Politique de confidentialité

Purpose 

1FITUK Limited trading as 1FIT (the Company, 1FIT, we, us or our) respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we process your personal data on our website, platform and mobile applications where you are a coach, a coach’s client, a supplier of services or a visitor on our website. It also tells you about your privacy rights pursuant to Data Protection Laws such as the UK Data Protection Act 2018, the General Data Protection Regulation (UK GDPR) and the EU GDPR.  

As our services may be accessed by users globally, we apply the GDPR as our benchmark standard for data protection practices. Where local data protection laws apply in other jurisdictions, we will comply with those requirements where applicable. However, our approach to the processing and protection of personal data is designed to meet the principles and standards set out under the GDPR. 

Controller for personal data 

A “controller” is a person or organisation who alone or jointly determines the purposes for which and the way any personal data is or is likely to be processed. 

Unless we notify you otherwise 1FIT is the data controller for personal data where we interact with you directly including where you use our website, register as a coach on the platform or otherwise engage with our services. 

Coaches and coach’s clients 

Where a coach uses the 1FIT platform to collect and manage personal data relating to their clients, the coach will act as the data controller for that personal data. This is because the coach determines the purposes for which the data is collected and how it is used in connection with the coaching services they provide. 

In these circumstances, 1FIT provides the platform and supporting infrastructure which enables coaches to store, manage and use client information within the platform and related services. For transparency, we have included information throughout this notice explaining how coach client information is processed within the platform. 

Coaches are responsible for providing their own privacy information to their clients explaining how they collect, use and manage their clients’ personal data.  

Scope 

This privacy notice applies to the processing of personal data by us in connection with: 

1. Coaches: where we provide our services and platform to coaches who use 1FIT to manage and service their clients. 
2. Coach’s clients: individuals who access the 1FIT client mobile application provided by their coach and use the platform to interact with their coach and record training or health information.
3. Suppliers: for the provision of products and services to us by suppliers or service providers.
4. Website visitors: anyone browsing our website or interacting with our content online. 

Types of personal data 

Personal data or personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed. This is known as anonymised data. Anonymised data falls outside the scope of Data Protection Laws. 

1FIT may collect, use, store and transfer different kinds of personal data about you. Please see the relevant Processing Table depending on the relationship you have with us.  

Lawful bases: How we use your personal data 

1FIT will only use your personal data when the law allows us to. We will use your personal data in the following circumstances: 

1. Performance of a contract: Where we need to perform the contract, we are about to enter into or have entered into with you. For example, when you sign up to our platform.
2. Legal obligation: Where we need to comply with a legal obligation.
3. Legitimate interests: Where it is necessary for our legitimate interests or those of a third party and your interests and fundamental rights do not override those interests.
4. Consent: We do not generally rely on consent as a legal basis for processing your personal data. Where we do rely on consent you have the right to withdraw consent at any time.
5. Vital interests: Where it is necessary to protect your vital interests in case of emergencies. 

How we collect your personal data 

Directly from you: You give us your personal data in your direct interactions with us. Such personal data includes Identity Data, Contact Data, Profile Data, Usage Data and Technical Data: 

1. by creating an account on our platform or mobile applications  
2. by filling in forms on our website or within the platform  
3. by uploading information, training plans, feedback, images or other content  
4. by communicating with other users through the platform  
5. by corresponding with us by email or other communication channels 

From coaches: Where you are a client of a coach, your coach may provide your personal data to the platform in order to provide coaching services to you. 

Third‑party sources: We may receive information from service providers who support our services. 

Examples include: 

1. Cloud infrastructure providers that host and maintain the platform’s technical infrastructure 
2. Payment processing providers that handle subscription payments made by coaches 
3. Analytics providers that help us understand how visitors interact with and use our website
4. When you visit our website or use our services we or third parties we work with may automatically collect certain information using online tracking technologies such as cookies. 

Processing Tables 

The processing tables explain why we process personal data and the lawful basis for doing so. Depending on your relationship with us you may need to refer to different tables relevant to your specific interactions or services. 

Coach: Processing Information 

This is where we directly provide our services to you where you are a coach using the 1FIT platform. 

Categories of personal data relating to coaches 

The categories of personal data we may process in relation to coaches include: 

1. Identity Data: first name, last name, username or similar identifier and profile or avatar images. 
2. Contact Data: email address and telephone number.  
3. Account Data: login credentials, password and time-zone settings. 
4. Profile Data: information contained within the coach’s profile and any images uploaded to the platform. 
5. Communications Data: messaging and communications between coaches and their clients or between coaches within a team using the platform. 
6. Usage Data: information about how the coach uses the platform, features accessed and activity within the system. 
7. Technical Data: internet protocol (IP) address, browser type and version, device information, operating system and other technology used to access the platform. 
8. Transaction Data: subscription payment information relating to the coach’s use of the platform. Payment card details are processed by our payment provider Stripe and are not stored by us. 

Open text fields: The platform contains certain open text fields which allow coaches and clients to input information freely. As a result, personal data or other information may be included within such fields depending on how the platform is used by the coach and their clients. 

Coach’s Client: Processing Information 

This is where you are a client of a coach who uses the 1FIT platform.  

Please note in relation to personal data relating to coaches’ clients, 1FIT provides the platform infrastructure and the coach acts as the data controller for all client data. The lawful basis for processing such personal data will therefore be determined by the coach providing the services to the client. 

Categories of personal data relating to Coach’s Client 

1. Identity Data: first name and last name.  
2. Contact Data: email address and telephone number.  
3. Account Data: login credentials, username and time zone settings.  
4. Profile Data: information contained within a user profile including profile or avatar images.  
5. Health and Fitness Data: health and fitness information entered by the client or their coach such as body weight, training history, exercise activity, nutrition tracking, performance metrics and qualitative wellbeing indicators such as energy levels or muscle soreness.  
6. Wearable Device Data: where permission is granted, health data collected from connected wearable devices including body weight, body temperature, blood oxygen levels, heart rate, heart rate variability, respiratory rate and steps.  
7. Image Data: profile images and progress photographs uploaded to the platform.  
8. Communications Data: messaging and communications between the client and their coach within the platform.  
9. Usage Data: information about how the client interacts with the platform or mobile application including feature usage and activity history.  
10. Technical Data: internet protocol (IP) address, device information, browser type and version, operating system and other technical data collected when accessing the platform.  
11. Free text content: information entered by users in open text fields such as feedback forms, messages, notes or other user‑generated content within the platform. 

Open text fields: The platform contains certain open text fields which allow coaches and coaches’ clients to input information freely. As a result, personal data or other information may be included within such fields depending on how the platform is used by the coach and their clients. 

Special category personal data 

Health and fitness data: Where health or fitness‑related data is processed through the platform in relation to a coach’s clients, this may constitute special category personal data under Article 9 GDPR. The lawful basis and applicable Article 9 condition for processing such data will be determined by the coach as the data controller including where the client has provided explicit consent or where processing is necessary for the provision of the coaching services requested. 

Supplier: Processing Information 

This is where you are a supplier of products and services to us. 

Categories of personal data relating to suppliers 

1. Identity Data: first name, last name and job title of individuals working for a supplier or service provider.  
2. Contact Data: business email address, telephone number and business contact details.  
3. Financial Data: bank account details or payment details required to process payments to suppliers.  
4. Transaction Data: details about payments made to suppliers and records relating to invoices, fees and charges.  
5. Communications Data: correspondence between us and the supplier including emails and other communications relating to services provided. 

Website visitor: Processing Information 

This is where you are a website visitor on our website regardless as to whether you will be taking up our services. 

1. Identity Data: first name and last name where provided through contact forms or enquiries. 
2. Contact Data: email address and any other contact information provided when contacting us through the website. 
3. Technical Data: internet protocol (IP) address, browser type and version, device information, operating system, time zone setting and other technology on the devices used to access the website. 
4. Usage Data: information about how visitors interact with and use our website, including pages visited, navigation paths and interaction with website features. 
5. Cookie Data: information collected through cookies and similar technologies used for website functionality, analytics and performance monitoring. 

Use of Artificial Intelligence 

We provide certain artificial intelligence (AI) tools within the platform to assist coaches in creating content and supporting their coaching workflows. For example, coaches may use an AI‑supported tool to generate outputs such as meal plans based on parameters entered by the coach such as caloric intake targets or dietary preferences. These tools operate using mathematical models and generalised data and are designed to generate generic informational outputs.  Coaches are responsible for how they use these tools within their services and for ensuring that any information entered is appropriate. The tools do not make automated decisions about individuals and any use of the outputs remains the responsibility of the coach. 

Cookies and similar technologies 

1FIT gathers information and statistics collectively about visitors to our website. Analysis of this information demonstrates the most frequently used sections of the website and assists us in continually improving the online service. We use analytics providers including Google Analytics to help understand how visitors interact with our website. 

Please also refer to our Cookie Notice for more information on how we set cookies. 

How We Disclose Personal Information 

In certain circumstances, we may disclose your personal information to third parties for contract fulfilment purposes, legitimate purposes and other reasons subject to this privacy notice. 

Such circumstances where we disclose information may include: 

1. Internally: your personal data will be used by our employees and contractors who are working on providing our services to you on a need‑to‑know basis. 
2. Service partners: vendors or other third parties who perform services on our behalf such as IT management, analytics providers and cloud hosting providers. 
3. AI service providers: we may use third‑party AI or large language model (LLM) providers to support administrative tasks, internal operations and platform efficiency. 
4. Cloud hosting: our platform infrastructure is hosted using Amazon Web Services (AWS). 
5. Payment service providers: Stripe processes subscription payments made by coaches. 
6. Professional advisers: this would include bankers, auditors and insurers who provide consultancy, banking, insurance and accounting services. 
7. Business transactions (M&A): this is in connection with a business transaction such as a merger or acquisition. 
8. Legal authorities: where disclosure is required by law or to protect our rights. 

International transfers for UK/EU 

We may transfer and process your personal data outside of the United Kingdom (UK) /European Union (EU) to countries where data protection laws are less stringent than those in the UK/EU. When we transfer your personal data outside of the UK/ EU we only do so to entities that offer our users the same level of data protection as that afforded by the UK Data Protection Act 2018 (including the UK GDPR) and the EU GDPR/ Data Protection Laws.  

1. We will only transfer your personal information to countries that have been deemed to provide an adequate level of protection for personal information; or  
2. We will use specific contracts approved for use in the UK or EU which give personal information the same protection it has in the UK/EU. For example, the use of Article 46 UK and EU GDPR safeguard mechanisms to transfer personal data endorsed by the UK Government or European Commission.  

For other countries we will use local law guidance to ensure personal data is transferred securely where there is a requirement in law to do so. 

Data security 

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These include organisational and technical safeguards such as encryption of data in transit and at rest and secure cloud infrastructure. However, the transmission of information via the internet is not completely secure and we cannot guarantee the security of information transmitted to our services. 

Data retention 

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. Personal data relating to user accounts will generally be retained for the duration of the account and for a limited period afterwards where required for legal, regulatory or security purposes. 

Data Subject Rights 

Where we act as a controller, under certain circumstances, you have rights under Data Protection Laws. Not all rights are absolute and depending on where you are located, not all rights may apply to you. You can: 

1. Request access to your personal data: This is known as a “subject access request” and enables you to receive a copy of the personal data we hold about you. 
2. Request correction of your personal data: This enables you to have any incomplete or inaccurate information we hold about you corrected. 
3. Request erasure of your personal data: This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. We may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you at the time of your request. 
4. Object to processing of your personal data: This is where we are processing your personal data based on a legitimate interest or those of a third party and you may challenge this. However, we may be entitled to continue processing your information based on our legitimate interests or where this is relevant to any legal claims. 
5. Request restriction of processing: This enables you to ask us to suspend the processing of your personal data in certain situations.  
6. Request transfer of your personal information (“data portability”): This is where in some circumstances we will provide to you or a third party you have chosen your personal data in a structured, commonly used, machine‑readable format 
7. Right to withdraw consent: This is where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. 

Automated decision making: This is where decisions are made about you by automated means. We do not carry out automated decision making. 

Carrying out your data subject rights 

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information. 

We try to respond to all legitimate requests within one month. Occasionally it may take longer if your request is particularly complex or you have made a number of requests. 

If you wish to exercise any of the rights set out above, please contact us at gdpr@1fit.com. 

Concerns and complaints 

We would appreciate the chance to deal with your concerns in the first instance. If you have unresolved issues, you have the right to complain at any time to a data protection supervisory authority such as the Information Commissioner’s Office (ICO). 

Changes to our privacy notice 

This privacy notice may be changed from time to time in response to legal, technical or business developments. We will take appropriate measures to inform you when we update our privacy notice.

Contact us 

If you would like more information about the way we manage personal information that we hold about you please contact us at: 

Email: gdpr@1fit.com