Fitrobit Admin App — Privacy & Data Processing

This policy establishes our operational standards globally and regionally. Fitrobit operates as an infrastructure provider, and our data architecture aligns with modern international frameworks for data processing, including principles of data minimization, purpose limitation, and storage limitation. This policy governs all processing streams initiated when a member of staff is issued an account, signs in to the Application, or records data through it.

The legal relationship regarding data management is structured under strict definitions: (a) Data Controller: The gym, fitness studio, franchise or corporate fitness centre that employs or engages you (the 'Gym Client') acts as the sole Data Controller — both for the personal data held about you as a member of staff and for all member data you handle through the Application. The Gym Client issues your account, sets what it may access, establishes the lawful basis for processing, and retains legal ownership of the records produced. (b) Data Processor: Fitrobit acts strictly as the Data Processor. We provide the cloud infrastructure, database pipelines and application interfaces the Data Controller requests. Fitrobit does not sell, monetize, or utilize your data for independent corporate objectives.

Fitrobit cannot create, suspend, alter or delete your staff account of its own motion. Requests to do any of those must be directed to your Gym Client.

Unlike a member, you interact with the Application in two distinct capacities, and this policy addresses both. As a Data Subject, personal data is held about you: your employment record, contact details, biometric enrolment and the log of your activity in the system. As an Authorised Operator, you are granted access to the personal data of members of your Gym Client so that you may perform your role. Data you view, record or amend in that second capacity is not yours; it is the Gym Client's, held about its members, and your access to it exists only for as long as the Gym Client authorises it.

We process the following categories of data about you on behalf of the Data Controller: (a) Core Identity & Authentication Elements: full legal name, staff identifier issued by your gym, telephone contact number, email address, physical address, date of birth, emergency contact, profile photograph, unique system-generated identifiers and cryptographically hashed passwords. (b) Employment & Role Configuration: your job title, assigned role, the permission set that role grants, instructor status, whether application sign-in is enabled for your account, and your joining date. (c) Biometric Identifiers: where your gym operates biometric access hardware, your fingerprint is enrolled on those devices against your staff identifier, so that the readers recognise you for facility access and attendance. (d) Attendance & Facility Access Logs: entry and exit timestamps generated at your gym's readers or through QR check-in. (e) Device & Notification Data: to deliver push notifications the Application registers a messaging token together with the platform, device identifier, device model and brand, operating system version, application version, locale and timezone of the handset you sign in on. (f) Operational Activity Records: the payments you record, sessions you log, plans you author, enrolments you create and subscription changes you make, each attributed to you. (g) Performance & Scheduling Records: the classes you instruct, the personal training slots assigned to you, and the analytics your gym derives from them.

Actions taken through the Application are attributed to the account that performed them, and sensitive actions are written to an immutable activity log visible to your gym's administrators. This includes, without limitation, recording or amending a payment, changing a member's renewal date, altering a remaining session count, deactivating or reactivating an enrolment, and logging a completed training session. This attribution exists for the protection of members, of your gym, and of you: it establishes what was done, when, and by whom. You should therefore treat your credentials as you would a signature, and you should expect that your operational activity within the Application is neither anonymous nor private to you.

The Application will display member personal data to you where your assigned role permits it. Depending on that role this may include identity and contact details, membership and payment history, attendance records, body measurements and progress photographs, nutrition and training plans, class and personal training enrolments, and uploaded documents. What you can see is determined by the permission set your Gym Client has granted your role — not by Fitrobit. This data is made available to you solely to perform your duties for the Gym Client. Any other use, including retention outside the Application, disclosure to third parties, or use after your engagement ends, is a matter between you and your Gym Client and may be unlawful.

Fitrobit implements strong physical, administrative, and technical safeguards designed to protect information from loss, misuse, or unauthorized modification: (a) Hosting Environment: the entire platform infrastructure is deployed within secure, high-availability data centers managed by Amazon Web Services (AWS). (b) Database Layer: data is organized and stored in an enterprise MongoDB cluster utilizing access controls and network isolation protocols. (c) Cryptographic Protections: all passwords undergo modern cryptographic hashing before being written to persistent storage. (d) Access Segmentation: each account is scoped to a single gym tenant and to the permissions its role grants, so an account cannot reach another gym's records. (e) Authentication Warning (Absence of MFA): this version of the Application relies on single-factor password authentication and does not support Multi-Factor Authentication (MFA). Because a staff account can reach the personal data of many members, the consequences of a compromised staff password are materially greater than those of a compromised member password. You assume full risk for unauthorized access resulting from weak or shared credentials.

You may close your own account from within the Application, under Profile → Terminate Account, or by written request to your Gym Client. On deactivation your account is marked inactive, your sign-in access is withdrawn on every device, your registered notification tokens are deleted, and your biometric enrolment is removed from every access device at the gym, so those readers will no longer admit you.

Records generated in the course of your duties are not deleted with your account. Attendance history, payments you recorded, session logs, activity attribution and the plans you authored for members belong to the Gym Client, form part of its own business and compliance records, and in many cases are records about its members rather than about you. Fitrobit holds them on the Gym Client's behalf and has no authority to erase them at your request. Requests concerning those records, and requests to reactivate a closed account, must be made to your Gym Client.