Privacy Policy

Fitedash is a cloud-based gym management platform designed for gyms, sports facilities, and activity-based businesses in the Philippines. We act as a data processor for the personal information of gym members on behalf of our business clients (gym operators), who are the data controllers.

We operate in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines, and the regulations issued by the National Privacy Commission (NPC).

We collect the following categories of information:

• Account Information. When you sign up as a gym operator, we collect your name, email address, business name, and billing details.
• Member Data. Gym operators may input personal information about their gym members, including names, contact details, subscription status, and attendance records. This data is owned and controlled by the gym operator.
• Usage Data. We automatically collect information about how you interact with the Service, including pages visited, features used, device type, browser, IP address, and timestamps.
• Communications. If you contact us via email or other channels, we retain those communications to assist you and improve our support.
• Cookies and Tracking. We use cookies and similar technologies to maintain session state and analyze usage. See Section 8 for details.

We use collected information to:

• Provide, maintain, and improve the Service;
• Process payments and manage your subscription;
• Send transactional emails (receipts, account notifications, product updates);
• Respond to support requests and inquiries;
• Analyze usage trends to improve product features;
• Comply with legal obligations and enforce our Terms & Conditions;
• Prevent fraud, abuse, and unauthorized access.

We do not sell your personal information or gym member data to third parties for marketing or advertising purposes.

We process personal data on the following legal bases:

• Contract. Processing necessary to deliver the Service under our subscription agreement.
• Legitimate Interest. Processing necessary to improve our platform, detect abuse, and maintain security.
• Consent. Where required by law, we obtain explicit consent before processing certain types of data.
• Legal Obligation. Where we are required to process data to comply with applicable law.

We do not sell, rent, or trade your personal information. We may share data with trusted third-party service providers who help us operate the platform, including:

• Cloud infrastructure and hosting providers;
• Payment processors;
• Analytics tools (e.g., for aggregated, anonymized usage statistics);
• Email delivery services.

All third-party providers are contractually bound to process data only as instructed by us and to maintain appropriate security measures. We may also disclose data when required by law or to protect the rights, property, or safety of Fitedash, our clients, or others.

We retain personal data for as long as your account is active or as needed to provide the Service. Upon account termination, you may request an export of your data within 30 days. After that period, we may permanently delete all associated data.

Some data may be retained longer where required by law (e.g., financial records for tax compliance) or for legitimate business purposes such as resolving disputes or enforcing agreements.

While Fitedash is primarily an operational platform for gym membership and subscription management, certain data fields collected through the Service may fall under the definition of sensitive personal information under Section 3(l) of the Data Privacy Act of 2012 (RA 10173), including:

• Educational status — whether a member is a student, which affects subscription pricing;
• Biological sex — recorded as part of member registration;
• Free-form notes — an optional field where gym operators may enter member-specific information, which could include health or physical condition details at the operator's discretion.

Gym operators, as data controllers, are responsible for ensuring they have a lawful basis — including member consent where required — for collecting and processing these fields. We, as data processor, handle this information strictly within the scope of delivering the Service and do not use it for any independent purpose.

We implement industry-standard technical and organizational security measures to protect your information against unauthorized access, loss, disclosure, or alteration. These include:

• Encryption in transit (HTTPS/TLS);
• Access controls and authentication;
• Regular security assessments;
• Secure cloud infrastructure with backups.

No method of transmission over the internet is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in harm to you or your gym members, we will:

• Notify affected gym operators within 72 hours of becoming aware of the breach;
• Provide details of the nature of the breach, the data involved, and the likely consequences;
• Describe the measures we have taken or propose to take to address the breach;
• Report the breach to the National Privacy Commission (NPC) as required under RA 10173.

Gym operators, as data controllers, are responsible for notifying their affected gym members in accordance with applicable law.

We use cookies and similar tracking technologies to maintain your session, remember your preferences, and understand how the Service is used. Types of cookies we use:

• Essential Cookies. Required for the platform to function (e.g., session management). These cannot be disabled.
• Analytics Cookies. Help us understand usage patterns to improve the product. Data is aggregated and anonymized where possible.

You can control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Service.

We may send you product updates, feature announcements, and other service-related communications via email. These are considered transactional communications and are part of the Service.

From time to time, we may also send promotional or marketing emails. You may opt out of marketing emails at any time by clicking the unsubscribe link in any such email or by contacting us at support@fitedash.app. Opting out of marketing emails does not affect transactional communications related to your account or subscription.

Under the Data Privacy Act of 2012 and applicable regulations, you have the following rights regarding your personal data:

• Right to Access. Request a copy of the personal data we hold about you.
• Right to Rectification. Request correction of inaccurate or incomplete data.
• Right to Erasure. Request deletion of your personal data, subject to legal retention requirements.
• Right to Data Portability. Request your data in a structured, machine-readable format.
• Right to Object. Object to processing based on legitimate interests.
• Right to Withdraw Consent. Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at support@fitedash.app. We will respond within 15 business days.

The Fitedash platform is a business-to-business service. Direct sign-up as a gym operator is intended for individuals who are 18 years of age or older.

However, gym operators may process personal data of gym members who are minors (e.g., youth programs, kids' fitness classes). In these cases, the gym operator — as the data controller — is solely responsible for:

• Obtaining verifiable parental or guardian consent before collecting a minor's personal information;
• Ensuring that the collection and use of such data complies with RA 10173 and any applicable child protection laws;
• Limiting the data collected to only what is necessary for the purposes of gym membership management.

As data processor, we will handle minor members' personal information only as directed by the gym operator and with the same heightened care applied to sensitive personal information. We do not use this data for any independent purpose.

The Service may contain links to third-party websites or integrations. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies separately.

Your data is primarily stored and processed in servers located in the Philippines or in regions covered by our cloud infrastructure providers. If data is transferred outside the Philippines, we ensure appropriate safeguards are in place consistent with the requirements of RA 10173.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on our website at least 14 days before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us: