Privacy Policy
Last updated: 2 September 2026
This policy explains what personal information FitLife collects, why we collect it, who we share it with, and the choices you have. It covers the FitLife mobile app for iOS and Android, our website, and the coach and club portals.
1. Who we are
FitLife is a fitness and nutrition service operating in the Kingdom of Saudi Arabia. We are the controller of the personal data described in this policy. You can reach us about anything in it at [email protected] or on +966 56 696 2767.
2. Information we collect
Account and identity
- Your name, email address and mobile number.
- A one-time passcode (OTP) sent to your phone to confirm the number belongs to you.
- Your password, stored only as a cryptographic hash — we never see or store it in readable form.
- A profile photo, if you choose to add one.
Health and fitness information
- Height, weight, age and gender, which you give us in the onboarding questionnaire.
- Your goal, activity level, target weight, training experience and where you train.
- Body composition measurements, if you use an InBody or ExBody device at a partner facility.
- Values we calculate from the above: body mass index, body fat percentage, daily calorie needs, protein, carbohydrate and fat targets, and daily water and sleep targets.
- What you log over time: water intake, sleep, weight history, training days and completed workouts.
- Your assigned meal plans, recipes and food exchange plans.
Subscription and payment
- Which package you subscribed to, its status, and any refunds.
- Payments are processed by our payment provider. We never receive or store your full card number — it goes directly to the payment provider.
Device and technical information
- A push notification token, so we can send you reminders and messages from your coach.
- Basic operational records of when items in your account were created or changed.
3. Apple Health and Health Connect
We never use health or fitness data for advertising or marketing, and we never sell it. It is used only to power the features described below, inside your own FitLife account.
FitLife can sync with Apple Health on iOS and with Health Connect on Android. This is entirely optional. Nothing is read or written until you turn on Health Sync in the app and grant permission on your device.
What we read, and why
- Weight — so weight you record elsewhere, such as on a smart scale, appears in your FitLife weight history.
- Hydration — so water logged in another app counts towards your daily water target.
- Sleep — so sleep recorded by your phone or wearable appears in your sleep history.
- Exercise sessions — to show how many active minutes you trained, including training logged outside FitLife.
- Steps, distance and active calories — to show your daily activity summary on the home screen.
- Resting heart rate — shown alongside that summary.
Steps, distance, active calories and resting heart rate are read only. FitLife never writes or changes them; your device records them and we only display them.
What we write, and why
When you log water, sleep, weight, meals or a workout inside FitLife, we can write it back to Apple Health or Health Connect so your other health apps stay in step with your training. This happens only while Health Sync is on.
Your control
- You can turn Health Sync off at any time in the app.
- You can revoke individual permissions at any time in Health Connect on Android, or in the Health app on iOS.
- Turning sync off stops all further reading and writing immediately.
- Health data already imported into your account is deleted when you delete your account (see section 8).
What we will never do with it
- We do not use it for advertising, marketing or any form of profiling for advertisers.
- We do not sell it, rent it, or share it with data brokers.
- We do not transfer it to any third party except the service providers in section 6, who only store or transmit it on our behalf.
- We do not use it for any purpose other than the features described above.
4. How we use your information
- To create your account and confirm it is really you, using the code sent to your phone.
- To generate your meal plans, workout plans and daily targets.
- To show your progress over time and let your coach follow it.
- To manage your subscription, payments and any refund.
- To send you reminders, plan updates and messages from your coach.
- To keep the service secure, investigate misuse, and meet our legal obligations.
5. Our legal basis
Under the Saudi Personal Data Protection Law (PDPL), we rely on:
- Providing the service you asked for — for your account, sign-in and core app features.
- Your explicit consent — for health and fitness data, which is treated as sensitive data, and for push notifications.
- Performing our contract with you — for subscriptions and payments.
- Our legal obligations — for financial and tax records we are required to keep.
Where we rely on consent, you can withdraw it at any time. Withdrawing it does not affect anything done beforehand.
6. Who your information is shared with
We do not sell your personal data, and we do not share it for advertising.
Your coach and club
If you are enrolled with a coach, that coach can see the account and health information needed to build and adjust your plans. If your coach belongs to a club, the club can see its own coaches and their athletes. Nobody outside that relationship can see your data, and our own staff access it only where their role requires it.
Service providers
- MyFatoorah — processes subscription payments. Receives payment identifiers and amounts.
- Mobile.SA — sends the one-time passcode. Receives your phone number and the code only.
- Google Firebase — delivers push notifications. Receives your device token.
- Our cloud hosting provider — stores the application and its database on our behalf.
These providers act on our instructions and may not use your data for their own purposes. We may also disclose information where the law, a court, or a competent authority in the Kingdom requires it.
7. Where your information is stored
Your data is held in our cloud infrastructure and processed by the providers listed above. Payments and OTP messages are handled by providers inside the Kingdom. Push notification delivery uses Google infrastructure, which means a device token may be processed outside the Kingdom; we keep the content of notifications free of health information for this reason. Where data is transferred outside Saudi Arabia, we do so only with the safeguards the PDPL requires.
8. How long we keep it, and how to delete it
We keep your information for as long as your account is open and you are using the service.
Deleting your account
- In the app, go to Profile and choose Delete account.
- Or email us at [email protected] from the address on your account.
When you delete your account we remove your personal and health data from the live service and delete or irreversibly anonymise it. Health data previously written to Apple Health or Health Connect stays on your own device under your control — you can remove it there. We keep payment and invoice records for the period Saudi tax and accounting rules require, separately from your health information.
9. Your rights
Under the PDPL you have the right to:
- Be told how your data is used — which is the purpose of this policy.
- Ask for a copy of the personal data we hold about you.
- Have inaccurate data corrected. Most of it you can edit yourself in the app.
- Ask us to delete your data.
- Ask for your data in a portable, machine-readable format.
- Object to a particular use, or withdraw a consent you previously gave.
Write to [email protected] to exercise any of these. We will ask you to confirm your identity before we act, so that nobody else can make a request in your name. If you are not satisfied with our response, you may complain to the Saudi Data & AI Authority (SDAIA).
10. How we protect your information
- All traffic between the app and our servers is encrypted in transit.
- Passwords are stored only as cryptographic hashes.
- Access is authenticated with signed tokens and limited by role, so each account reaches only its own data.
- Access to production systems is restricted to staff who need it.
No system is perfectly secure, but we work to protect your data and we will tell you and the competent authority about a breach affecting you within the time the law requires.
11. Children
FitLife is intended for people aged 18 and over, or younger users with the consent of a parent or guardian. We do not knowingly collect data from children without that consent. If you believe a child has given us personal data, contact us and we will remove it.
12. Changes to this policy
If we change this policy we will update the date at the top of this page, and we will tell you in the app when the change is significant. Continuing to use FitLife after a change means you accept the updated policy.
13. Contact us
Questions, requests or complaints about privacy: [email protected] · +966 56 696 2767