Fitkora Privacy Policy

1. Who we are

Fitkora LLC ("Fitkora," "we," "us") is an Iowa limited liability company. We provide a software platform for gyms and fitness facilities, available at fitkora.com and fitkora.app (together, the "Platform").

Contact: privacy@fitkora.app

2. Our two different roles — please read this section

How we handle your information depends on how you came to use Fitkora. We act in two distinct capacities, and your rights differ between them.

2.1 When your gym uses Fitkora (we are a service provider)

If you are a member of a gym that uses Fitkora for scheduling, check-in, membership management, or billing, your gym controls that information. We process it on your gym's behalf and under its instructions. Your gym decides what is collected, how long it is kept, and who at the gym can see it.

For questions about that data — or to request access, correction, or deletion — contact your gym first. We will assist your gym in responding, but we cannot act on your gym's data without its instruction.

2.2 When you subscribe to the Nutrition Hub or Program Library directly (we are the controller)

If you subscribe to the Nutrition Hub, the Program Library, or book a nutrition consultation, you are our customer directly. You pay Fitkora, and we determine how that information is handled. This includes any health information you provide. Section 5 of this policy governs that data, and you may exercise your rights directly with us.

3. Information we collect

3.1 Information you provide

3.2 Information collected automatically

• Device and browser type, operating system, and IP address
• Pages viewed, features used, and time spent
• Approximate location derived from IP address
• Location data used for geofenced gym check-in, where you have enabled it
• Cookies and similar technologies (see Section 8)

4. How we use information

• To provide, operate, and maintain the Platform
• To create and manage your account and authenticate you
• To process subscriptions and payments
• To deliver Nutrition Hub content, programming, and habit tracking
• To facilitate booking with licensed nutrition professionals
• To provide customer support and respond to inquiries
• To send transactional messages about your account, subscription, or bookings
• To improve the Platform, diagnose problems, and analyze usage
• To detect and prevent fraud and abuse
• To comply with legal obligations

We do not sell your personal information. We do not share it for cross-context behavioral advertising.

5. Consumer health data

This section applies to information that reveals your past, present, or future physical or mental health — including the weight, measurements, dietary restrictions, goals, food logs, and habit data you provide through the Nutrition Hub, and any inferences we draw from it. Several state laws treat this as a special category. This section is our notice regarding that data.

5.1 What health data we collect and why

We collect the health data described in Section 3.1 for one purpose: to deliver the nutrition and fitness services you have subscribed to. That means personalizing content and programming, tracking your progress, and — if you book one — providing relevant information to the licensed professional you have chosen to meet with.

5.2 Consent

We collect consumer health data only with your consent, given separately from your agreement to this policy and to our Terms of Service. We ask for that consent before collection, and it is specific to the purposes described above.

If we ever wish to use your health data for a purpose not described here, we will ask for your consent again first.

5.3 We do not sell consumer health data

Fitkora does not sell consumer health data, and will not sell it. We do not share it with advertisers, data brokers, or advertising networks, and we do not use it for advertising or marketing purposes.

5.4 Health data is excluded from analytics

We do not transmit consumer health data to analytics or advertising services. Pages and screens where health information is entered or displayed are configured to exclude that data from analytics collection.

5.5 Who can access your health data

5.6 Your health data rights

You may at any time: confirm whether we are collecting or sharing your health data; obtain a list of who has received it; withdraw your consent; and request deletion. To exercise these rights, email privacy@fitkora.app.

When you request deletion of consumer health data, we will delete it from our records and direct our service providers to do the same. We will respond within the timeframe required by applicable law.

6. When we share information

We share personal information only as described here:

• Your gym, for data your gym controls under Section 2.1
• Licensed professionals you choose to book with, limited to what is relevant to that consultation
• Payment processing — Stripe, Inc., to process subscriptions and payments
• Hosting and infrastructure providers that operate the Platform
• Analytics providers, excluding consumer health data (Section 5.4)
• Professional advisors such as attorneys and accountants, under confidentiality obligations
• Legal requirements — when required by law, subpoena, or court order, or to protect rights and safety
• Business transfer — if Fitkora is acquired or merges, information may transfer as part of that transaction; we will notify you and any purchaser will be bound by commitments no less protective than this policy for consumer health data

We do not sell personal information to third parties.

7. Your privacy rights

Depending on where you live, you may have the right to:

• Know what personal information we collect and how we use it
• Access a copy of your personal information
• Correct inaccurate information
• Delete your personal information
• Opt out of sale or targeted advertising (we do neither)
• Withdraw consent for processing health data
• Appeal a decision we make about your request
• Non-discrimination for exercising any of these rights

To exercise a right: email privacy@fitkora.app from the email address associated with your account. We will verify your identity before acting. We respond within 45 days and may extend once where permitted, with notice.

Authorized agents may submit requests on your behalf with written proof of authorization.

Appeals: if we decline your request, you may appeal by replying to our decision. We will respond within 60 days. If we deny your appeal, you may contact your state Attorney General.

Note: for information your gym controls (Section 2.1), please direct requests to your gym.

8. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Platform is used.

Analytics. We use Google Analytics to understand aggregate usage. This collects device, browser, and page-view information. It does not collect consumer health data (Section 5.4). You can opt out using the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout.

Global Privacy Control. We honor the Global Privacy Control (GPC) signal where required by law.

Advertising. We do not use advertising cookies or tracking pixels.

You can control cookies through your browser settings, though disabling them may affect Platform functionality.

9. How long we keep information

• Account information: while your account is active, and up to 24 months after closure
• Consumer health data: while your subscription is active, and up to 12 months after cancellation unless you request earlier deletion
• Payment records: as required by tax and accounting law, generally 7 years
• Gym-controlled data: per your gym's instructions; on termination of a gym's agreement, we make data available for export for 30 days and may then delete it

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls limiting who can view health data, and secured infrastructure. No system is perfectly secure, and we cannot guarantee absolute security.

If a breach affecting your unsecured health information occurs, we will notify you and applicable regulators as required by law.

11. Children

The Platform is not directed to children under 13, and we do not knowingly collect their personal information. Members between 13 and 18 may use the Platform only through a gym and with verifiable parental or guardian consent obtained by the gym. The Nutrition Hub and nutrition consultations are available only to individuals 18 and older. If we learn we have collected information from a child under 13, we will delete it.

12. State-specific disclosures

California. You have rights under the CCPA as amended. We do not sell or share personal information for cross-context behavioral advertising. We collect the categories described in Section 3 for the purposes in Section 4. We do not use sensitive personal information for purposes beyond those permitted.

Washington, Nevada. Section 5 constitutes our consumer health data privacy notice. Washington residents have a private right of action under the My Health My Data Act.

Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws. We process consumer health data only with your opt-in consent, and provide the rights described in Section 7, including appeal.

All states. We do not use consumer health data for targeted advertising or profiling that produces legal or similarly significant effects.

13. Changes to this policy

We may update this policy. If we make material changes affecting how we handle consumer health data, we will notify you by email and obtain your consent where required before applying the change to previously collected data. The "Last updated" date above reflects the most recent revision.

14. Contact

Questions, requests, or complaints:

Email: privacy@fitkora.app

© 2026 Fitkora LLC. All rights reserved.