العربية

Fitlyn Privacy Policy

Version: 2026-11-10 · Effective: 2026-11-10

1. Who we are

Fitlyn is owned and operated by M7.T.S. and is available to users in many countries. We are the "controller" of your personal data.

We comply with the data-protection laws that apply to you where you live, including Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations, the EU and UK General Data Protection Regulation (GDPR) where it applies, US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA), and similar local laws.

For privacy questions, use Settings → Privacy in the app.

2. Data we collect

• Account data: name, email, phone number, country, profile photo and sign-in method (email and password, Google or Facebook).
• Health data (sensitive): age, height, weight history, body measurements and body fat, health conditions (e.g. diabetes, hypertension), allergies, meals, calories and macros, water, medications and schedules, supplements, workouts and sessions, sleep and daily check-ins.
• Health Connect, Apple Health and wearable data: steps, active calories burned, heart rate, sleep and weight — only if you enable sync and consent (see section 4).
• Photos: progress photos (stored privately, visible only to you and the doctor/coach you share with), food photos you send for analysis, and chat or community images you choose to upload.
• Conversations and consultations: messages with your doctor or coach, appointments, call metadata (time and duration; call content is not recorded) and your conversations with the AI coach.
• Payments and orders: subscriptions, orders, delivery addresses, manual transfer references (such as InstaPay / Vodafone Cash in Egypt) and online payment results. We do not store card numbers (see section 8).
• Technical data: the device token for notifications (FCM), IP address and app user agent when recording consent, and security logs.
• Anonymous usage & crash data (optional): if you allow it in Settings → Privacy → "Share anonymous usage & crash data", the app sends crash reports through Firebase Crashlytics and usage events (such as screens opened, sign-up completed, or a meal logged with only its source) through Google Analytics for Firebase, together with your internal account id, device model, OS and app version. They never include your name, email, phone number, health values or any text you type. We use them only to fix crashes and improve the app; we do not sell or share them or use them for advertising. The option is on by default, except in countries whose law requires your prior consent (EU/EEA, the UK and Switzerland), where it stays off until you agree. You can turn it off at any time.

We use no advertising SDKs, do not collect the advertising ID, and use no analytics or crash-reporting tools other than the ones above.

3. Signing in with Google or Facebook

You can sign in with your Google or Facebook account through Google Firebase Authentication. We then receive only your name, your email address and whether it is verified, and use them only to create your account and sign you in.

We never receive your Google or Facebook password, do not access your friends list or posts, and never post on your behalf. Automatic app-event logging and advertising-ID collection are disabled in the Facebook SDK inside the app.

Google and Meta process sign-in data under their own privacy policies. You can remove Fitlyn's access from your Google or Facebook account settings at any time.

4. Health Connect and Apple Health

If you connect Fitlyn to Health Connect (Android) or Apple Health (iPhone, where available), we ask for read-only access to these data types: steps, active calories burned, heart rate, sleep and weight. Fitlyn does not write any data to Health Connect or Apple Health.

We read this data only after you give the in-app "Wearable sync" consent and the system permission. You can revoke either at any time in Health Connect settings or the iPhone Health app, and in Settings → Privacy in Fitlyn.

We use it only to show your activity, sleep and weight in the app, to track your progress towards your daily goals, to share it with your doctor/coach if you choose to, and to include it in the AI coach context if you consented to "AI processing".

Fitlyn's use and transfer of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. In particular:

• We use this data only to provide or improve the user-facing features of the app.
• We never sell it.
• We never use or transfer it for advertising, including personalised or interest-based ads, nor to determine creditworthiness or for lending purposes.
• We transfer it only to service providers needed to run these features (hosting, and the AI provider after your consent), to your doctor/coach after your consent, or where the law requires.
• No one on our team reads this data unless you give affirmative agreement for specific data, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and anonymised for internal operations.

The same limits apply to data read from Apple Health: it is not used for advertising, not sold, and not stored in iCloud by Fitlyn.

5. Purposes and legal basis

• Providing the service (performance of our contract with you): account, diet and workout plans, tracking, the store, subscriptions and consultations.
• Health and other sensitive data: processed only with your explicit written (in-app electronic) consent, given separately for each purpose: health data processing, wearable sync, AI processing, and sharing with your doctor/coach.
• Marketing messages and analytics: only with your consent, which you can withdraw at any time in Settings.
• Legal obligations: keeping invoices and financial records, responding to competent authorities.
• Legitimate interest: platform security, fraud and abuse prevention.

Withdrawing consent does not affect processing carried out before it, but may stop features that depend on it (for example food photo analysis).

6. AI processing

AI features (the AI coach, estimating a meal from a photo, text or voice, and meal, workout and summary suggestions) work only after you consent to "AI processing", and run through an external provider, Google Gemini, which may process data outside your country.

What we send: your message, meal photo or the text you entered, plus only the context needed: your first name, age, sex, height, weight and target weight, goal and activity level, health conditions and allergies, today's and the last 7 days' numbers (calories, macros, water, steps, sleep), your current plan, the notes the coach saved for you, and your doctor's name if you have one.

What we do not send: your email, phone number, address, payment data or account identifiers.

We do not use your data to train AI models of our own. Your AI coach conversations are stored in our database to show them to you; you can delete them, and they are deleted with your account.

The provider processes the content under its API terms, which (on free tiers) may allow it to retain and review content to improve its services. That is why we limit what we send to the minimum listed above; you can withdraw consent at any time.

AI results are estimates, not medical advice.

7. Notifications and reminders

We send notifications (messages, coach replies, appointments, orders and daily reminders) through Google's Firebase Cloud Messaging. For this we store your device's notification token, and notification titles and short texts pass through Google's servers for delivery.

Medication, meal and workout reminders you set yourself are scheduled locally on your device.

Marketing notifications are sent only with your consent. You can turn notifications off in your phone or app settings; the device token is removed when you sign out or delete your account.

8. Payments

We do not store card numbers. Payments are processed by:

• Online payment providers depending on your country, such as Paymob (in Egypt and other supported countries: cards, wallets, Fawry, valU where available) and international card processors where available, for orders, consultations and some packages. We receive only the result, transaction reference and amount.
• Google Play Billing and the Apple App Store: in-app subscriptions. We receive the purchase token and subscription status to verify it; payment is subject to the store's terms and policies.
• Manual transfer (such as InstaPay / Vodafone Cash in Egypt): we store the transfer reference you enter so the payment can be reviewed.

9. Who we share data with

We do not sell your personal data, do not "share" it for cross-context behavioural advertising, and do not use it for advertising. We share it only as needed with:

• The doctor, dietitian or coach you subscribe to or book, after you consent to sharing.
• Store suppliers: your name, phone and delivery address, only to fulfil your order.
• Service providers (processors acting for us): hosting (our cloud hosting provider), Google Firebase (sign-in, notifications and, if you allow it, crash reports and usage analytics), Meta (Facebook sign-in, if you choose it), payment providers (such as Paymob), Google Play and the Apple App Store, the AI provider (Google Gemini), and Jitsi Meet for voice and video calls (we do not record calls).
• Data sources: to show the approximate location of sign-ins (city and country) in Settings → Security and in new sign-in alerts, we look up the IP address in the DB-IP "IP to City Lite" database stored on our own servers (IP geolocation by DB-IP, https://db-ip.com, licensed under CC BY 4.0). The IP address is not sent to any third party for this, and only a masked part of it is shown to you.
• Government and judicial authorities where the law requires.

10. International transfers

Some providers (such as Google, Meta, Apple, the AI provider and possibly the hosting provider) process data outside your country.

We transfer data only with appropriate contractual and security safeguards under the law that applies to you: for users in Egypt under the conditions set by the Personal Data Protection Center, and for users in the EU/EEA and the UK through adequacy decisions or Standard Contractual Clauses (SCCs).

11. Retention and account deletion

• While your account is active we keep your data to provide the service.
• You can delete your account in the app (Settings → Privacy → Delete account) or without the app at https://fitlynapp.com/delete-account.
• Immediately on deletion: the account is anonymised (name, email, phone, photo, date of birth, height, weight, health conditions and allergies), sign-in is disabled and all sessions are revoked.
• After a 30-day grace period (or immediately if you choose so when deleting) we permanently delete: health logs, food log, training and check-ins, AI coach conversations and notes, plans, medications, progress photos and uploaded files, your community and club posts, comments and likes, notifications and device tokens, saved addresses, wishlist and settings. The text and attachments of messages you sent are erased.
• We keep, linked to the anonymised account, orders and invoices with the delivery details of past orders, payments, subscriptions and purchases, consultation bookings, coaching-package enrolments and reward-point transactions, for the period required by applicable tax and commercial law (for example Egyptian law for transactions in Egypt).
• Consent records are kept as proof of consent, with the IP address and device details removed.
• Foods you submitted that were approved into the shared food database stay there without any link to you.
• Daily database backups are kept for at most 14 days, so deleted data disappears from backups within that period.
• Data export files are deleted automatically after 7 days.

12. Your rights

Wherever you live, we give every user these rights (they are guaranteed by Egypt's Law 151 of 2020, the GDPR and US privacy laws such as the CCPA/CPRA):

• Access: know what data we hold and obtain a copy.
• Portability: download your data as portable JSON (Settings → Privacy → Export my data).
• Rectification: correct your data from your profile or by contacting us.
• Erasure: delete your account and data from Settings or at https://fitlynapp.com/delete-account.
• Objection and withdrawal of consent: stop any purpose at any time in Settings → Privacy, and object to processing based on legitimate interest.
• Restriction of processing.
• Not to be subject to solely automated decisions with legal effects: AI suggestions are guidance only and never decide for you.
• Be notified of any breach affecting your data.
• California and similar US states — "Do Not Sell or Share My Personal Information": we do not sell your personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of. We will not discriminate against you for exercising any of your rights.

We answer requests within the period set by the applicable law (normally within one month). You may also complain to the data-protection authority where you live, such as Egypt's Personal Data Protection Center, your EU supervisory authority or the UK Information Commissioner's Office (ICO).

13. Security and breaches

We use encrypted connections (HTTPS), private storage for progress photos that is reachable only through the app after identity and permission checks, hashed passwords, and limited staff access.

If a personal data breach occurs we notify the competent authority under the applicable law (such as Egypt's Personal Data Protection Center or the European data-protection authorities) within 72 hours of becoming aware of it, and notify affected users within the legal period, explaining the measures taken.

14. Children and minors

Fitlyn is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect data from anyone under 18, and in particular from children under 13.

If we learn that an account belongs to a minor we will close it and delete its data. If you are a parent or guardian and believe your child created an account, contact us or delete the account at https://fitlynapp.com/delete-account.

15. Not medical advice

Content and automated suggestions (including AI) are general guidance and do not replace a doctor. Consult your doctor before changing your diet or medication.

16. Changes and contact

We may update this policy. For any material change we will ask you to review it and renew your consent in the app.

For questions or rights requests, use Settings → Privacy in the app.