Legal
Privacy Policy
Your health data is among the most sensitive information you can share. This Privacy Policy explains clearly what we collect, why we collect it, how it is protected, and what rights you have. Please read it in full.
1. Who we are
Fitra360 ("we", "us", "our") is an AI-powered personalized wellness platform operated from the State of Florida, United States. We are the data controller for the personal information you provide through our mobile application and associated services (collectively, the "Platform").
Contact for all privacy matters: hello@fitra360.com. Use subject line "Privacy Request" for data requests, "GDPR Data Request" for GDPR requests, and "California Privacy Rights Request" for CCPA requests.
2. The data we collect
Because Fitra360 delivers genuinely personalized wellness insights, we collect a broader range of data than most wellness apps. Every category below is collected only to generate, improve, and deliver your personalized wellness plan. We do not collect data for advertising purposes.
2.1 Account & identity data
- Full name and email address.
- Date of birth and biological sex (required for accurate wellness modeling).
- Profile photo (optional).
- Account credentials (password stored in hashed, salted form, never in plain text).
2.2 Sensitive health data
The following categories are classified as sensitive personal data under GDPR, CCPA/CPRA, and other applicable laws. We collect them only with your explicit, informed consent.
- DNA & genetic data: Methylation data and genetic markers you voluntarily upload or connect. Used to personalize supplement suggestions, nutrition guidance, and identify metabolic patterns.
- Blood work & lab results: Lab reports, bloodwork panels, and biomarker data you upload. Used to help you understand nutrient status, markers associated with hormonal balance, and trends.
- Symptoms & signals: Self-reported signals, locations, severity, and duration. Used to help you understand patterns and suggest relevant testing or adjustments to discuss with a professional.
- Gut health data: Digestive patterns, microbiome reports, and gastrointestinal information you provide. Used to tailor nutrition and supplement suggestions.
- Dental & oral health history: Dental procedures, existing conditions, and oral health inputs. Used to factor oral health into the broader picture.
- Well-being & stress indicators: Self-reported stress, mood, and energy. Used to calibrate recovery suggestions.
2.3 Wearable & device data
In future releases, Fitra360 may integrate with wearable device platforms (such as Apple HealthKit, Google Fit, Fitbit, or Garmin) and nutrition tracking applications. When such integrations are activated by you, we may collect sleep data, heart rate and HRV, activity and caloric expenditure, and recovery scores. No third-party integrations are active in the current release. When they are introduced, you will be asked for explicit consent before any data is shared between platforms.
2.4 Nutrition & lifestyle data
- Food logs entered manually, photographed, or synced from third-party apps (future feature).
- Meal timing and dietary preferences or restrictions.
- Supplement usage and self-reported effects.
- Hydration, alcohol, and caffeine intake.
2.5 Location & environmental data
- General geographic location (city/region level), used to factor in environmental context such as seasonal light cycles.
- Precise location is not collected unless explicitly enabled by you for a specific feature.
2.6 Technical & usage data
- Device type, operating system, and app version.
- IP address and general network information.
- Basic app functionality data needed to operate the service.
- Push notification preferences.
We do not use third-party analytics or crash-reporting SDKs.
2.7 Communications data
- Emails or messages you send to our support team.
- Feedback, survey responses, and waitlist submissions.
2.8 Derived & inferred data
As you use Fitra360, we generate additional data derived from your inputs, including wellness scores, AI-generated insights, recommendation histories, and trend analyses. This derived data is considered personal data where it can be linked to you and is treated with the same level of protection as your original inputs. You may request access to or deletion of your derived data in the same way as any other personal data we hold.
3. How we use your data
We use your data exclusively for the purposes below. We do not use your health or genetic data for advertising, profiling for commercial sale, or any purpose beyond what is listed here.
3.1 Delivering your personalized wellness plan
- Generating AI-powered wellness insights, supplement suggestions, nutrition guidance, movement plans, and sleep recommendations tailored to your biology.
- Continuously recalibrating your plan as you upload new data or report signals.
- Helping you understand nutrient status and trends from your lab and DNA data.
3.2 AI processing
Fitra360 uses artificial intelligence to analyze your health data and generate personalized recommendations. To do this, we send your health information to a third-party AI service provider (see Section 7). We do not use your data to train AI models, and your health data is never used for advertising. As our platform evolves, we may change AI providers or build our own models. Any change that affects how your data is processed will be communicated to you in advance, and where required, we will ask for your consent again.
3.3 Safety, security & legal compliance
- Detecting and preventing fraud, unauthorized access, and security incidents.
- Complying with applicable laws, regulations, and lawful government requests.
- Enforcing our Terms of Service.
- Protecting the rights, property, or safety of Fitra360, our users, or the public.
3.4 Communications
- Account-related notifications (e.g., confirmation, password reset).
- Wellness plan updates and insights.
- Product updates and wellness content (only with your consent; unsubscribe available at any time).
4. Legal basis for processing (GDPR)
If you are in the EEA or the UK, we process your personal data on these legal bases:
- Explicit Consent (Art. 6(1)(a) and 9(2)(a)): For all sensitive health data, genetic data, and any processing beyond strict service delivery. You may withdraw consent at any time without affecting prior lawful processing.
- Performance of a Contract (Art. 6(1)(b)): To deliver the Fitra360 service you signed up for.
- Legal Obligation (Art. 6(1)(c)): Where required by law.
- Legitimate Interests (Art. 6(1)(f)): For platform security and fraud prevention, only where not overridden by your rights.
For each sensitive data category, the legal basis is always explicit, granular consent. You may withdraw consent at any time through your account settings or by contacting hello@fitra360.com.
5. Genetic & biometric data: special protections
- Separate consent required: affirmative, explicit consent specifically for genetic data processing, separate from general account consent.
- Encryption at rest and in transit: all genetic data is encrypted in transmission and storage.
- No sale or commercial sharing: never sold, shared for advertising, or disclosed to insurers or employers.
- De-identification before any research use: fully de-identified first, and only with your separate opt-in consent.
- Right to deletion: request permanent deletion at any time; completed within 30 days.
- State law compliance: if you reside in Illinois, Texas, Washington, or another jurisdiction with biometric or genetic data laws (e.g., BIPA, TBIA), your additional statutory rights apply.
- GINA alignment: we do not use genetic data in any manner that could affect health insurance or employment eligibility.
6. How we store & protect your data
6.1 Storage infrastructure
Fitra360 stores user data using cloud infrastructure operated by Supabase, which provides authentication and database services with row-level security so that only you can access your own records. We will update this section if our infrastructure providers change. We use TLS 1.2 or higher in transit, AES-256 or equivalent at rest, role-based access controls, and audit logging of access to sensitive health data.
6.2 Data minimization
We collect only the data necessary to deliver your plan. You are never required to provide genetic data or lab results; these are optional inputs that enhance the depth of your plan. The Platform will function with less data; it will simply be less personalized.
6.3 Retention periods
- Active account data: retained for the duration of your account plus 30 days after deletion request.
- Health and genetic data: deleted within 30 days of account closure or deletion request, unless retention is required by law.
- Technical logs: retained for a limited period, then deleted.
- Support communications: retained for up to 24 months.
- De-identified, aggregated data: may be retained as it cannot be linked to you.
6.4 Security incident response
In the event of a data breach affecting your personal data, Fitra360 will notify affected users without unreasonable delay and in accordance with applicable law, with information about the incident, data affected, steps taken, and recommended actions.
7. Third-party AI service provider
Fitra360's personalized wellness insights are generated using artificial intelligence. We use a third-party AI service provider to process your health inputs, read the lab reports you upload, and generate your recommendations. This is a core part of how the app works. To create your plan, we send your health information to this provider, including profile details such as your name and date of birth, your analyzed DNA and blood work, your lifestyle inputs and self-reported signals, and the lab reports you choose to upload. The information is sent from our secure backend over an encrypted connection, not directly from your device.
The provider uses your information only to generate your recommendations. It does not use your data to train its models, and your data is never sold or used for advertising. We keep an up-to-date list of all service providers that process your data, including the current AI provider, at https://fitra360.com/subprocessors. If we change AI providers in a way that affects how your data is processed, we will update this policy and the subprocessors page, and where required by law, ask for your consent again.
8. Third-party integrations & data sharing
8.1 Current integrations
Fitra360 does not currently integrate with any third-party health platforms, wearable devices, or nutrition applications. All data in the current release is entered directly by you.
8.2 Future integrations
Future releases may offer integrations with platforms such as Apple HealthKit, Google Fit, and wearable manufacturers. When available, you will be asked to grant explicit permission, informed of exactly what data will be accessed and why, and able to revoke permissions at any time. This policy will be updated to identify each integration.
8.3 When we may share your data
We do not sell your personal data. We share it only with our AI service provider (Section 7), our cloud infrastructure provider (Section 6.1), where required by law, in the event of a business transfer (with advance notice and, where required, consent), or with your explicit consent. We do not use third-party analytics providers, and we do not share your data for advertising.
8.4 Healthcare practitioners (B2B)
Practitioner and B2B functionality is planned for a future release and will be governed by a separate agreement. Contact hello@fitra360.com to be notified.
9. Apple App Store & Google Play disclosures
If and when Fitra360 integrates with Apple HealthKit or Google Fit, we will comply with the applicable developer guidelines, including that such data will not be used for advertising, sold to data brokers, or used for any purpose other than supporting your wellness within Fitra360. The data types collected by Fitra360 include Health & Fitness data, Identifiers, Usage Data, and Sensitive Information. Our app store listings are kept current with our data practices.
10. Your privacy rights
10.1 Universal rights (all users)
- Right to access, correction, deletion, withdrawal of consent, data portability, and to complain to a data protection authority.
To protect your data, we may require identity verification before fulfilling a request, using the minimum information necessary. We may refuse or charge a reasonable fee for requests that are excessive, repetitive, or manifestly unfounded, where permitted.
10.2 GDPR rights (EEA & UK users)
- Right to restrict processing, to object to processing based on legitimate interests, and rights related to automated decision-making. Fitra360's AI generates recommendations for your review; it does not make binding decisions about you.
10.3 California rights (CCPA/CPRA)
- Right to know, delete, correct, opt out of sale or sharing (Fitra360 does not sell personal information), limit use of sensitive personal information, and non-discrimination.
To exercise any of these rights, contact hello@fitra360.com with the appropriate subject line. We respond within 30 days (GDPR) or 45 days (CCPA), with one possible extension where permitted.
11. Age requirement
Fitra360 is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a person under 18, we will delete that information promptly. If you believe we may have collected data from someone under 18, please contact us at hello@fitra360.com.
12. International data transfers
Fitra360 is operated from the United States. If you access the Platform from outside the United States, your personal data will be transferred to and processed in the United States. For users in the EEA or UK, we rely on Standard Contractual Clauses and Data Processing Agreements with all third-party providers who receive your personal data. By using Fitra360, you acknowledge that your data may be processed in the United States and other countries where our service providers operate.
13. Cookies & tracking technologies
The Fitra360 mobile application does not use browser cookies, and we do not use third-party analytics or crash-reporting SDKs. Push notification services are used to deliver plan updates and reminders; you may opt out at any time from your device settings. If a web version of Fitra360 is released, a separate Cookie Policy will be published with a consent mechanism before any non-essential tracking is activated.
14. AI transparency
- What AI does: analyzes your combined inputs (DNA, labs, signals, lifestyle) to generate personalized wellness recommendations.
- What AI does not do: make binding clinical decisions, replace a licensed healthcare provider, or take any action without presenting its output to you first.
- How recommendations are generated: your information is sent to a third-party AI provider that identifies patterns and generates suggestions, which are reviewed and formatted by Fitra360 before being presented to you.
- Accuracy limitations: recommendations are probabilistic, depend on the quality of your inputs, and may not be accurate for your situation. Always consult a qualified healthcare professional before acting on any recommendation.
- No automated decision-making with legal effect.
- Model changes: disclosed, with renewed consent where required.
15. Changes to this Privacy Policy
We may update this Privacy Policy as our Platform evolves or laws change. We will notify you via email and/or in-app notification at least 14 days before material changes take effect. For changes that materially affect how we process your sensitive health or genetic data, we will seek your active, affirmative consent rather than rely on continued use. The updated policy will always display its effective date, and previous versions will be archived and available upon request.
16. Contact & data protection inquiries
Fitra360
Email: hello@fitra360.com
Website: www.fitra360.com
For GDPR requests, CCPA requests, or genetic data deletion, email hello@fitra360.com with the appropriate subject line. We fulfill verified data requests within the legally required timeframes (30 days under GDPR, 45 days under CCPA).
See also our Consumer Health Data Notice and SubProcessors.