Privacy Policy

Last updated: 19 August 2026

Data controller: Muhammed Ibrahim Fahmy Mahmoud trading as Fit With Fahmi

This Privacy Policy explains what personal data FWF — Fit With Fahmi (“we”, “us”, “our”) collects, why we collect it, how we use and share it, how long we keep it, and the rights you have. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL).

1. Who is responsible for your data

The data controller is Muhammed Ibrahim Fahmy Mahmoud, a sole trader trading as Fit With Fahmi, of 35 Valerian Court, Cambridge, CB1 9YP, United Kingdom. For any privacy question, or to exercise your rights, contact us at fahmi@fitwithfahmi.com. A dedicated Data Protection Officer has not been appointed at this stage; data protection queries are handled directly by the controller named above. This will be reassessed before FWF scales beyond the pilot.

2. What personal data we collect

We collect the following categories of data, most of which you give us directly when you register, complete the questionnaire, log activity, or pay:

Identity & account

Name, email address, password (stored hashed)

To create and secure your account and identify you

Profile & goals

Age, gender, height, country, main goal, workout days, gym experience level

To personalise your programme and targets

Health data (sensitive)

Weight and weight history, body-composition / InBody reports, injury information (knee, back, elbow, other, free text)

To calculate targets and adapt workouts safely to you

Activity data

Workout logs, weights lifted, nutrition adherence check-ins, hydration, completion status

To track progress and generate your reports

Booking & communication

Call bookings, phone number (for intro calls), WhatsApp group membership

To schedule calls and provide coach support

Payment data

Billing status, plan, promo code used, last-4 of card and payment token (held by Stripe)

To take payment and manage your subscription

Technical data

Log-in sessions, device/browser type, IP address, essential cookies

To keep you logged in securely and keep the app working

Health data — your weight, body composition and injury information — is “special category” / sensitive personal data and is given extra protection. We collect it only with your explicit consent and use it only to deliver your coaching.

3. Legal basis for each type of processing

Under UK GDPR we must have a lawful basis for each use of your data. Our bases are:

Health data (weight, body composition, injuries)

Explicit consent (Art. 6(1)(a) + Art. 9(2)(a))

Special-category data. Collected only with your explicit consent at registration; you can withdraw it.

Account & profile data

Contract (Art. 6(1)(b))

Needed to provide the coaching service you signed up for.

Payment & billing data

Contract (Art. 6(1)(b)) + legal obligation for records

Needed to take payment; some records kept to meet tax/accounting law.

Service operation, security, analytics

Legitimate interests (Art. 6(1)(f))

To run, secure and improve the Service, balanced against your rights.

Marketing emails (if any)

Consent (Art. 6(1)(a))

Only if you opt in; you can opt out at any time.

Under the UAE PDPL, processing is generally based on your consent, with limited exceptions for performing a contract, meeting a legal obligation, or protecting legitimate interests that do not override your rights. Where the PDPL requires consent for a given use, we rely on the consent you give at registration.

4. How we use your data

To create your account, verify your email and keep you securely logged in.
To calculate your calorie, macro and hydration targets and assign an appropriate workout programme, including adapting it around injuries you report.
To generate your progress charts and your 6-week coachee progress report, which is visible to you and your coach.
To take payment, apply promo codes, manage renewals and send billing notifications.
To schedule intro and follow-up calls and to enable coach support.
To secure the Service, prevent fraud, and comply with our legal obligations.

5. Automated calculations and profiling

We use formula-based calculations (for example the Mifflin-St Jeor equation for energy needs) and rules that adapt workouts to your goal, experience and injuries. These help personalise your programme. Your coach reviews and can override these outputs, so decisions affecting you are not based solely on automated processing. You can ask for human review of any calculated target (see clause 9).

6. Who we share your data with

We do not sell your data. We share it only with service providers who help us run FWF, and only as needed:

Stripe — payment processing. Stripe receives the data needed to take payment and acts under its own privacy terms.
Cloud hosting and database providers (Vercel for application hosting and Supabase for the database) — store the app and your data securely on our behalf as processors.
Transactional email provider (Resend) — sends verification, booking and payment emails.
WhatsApp (Meta) — used for coach support groups. If you choose to communicate via WhatsApp, your messages and number are handled under Meta’s own terms. Do not share sensitive health details there unless you are comfortable doing so.
Coach Fahmi — as your coach, has access to your profile, health data, logs and reports to deliver coaching.
Authorities or advisers — where we are legally required to disclose, or to establish or defend legal claims.

We put appropriate data-processing agreements in place with our processors.

7. International data transfers

Your data may be processed outside your home country — including in the United Kingdom, the European Economic Area, and the United States, depending on where our hosting providers operate. Where data moves between the UK, the UAE and other countries, we use an appropriate safeguard, such as the UK International Data Transfer Agreement / Addendum, EU Standard Contractual Clauses, or the transfer conditions permitted under the UAE PDPL.

8. How long we keep your data

Active accounts: for as long as your account is active.
After cancellation or expiry: your data is retained for a 90-day grace period so you can re-subscribe without losing progress.
After the 90-day grace period: your account data is deleted or anonymised, except records we are legally required to keep.
Payment and tax records: retained for 6 years, as required by applicable UK tax/accounting law.
If you exercise your right to erasure sooner, we will delete data we are not legally required to keep.

9. Your rights

You have the following rights over your personal data. These reflect UK GDPR; the UAE PDPL grants closely equivalent rights, and we apply the stronger standard where they differ.

1. Access

Get a copy of the personal data we hold about you.

2. Rectification

Have inaccurate or incomplete data corrected.

3. Erasure

Ask us to delete your data ("right to be forgotten"), subject to legal retention limits.

4. Restriction

Ask us to pause processing while a concern is resolved.

5. Portability

Receive your data in a common, machine-readable format, or have it sent to another provider where technically feasible.

6. Objection

Object to processing based on legitimate interests, including profiling.

7. Rights re automated decisions

Not be subject to solely automated decisions with legal or similarly significant effects; request human review.

8. Withdraw consent

Withdraw consent for health-data or marketing processing at any time, without affecting prior lawful processing.

How to exercise your rights

You can use the in-app tools in Settings (Download my data, Manage consent, Delete my account) or contact us at fahmi@fitwithfahmi.com. We will respond within one month (UK GDPR) or the period required by the UAE PDPL, whichever is shorter. We may need to verify your identity first. Using these rights is free unless a request is manifestly unfounded or excessive.

Complaints

If you are unhappy with how we handle your data, you can complain to us first. You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ICO) at ico.org.uk; in the UAE, the UAE Data Office.

10. Cookies and similar technologies

FWF uses only the cookies and local storage needed to run the app — principally to keep you securely logged in (session and refresh tokens) and to remember essential preferences. These are strictly necessary and do not require consent under most frameworks.

If in future we add non-essential cookies (for example analytics or marketing), we will request your consent through a cookie banner before setting them, and update this policy.

11. Data security

We use technical and organisational measures to protect your data, including encryption in transit (TLS) and at rest, hashed passwords, token-based authentication, access limited to those who need it, and rate limiting on sign-in. No system is completely secure; if a breach affects your rights, we will notify you and the relevant authority as required by law.

12. Children

The Service is for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. Material changes will be notified by email or in-app. The “last updated” date at the top shows the current version.

14. Contact

Privacy queries and rights requests: fahmi@fitwithfahmi.com · Muhammed Ibrahim Fahmy Mahmoud (sole trader), 35 Valerian Court, Cambridge, CB1 9YP, United Kingdom.

FWF · Fit With Fahmi — Privacy Policy v1.0.