Privacy Policy

1. WHAT INFORMATION DO WE COLLECT?

2. HOW DO WE USE YOUR INFORMATION?

In Short: We process your information for purposes based on legitimate business interests, the fulfillment of our contract with you, compliance with our legal obligations, and/or your consent.

We use personal information collected via our Services or Apps for a variety of business purposes described below. We process your personal information for these purposes in reliance on our legitimate business interests, in order to enter into or perform a contract with you, with your consent, and/or for compliance with our legal obligations. We indicate the specific processing grounds we rely on next to each purpose listed below.

We use the information we collect or receive:

• To facilitate account creation and logon process. If you choose to link your account with us to a third-party account *(such as your Google or Facebook account), we use the information you allowed us to collect from those third parties to facilitate account creation and logon process for the performance of the contract. See the section below headed " HOW DO WE HANDLE YOUR SOCIAL LOGINS " for further information.
• To send you marketing and promotional communications. We and/or our third-party marketing partners, after taking explicit consent from you, may use the personal information you send to us such as name and email for our marketing purposes, if this is in accordance with your marketing preferences. You can opt-out of our marketing emails at any time (see the " WHAT ARE YOUR PRIVACY RIGHTS " below).
• To send administrative information to you. We may use your personal information to send you product, service and new feature information and/or information about changes to our terms, conditions, and policies.
• To facilitate booking and administration of diagnostic tests. We use your provided details to process your request for diagnostic tests, coordinate sample collection, and enable testing through Fittr-operated / in-house laboratories and/or selected NABL-certified or other qualified diagnostic partner laboratories.
• To deliver your diagnostic reports. We use your account details to securely make your test results available to you.
• To assess coaching-plan eligibility and suitability. Where a coaching or nutrition plan requires health disclosures or a pre-coaching blood or laboratory test, we may use the information you provide, including disclosures regarding GLP-1 receptor agonist use and relevant lab reports or results, to assess eligibility, safety, suitability and readiness to commence the selected plan.
• To facilitate doctor consultation services. We may use information you provide in connection with a consultation to facilitate the requested Service, make relevant information available to the Registered Medical Practitioner, maintain consultation or service records, provide support, and, where applicable, make any prescription or clinical recommendation issued by the Registered Medical Practitioner available through the Platform.
• To provide a Medical Report Summary. We may use medical or lab reports you choose to upload to generate, display and maintain the requested summary and, where you choose, enable sharing of the report or summary with your assigned FITTR Coach or a Registered Medical Practitioner.
• To manage health profiles and records of added members. We use the information of added members, including family members, friends, dependents, and minors, to create and maintain their profiles, facilitate services requested through the Platform, and enable account-level management of such profiles.
• To display reports, records, body metrics, and health insights for added members. We use personal information and health-related information, including uploaded records, lab reports, medical history, and device-generated data from FITTR HART, FITTR Sense, and FITTR Sense Pro, to generate, organise, store, and display health records, body composition metrics, wellness data, and health insights relating to added members in the relevant user account, including within the “My Health” section.
• To facilitate services booked or used on behalf of added members. We use such information to coordinate diagnostic bookings, sample collection, report delivery, body measurement tracking, device syncing, customer support, and related health and wellness services requested through the Platform.
• To process and fulfil packaged food product orders. We use your personal information to process purchases of packaged food products, coordinate order fulfilment, shipping, delivery, returns, replacements, refunds, customer support, and related service communications.
• To track your nutrition intake, weight and fitness routine. Fittr Coaches require information about your eating habits, changes in your body weight and your fitness regime to craft a personalised Nutrition and Training Plans and to monitor your progress.
• Fulfill and manage your orders. We may use your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services or Apps to deliver products to you, including through our delivery partners.
• To post testimonials. We post testimonials on our Services or Apps that may contain personal information. Prior to posting a testimonial, we will obtain your consent to use your name and testimonial. If you wish to update, or delete your testimonial, please contact us at support@fittr.com and be sure to include your name, testimonial location, and contact information.
• Administer prize draws and competitions. We may use your information to administer prize draws and competitions when you elect to participate in competitions.
• Request Feedback. We may use your information to request feedback via calls/emails/survey tools and to contact you about your use of our Services or Apps.
• To protect our Services. We may use your information as part of our efforts to keep our Services or Apps safe and secure (for example, for fraud monitoring and prevention).
• To enforce our terms, conditions and policies for Business Purposes, Legal Reasons and Contractual.
• To respond to legal requests and prevent harm. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.
• To manage user accounts. We may use your information for the purposes of managing our account and keeping it in working order.
• To deliver services to the user. We may use your information to provide you with the requested service.
• To respond to user inquiries/offer support to users. We may use your information to investigate complaints, process refunds, coach change or product replacements, respond to your inquiries, address quality related concerns and solve any potential issues you might have with the use of our Products or Services and comply with applicable legal and regulatory obligations..
• For Marketing, Publicity & Promotions. Where you separately submit content to Fittr for testimonial, marketing, publicity or promotional use, Fittr may use your name, voice, likeness and associated personal information only in accordance with the consent obtained from you for such use.
• For other Business Purposes. We may use your information for other Business Purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Services or Apps, products, marketing and your experience. We may use and store this information in aggregated and anonymized form so that it is not associated with individual end users and does not include personal information. We will not use identifiable personal information without your consent.

3. WILL YOUR INFORMATION BE SHARED WITH ANYONE?

In Short: We only share information with your consent, to comply with laws, to provide you with services, to protect your rights, or to fulfill business obligations. We may process or share data based on the following legal basis:

• Consent: We process your sensitive personal data or information if you have given us specific consent to use it for a specific purpose.
• Legitimate Interests: We may process your data when it is reasonably necessary to achieve our legitimate business interests.
• Performance of a Contract: Where we have entered into a contract with you, we may process your personal information to fulfill the terms of our contract.
• Legal Obligations: We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements).
• Vital Interests: We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person and illegal activities, or as evidence in litigation in which we are involved.

More specifically, we may need to process your data or share your personal information in the following situations:

• Diagnostic Laboratories and Healthcare Providers: Your personal information and health-related information may be shared with:
• FITTR-operated / in-house laboratories, NABL-certified or other qualified third-party diagnostic laboratories, and sample collection partners, strictly for the purpose of facilitating bookings, sample collection, conducting diagnostic tests, processing samples, generating and sharing reports;
• Registered Medical Practitioners and healthcare professionals, only to the extent necessary for interpreting reports, consultations, or providing health-related services requested by you; and
• Where you choose to share a medical or lab report or Medical Report Summary with your assigned FITTR Coach or a Registered Medical Practitioner through the Platform, we may disclose that information to the selected recipient solely for the purpose requested by you.
• Authorised personnel within Squats Fitness Private Limited and Fittr Lifecare Private Limited, including limited teams such as diagnostics operations, customer support, and relevant technology personnel, strictly on a need-to-know basis for purposes including report access facilitation, customer support, technical troubleshooting, service improvement, and compliance with applicable law.
• Added Members / Account Holder Access and Internal Service Access. Where a user adds, books, or manages another person under their account, the personal information and health-related information of such added member, including uploaded medical records, diagnostic reports, medical history, FITTR HART data, FITTR Sense / Sense Pro data, body composition metrics, booking details, status updates, and health insights, may be made accessible through the account used to add, book, or manage such member, based on the account holder’s confirmation that they are duly authorised and have obtained all necessary consents from the concerned adult member or, in the case of a minor, the parent or lawful guardian. Such information may also be accessed on a strict need-to-know basis by authorised personnel within Squats Fitness Private Limited and Fittr Lifecare Private Limited, including relevant operations, customer support, diagnostics, product, and technology teams, solely for the purposes of service delivery, troubleshooting, report access facilitation, profile management, and compliance with applicable law. We implement role-based access controls and appropriate internal safeguards to restrict such access.
• Vendors, Consultants and Other Third-Party Service Providers. We may share your data with third party vendors, service providers, contractors or agents who perform services for us or on our behalf and require access to such information to do that work. Examples include: Fittr Coaches’, Registered Medical Practitioners, sample collection partners, payment processing, data analysis, email delivery, delivery partners, hosting services and marketing efforts. Fittr Coaches and authorised personnel may access only such personal and progress information as is reasonably necessary to provide the coaching, progress-tracking, customer-support or administrative services assigned to them. We may allow selected third parties to use tracking technology on the Services or Apps, which will enable them to collect data about how you interact with the Services or Apps over time. This information may be used to, among other things, analyse and track data, determine the popularity of certain content and better understand online activity. Unless described in this Policy, we do not share, sell, rent or trade any of your information with third parties for their promotional purposes. We have contracts in place with our data processors, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organization apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Third-Party Advertisers. We may use third-party advertising companies to serve ads when you visit the Services or Apps. These companies may use information about your visits to our Website(s) and other websites that are contained in web cookies and other tracking technologies in order to provide advertisements about goods and services of interest to you.
• Offer Wall. Our Apps may display an offer wall (“FitShop”). Such an offer wall allows us to offer gifts, or other third-party items to users in return for exchange of virtual currency (“FitCoin”). Such an offer wall may appear in our website and mobile application and be displayed to you based on certain data, such as your geographic area or demographic information. When a user redeems any products from the offer wall, the user's name, address and phone number is shared with the third party to deliver the products redeemed by the user through the offer wall.
• Third-party Websites. The Website/Mobile Application may contain links to third-party websites and applications of interest, including advertisements and external services, that are not affiliated with us. Once you have used these links to leave the Website/Mobile Application, any information you provide to these third parties is not covered by this Privacy Policy, and we cannot guarantee the safety and privacy of your information. Before visiting and providing any information to any third-party websites, you should inform yourself of the privacy policies and practices (if any) of the third party responsible for that website, and should take those steps necessary to, in your discretion, protect the privacy of your information. We are not responsible for the content or privacy and security practices and policies of any third parties, including other sites, services or applications that may be linked to or from the Website/Mobile Application.

4. WHO WILL YOUR INFORMATION BE SHARED WITH?

In Short: We only share information with the following third parties.

We only share and disclose your information with the following third parties. We have categorized each party so that you may easily understand the purpose of our data collection and processing practices. If we have processed your data based on your consent and you wish to revoke your consent, please contact us using the contact details provided in the section below titled "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?".

• Cloud Computing Services

Amazon Web Services (AWS) (Privacy Policy) (GDPR Compliance)

• Communicate and Chat with Users

LeadSquared (Privacy Policy) (GDPR Compliance)

Whatsapp (Privacy Policy)

Google Forms (Privacy Policy)

• Invoice and Billing
• PayPal (Privacy Policy) (GDPR Compliance)
• Stripe (Privacy Policy) (GDPR Compliance)
• RazorPay (Privacy Policy)
• CashFree (Privacy Policy)
• Paytm (Privacy Policy)
• Payglocal (Privacy Policy)
• Juspay (Privacy Policy)
• Bulk Mail Service
• Mailchimp (Privacy Policy) (GDPR Compliance)
• Mailgun (Privacy Policy) (GDPR Compliance)
• Sendy (Privacy Policy)
• User Account Registration and Authentication
• Google Sign-In (Privacy Policy)
• Sign in with Apple (Privacy Policy)
• Web and Mobile Analytics
• Google Analytics (Privacy Policy) (GDPR Compliance)
• CleverTap (Privacy Policy) (GDPR Compliance)
• UXCam (Privacy Policy) (GDPR Compliance)
• Clarity (Privacy Policy) (GDPR Compliance)
• AI-bot to Answer User Queries
• Gemini (Privacy Policy)
• Claude (Privacy Policy)
• ChatGPT (Privacy Policy) (Terms of Use) (API data usage policies)
• App Testing and Beta Distribution
• Apple TestFlight / App Store Connect (Privacy Policy)
• Google Play / Google Play Console (Privacy Policy)
• Planning Nutrition & Fitness Plan
• FITTR Coach
• Manage App
• FITTR Admins
• FITTR HART API
• Lab Test Reports
• Thyrocare (Privacy Policy)
• TATA 1mg (Privacy Policy)
• Healthians (Privacy Policy)
• Registered Medical Practitioners
• AI Tools

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

6. DO WE USE GOOGLE MAPS?

In Short: Yes, we use Google Maps for the purpose of providing better service.

This website and mobile application uses Google Maps APIs. You may find the Google Maps APIs Terms of Service here. To better understand Google’s Privacy Policy, please refer to this link. By using our Maps API Implementation, you agree to be bound by Google’s Terms of Service.

7. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short:

Our Services or Apps may offer you the ability to register and login using supported third-party sign-in services, such as Google or Apple. Where you choose to do this, we receive only the profile or account information made available to us by that sign-in provider and authorised by you, such as your name and email address.

8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We may transfer, store, and process your information in countries other than your own. All web servers and hosting are managed by our team using Amazon Web Services in EU Region. This includes website hosting, backups, web database, file storage, APIs, and log files. Amazon’s privacy policy can be found here: https://aws.amazon.com/privacy/.

If you are accessing our Services or Apps from outside EU Region, please be aware that your information may be transferred to, stored, and processed by us in our facilities and by those third parties with whom we may share your personal information (see " WILL YOUR INFORMATION BE SHARED WITH ANYONE? " above), in India, and other countries.

If you are a resident in the European Economic Area, then these countries may not have data protection or other laws as comprehensive as those in your country. We will however take all necessary measures to protect your personal information in accordance with this privacy policy and applicable law.

9. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this privacy policy unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy policy, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). We retain your personal information for the period necessary to provide the relevant Services and fulfil the purposes described in this Privacy Policy. Following completion of the relevant Service or transaction, we will retain the personal data, associated traffic data and processing logs for a minimum period of one year from the date of the relevant processing, or for such longer period as may be required under applicable law.

Certain categories of information, including transaction, payment, accounting, tax, coaching, diagnostic, medical, grievance, fraud-prevention and dispute-related records, may be retained for longer periods where such retention is required or permitted under applicable law or is necessary for the establishment, exercise or defence of legal claims.

Upon expiry of the applicable retention period, we will delete or anonymise the personal information. Where immediate deletion is not technically feasible, including where the information is stored in backup archives, we will securely isolate the information from further processing until deletion is possible.

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented an appropriate Information Security Management System (ISMS) designed to protect the security of any personal information we process. This ISMS is established and managed in alignment with global best practices and certified towards ISO 27001:2013 standard. Additionally, our ISMS is certified by a CERT-In Empaneled IT Security Auditing Organization, underscoring our commitment to robust cybersecurity measures. The system is subject to strong controls including ongoing monitoring, periodic security testing, internal/external audits and verifications. However, please also remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our Services or Apps is at your own risk. You should only access the services within a secure environment.

Fittr is committed to maintaining the highest standards of data privacy and security. In addition to following global best practices, our operations comply with the applicable provisions of the Health Insurance Portability and Accountability Act (HIPAA), the General Data Protection Regulation (GDPR), and the Digital Personal Data Protection Act (DPDPA). These compliance measures ensure the robust protection of sensitive personal and health-related information across our services.

11. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

Fittr does not permit a person under 18 years of age to independently create or operate an account, unless expressly permitted for a particular Service under applicable law. Where Fittr expressly provides a service intended for children or teenagers, the account or service must be initiated, managed or authorised by the child’s parent or lawful guardian. By using the Services or Apps, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services or Apps. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we have collected from children under age 18, please contact us at support@fittr.com.

12. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Subject to applicable law, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time.

Digital Personal Data Protection Act, 2023 (“DPDP ACT”), Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 permits our users who are Indian residents and The General Data Protection Regulation (EU) permits our users who are EU residents the right to review or amend the Sensitive Personal Data or Information (SPDI) and give the information provider an option to retract consent at any point of time, in relation to the information that has been so provided.

In some regions (like the European Economic Area), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; and (iv) if applicable, to data portability. In certain circumstances, you may also have the right to object to the processing of your personal information. To make such a request, please use the contact details provided below. We will consider and act upon any request in accordance with applicable data protection laws.

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. Please note however that this will not affect the lawfulness of the processing before its withdrawal.

If you are resident in the European Economic Area and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. You can find their contact details here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

• Account Information: If you would at any time like to review or change the information in your account or terminate your account, you can:
• Log into your account settings and update your user account.
• Contact us using the contact information provided
• Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, some information may be retained in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our Terms of Use and/or comply with legal requirements.
• Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services or Apps. To opt-out of interest-based advertising by advertisers on our Services or Apps visit http://www.aboutads.info/choices/ .
• Opting out of email marketing: You can unsubscribe from our marketing email list at any time by clicking on the unsubscribe link in the emails that we send or by contacting us using the details provided below. You will then be removed from the marketing email list – however, we will still need to send you service-related emails that are necessary for the administration and use of your account. To otherwise opt-out, you may:
• Note your preferences when you register an account with the site.
• Access your account settings and update preferences.
• Contact us using the contact information provided.
• Google forms: We also collect data through Google Forms and our surveys are designed to be anonymous. However, respondents should be aware that in responding to surveys, they could be disclosing information that could make them personally identifiable to Fittr. Respondents to surveys should be aware that they alone are responsible for the content of their responses.
• We are specifically collecting information from our respondents so that we can better serve each of you and the Fittr community as a whole. We map the feedback given by you through these surveys to our internal variables in order to enhance our services provided to you. This information is for our internal purposes only and will not be shared with outside parties without your consent. We do ensure that only authorised people within the organisation have access to the personal data harvested from Google Forms and they respect the company’s code of conduct regarding data protection.

For more details on terms of use & privacy policy practices of Google, please visit the Google Privacy & Terms web page at http://www.google.com/intl/en/policies/privacy/ Subject to applicable law and retention requirements, you may also request deletion of your personal information, including health data, diagnostic reports, uploaded medical records, and device-generated data, by contacting us at support@fittr.com or dpo@fittr.com.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy policy.

14. DO WE MAKE UPDATES TO THIS POLICY?

In Short: Yes, we will update this policy as necessary to stay compliant with relevant laws.

We may update this privacy policy from time to time. The updated version will be indicated by an updated “Revised” date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy policy, we may notify you either by prominently posting a policy of such changes or by directly sending you a notification. We encourage you to review this privacy policy frequently to be informed of how we are protecting your information.

15. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have questions or comments about this policy, you may contact our Data Protection Officer (DPO), by email at dpo@fittr.com, or by post to:

Squats Fitness Private Limited

7th Floor, Goodwill B’Yond,

Kharadi, Maharashtra - 411014

For any product, device, or diagnostic-related data inquiries, you may also reach our support desk at support@fittr.com.

Squats Fitness Private Limited is responsible for personal data processed in connection with the core Fittr Platform and coaching services. Fittr Lifecare Private Limited is responsible for personal data processed in connection with the products, devices and diagnostic services operated or provided by it. Where both entities jointly determine the purposes and means of a particular processing activity, they may act together as data fiduciaries for that specific activity.

16 HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information, or delete it in some circumstances. To request to review, update, or delete your personal information, please visit: support@fittr.com. We will respond to your request within 30 days.

1. Information We Collect

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account and provide the Services you request, including personalized nutrition and training plans;
• Assess coaching eligibility, safety and suitability, and determine whether a selected plan may commence, including by reviewing required health disclosures and designated pre-coaching lab-test information;
• Provide Medical Report Summary and consultation-related functionality, including processing reports you upload to generate and display summaries and, where you choose, making relevant reports or summaries available to your FITTR Coach or a registered medical practitioner;
• Process payments, subscriptions, and orders;
• Communicate with you about your account, transactions, and (with consent, where required) marketing offers;
• Personalize your experience, including recommendations, coaching insights, progress tracking, device insights, and wellness-related features requested by you;
• Maintain the security and integrity of the Services and prevent fraud;
• Analyze usage trends and improve our Services, generally using aggregated or de-identified data;
• Comply with legal obligations and respond to lawful requests from public authorities.

We do not use your sensitive health information (including biometric, lab, or HART Ring data) for third-party advertising purposes, and we do not sell that information.

3. How We Share Your Information

We share personal information with the following categories of recipients. Where a recipient acts as our service provider or processor, we require appropriate contractual obligations requiring them to protect your information and use it only for the purposes we specify:

• Your FITTR Coach and, where you choose to share medical or lab reports, Medical Report Summaries or related health information, registered medical practitioners selected by you, solely to provide the coaching, consultation or informational services you request.
• Cloud hosting and infrastructure: Amazon Web Services (AWS), hosted in India data centers.
• Payment processing: Stripe, PayPal.
• Order fulfillment and logistics: third-party fulfillment providers, logistics partners, warehouse partners, shipping carriers, delivery service providers, payment processors, and other service providers, including Amazon Multi-Channel Fulfillment (“Amazon MCF”) where used, solely as necessary to process and fulfill your order, store inventory, package and ship purchased products, provide shipment tracking and delivery notifications, facilitate returns, refunds, replacements or exchanges, detect and prevent fraud, comply with applicable legal and regulatory obligations, and operate and improve our business.

When Amazon MCF is used to fulfill your order, we provide Amazon with the information reasonably necessary to process, package, ship, deliver, and, where applicable, facilitate returns for your order. This information may include your name, shipping address, billing address where necessary, email address, telephone number/contact information, order number, purchased products, and shipping preferences. We do not share more information than is reasonably necessary for these purposes.

Amazon acts solely as our fulfillment service provider. Your purchase is made from us, not from Amazon. Amazon’s handling of information provided for fulfillment is governed by its own privacy and security practices, in addition to the contractual obligations applicable to its fulfillment services. We do not sell your personal information to Amazon or our fulfillment providers, and information is shared solely for the fulfillment-related purposes described above.

• Customer support and messaging: LeadSquared, WhatsApp Business (where you opt in to messaging).
• Email and SMS communications: Mailchimp, Mailgun, and SMS providers used for opted-in marketing or transactional messages.
• Authentication: Google Sign-In, Sign in with Apple (only if you choose to use these).
• Analytics: Google Analytics, CleverTap.
• App testing and beta distribution: Apple TestFlight / App Store Connect and Google Play / Google Play Console, where you participate in beta testing or use a beta version of the Services.
• Laboratory diagnostics partners: SiPhox, Quest Diagnostics, and/or LabCorp, solely to process tests you book.
• AI-assisted features: OpenAI, used to power in-app question-answering and content features. We do not send your health, biometric, or lab data to OpenAI for this purpose unless you have separately and explicitly opted in to an AI feature that requires it; general account or marketing content may be processed per OpenAI's API data usage policies, which do not permit OpenAI to use API data to train its models.
• Legal and safety: when required to comply with law, respond to legal process, or protect the rights, property, or safety of FITTR, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of company assets, subject to the acquiring party's commitment to honor this Policy or provide you notice of any material change.

We do not sell or share your personal information with third parties for their own independent advertising or marketing purposes, and we do not display third-party advertising within the Services.

4. Cookies and Tracking Technologies

We and our analytics partners (Google Analytics) use cookies and similar technologies to operate the Services, remember preferences, and understand usage. You can control cookies through your browser settings; disabling cookies may limit some functionality.

We recognize and honor the Global Privacy Control (GPC) browser signal as a valid request to opt out of the sale or sharing of personal information and targeted advertising, consistent with the requirements of California, Colorado, Connecticut, and other states that mandate GPC recognition. You can also manage cookie preferences using the banner presented on our website.

5. Social Logins and Wearable Integrations

If you register or log in using a third-party account (such as Google or Apple), we receive the profile information that provider shares with us, typically your name, email address, and profile photo. We use this information only as described in this Policy. We are not responsible for the privacy practices of the third-party provider; please review their privacy policy directly.

6. International Data Transfers

Our primary infrastructure is hosted in India. Certain engineering, product, and operational support functions for FITTR are performed by personnel and service providers located in India. As a result, some personal information may be accessed, processed, or stored by those teams in India, subject to contractual confidentiality and data protection obligations consistent with applicable law, including India's Digital Personal Data Protection Act as its provisions come into effect.

7. Data Retention

We retain personal information for as long as necessary to provide the Services, comply with legal obligations (such as tax and accounting requirements), resolve disputes, and enforce our agreements. When we no longer have a legitimate business need to retain information, we delete or de-identify it, except where retention is required by law or backup systems.Order and customer information relating to physical product or hardware orders may be retained for as long as reasonably necessary to provide customer support, maintain business records, comply with tax and accounting obligations, resolve disputes, enforce our agreements, process warranty, return, refund, replacement or exchange requests, and satisfy applicable legal requirements. When this information is no longer required for these purposes, it is securely deleted, anonymized, or de-identified in accordance with our record retention practices.

8. Data Security

We maintain an information security management system aligned with ISO 27001:2013 practices, including encryption, access controls, and regular security testing. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We are not currently a "covered entity" or "business associate" under the Health Insurance Portability and Accountability Act (HIPAA) for most of our Services, and most health and fitness information we collect directly from you is not subject to HIPAA. We design our security and privacy practices to reflect HIPAA-aligned safeguards as a matter of best practice, but we do not represent that all of our Services are HIPAA-compliant.

9. Age Requirement (18+)

THE SERVICES ARE EXCLUSIVELY FOR INDIVIDUALS WHO ARE 18 YEARS OF AGE OR OLDER. WE DO NOT KNOWINGLY COLLECT PERSONAL INFORMATION FROM ANYONE UNDER 18.

If we learn that we have collected personal information from someone under 18, we will terminate that account and delete that information promptly. If you believe a minor has provided us with personal information, please contact us at privacy@fittr.com so we can investigate and delete it.

10. Washington Consumer Health Data

Washington’s My Health My Data Act ("MHMDA") defines "consumer health data" broadly to include information that identifies a consumer’s past, present, or future physical or mental health status — which includes much of the biometric, sleep, heart rate, body composition, and lab data the Services collect. This section applies to all users, not only Washington residents, consistent with our practice of extending Washington’s protections to our full US user base.

Before we collect consumer health data, we obtain your affirmative, opt-in consent, separate from your general agreement to this Privacy Policy. We do not sell consumer health data, and we do not use geofencing technology around healthcare facilities to identify, track, or target consumers.

You have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data;
• Withdraw your consent to the collection or sharing of your consumer health data at any time;
• Request deletion of your consumer health data, which we will honor by deleting it from our records and directing any processors or affiliates who received it to do the same.

To exercise these rights, contact us at privacy@fittr.com. We will respond within the timeframe required by law. You may also have a private right of action under MHMDA and Washington's Consumer Protection Act for certain violations.

11. Your US Privacy Rights

Depending on where you live, you may have some or all of the following rights under state privacy laws (including California's CCPA/CPRA, and comparable laws in Colorado, Connecticut, Virginia, Texas, and other states):

• Right to know/access the categories and specific pieces of personal information we have collected about you;
• Right to delete personal information we have collected from you, subject to certain exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of your personal information, and out of targeted/cross-context behavioral advertising (as noted above, we do not currently engage in either, but you can still submit a request);
• Right to limit the use of sensitive personal information (which includes precise geolocation and health data) to purposes necessary to provide the Services;
• Right to non-discrimination for exercising any of these rights;
• Right to designate an authorized agent to submit requests on your behalf;
• Right to appeal if we deny your request, by contacting us at privacy@fittr.com with 'Privacy Rights Appeal' in the subject line.

To exercise these rights, contact us at privacy@fittr.com. We will verify your identity before responding and will respond within 45 days, with one 45-day extension where reasonably necessary, or such other timeframe as required by the law of your state of residence.

12. Do Not Track

Most browsers offer a "Do Not Track" (DNT) signal. Because there is no common industry standard for responding to DNT signals, we do not currently respond to them; however, as noted above, we do honor the Global Privacy Control signal.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new 'Last Updated' date, and for material changes affecting how we use previously collected information, we will provide notice by email or prominent in-app notice before the change takes effect.

14. Data Deletion Requests

You have the right to request that we delete the personal information we have collected about you. This section explains how to submit a request, what to expect from us, and which categories of data we may retain even after a deletion request.

15. Contact Us

FITTR Inc.

1013 Centre Road, Suite 403-B

Wilmington, Delaware, 19805-1270

Privacy inquiries: privacy@fittr.com

General support: Support-USA@fittr.com