Privacy Policy

What data we process

We process the following data:

• Account data: email address, name, username and profile picture
• Profile data: date of birth, height, gender and weight
• Training data: workouts, exercises, sets, reps and weights, and training programmes
• Health data from Apple Health or Health Connect, if you grant permission: heart rate, resting heart rate, active energy burned, steps, sleep and exercise sessions
• Data written back to the health platform: body weight and workouts
• Communication: chats with your coach, and posts, comments and images in your gym's feed
• Notes and timeline entries created by you or your coach
• Technical data: push notification device token

Health data

Health data is a special category of personal data under the GDPR. We read it from Apple Health or Health Connect only if you explicitly grant permission in your device settings. You can withdraw that permission at any time in your device settings, after which no new data is read.

We use health data solely to show you your own activity and progress in the app. We do not use it for advertising and we do not sell it.

Why we process data

• Providing the service: logging workouts, tracking progress and delivering programmes
• Communication between you and your gym's coaches
• Notifications, if you have enabled them
• Technical maintenance and security of the service

Legal basis

Processing is based on the contract (GDPR Article 6(1)(b)) — your use of the service as a member of your gym.

Health data is processed on the basis of your explicit consent (GDPR Article 9(2)(a)), given when you grant the app permission to read health data.

Who can see your data

Your data is not visible to users of other gyms. We do not sell your data or disclose it for marketing purposes.

• You
• Coaches and administrators of your own gym, who are responsible for your coaching
• Back2stages Oy as the operator of the service, to the extent maintenance requires

Service providers

We use the following processors:

• Supabase — database, authentication and file storage, servers in the EU (Stockholm)
• Cloudflare — the application API
• Expo (Expo Application Services) — push notification relay and app update delivery
• Apple Push Notification service and Google Firebase Cloud Messaging — delivery of notifications to your device
• Vercel — hosting for this website and the admin portal

Retention

We retain your data for as long as your account exists. When you delete your account, the data is permanently deleted — deletion begins immediately and completes within a few minutes.

We do not retain data after account deletion unless required by law.

Deleting your account and data

You can delete your account and all your data directly in the app: open Profile and choose Delete Account.

If you can no longer sign in, contact your gym or write to coen@fiid.io.

Your rights

You have the right to:

• Know what data we process about you and receive a copy
• Have inaccurate data corrected
• Have your data erased
• Restrict or object to processing
• Data portability
• Withdraw your consent to health data processing
• Lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi)

Minimum age

HealthUpp is intended for users aged 16 and over. We do not knowingly collect data from anyone under 16.

If a gym provides the service to a member under 16, the gym must obtain guardian consent before the account is created. If we learn that data from a user under 16 has been collected without guardian consent, we will delete the account and the associated data.

Changes to this policy

If we change what data we process or how, we will update this policy and its date.