Privacy Notice

For EazyFit account administration, platform subscriptions, fraud/security, product operations, legal compliance, support and direct communications about the service, the EazyFit legal operator determines why and how data is used and acts as controller.

For coaching records an individual PT enters or asks clients to enter—such as programmes, messages, progress, appointments, nutrition information and optional fitness/wellness information—the PT is generally the controller and EazyFit processes the data on the PT's documented instructions under the Data Processing Addendum. The PT is responsible for deciding what client coaching information is appropriate and lawful to request and use.

Core account data is intentionally limited. It may include name, email, optional phone/profile photo/timezone, roles, tenant memberships, authentication and account-security information. EazyFit does not require medical history, diagnoses, medication, treatment information, clinical test results or medical records to create or use a client account.

Business and payment data may include PT-business details, plan, invoices, transaction references, Stripe customer/subscription/account identifiers and payment status. Full card and bank details are handled by Stripe rather than stored by EazyFit.

If a PT and client choose to use optional coaching features, the service may process PT-controlled coaching data such as programmes, exercise performance, fitness measurements, progress photos, nutrition logs, habits, check-ins, messages, appointments and wearable/fitness information. These features are not a request for clinical records and should not be used as a medical record system.

Technical and support data may include device/browser information, security logs, audit events, support correspondence, storage preferences, offline-sync metadata and service-use events needed to operate and protect EazyFit.

We process data to provide and secure accounts; deliver contracted platform services; process billing; route trainer-client services; provide support; send necessary account, security, service, legal and privacy communications; prevent abuse and fraud; maintain audit and incident records; comply with legal obligations; and improve service reliability and usability.

Controller processing relies on the lawful basis appropriate to the purpose, which may include performance of a contract, legitimate interests, legal obligations or consent where required. Optional EazyFit marketing is managed separately and, where we rely on consent, that consent can be withdrawn. We do not treat opening an administrative notice as consent, and we do not use special-category health data for advertising.

EazyFit does not require clients to provide medical records or medical history. Some optional fitness/wellness features—such as body measurements, progress photos, nutrition, injury or limitation information volunteered to a PT, and wearable information—can nevertheless reveal health information and may be special-category data. The individual PT, as controller of the coaching records they decide to collect or use, is responsible for identifying an Article 6 lawful basis and an applicable Article 9 condition before collecting or using such data.

EazyFit provides a separate, versioned health-data consent control for clients. Where a PT relies on explicit consent as their Article 9 condition, the PT must make sure that consent is valid for the specific processing, respect withdrawal, avoid collecting health information that is not needed, and stop or change ongoing processing when the lawful basis/condition no longer applies. A client can use their EazyFit account without granting the optional health-data consent.

Where EazyFit acts as processor, it processes PT-controlled coaching information only to provide the contracted service, follow lawful documented instructions, secure the platform and meet applicable processor obligations. EazyFit does not use special-category coaching data for advertising.

We share data only where necessary with service providers/subprocessors, connected services selected by users, professional advisers, regulators/law-enforcement where legally required, or parties involved in a legitimate corporate transaction subject to appropriate safeguards.

Current important service categories include Base44 infrastructure and managed platform services, Stripe for platform/client payments, and Google when a user chooses to connect Google Calendar. See Subprocessors & transfers for more detail.

Some service providers may process data outside the UK. Where UK restricted-transfer rules apply, the relevant controller/exporter must use an available adequacy regulation or appropriate safeguard such as the UK International Data Transfer Agreement or UK Addendum, together with any required transfer risk assessment.

We keep personal data only for as long as needed for the purpose for which it was collected, the active account/service relationship, security and dispute handling, and applicable tax, accounting, regulatory or legal requirements.

Deletion of an account removes or deactivates operational access. Limited financial, audit, incident, legal-claim or anti-fraud records may be securely retained for the applicable period. Processor data is deleted or returned at the end of services as described in the DPA, unless law requires retention.

Depending on the circumstances, UK data protection rights can include access, correction, erasure, restriction, objection, data portability and rights concerning certain automated decisions. Where a PT is controller of client coaching data, the request should normally be made to that PT; EazyFit will assist the controller as required by the DPA.

For EazyFit-controller data, use the privacy/data-rights category in Contact or Help & Support. You can also delete your account using account settings. Optional marketing choices can be changed in account settings. Essential account, legal, security, privacy and service communications are administered separately from marketing preferences where they are necessary for the relevant purpose and lawful basis.

You may complain to the UK Information Commissioner's Office if you are unhappy with how a data protection concern is handled.

EazyFit uses access controls, tenant separation, authentication, audit logging, restricted backend functions and other technical/organisational controls appropriate to the service. No internet service can promise absolute security.

We assess personal-data incidents, preserve an incident decision record and notify affected controllers, regulators or individuals where applicable law requires it. Where direct notice to an affected person is required, we aim to provide the nature of the incident, a contact point, likely consequences and mitigation or protective steps without including unnecessary sensitive information in the notice.

EazyFit is 18+ at launch. We do not intentionally offer accounts to children. If you believe a child has created or been given an account, report it through Safety/illegal content or Privacy/data rights so it can be investigated.

Contact details for the EazyFit legal operator are shown at the top of this page when configured by the platform owner.