Privacy policy

Two organisations are involved, and each has a different role. This decides who answers your questions.

• Your gym is the controller of your member data. That means your profile, membership, bookings, attendance, workouts and similar information. The gym decides why and how this data is used. NetFit is the processor: we run the software and handle this data only on the gym’s instructions.
• NetFit is the controller for three things: the account data of gym staff and other business users of the software; our marketing website (netfit.coach), demo requests and support contacts; and security logs and the operation of the platform, to the extent that we decide the purposes ourselves.

What is stored depends on how your gym uses the service and on the choices you make in the app. These are the categories.

We do not sell personal data, we do not use it for advertising profiling, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

For member data, the gym as controller is responsible for having a legal basis. The table shows the bases the service is built around.

When you first sign in, the app asks for the choices below. You can review them at any time in the app under More → Privacy & data.

• Terms of use and Privacy policy (required): you accept the terms and confirm that you have read this policy and understand how your data is used.
• Age confirmation (required): you are 16 or older, or your parent or guardian has agreed on your behalf.
• Training data (optional): store your workouts, personal records and body measurements so you can track your progress. This can include health-related data. It is visible only to you and your gym’s trainers.
• Progress photos (optional): photos are private to you unless you share them with a trainer.
• News and offers from your gym (optional): marketing messages sent by your gym.

The app keeps a consent log: what you agreed to, when, and which version. If we update the terms, the app asks you to review the changes before you continue.

If you withdraw consent for training data, we stop storing new training data, and your existing workouts, records and health-related data are purged within 30 days unless you turn the option back on. If you withdraw consent for progress photos, your photos are deleted immediately and permanently. Withdrawing consent does not affect processing that took place before.

We share personal data only with the following, and only as far as needed:

• Your own gym and its staff, according to their role. Staff see only what they need to run the gym, and their access to personal data is logged.
• Our service providers (sub-processors), listed below.
• Authorities, where we are legally required to disclose data.
• Professional advisers such as lawyers, accountants and auditors, who are bound by confidentiality.

“To be confirmed” means we are still verifying the provider’s details and data-processing terms. We will update this list.

Our service providers are bound by data-processing agreements: they may process personal data only on our instructions. We do not sell personal data.

Our primary hosting is in the European Union. Some of our providers, for example Vercel, Expo and Resend, may process data in the United States or in other countries outside the EU/EEA.

Where that happens, the transfer relies on the provider’s certification under the EU-US Data Privacy Framework where it applies, and/or on the Standard Contractual Clauses approved by the European Commission. The mechanism depends on the provider, and we are still confirming it for each one.

You can ask us for more information about these safeguards at privacy@netfit.coach.

We keep personal data only as long as it is needed for the purposes above. These are the periods built into the service and the ones we apply.

For member data, the gym as controller decides how long it needs the information, within the limits of the law. When a member deletes their account, the gym is told so that it can close the membership. The Delete account page explains what is deleted and what is kept.

You have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or incomplete.
• Erase your data.
• Restrict how your data is used, in certain cases.
• Take your data with you (portability): the app gives you a copy of your data as a machine-readable JSON file.
• Object to processing that is based on legitimate interests.
• Withdraw consent at any time, in the app under Privacy settings. This does not affect what was done before.
• Not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make such decisions.

In the app first. Under More → Privacy & data you can change your choices, download your data and delete your account. Otherwise, write to privacy@netfit.coach. Members: for requests about your membership data, please contact your gym first; NetFit will forward the request or help the gym to answer it. We may ask you to confirm who you are. We respond within one month.

You also have the right to complain to a supervisory authority. In North Macedonia that is the Personal Data Protection Agency (AZLP; in Macedonian: Агенција за заштита на личните податоци), azlp.mk. You can also complain to the supervisory authority of the EU/EEA country where you live or work.

The NetFit website (netfit.coach) uses only strictly necessary storage. If Plausible Analytics is switched on, it is cookieless: it sets no cookies, collects no personal data and does not track you across sites, so no cookie banner is needed. The website also writes one flag to your browser’s session storage, only to remember that you dismissed a banner during your visit.

The apps use essential cookies and local storage to keep you signed in and secure. They ask for your permission before any analytics cookies are used. The cookie-choice screen has two groups: Essential (needed for sign-in and security, always on) and Analytics (anonymous usage statistics, optional). You can change your choice later in the app’s cookie settings.

We use technical and organisational measures to protect personal data, including:

• encryption of data in transit;
• access control by role: gym staff see only what their role needs, and members never see other members’ personal details;
• access logging: when staff view personal data, the access is logged, and the app tells staff so;
• private storage for photos, with links that expire.

No system is completely secure. If you think your account has been compromised, tell us at privacy@netfit.coach. If a personal-data breach occurs, we will inform the affected gym and, where the law requires it, the supervisory authority and the people concerned.

Members must be 16 or older, or have a parent or guardian agree on their behalf. The app asks you to confirm this. If you believe that someone under 16 is using the service without that agreement, please contact us.

We may update this policy, for example when the service or the law changes. The “last updated” date at the top shows the current version. If a change is important, we will tell you, for example in the app, and where the law requires it we will ask for your agreement again.