Privacy Policy

BrixFit is operated by Brixfly Services, a company registered in India. This Privacy Policy explains what information we collect, how we use it, and how we protect it.

---

1. Information We Collect

1.1 Coach Account Information

When you create a BrixFit account, we collect:

• Your name and email address
• Your password (stored as a secure hash — we never see your actual password)
• Billing details such as name, address, GSTIN, and PAN (for invoice generation)
• Payment is processed by Razorpay. We never store your full card number, CVV or bank details. We keep only the payment method type and, for cards, the card network and last four digits, so we can show you how you last paid

1.2 Client & Lead Data

As a coach, you collect information from your clients and leads through BrixFit. This may include:

• Health metrics (weight, height, age, fitness goals, body measurements)
• Check-in responses, meal compliance logs, and progress photos
• Workout session records and progress data
• Personal contact details (name, phone, email)
• In-app messages exchanged between coach and client

You are responsible for obtaining consent from your clients before collecting their data. BrixFit stores and processes this data on your behalf as a data processor. You remain the data controller for all client and lead data you collect.

1.3 Usage Data

We automatically collect basic technical information to keep the platform running:

• IP address, browser type, and device information
• Pages visited and features used
• Error logs and performance data
• On some pages, a recording of how the page is used (clicks, scrolling and navigation), so we can find and fix problems. Screens that show client data — health information, measurements, check-ins and progress photos — are never recorded

Some of this is collected using cookies and similar technologies. Our Cookie Policy lists them, and explains which ones are optional and how to switch them off.

1.4 Health & Fitness Data (Apple Health / Health Connect)

If a client chooses to connect a health source — Apple Health on iPhone or Google Health Connect on Android — the BrixFit mobile app reads a limited set of health and activity data on the client's device and sends it to BrixFit so it can be shown to that client and their assigned coach:

• Steps, walking/running distance, active energy burned, and exercise minutes
• Heart rate, resting heart rate, and heart-rate variability
• Sleep duration and sleep stages
• Body measurements the client records (weight, body-fat percentage, lean mass, BMI)

BrixFit requests only the data types listed above, and only read access — it is never granted, and never asks for, permission to write to Apple Health or Health Connect.

This feature is opt-in. It stays off until the client turns it on, and the on-device permission prompt appears only after the client taps "Connect" on a screen that explains what will be read and why. The client can disconnect at any time from the BrixFit app (Settings › Integrations) or from the Apple Health / Health Connect app itself, and can permanently delete all previously synced health data from within the BrixFit app. On Android, Health Connect only makes the last ~30 days of data available to a newly connected app; older readings are never sent.

We use this data only to display the client's progress to the client and their coach. We do not use it for advertising or marketing, we do not sell it or share it with data brokers, we do not transfer it to any third party other than our infrastructure provider, and we do not use it for any purpose other than providing the coaching service. Health Connect data is used solely for the feature the client granted it for.

Health data is stored in our managed database (Supabase, hosted on Amazon Web Services in the Asia Pacific (Mumbai) region) with the same encryption and access controls as other client data. Detailed intraday readings are retained for approximately 90 days; daily summaries are retained for the duration of the coaching relationship or until the client deletes them.

1.5 Progress Photos

If a client's coach has enabled progress photos, the client may upload photographs of themselves through the BrixFit app so the coach can track visible changes over time. Progress photos are treated as a sensitive category of personal data:

• Consent. The first time a client opens the upload screen (and again if this policy changes materially), the app shows a short consent screen explaining what is collected, who can see it, and how it is stored. No photo can be uploaded until the client accepts.
• What we do with them. Photos are shown only to the client and their assigned coach, for coaching purposes. We do not use them for advertising or marketing, we do not sell or share them, and we do not transfer them to any third party other than our storage provider.
• On upload. Photos are processed on our servers into a compressed web format. This step removes embedded metadata such as GPS location and camera details before the image is stored.
• Storage & access. Photos are stored with our file-storage provider (Cloudflare R2, encrypted at rest). They are never available at a public web address — the app and dashboard load them through short-lived, signed links that expire automatically.
• Deletion. A client can delete any photo session themselves, at any time, from the BrixFit app. Deleting a client record, or a client deleting their own account, permanently removes all of that client's progress photos from storage.

---

2. How We Use Your Information

We use your information only to:

• Run, maintain, and improve BrixFit
• Generate AI health reports and lead analysis (using health data you provide)
• Calculate health metrics (BMI, BMR, TDEE, body fat %, protein targets) using validated clinical formulas — see our Health Metrics Methodology
• Deliver in-app messages between coaches and their clients
• Send WhatsApp notifications, such as new-lead alerts to coaches (eligible plans only) — message content is transmitted through Meta's WhatsApp Business API
• Process your BrixFit plan payments and generate GST invoices for them. BrixFit does not collect payments from a coach's clients — coaches record the payments they receive themselves
• Respond to support requests
• Detect fraud and prevent abuse
• Meet our legal obligations
• Understand how our website and app are used, so we can find problems and improve them
• Measure our advertising, and show BrixFit adverts to people who have visited our public website — only where your cookie choices allow it

We do not sell your personal data to anyone.

If you allow marketing cookies, limited information about your visit to our public website (such as the pages you viewed) is passed to Google and Meta so they can measure and show our adverts. Some laws call this "sharing". It never includes your account details, client records, health data or progress photos. You can switch it off at any time from the cookie settings link at the bottom of any page of our website, and we automatically honour a Global Privacy Control signal from your browser.

---

3. Who We Share Data With

We use trusted service providers to run BrixFit. They only receive the data they need for the job described, and they may not use it for anything else.

You can ask us for the current list of the companies behind each type at any time: email support@brixfit.app and we will send it. Coaches can ask for the same list for the client data they manage in BrixFit.

---

4. Data Security

We take security seriously:

• All data is encrypted at rest and in transit. Connections are forced to HTTPS (HSTS) and use TLS 1.2 or higher
• Access is role-based: each coach account can only reach its own clients' data, each client only their own, enforced both in our application and at the database layer (row-level security)
• Uploaded files (progress photos, documents) are validated and re-processed on our servers, stored encrypted, and served only through short-lived signed links — never a public URL
• Internal team access is restricted by role and logged
• Passwords are hashed and never stored in readable form

If you discover a security issue, please email security@brixfly.in and we will respond promptly.

---

5. Data Retention

• Coach accounts — your data is kept as long as your account is active. After deletion, data is removed within 90 days.
• Client data — kept as long as your account is active. You can delete client records from your dashboard at any time; doing so also removes that client's progress photos and synced health data from storage.
• Synced health data — detailed intraday readings are kept for about 90 days; daily summaries for the duration of the coaching relationship. A client can delete all of it immediately from the app.
• Progress photos — kept for the duration of the coaching relationship. Deleted immediately when the client deletes the session, the coach deletes the client, or the client deletes their account. Storage is swept regularly for any files left behind by an incomplete deletion.
• Billing & invoice records — kept for 7 years as required under Indian financial regulations.

---

6. Your Rights

You have the right to:

• Access & Export — get a copy of the data we hold about you. Clients can download a complete export of their own data (profile, check-ins, measurements, habits, tasks, health data, photos, messages) from within the BrixFit app. Coaches can export their client data from the dashboard.

• Correct — ask us to fix inaccurate information

• Delete — delete your account and data. Clients can do this from the app (Settings › Request Account Deletion); coaches can delete client records from the dashboard. Either way, personal data and health details are removed and progress photos are permanently deleted from storage. See the Delete Your Account page.

• Withdraw consent — where we rely on your consent, such as optional cookies or a connected health source, you can withdraw it at any time. For cookies, use the cookie settings link at the bottom of any page of our website.

• Complain — if you are in the United Kingdom or the European Union, you can also complain to your data protection regulator.

For anything not covered by the in-app tools, email support@brixfit.app. We will respond within 7 business days.

---

7. Children

BrixFit is not for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will remove it.

---

8. Changes to This Policy

We may update this policy. When we do, we will update the date at the top of this page. For significant changes, we will notify you by email.

---

9. Contact

For privacy questions, contact Brixfly Services:

• Email: support@brixfit.app
• Address: Ward 22 Ganeshpuravaas, Bhadra, Rajasthan — 335501, India