Privacy Policy — FitRace 360

Effective date: 26 July 2025  ·  Last updated: 26 July 2025
Applies to: the FitRace 360 Android app, iOS app, and https://fitrace360.com

FitRace Technologies Pvt. Ltd. ("FitRace", "we", "our") operates https://fitrace360.com and the FitRace 360 mobile and web application. This policy explains what data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have over it.

FitRace 360 is a fitness and wellness product. It is not a medical device and does not diagnose, treat, cure, or prevent any disease. Nothing in the app is medical advice.

1. Data We Collect

Sensitive personal data. Body metrics, progress photos, nutrition logs and health-and-fitness data are treated as sensitive personal data. We process them only on the basis of your explicit, separately obtained consent, which you can withdraw at any time (see Section 8).

Children. FitRace 360 is not directed to children. You must be at least 16 years old to create an account (18 in jurisdictions that require it for health-data consent). We do not knowingly collect data from anyone below this age; if we learn that we have, we delete the account and its data promptly.

2. Google Health Connect — Data & Permissions

2.1 Permissions we request and exactly what we do with each

We request read access only. FitRace 360 does not write, modify, or delete any record in your Health Connect store. We do not request historical data beyond what is needed to populate your logs and race progress, and we read data only while you have an active FitRace 360 account with Health Connect sync enabled.

Health Connect access is optional. If you decline or later revoke it, FitRace 360 continues to work — you can log workouts and steps manually — and we will not repeatedly prompt you.

2.2 Limited Use — how we use, transfer and protect Health Connect data

• Core functionality only. Health Connect data is used solely to provide and improve the user-facing features described in Section 2.1: activity tracking, virtual race progress, workout history and performance analytics shown to you.
• No advertising or marketing. Health Connect data is never used to serve advertisements, build advertising or marketing profiles, perform targeting or retargeting, or personalise marketing of any kind.
• No sale, no brokers. We do not sell, rent, trade or otherwise transfer Health Connect data to any third party, and specifically never to advertising platforms, ad networks, data brokers, information resellers, insurers, employers, or credit-scoring services.
• No sharing with our other integrations. Health Connect data is not sent to FatSecret, Twilio, Stripe, Pusher, or any analytics provider. It stays within FitRace 360's own systems.
• Transfers are limited to the following, and nothing else:
  • with your explicit, prior consent for a specific action you initiate;
  • to our own hosting and backup infrastructure providers acting strictly as processors under contract, solely to store and serve the data back to you;
  • where necessary for security purposes, such as investigating a suspected violation of our terms or an attack on our systems;
  • where required by applicable law or valid legal process; or
  • as part of a merger, acquisition or sale of assets — in which case we will notify affected users before their Health Connect data is transferred and it will remain subject to this policy or a policy at least as protective.
• No human inspection. No FitRace employee, contractor or agent reads or inspects your Health Connect data, except:
  • where you give explicit, case-specific consent so we can troubleshoot a problem you reported;
  • where it is strictly necessary for security purposes (for example, investigating abuse or fraud); or
  • where it is required to comply with applicable law or legal process.
  Automated processing is limited to the calculations that produce the features listed in Section 2.1.
• No de-anonymised analytics. Any product analytics we run are performed on aggregated, de-identified figures only, and never include raw Health Connect records or anything that can be linked back to an individual user.

2.3 Retention, revocation and deletion of Health Connect data

• Retention. We retain synced steps, exercise sessions and distance only for as long as you keep your FitRace 360 account, because these records are your workout log and your race history. We do not keep a shadow copy after deletion.
• Revoke access at any time from your device: Settings → Apps → Health Connect → App permissions → FitRace 360, or from within Health Connect under App permissions. Revoking stops all future syncing immediately.
• Delete data already synced in either of these ways:
  • In the app: Settings → Account → Delete Health Connect Data — removes all previously synced steps, exercise and distance records from our servers while keeping the rest of your account.
  • Delete your whole account: Settings → Delete Account, or email support@fitrace360.com from your registered address.
• Timeline. Deletion removes the data from live systems immediately. Encrypted backups are overwritten on a rolling 30-day cycle, after which the data is unrecoverable. During that window backups are not accessed for any purpose other than disaster recovery.
• Revoking Health Connect access or deleting synced data does not delete anything from Health Connect itself — your data stays on your device under your control.

3. Apple HealthKit & Apple Watch (iOS)

3.1 HealthKit data types we read and what each one powers

On iOS, FitRace 360 reads the following HealthKit types — and only these — after you explicitly grant permission in the Apple Health app. Data may originate from your iPhone or a paired Apple Watch.

We request read access only. FitRace 360 does not write, modify or delete any record in your Health store, and requests no clinical health records, no heart-rate or medical data, and no reproductive-health or other sensitive categories. You may grant or deny each type individually in the Health app; denying a type disables only the feature that depends on it.

HealthKit access is entirely optional. FitRace 360 remains fully usable without it — you can log steps and workouts manually — and we will not gate features behind the permission or repeatedly re-prompt you.

3.2 Restrictions on our use of HealthKit data

All of the Limited Use restrictions in Section 2.2 apply to HealthKit data in full. In addition, and as specifically required by Apple:

• No advertising or marketing. We never use HealthKit data for advertising, marketing, or use-based data mining, and never for any purpose other than improving your health, fitness and training experience inside FitRace 360.
• No disclosure to third parties. We never disclose HealthKit data to third parties — including advertising platforms, data brokers, information resellers, insurers or employers — without your explicit, separately obtained consent. HealthKit data is not sent to FatSecret, Twilio, Stripe, Pusher, or any analytics provider.
• No sale. We do not sell HealthKit data under any circumstances.
• No iCloud storage. We do not store HealthKit data in iCloud. It is stored only in our own encrypted infrastructure described in Section 6.
• No health research without consent. We do not use your data for health research. If we ever offer a research feature, it will require separate, informed, opt-in consent and review by an independent ethics review board.
• No false data. We do not write inaccurate or fabricated data into the Health app — we do not write to it at all.

3.3 App Tracking Transparency

FitRace 360 does not track you across apps and websites owned by other companies. We do not use the Advertising Identifier (IDFA), do not share your data with data brokers, and do not build cross-app advertising profiles. Accordingly, we do not present an App Tracking Transparency prompt.

3.4 Revoking access and deleting HealthKit data

• Revoke access at any time: iOS Settings → Health → Data Access & Devices → FitRace 360, or Health app → Sharing → Apps → FitRace 360. Revoking stops all future syncing immediately.
• Delete data already synced: in the app, Settings → Account → Delete Synced Health Data removes all previously synced steps, workouts and distance from our servers while keeping the rest of your account.
• Delete your entire account from within the app: Settings → Delete Account. In line with Apple's account-deletion requirement (Guideline 5.1.1(v)), account deletion can be started and completed inside FitRace 360 — you are never required to email us, visit a website, or call support. You may still email support@fitrace360.com if you prefer.
• Timeline: deletion removes the data from live systems immediately; encrypted backups are overwritten on a rolling 30-day cycle, after which the data is unrecoverable.
• Revoking access or deleting synced data does not remove anything from the Apple Health app itself — that data stays on your device under your control, and can be deleted there via Health → Browse → [data type] → Show All Data.

Subscriptions. If you purchase a FitRace 360 subscription through the App Store, billing is handled by Apple under Apple's own terms and privacy policy. We receive only your subscription status and an anonymous transaction identifier — never your payment card details. Cancel at any time via iOS Settings → [your name] → Subscriptions; deleting your account does not automatically cancel an active App Store subscription.

4. How We Use Your Data

• To run the service — sign-in, saving your logs, delivering notifications you asked for.
• To compute personalised metrics such as TDEE, macro targets and training suggestions.
• To operate races, challenges, leaderboards and communities.
• To process payments and manage subscriptions.
• To prevent fraud, abuse and unauthorised access.
• To improve the product using aggregated, anonymised analytics only.

We do not sell your personal data, and never have. We do not use your health or fitness data for advertising.

Legal bases (where GDPR / UK GDPR applies)

• Contract — account data, subscription data, and the logs needed to deliver the service.
• Explicit consent (Art. 9(2)(a)) — all health and fitness data, including Health Connect, HealthKit, body metrics and progress photos. Withdrawable at any time.
• Legitimate interests — security, fraud prevention, and aggregate product analytics.
• Legal obligation — tax, accounting and lawful requests.

In India, we process personal data under the Digital Personal Data Protection Act, 2023 on the basis of the consent you give at sign-up and at each health-permission prompt.

5. Who We Share Data With

We share the minimum data necessary, only with the processors below, each under contract restricting them to our instructions. None of them receive Health Connect or HealthKit data.

No tracking, no data brokers. We do not track you across other companies' apps and websites, do not use advertising identifiers, and do not sell or transfer any of your data to data brokers or information resellers.

We may also disclose data where required by law or valid legal process, to protect the rights, safety and security of our users or the service, or in connection with a merger or acquisition (with notice to you, as described in Section 2.2).

Public content. Posts, comments and profile details you publish in communities are visible to other members of those communities. Please do not post health information you want kept private.

6. Where Your Data Lives & How It's Protected

• Primary servers are located in Mumbai, Maharashtra, India.
• All data is encrypted in transit using TLS 1.2 or higher.
• Databases and backups are encrypted at rest.
• Passwords are stored only as bcrypt hashes and are never recoverable in plain text.
• Access to production systems is restricted to authorised personnel, requires multi-factor authentication, and is logged and reviewed.
• Health data is segregated from analytics and marketing systems by design.
• If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities without undue delay, as required by applicable law.

If you use the service from outside India, your data is transferred to and processed in India under appropriate safeguards, including standard contractual clauses where required.

7. How Long We Keep Data

8. Your Rights

• Access / portability — download a copy of your data from Settings → Account → Export My Data. Premium users can also export logs as CSV.
• Correction — edit profile and body-metric fields at any time in the app.
• Deletion — start and complete account deletion entirely inside the app at Settings → Delete Account, on both iOS and Android. Emailing support@fitrace360.com is an alternative, never a requirement. See Sections 2.3 and 3.4 for the timeline.
• Withdraw consent — revoke Health Connect or HealthKit permissions on your device at any time (Sections 2.3 and 3.4). Withdrawal does not affect processing carried out before withdrawal.
• Object / restrict — where GDPR applies, object to or restrict processing based on legitimate interests.
• Complain — you may lodge a complaint with your data protection authority, or with the Data Protection Board of India.

We respond to rights requests within 30 days. We may ask you to verify your identity first.

9. Changes to This Policy

We will post any changes on this page and update the "Last updated" date. If a change materially affects how we handle health data — including any change to the Health Connect or HealthKit permissions we request — we will notify you in the app and, where required, ask for fresh consent before the change takes effect. We do not apply material changes retroactively to data already collected without your consent.

10. Contact Us

FitRace Healthtech Solutions Pvt. Ltd.
CIN: U62099TS2024PTC191240
Registered address: 18-70/2, Plot No. B-29/2, Venkatapuram MES Colony, Alwal, Tirumalagiri, Hyderabad 500010, Telangana, India
Phone: +91 91002 16961
Consumer health data requests: support@fitrace360.com
General support: support@fitrace360.com