government regulation, or to protect the vital interests, safety, or legal rights of our users, staff, or the public.
  • Business Transfers: In the event of a merger, acquisition, corporate reorganization, or sale of assets, user data may be transferred as part of the business assets, subject to the recipient adhering to this Privacy Policy.

5. Data Security & Storage Architecture

We deploy robust, multi-layered technical, physical, and administrative safeguards to ensure the confidentiality, integrity, and availability of your data:

  • Encryption in Transit: All communications between the mobile/web apps and our backend APIs are encrypted using Transport Layer Security (TLS 1.3 / SSL) with strong cipher suites.
  • Encryption at Rest: All stored database records, progress media, and backup archives are encrypted using industry-standard AES-256 encryption.
  • Access Controls & Authentication: Role-Based Access Control (RBAC), least-privilege administrative access, tokenized API sessions, and multi-factor authentication for administrative endpoints.
  • Audit Logging & Defense: Automated rate limiting, vulnerability testing, intrusion prevention monitoring, and continuous dependency auditing.

6. Data Retention & In-App Account Deletion

We retain your personal information for as long as your account remains active, or as necessary to fulfill the purposes outlined in this policy and satisfy legal, accounting, and reporting obligations.

Self-Service Account Deletion (Apple App Store Guideline 5.1.1(v) Compliant):

You have full autonomy over your account and data. You can delete your account and all associated data permanently at any time directly within the application:

  • In the SIC-FIT User App: Navigate to Profile > Account Preferences > Delete Account and confirm your request.
  • In the SIC-FIT Coach App: Navigate to Settings > Account > Delete Account and confirm your request.
  • Via Email: Send a direct deletion request to support@sic-fitness.com or privacy@sic-fitness.com.

Effect of Account Deletion: Upon confirming account deletion, your login credentials, personal profile, biometric records, workout history, nutrition logs, progress photos, and chat histories will be permanently wiped from our production databases, and media assets deleted from cloud storage, with backups purged according to our 30-day backup cycle (except where retention is required by financial/tax law).

7. Your Global Privacy Rights

Depending on your geographic location, you possess defined legal rights regarding your personal data:

A. European Union / United Kingdom (GDPR / UK GDPR)

  • Right of Access & Portability: Request an export of your personal and health data in a structured, machine-readable format.
  • Right to Rectification: Request correction of inaccurate or incomplete personal information.
  • Right to Erasure ("Right to be Forgotten"): Request immediate permanent deletion of your data.
  • Right to Restrict or Object: Restrict the scope of data processing or object to processing based on legitimate interests.
  • Right to Lodge a Complaint: Lodge a formal grievance with your local Data Protection Authority (DPA).

B. California Residents (CCPA / CPRA)

  • Right to Know: Access specific pieces and categories of personal information collected over the preceding 12 months.
  • Right to Delete: Request deletion of personal information collected from you.
  • Right to Correct: Request the correction of inaccurate personal data.
  • No Sale or Sharing of Personal Data: SIC-FIT does not sell or share personal information (including sensitive health metrics) as defined under the CCPA/CPRA.
  • Right to Non-Discrimination: We will never deny services, charge different prices, or provide a different quality of service for exercising your privacy rights.

8. Children's Privacy

The SIC-FIT Platform is strictly intended for individuals who are at least 18 years old (or 16 years old with parental/legal guardian consent where permitted by law). We do not knowingly collect, solicit, or maintain personal information from children under 13 (or under 16 in the EEA/UK). If we discover that a minor under the minimum legal age has registered an account without verified parental consent, we will promptly delete that account and all associated information.

9. Third-Party Links & External Services

Our platform may contain links to external websites, certified supplement retailers, fitness equipment manufacturers, or third-party health tools. We do not control and are not responsible for the privacy practices, content, or policies of third-party services. We encourage you to review the privacy policies of any third-party services you visit.

10. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements to our platform features, integrations with new health technologies, or changes in legal regulations. When changes are made, we will update the "Last Updated" date at the top of this document. For material changes, we will provide conspicuous notification via in-app banner alerts, push notifications, or direct email communication prior to the changes taking effect.

11. Contact Us & Data Protection Officer

If you have any questions, inquiries, concerns, or requests regarding this Privacy Policy, your personal data, or our data handling practices, please reach out to our dedicated privacy and legal team:

## AI Features & Third-Party AI Processing SicFit's optional AI features are powered by **Google's Gemini API**. When you use an AI feature, the information below is sent from our servers to Google for automated processing. We only send it after you agree on the in-app "AI Features & Your Data" screen. ### What we send to Google (Gemini API) • **AI Chat:** your messages, and any photos, audio, video or documents you attach. • **Physique Analysis:** the physique photos and body measurements you upload. • **AI Wellness Insights:** sleep, steps, weight, water and check-in entries you log in SicFit. • **Blood Work Analysis:** the lab reports you upload and the marker values read from them. • **Supplement Recommendations:** your selected goals, dietary preferences and relevant health context. • **Genetic Leverage:** your answers to the in-app questionnaire. SicFit does not analyze DNA or genetic test results. ### What we don't send • Your name, email address, phone number, date of birth, address, password or payment details, apart from anything you choose to type or upload yourself. • Data from Apple Health (HealthKit) or Health Connect. It is never used for AI features or shared with any third party. ### How we collect it and why We collect this information when you type, upload or log it in the SicFit app. We send it to Google only to generate the AI result you asked for, such as chat replies, physique reports, wellness insights, blood work summaries, supplement suggestions and your Genetic Leverage profile. The results are saved in your SicFit account so you can view them later. ### How Google protects it Google processes this data on our behalf as a service provider, under written data processing terms that require it to protect the data with safeguards equal to those described in this Privacy Policy and to use it only to provide the service to us. Photos and documents uploaded for Physique Analysis are deleted from Google after the analysis. Files attached in AI Chat are deleted by Google automatically within 48 hours. ### Your choices AI features are optional. You can withdraw consent at any time in Settings → Account Preferences → AI Data & Privacy; AI processing stops immediately and the rest of SicFit keeps working. If we change what we send, we will ask for your consent again. You can delete your account and personal data at any time in Settings → Account Preferences → Login & Security → Delete Account.