Privacy Policy

This policy explains how FitLife ("FitLife", "we", "us") collects, uses and protects your personal data when you use the FitLife app and website. We are the data controller. We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.

1. The data we collect

• Account data — email, password (hashed), name.
• Profile data — age, gender, height, weight, goals and preferences.
• Health data (special category) — diabetes status and type, glucose readings (Dexcom, FreeStyle Libre, manual or CSV), insulin doses, carbohydrate/food logs and photos, NHS test results, mood/sleep/symptom logs.
• Billing data — subscription status and a Stripe customer reference. Card details are handled by Stripe; we never see or store your full card number.
• Technical data — limited logs needed to operate and secure the service.

2. Special-category (health) data & lawful basis

Health data is "special category" data under Article 9 UK GDPR. We process it only on the basis of your explicit consent, which you give at sign-up and can withdraw at any time by deleting the relevant data or your account. Our lawful basis for other personal data is the performance of our contract with you (providing the service) and our legitimate interests in operating and securing it.

3. How we use your data

• To provide the core features: glucose monitoring, food and insulin logging, and AI insights.
• To generate AI analysis, meal plans and workout plans you request.
• To manage your subscription and provide support.
• To keep the service secure and to meet our legal obligations.

Important: FitLife provides information and estimates only. It is not a medical device and does not provide medical advice. Always confirm insulin doses and treatment decisions with your diabetes care team.

4. AI processing

Some features send your data to AI providers to generate results (for example, a food photo to analyse carbohydrates, or glucose summaries for trend insights). These providers process the data only to return your result and do not use it to train their models on terms we accept.

5. Who we share data with

We use the following processors. We do not sell your data.

• Supabase — Database, authentication and file storage hosting.
• OpenAI — AI food-photo analysis.
• Anthropic — AI glucose trend analysis and plan generation.
• Stripe — Subscription payments and billing.
• Dexcom / Abbott (LibreLinkUp) — Continuous glucose monitor data, at your request.
• NHS (FHIR APIs) — Your NHS test results, at your request.
• Resend — Transactional email delivery.
• ElevenLabs — Voice coach (when used).

Some providers may process data outside the UK/EEA; where they do, appropriate safeguards (such as Standard Contractual Clauses) are in place.

6. Retention

We keep your data while your account is active. If you delete your account, your personal data and health data are erased from our systems (subject to short-lived backups and any records we must keep by law). You can delete your account at any time in Settings.

7. Your rights

• Access a copy of your data (Settings → Download my data).
• Erase your account and data (Settings → Delete account).
• Rectify inaccurate data, restrict or object to processing, and withdraw consent.
• Complain to the Information Commissioner's Office (ico.org.uk).

8. Security

Data is encrypted in transit (TLS) and access is restricted by row-level security so you can only access your own records. Connected-service credentials and tokens are stored encrypted.

9. Contact

Privacy enquiries: privacy@fitlife.app. Data protection: dpo@fitlife.app.FitLife, [Registered address, UK].