Privacy Policy

FitEcho ("we," "our," or "us") is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal data when you use the FitEcho mobile application, the fitecho.ai website and related services ("Services").

For data protection compliance (including GDPR and other applicable regulations), FitEcho is the data controller. Contact us at admin@fitecho.ai for any privacy-related concerns.

We process the content of your consultations and check-ins, including voice notes, written responses and the notes your coach records about your sessions, to deliver coaching and track your progress over time.

If you use body scans, we process the photos you capture to estimate body composition and track visual progress. These images are stored against your account and shared only with your coach.

We process the food, macro and supplement information you log to provide nutrition tracking and coaching feedback.

Health data, body scan photos and coaching content are sensitive. We process them only with your explicit consent, which you give when you enable each feature and can withdraw at any time.

With your permission, FitEcho reads the following from Apple Health on iPhone or Health Connect on Android to show your recovery and share it with your coach:

• Steps
• Active energy
• Sleep
• Resting heart rate
• Heart rate variability
• Body weight
• Workouts and exercise sessions

Access is read only. FitEcho never writes to Apple Health or Health Connect, and never uses Health data for advertising, marketing or data mining, and never sells it. You can turn access off at any time in the Health app on iPhone or in Health Connect settings on Android.

If you sign in with Google, we receive your name, email address and profile photo only. We use them to create and identify your account and show your profile to your coach or clients. We do not request access to any other Google data.

FitEcho's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small number of processors to run FitEcho. They act on our instructions and only receive what they need:

• OpenAI: we use OpenAI as a processor to transcribe your voice recordings and convert them into structured workouts. Audio and workout text are sent to OpenAI solely to provide this feature. Under OpenAI's API terms, data sent through the API is not used to train their models.
• Push notifications: if you enable notifications, we store a push token for your device and share it with our push delivery providers (Google Firebase Cloud Messaging and Apple Push Notification service) so we can send you workout updates and personal-record alerts. You can revoke this at any time in your device settings.
• Hosting: our servers and database run on Amazon Web Services in the EU (Stockholm).
• Sign-in: Apple and Google authenticate you when you choose to sign in with them.

Crash reports and error logs are sent to our own servers and are not shared with any third-party crash reporting or analytics provider. They are kept for 6 months.

Pages on our website with embedded YouTube videos load content from Google, which may set cookies and receive your IP address. We use youtube-nocookie where possible.

We do not sell your personal data.

We implement industry-standard security measures:

• Encryption in transit (TLS) for all data transmission
• Secure cloud storage with regular backups
• Access controls and authentication
• Regular security reviews
• Rate limiting and abuse protection

We will notify affected users within 72 hours of discovering any data breach that risks their rights and freedoms.

• Account data: Retained while account is active
• Workout data: Stored for 24 months unless manually deleted
• Technical logs: Kept for 6 months
• Payment information: Retained as required by law

You can delete your account at any time in the app under Profile, then Delete account, or by emailing admin@fitecho.ai from the address linked to your account.

When you delete your account we delete your profile, sign-in identifiers, workouts, voice recordings and transcripts, check-in and consultation content, body scan photos, nutrition logs, data imported from Apple Health or Health Connect, and push tokens. Deletion is completed within 30 days, including removal from backups as they rotate. We keep only what the law requires us to retain, such as payment records.

If you are a client, notes your coach wrote about you are deleted with your account. If you are a coach, your clients keep their own accounts and workout history.

You can:

• Access your personal data
• Correct inaccurate information
• Request data deletion
• Export your data
• Object to or restrict processing
• Withdraw consent for data processing
• Complain to your local data protection authority

To exercise any of these rights, email admin@fitecho.ai. We respond within 30 days.

Our servers are in the EU. Some processors, including OpenAI and Google, may process data in the United States. Where data leaves the EU we rely on:

• EU-approved standard contractual clauses
• The EU-US Data Privacy Framework, where the recipient is certified
• Appropriate security measures

FitEcho is not intended for anyone under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact admin@fitecho.ai and we will delete it.

We'll notify you of significant changes through:

• In-app notifications
• Email updates
• Website announcements