FitFlowCircle

FitFlowCircle — Privacy Policy

Operator: FitFlowRecreation LLC (Florida, United States)

Version: 2026.07 Last updated: July 9th, 2026

Contact: contact@fitflowrecreation.com

 

HIPAA Notice: FitFlowCircle is NOT a HIPAA covered entity. We do not provide medical services. The term "health data" on this page refers to biometric and wellness measurements collected from your connected wearables, not medical records.

 

1. Introduction:

This Privacy Policy explains what data we collect through the FitFlowCircle mobile application, why we collect it, who can see it, and how you can control it. By downloading and using the App, you agree to the practices described in this Policy.

 

2. Data controller:

The data controller is FitFlowRecreation LLC. Our EU representative under GDPR Art. 27 is Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria. Our UK representative under UK GDPR Art. 27 is Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom. Our Data Protection Officer and all privacy-related requests (Art. 15–17 access, rectification, erasure) are reached via our single corporate mailbox: contact@fitflowrecreation.com.

 

3. Data we collect:

We collect the minimum data needed to deliver the service. • Account: email (hashed for login), pseudonym, first name, last name. • Biometric & wearable telemetry: sleep architecture, heart-rate variability (HRV), resting heart rate, physical activity volumes, VO₂ Max, recovery score, and metabolic trends — only from wearables you explicitly connect. • Demographic: date of birth (for age-cohort scoring), country, optional city, biological sex, height, weight. • Location: precise GPS coordinates collected during active workout sessions only, for route mapping and distance tracking. Location data is never collected in the background outside of an active workout. • Contact: phone number (optional, with country dial code), used exclusively for the Safety Mode emergency contact feature. • Device: app version, operating system, push notification token. • Analytics: anonymised crash and performance metrics. No personal identifiers. • Photos: food images captured for AI nutritional analysis. Images are processed in real time and not stored permanently.

 

4. Biometric consent:

Biometric data is a special category of personal data under GDPR Art. 9. We process it only with your explicit, separate consent. • You provide this consent at signup via a dedicated, unbundled checkbox (separate from the general Terms acceptance). • Purposes: calculating your daily longevity/health consistency score, managing the global leaderboard, and (where applicable) personalised insights — nothing else. • We NEVER sell, rent, or trade your biometric data to third parties, data brokers, or advertisers — not under any circumstance. • You can withdraw consent at any time from Settings. Your biometric data is then erased within 30 days.

 

5. Lawful basis for processing:

Our legal bases for processing your data are: • Contractual necessity (GDPR Art. 6(1)(b)) — to deliver the service you signed up for (scoring, ranking, social features). • Explicit consent (GDPR Art. 9(2)(a)) — for biometric and health-related data. • Legitimate interests (GDPR Art. 6(1)(f)) — for fraud prevention, security, and platform integrity.

 

6. How your data is used:

We process your personal and biometric data for the following purposes: • To calculate your daily health consistency scores and manage the global ranking leaderboard. • To power social features (activity feed, stories, comments, reactions, public profile). • To send product updates, feature releases, and technical notifications. • To maintain and secure your authenticated personal dashboard. • If you use the meal-scanning feature, to analyse food photos for nutritional content. • To provide GPS route mapping during active workout sessions. • To enable the Safety Mode feature, which shares your location with pre-selected emergency contacts during a workout session.

 

7. Data sharing & processors:

We share data only when strictly necessary to operate the Service.

• We do not sell, rent, or trade your personal or biometric data.

• Sub-processors: o Supabase — database hosting, authentication, and storage. o Anthropic — meal-photo analysis (nutritional content) when you use the foodscanning feature. Images are not retained by Anthropic for model training.

o Resend — transactional email delivery (welcome emails, weekly reports, streak notifications). Email addresses are shared solely for delivery purposes.

o Mapbox — map tile rendering for GPS route visualization. Only anonymized tile requests are sent; no personal data is shared.

o Expo (EAS) — push notification delivery. Push tokens are shared solely for notification routing.

• We may disclose data when legally compelled by a valid court order or governmental request, and only to the extent strictly required.

 

8. International data transfers:

Some of our sub-processors are located outside the EU/EEA (United States). Transfers are protected by the European Commission's Standard Contractual Clauses (SCCs). US-based processors (Supabase, Anthropic, Resend, Mapbox, Expo) are bound by additional supplementary technical and contractual safeguards.

 

9. Backend security & data isolation:

• All traffic is encrypted in transit via TLS 1.3.

• Data at rest is encrypted via AES-256 (Supabase Postgres).

• Your data is protected by strict Row Level Security (RLS) policies — your biometric profile is sandboxed and inaccessible to any other user or unauthorized party.

• Strict role-based access controls are enforced in production.

 

10. Data retention:

We keep data only as long as needed.

• Active accounts: data is retained while your account exists, to maintain your score history and leaderboard status.

• After deletion: live data is wiped immediately upon account deletion. Encrypted backups are purged within 30 days.

• GPS route data: retained as part of your activity history until account deletion.

• Food photos: deleted immediately after nutritional analysis is complete.

 

11. Account deletion & data removal:

You have the right to delete your account and all associated data at any time. To delete your account directly in the app:

1. Open FitFlowCircle

2. Go to Settings

3. Tap "Data & Privacy"

4. Tap "Delete Account"

5. Confirm deletion

Upon deletion, all personal data including your Longevity Score history, activity records, biometric data, GPS routes, and social content will be permanently deleted. Encrypted backups are purged within 30 days. To request data deletion without deleting your account: Contact us at contact@fitflowrecreation.com with the subject line "Data Deletion Request" and specify which data you would like removed. To request a copy of your data: Contact us at contact@fitflowrecreation.com with the subject line "Data Export Request". We will provide your data in a structured, machine-readable format within 30 days.

 

12. Your rights:

Depending on your jurisdiction (including under GDPR), you have the right to:

• Request a copy of all your data.

• Correct (rectify) inaccurate data — directly in-app via Settings → Personal Information.

• Delete your account and all related data in one tap from Settings → Data & Privacy → Delete Account.

• Export your data as a structured file.

• Object to certain processing operations.

• Withdraw consent for biometric processing at any time.

• Lodge a complaint with the CNIL (France), your local data-protection authority, or — for EU/EEA residents — with our appointed GDPR Art. 27 representative.

 

13. Children's privacy:

FitFlowCircle is not intended for users under 13 years of age. We do not knowingly collect personal data from children below this age. If you believe a child has provided us with personal data, please contact us at contact@fitflowrecreation.com and we will erase it.

 

14. California residents (CCPA / CPRA):

If you are a California resident, you have additional rights:

• Right to know what categories of personal information we collect (see Section 3) and how we use it.

• Right to delete your data — exercisable from Settings → Data & Privacy → Delete Account.

• Right to non-discrimination: we never discriminate against users who exercise their CCPA/CPRA rights.

• We do not sell or share personal information as defined under CCPA/CPRA.

 

15. Cookies:

The mobile app does not use cookies. Our marketing website uses essential cookies only, with explicit consent required for any analytics cookies.

 

16. Automated decision-making:

Your Longevity Score is computed by an algorithm based on your biometric data.

• The scoring methodology is described in our in-app methodology page.

• The score has no legal or medical effect on you. It is informational and motivational only.

 

17. Changes to this Policy:

We may update this Privacy Policy from time to time. We will notify you in-app and, where changes are material, request renewed consent before continued use.

 

18. Contact us:

If you have any questions or wish to exercise your data protection rights, please contact us at:

FitFlowCircle — Privacy Team

Email: contact@fitflowrecreation.com

Support: contact@fitflowrecreation.com

EU Representative (GDPR Art. 27): Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria UK Representative (UK GDPR Art. 27): Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom