PRIVACY POLICY OF THE FITMATE APP
(EN version — 2026-11-04)

Last update: 4 November 2026

1. General information

1. This Privacy Policy describes how personal data is processed by the FitMate mobile application (the “App”).
2. The data controller is:
   CodeVee
   Tax ID (NIP): 588-237-50-92
   Address: Eugeniusza Węgrzyna 10/30, 80-175 Gdańsk, Poland
   contact e-mail: contact@fitmate.co

2. Scope of processed data

1. Data provided by the user
   During registration and use of the App, the following data may be collected:
   • e-mail address,
   • password (encrypted),
   • username,
   • selected avatar (m/f),
   • name and e-mail address from an Apple or Google account, if the User signs in with it,
   • answers given during sign-up: sex, birth year, height, weight, goals, workout experience, equipment and notes,
   • training data:
     • workouts performed, sets, reps, weights,
     • planned workouts and goals,
     • workout history imported by the User from other apps,
   • nutrition data:
     • meals, calories, macronutrients,
   • health data:
     • weight, body measurements, trends and statistics,
     • steps, active energy and workouts from Apple Health or Health Connect, if the User allows access,
   • photos sent in chat with a trainer,
   • photos sent to a trainer in the trainer questionnaire,
   • food photos (calorie analysis).
   These include special categories of personal data (health data).
2. Data collected automatically
   During the operation of the App, the following may be collected:
   • anonymous User identifiers,
   • data on use of App features,
   • device data (model, operating system),
   • IP address,
   • advertising and attribution identifiers (to measure advertising campaigns),
   • technical error data (crash reports).
3. Data generated by the trainer
   A trainer working with the User may:
   • log the User’s workouts and meals,
   • set goals and workout plans,
   • send content in chat.
   These data are processed within the User–Trainer relationship.
4. Providing data is voluntary. An account needs an e-mail address and password or an Apple or Google account, a username and an avatar. Without other data, some features do not work.

3. Purposes of data processing

1. Creating and managing the User’s account – Art. 6(1)(b) GDPR (performance of the contract).
2. Using App features (workouts, statistics, history, meal logging) – Art. 6(1)(b) GDPR.
3. Cooperation with a trainer – sharing the User’s data with the selected Trainer – Art. 6(1)(b) GDPR.
4. Analyzing and improving App performance, crash reports, security and server logs – analytics and crash-report providers – Art. 6(1)(f) GDPR (legitimate interest: stable and secure operation of the App).
5. Measuring advertising campaigns – advertising and attribution partners – Art. 6(1)(f) GDPR (legitimate interest: measuring our advertising). The User can limit this in the device settings: on iOS by not allowing tracking, on Android by deleting the advertising ID.
6. Handling payments and subscriptions – payment providers – Art. 6(1)(b) GDPR.
7. AI-based features – Art. 6(1)(b) GDPR:
   • MateGPT chatbot,
   • workout plan generator,
   • calorie and nutrient estimates from meal photos or descriptions,
   • progress analyses.
8. Archiving chats with trainers and establishing, exercising or defending legal claims – Art. 6(1)(f) GDPR; for health data in chats, Art. 9(2)(f) GDPR.
9. Tax and accounting obligations – Art. 6(1)(c) GDPR.
10. Consent to process health data – Art. 9(2)(a) GDPR. Accepting the Policy and Terms constitutes explicit consent to process health data.

4. Data shared with trainers

1. The User may voluntarily select a Trainer.
2. Choosing a trainer means sharing:
   • training and nutrition data,
   • weight and body measurements,
   • statistics and progress history,
   • AI analyses,
   • trainer questionnaire answers and photos,
   • photos sent in chat.
3. The trainer may log data on behalf of the User.
4. The User may revoke access at any time.
5. After access is revoked, the trainer no longer has access to previous data or chat.

5. Data storage

1. Storage location
   We store App data mainly on servers in the European Economic Area (EEA). Some providers process data outside the EEA – see section 7.
2. Data retention period
   • Account data (e-mail, login, password) – deleted immediately after account removal.
   • Training and nutrition data – anonymized, not linked to any user.
   • Chat history – archived solely for security purposes (not available to trainers).
   • Photos sent in chat – may be deleted after 30 days, but FitMate does not guarantee full automation.
   • Food photos – not stored in FitMate’s system; they are passed to AI providers for analysis.

6. Data sent to third parties

1. FitMate shares data only with these types of providers, and only as much as the service needs:
   • hosting and server providers,
   • AI providers (meal photos, chat and workout plans),
   • analytics and crash-report providers,
   • advertising and attribution partners,
   • payment providers,
   • an e-mail delivery provider,
   • the trainer that the User selects.
2. AI providers do not use this data to train their models. FitMate does not store food photos.
3. FitMate does not process or store payment data. Access to transaction information is limited to technical data necessary to assign subscriptions to an account.
4. Trainer access – trainers only receive data of Users who select them.

7. Data transfers outside the EU

1. Some providers process data in the USA or other countries outside the EEA. Transfers are based on the EU-US Data Privacy Framework (if the recipient is certified) or on standard contractual clauses (SCC). A copy is available on request at contact@fitmate.co.

8. User rights

1. The User has the right to:
   • access data,
   • rectify data,
   • erase data (“right to be forgotten”),
   • restrict processing,
   • data portability (where technically feasible),
   • object to processing,
   • withdraw consent at any time,
   • lodge a complaint with the Polish DPA (PUODO).

9. Rules on algorithms and AI

1. AI features (MateGPT, workout plan generator, calorie estimates from photos and descriptions, analyses) are informational only.
2. FitMate does not guarantee the accuracy or adequacy of responses.
3. The User uses AI features at their own responsibility.
4. No AI feature constitutes medical, dietary, or professional advice.
5. FitMate does not make automated decisions that have legal effects on the User (Art. 22 GDPR).

10. Changes to this Policy

1. FitMate may change this Policy. The App shows each new version to the User before it applies.