This is the UK privacy policy for Fitara. A US version covering CCPA / MHMDA requirements applies when a tenant is operated in the United States. This document is written to the ICO's privacy-policy checklist and UK GDPR Articles 13 and 14 disclosure requirements.
Fitara is operated by JS Technology Group, a UK-based software company. JS Technology Group provides the platform (the mobile app, the backend, the licensing service, and the admin web interface); your personal trainer ("PT") or their business operates the tenant within which your data lives.
For most questions about your data, contact your PT directly — they are the party with the trainer-client relationship and control the day-to-day handling of your information. For platform-wide questions (security, deletion, breach response), contact JS Technology Group.
Joint controllership: Under UK GDPR, JS Technology Group and your PT (or their business) act as joint controllers of your personal data. We have a written arrangement that splits responsibilities:
You may exercise your rights against either party — neither will refer you to the other to avoid answering.
Contact:
| Category | Example data | Source |
|---|---|---|
| Identity | Email, display name, date of birth | You enter when you sign up |
| Authentication | Password (hashed; we never see plaintext), TOTP code (if you enable two-factor) | You set during account creation |
| Food intake | Meals you log: name, weight, calories, macros, meal slot, notes | You enter, or your PT enters on your behalf |
| Body weight + composition | Weight, body fat percentage, measurement date | You enter, or read from Apple Health or Google Health Connect (with your permission) |
| Activity + sleep | Daily step count; sleep start/end and deep/REM minutes; distance travelled; active energy and total energy burned; resting heart rate | Read from Apple Health or Google Health Connect (with your permission) or entered by you |
| Exercise plans + workouts | Plans your trainer authors for you; sets/reps/weights you log during sessions; workout sessions recorded by your phone or watch | Your PT authors; you log; or read from Apple Health or Google Health Connect (with your permission) |
| Check-in photos | Photographs you take at regular check-ins for body-composition tracking | You take in-app; optional — you control whether this category is enabled |
| Medical notes / allergies | Information you choose to share with your trainer about conditions, medications, allergies, etc. | You enter — optional and your choice what to include |
| Goals | Body composition / performance goals you discuss with your trainer | You enter |
| Device + audit | Device identifier, app version, IP address (when you connect), timestamps of actions | Captured automatically when you use the app |
We do not collect: precise location, contacts, browsing history, advertising identifiers, behavioural fingerprints, or social-network data.
Under UK GDPR, every type of processing must have a lawful basis. Ours:
| Purpose | Lawful basis (Article 6) | Special-category condition (Article 9) |
|---|---|---|
| Providing the Fitara service (contract with your trainer) | Article 6(1)(b) — performance of a contract | Article 9(2)(a) — your explicit consent, per data category |
| Enabling your trainer to coach you (sharing your data with them) | Article 6(1)(b) | Article 9(2)(a) — your explicit consent (the share_with_trainer toggle) |
| Aggregate reporting for the tenant operator | Article 6(1)(f) — legitimate interests in business operation | n/a — aggregates only |
| Account security, audit, fraud prevention | Article 6(1)(f) — legitimate interests (security) and Article 6(1)(c) — legal obligation (Article 32) | n/a |
| Responding to your data subject rights (DSAR, erasure) | Article 6(1)(c) — legal obligation | Article 9(2)(g) where rights involve special-category data |
| Marketing communications (only with separate opt-in) | Article 6(1)(a) — consent | n/a |
You see the per-category consent toggles when you first set up your account, and you can change them at any time in Settings → Privacy. Withdrawing consent for a category stops further processing of that category from the moment of withdrawal. For check-in photos specifically, withdrawing consent triggers immediate cryptographic deletion of all your existing photos.
share_with_trainer consent.share_with_trainer consent above; there is no separate gym-owner audience.We use a small number of sub-processors to deliver the service:
A full sub-processor list is available on request.
At v1, all your data stays in the UK / EU. The platform's tenant_config.data_region is pinned to eu_uk for all UK tenants.
Where a sub-processor (e.g. Firebase) operates outside the UK / EU, the transfer is covered by the EU Standard Contractual Clauses + the UK International Data Transfer Addendum. Encrypted data leaves the UK / EU only inside cryptographic envelopes that JS Technology Group controls — the sub-processor cannot read your data unilaterally.
| Category | Retention | When deleted |
|---|---|---|
| Your account + profile | While your account is active, plus a 30-day grace after closure | On account deletion or 12 months of inactivity |
| Food, weight, step, sleep logs | While your account is active | On account deletion or when you request erasure |
| Check-in photos | 12 months by default (your trainer's tenant may set a shorter retention) | On photo deletion, consent withdrawal, or retention timer |
| Audit log entries (about your actions) | 6 years from the action | Retention timer |
| Records of data subject requests | 6 years after fulfilment | Retention timer |
| Backups | 35-day rotation | Rotational ageing |
The 6-year audit retention follows ICO recommendation for health data processing — it lets us investigate incidents and demonstrate compliance.
You can exercise these rights in two ways: directly in the app (Settings → Privacy for most rights), or by contacting JS Technology Group or your trainer.
| Right | What it means | How to exercise |
|---|---|---|
| Be informed (Art. 13) | This privacy policy is the disclosure. | Read this document. |
| Access (Art. 15) | Request a copy of all the personal data we hold about you. | Tap Settings → Privacy → Export My Data. We aim to deliver within 14 days; legal limit is 1 month. |
| Rectification (Art. 16) | Correct inaccurate or incomplete data. | Edit data directly in the app for self-managed fields; contact your trainer or use Settings → Privacy → Request Correction for trainer-managed fields. |
| Erasure (Art. 17) | Request deletion of your data. | Tap Settings → Privacy → Delete My Account. We crypto-shred photos and logs immediately; backups age out within 35 days. |
| Restriction (Art. 18) | Pause processing of your data while a dispute is resolved. | Contact privacy@jstechnologygroup.co.uk. |
| Portability (Art. 20) | Receive your data in a portable JSON format. | The DSAR Export delivers a structured JSON export. |
| Object (Art. 21) | Object to processing based on legitimate interests (audit / security). | Contact privacy@jstechnologygroup.co.uk. We may not be able to discontinue security-related processing — Article 32 requires it. |
| Withdraw consent (Art. 7) | Withdraw your consent for any data category. | Tap Settings → Privacy → Per-category consent. Effect is immediate. |
| Lodge a complaint | Complain to the ICO if you believe your rights are being infringed. | https://ico.org.uk/concerns/ or +44 303 123 1113. |
We respond to most rights requests within 14 days (well inside the 1-month statutory limit).
Fitara is for adults only. You must be 18 or older to create an account. We collect date of birth at signup, and accounts indicating an age below 18 are rejected. We do not knowingly process data of children under 18.
If you believe a child has signed up using a misrepresented DOB, contact privacy@jstechnologygroup.co.uk and we will investigate and delete the account.
If you discover a vulnerability, please report it to security@jstechnologygroup.co.uk. We will investigate promptly and have a documented incident response process.
You will not receive marketing communications from us by default. Marketing push notifications and emails are separately opt-in and visible as their own consent category in Settings → Privacy. If you opt in and later wish to stop, untoggle the consent — effect is immediate.
Service notifications (e.g. "your trainer assigned you a new plan", "check-in reminder") are not marketing and are not affected by the marketing consent.
The mobile app does not use browser cookies. The admin web interface (used by tenant operators) uses one strictly-necessary cookie for session management (pt_session_refresh). No analytics cookies, no marketing cookies, no third-party cookies.
We will notify you of material changes via in-app banner + the next time you sign in. The current version of the policy is the version displayed in Settings → Privacy → Privacy Policy at any given moment.
| Want to | Contact |
|---|---|
| Ask about your data | Your trainer first; or privacy@jstechnologygroup.co.uk |
| Exercise a data subject right | Settings → Privacy in the app, or privacy@jstechnologygroup.co.uk |
| Report a security concern | security@jstechnologygroup.co.uk |
| Lodge a formal complaint | Information Commissioner's Office: https://ico.org.uk/concerns/ — +44 303 123 1113 |
| Version | Date | Change |
|---|---|---|
| v1.0 | 3 June 2026 | Initial published version. |
| v1.1 | 30 September 2026 | Product renamed from JS Coach to Fitara. No change to what data is collected, the lawful bases, retention, or your rights. |