Privacy Policy

Be Fit and Strong is a personal fitness coaching service based in Dubai, United Arab Emirates. We provide one-to-one coaching delivered through a private application in which your coach builds and adjusts your training and nutrition.

We only collect what we need to coach you.

You give us:

• Account details: your name, email address, and a password (handled by our authentication provider; we never see it in plain text).
• Profile and body metrics: age, sex, height, body weight, body-fat estimates, and goals, used to calculate your training and nutrition targets.
• Training data: your workouts, exercises, sets, reps, weights, and effort.
• Nutrition data: meal logs, food entries and photos you upload, and dietary preferences.
• Check-ins: subjective inputs such as sleep, soreness, stress, and energy, and any photos you choose to add.
• Messages: communications between you and your coach.

Collected automatically:

• Usage and device data: basic information about how you use the app and the device or browser you use, including a push-notification token if you enable reminders.

From your wearable or scale, only if you connect it (see Section 4):

• WHOOP data: recovery score, heart-rate variability, resting heart rate, sleep stages and duration, daily strain, workouts, and related metrics.
• Withings scale data: each weigh-in with its time, and body composition readings (body-fat percentage, fat mass, fat-free mass, muscle mass, water, and bone mass), plus your scale model and the ID Withings gives your account. We do not collect activity, sleep, heart, temperature, or profile data from Withings.

We do not intentionally collect special-category data beyond the health and fitness data above, which you provide to receive coaching.

• To deliver your coaching: build and adjust your training program and nutrition targets, and track your progress.
• To personalize guidance, including using automated tools and AI (see Section 5) to help your coach analyze your training and nutrition and prepare recommendations, which your coach reviews.
• To send you reminders and updates you have enabled (push notifications and messages).
• To operate, secure, and improve the Service.
• To comply with legal obligations.

Our lawful bases, where applicable, are the performance of our coaching agreement with you, your consent (for example, connecting WHOOP or a Withings scale, or enabling notifications), and our legitimate interests in running and securing the Service.

Connecting a wearable or a scale is optional.

WHOOP

If you choose to connect your WHOOP account, you authorize us through WHOOP's secure sign-in (OAuth) to read your recovery, sleep, strain, and workout data. We use it only to inform your coaching, for example to read recovery and adjust your training. We request read-only access and the specific permissions needed for those metrics.

• We store the WHOOP data needed for your coaching and the secure tokens that let us sync it.
• We do not sell your WHOOP data or use it for advertising.
• You can disconnect WHOOP at any time from the app settings, which stops further syncing and revokes our access. You can also revoke access from your WHOOP account.

Your use of WHOOP is also governed by WHOOP's own privacy policy and terms.

Withings

If you choose to connect your Withings scale, you authorize us through Withings' secure sign-in (OAuth) to read your scale's measurements. We fetch only your weight and body composition readings (see Section 2), and we use them only to inform your coaching.

• When you connect (or connect again after disconnecting), we also bring in your scale's readings from the last 90 days. They are stored with your data, but readings from before the day you connect do not go into your log.
• From the day you connect, your weight goes into your log on the day you weighed in, and is used like a weight you log yourself. If you type a weight yourself for that day, yours is kept. Your coach sees which weights came from the scale.
• Body composition readings are visible to your coach only. They never change your body-fat estimate on their own. Your coach may refer to them when updating it by hand. The data download in the app's settings includes your scale weigh-ins and their times, not your body composition readings.
• If Withings cannot tell whether a reading was yours (for example, on a shared scale), we keep only the time it was taken, not its measurements.
• Readings follow the Withings account they came from. If you share one Withings account with someone else, their weigh-ins can come in as yours, so give each person their own profile on the scale. If someone else later connects that same Withings account to the app, the scale readings we stored from it move with the account. The weights already in your log stay yours.
• We store the secure tokens that let us sync your readings. They are encrypted, and only our server can use them.
• We do not sell your Withings data or use it for advertising.
• You can disconnect Withings at any time from the app settings. This stops new readings, deletes the tokens we hold, and asks Withings to end our access. You can also remove our access from your Withings account.
• After you disconnect, and after your coaching ends, the weigh-ins already in your log and the scale readings we stored stay until you ask us to remove them. If you ask, we delete your stored scale readings and the weights the scale added to your log. Weights you typed yourself stay.

Your use of Withings is also governed by Withings' own privacy policy and terms.

To help your coach personalize your plan, parts of the Service use artificial-intelligence tools (provided by Anthropic) to analyze your training and nutrition data and draft recommendations. These drafts are reviewed by your human coach before they reach you. The AI does not make final coaching decisions on its own. Data sent to our AI provider is processed to generate these outputs and is not used by us to train public models.

We do not sell your personal information. We share it only with:

• Service providers (sub-processors) who run the Service on our behalf, under contract and only as needed: Supabase (database, authentication, and file storage), Vercel (application hosting and delivery), Anthropic (the AI processing described in Section 5), Twilio (sending messages and notifications), WHOOP (only if you connect it, to read your wearable data), and Withings (only if you connect it, to read your scale readings).
• Your coach, who needs your data to coach you.
• Legal and safety: if required by law, or to protect rights, safety, and the integrity of the Service.

Our database and storage are hosted in Singapore, and our application runs on cloud infrastructure that may process data in Singapore and other regions. If you are located in the UAE, the United Kingdom, the EU or EEA, or elsewhere, your information may be transferred to and processed in these locations. For transfers out of the UK or the EU and EEA, we rely on appropriate safeguards such as Standard Contractual Clauses together with our service providers' contractual protections.

We keep your information for as long as you have an active coaching relationship with us, and afterward only as long as needed for legitimate business or legal purposes. You can ask us to delete your account and associated data (see Section 9). Disconnecting WHOOP stops new wearable data from being collected. Disconnecting Withings stops new scale readings from being collected, and the readings already stored are kept until you ask us to remove them (see Section 4).

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, to object to certain processing, and to withdraw consent (for example, by disconnecting WHOOP or Withings, or turning off notifications). You can:

• View and update much of your data directly in the app.
• Disconnect WHOOP or Withings from the app settings at any time.
• Ask us to remove your Withings data: the scale readings we stored and the weights your scale added to your log.
• Turn notifications on or off in settings.
• Contact us at mirza@befitandstrong.com to access, correct, or delete your data, or to ask a privacy question.

We will respond within the time required by applicable law. If you are in the UK, the EU, or the EEA, you also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office).

We protect your data with industry-standard measures, including encryption in transit, access controls, and reputable infrastructure providers. No system is perfectly secure, but we work to safeguard your information and limit access to those who need it to coach you.

The Service is intended for adults aged 18 and over. We do not knowingly collect data from children. If you believe a minor has used the Service, contact us and we will remove the data.

We may update this policy from time to time. We will post the updated version here with a new "Last updated" date, and, for material changes, take reasonable steps to let you know.

Be Fit and Strong
Dubai, United Arab Emirates
mirza@befitandstrong.com