Privacy Policy

1. Introduction & Statutory Framework

At FitTrack (operated under fitworks.tech), we respect your fundamental right to privacy and are committed to safeguarding your personal and health-related information. This Privacy Policy outlines our standards and procedures regarding the collection, processing, storage, disclosure, and deletion of personal data in strict adherence to the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and recognized international privacy standards including the General Data Protection Regulation (GDPR).

2. Information We Collect

We collect information you directly provide when registering an account, utilizing gym facilities, recording fitness progress, or managing a gym facility:

• Personal Account Identifiers: Legal full name, email address, mobile phone number, assigned role (member, trainer, gym owner, administrator), encrypted password, and uploaded profile pictures.
• Sensitive Physical & Health Metrics: Height, body weight, anthropometric measurements (neck, waist, hip, chest, arm circumferences), estimated body fat percentage, workout history (sets, repetitions, resistance weight, RPE), dietary and macro logs, and physical training goals.
• Facility Attendance & Access Records: Timestamped QR code check-in and check-out logs, gym turnstile records, equipment usage queues, and group fitness class reservations.
• Geolocation Data (Optional): With your browser or device permission, real-time latitude and longitude coordinates used ephemerally to display partner gyms sorted by distance ("Nearest to Me"), render facilities on interactive maps, and verify presence during attendance check-in. Coordinates used for proximity browsing are processed on-device and are not persistently stored on our servers.
• Gym Business Verification Data: For gym owners: facility trade name, physical address, local government business permits, Bureau of Internal Revenue (BIR) registration details, and government-issued identification cards submitted for facility validation.

3. Google OAuth & Third-Party Authentication Policy

When you choose to register or sign in to FitTrack using your Google account (via Google Identity Services):

• Scopes Requested: We request access only to basic profile information: your Google unique user identifier (sub), verified email address, and display name.
• Purpose of Processing: Google account data is processed solely for verifying your identity, authenticating your session, and establishing your user profile on FitTrack.
• No Data Selling or Advertising: Google user data is never sold, rented, monetized, transferred to data brokers, or utilized for serving targeted advertisements.
• No Unauthorized AI Training: FitTrack does not transfer Google user data to generalized third-party artificial intelligence or machine learning models without your explicit, separate consent.
• Revocation of Access: You can revoke FitTrack's access to your Google account at any time by visiting your Google Account Security Permissions.

4. Processing of Sensitive Health Data & Explicit Consent

In compliance with Section 13 of Republic Act No. 10173 and Article 9 of the GDPR, processing of physical measurements and fitness performance metrics requires explicit consent.

By entering body metrics, workout completions, or nutritional records into FitTrack, you explicitly grant consent for FitTrack and your designated gym trainers to process this information solely to calculate body composition estimates (e.g., U.S. Navy circumference calculations), analyze engagement scores, structure customized training programs, and monitor your personal fitness trajectory.

5. Data Sharing & Third-Party Service Providers

We do not trade, sell, or rent your personal data. We disclose your information only under the following controlled conditions:

• Affiliated Gym Facilities & Coaches: Authorized staff and assigned trainers at your registered gym facility can view your workout activity, check-in history, and fitness benchmarks to deliver instruction and ensure member safety.
• Essential Infrastructure Sub-processors: We partner with trusted enterprise cloud vendors bound by strict data processing confidentiality agreements:
  • Cloudinary & ImageKit: For secure, encrypted storage and optimization of profile pictures and facility documents.
  • Google Cloud Platform: For OAuth 2.0 user authentication and token verification.
  • Transactional Mail Providers (SMTP / Brevo): Strictly for delivering essential account alerts, password resets, and verification messages.
• Legal & Statutory Mandate: Where disclosure is necessary to comply with valid legal processes, national court subpoenas, or lawful government orders.

6. Data Security Measures

We enforce organizational, physical, and technical controls to safeguard personal data against accidental or unlawful destruction, alteration, unauthorized disclosure, or access. These protections include TLS/SSL transport encryption, Bcrypt cryptographic password hashing, strict Content Security Policies (CSP), CSRF token validation, automated IP rate-limiting, and restricted role-based database permissions.

7. Data Retention & Account Deletion (Right to Erasure)

We retain your personal data only as long as your FitTrack account remains active or as needed to provide you with gym management and tracking services. Financial and transaction logs are retained for the minimum statutory period required by Philippine tax regulations.

You have the right to request the permanent deletion of your account and associated personal data. Upon receiving a verified deletion request via email, we will purge or anonymize your personal identifiers, Google authentication tokens, and private health logs within thirty (30) business days, subject to statutory retention obligations.

8. Your Statutory Rights

Under RA 10173 and international privacy laws, you are entitled to:

• Right to be Informed: Receive clear details regarding how your information is being collected and processed.
• Right to Access: View and request copies of personal information held in our records.
• Right to Rectification: Contest and correct inaccurate or incomplete personal records.
• Right to Erasure or Blocking: Request withdrawal, removal, or blocking of data processed unlawfully or no longer necessary.
• Right to Data Portability: Obtain an electronic copy of your training and attendance logs.

9. Age Restriction & Protection of Minors

FitTrack is intended for individuals aged 18 years or older. Minors who are at least 15 years of age may register and use the platform only with the verified consent and supervision of a parent or legal guardian. We do not knowingly collect personal or health information from children under 15 years old.

10. Contact Information & Data Protection Officer

For questions, concerns, or to exercise your privacy rights, please contact our Data Protection Office: