Privacy Policy
Last updated: 31 July 2026
Fittek Ltd ("we", "us", "our") operates the ReShape Method mobile application and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.
By using the Service, you agree to the collection and use of information in accordance with this policy.
1. Information We Collect
Account Information: When your coach creates your account, we collect your name, email address, phone number, date of birth, and gender.
Health & Fitness Data: To deliver personalised coaching, we collect:
- Body composition measurements (weight, body fat percentage, muscle mass)
- Daily tracker data (sleep, water intake, meals, steps, mood, digestion, supplements)
- Training session attendance and booking history
- Hormonal assessment responses
- Session ratings and feedback
- Injury and medical notes shared with your coach
Communications: Messages, voice notes, images, and documents sent through the in-app chat system between you and your coach.
Device Information: We collect push notification tokens to send you notifications. We may receive step count data from Apple Health or Google Fit if you grant permission.
Payment Information: Payment processing is handled by Stripe. We do not store your full card details. Stripe's privacy policy applies to payment data.
2. How We Use Your Information
- To provide and personalise your coaching experience, including nutrition plans and training programmes
- To enable communication between you and your coach
- To track your progress and adherence for plan adjustments
- To manage session bookings and membership tokens
- To send push notifications about sessions, ratings, and plan updates
- To process payments and manage your membership
- To improve our Service and resolve technical issues
3. Data Sharing
We do not sell, rent, or trade your personal information to third parties. We share data only in these circumstances:
- Your Coaching Team: Your coach and authorised staff members can access your health data, tracker entries, and chat messages to deliver your programme
- Service Providers: We use Supabase (database hosting), Stripe (payments), Expo and Firebase (push notifications), and Amazon Web Services (infrastructure). These providers process data on our behalf under contractual obligations
- Legal Requirements: We may disclose information if required by law, regulation, or legal process
4. Data Storage & Security
Your data is stored on servers located in the EU (London, UK — AWS eu-west-2 region). We use industry-standard security measures including:
- Encrypted connections (TLS/HTTPS) for all data in transit
- Row-level security policies on our database
- JWT-based authentication with secure password hashing (bcrypt)
- Role-based access controls limiting staff access to relevant data
5. Data Retention
We retain your personal data for as long as your account is active and your membership is in effect. After your membership ends, we retain your data for up to 12 months to allow for reactivation. After this period, or upon your deletion request, we delete your personal data within 30 days.
Anonymised, aggregated data (e.g., overall attendance statistics) may be retained indefinitely for service improvement.
6. Your Rights
Under UK GDPR and applicable data protection laws, you have the right to:
- Access: Request a copy of the personal data we hold about you
- Rectification: Request correction of inaccurate or incomplete data
- Erasure: Request deletion of your personal data ("right to be forgotten")
- Portability: Request your data in a structured, machine-readable format
- Restriction: Request that we limit processing of your data
- Objection: Object to processing based on legitimate interests
- Withdraw Consent: Where processing is based on consent, withdraw it at any time
To exercise any of these rights, email [email protected]. We will respond within 30 days.
7. Account Deletion
You can request complete deletion of your account and all associated data by emailing [email protected]. Upon receiving your request, we will:
- Delete your account, profile, and login credentials
- Delete all health and fitness data, tracker entries, and body composition records
- Delete all chat messages, voice notes, and shared media
- Delete booking history, session records, and ratings
- Cancel any active membership and cease billing
Deletion is completed within 30 days and is irreversible.
8. Children's Privacy
Our Service is not intended for anyone under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child under 16 has provided us with personal data, we will delete it promptly.
9. Push Notifications
We send push notifications for session reminders, attendance confirmations, rating prompts, chat messages, and plan updates. You can disable push notifications at any time through your device settings.
10. Third-Party Links
Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the app or by email. Your continued use of the Service after changes constitutes acceptance of the revised policy.
12. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us:
Fittek Ltd
Email: [email protected]
Website: reshape.fit