RaFit Privacy Policy
What RaFit collects, why, who sees it, and how you stay in control.
Draft for review. It takes effect when RaFit is released, and the items marked like [this] are filled in first.
Who We Are
RaFit is an app for training, meals and progress, with tools for coaches and the people they support. It is made by Mohamed Saleem, an individual developer trading as Sporade. In this policy, “we” and “us” mean Mohamed Saleem, who decides how your personal data is used (the data controller).
Questions or requests about your data: [contact email]. Sporade plans to become a company; if that happens, we’ll update this policy and tell you in the app before the change takes effect.
The Short Version
- We use your data to run RaFit for you. We don’t sell it, we don’t show ads, and we don’t track you across other apps or websites.
- Your plan and logs are kept in your RaFit account so they’re safe if you change phones.
- Apple Health and Health Connect are read only with your permission, and only for steps, sleep and body weight.
- AI is off unless you turn on AI Help. When it’s on, your name and email are not sent to the AI provider.
- A coach sees your plan and logs only after you join them, and you can see each time they looked.
- You can download a copy of your data and delete your account in the app at any time.
What We Collect
Account. Your email address and a password. We store the password only as a secure hash. When you’re signed in, we keep a record of each signed-in device: which app and version, and when it was last used.
About you and your routine. What you tell RaFit when you set up and use it, for example:
- your name, time zone, height, year of birth, sex and target weight;
- your goals, training experience, equipment, training days, session length and preferred time;
- your diet, allergies, religious food needs, foods you avoid or dislike, cuisines, meals per day, cooking time and budget;
- injuries, movement limits and health notes you choose to write;
- safety answers, such as whether you are pregnant, have had an eating disorder or follow a medical diet;
- your daily calorie and protein targets.
What you log. Workouts and sets, meals, meal photos, steps, sleep, weight, how tired you feel, blood pressure if you enter it, check-ins and notes, and the plans RaFit makes for you.
Choices you make. When you turn Apple Health, Health Connect, AI Help or coach sharing on or off, we record the choice and when you made it, so we can show we only use your data as you agreed.
Security. To limit abuse, we briefly use your IP address to count requests. We don’t store it with your account.
We don’t collect your location, contacts or advertising identifier, and the apps contain no analytics, advertising or crash-reporting tools from other companies.
Health Data
Much of what you log is health data. We treat it with extra care: we use it only to run RaFit for you and, if you choose, to share it with your coach. We ask for your consent before reading anything from Apple Health or Health Connect, before using AI with your data and before a coach can see it.
Apple Health (iPhone). With your permission, the RaFit iPhone app reads your step count, sleep and body weight. It does not write anything to Apple Health. If you use the RaFit Apple Watch app, the watch reads your heart rate and active energy during a workout to show them to you, and saves the workout to Apple Health. Heart rate stays on your watch and in Apple Health; it isn’t sent to RaFit.
Health Connect (Android). With your permission, RaFit reads your steps, sleep and weight. It does not write to Health Connect.
Data read from Apple Health or Health Connect is used only to show your progress and shape your plan, and is never used for advertising or sold. You can turn access off at any time in the app (Profile, then Health Data) or in your phone’s settings.
Meal Photos
If you add a photo to a meal, it is saved on your phone and, when you’re signed in, in your account, so it survives a phone change and your coach can see it if you have one. Before saving, we remove hidden details such as the place the photo was taken. A photo is kept as long as the meal it belongs to; photos that no longer belong to a meal are removed within two days.
AI Help
AI Help is off until you turn it on, during setup or later in the app (Coach, then AI Help). When it’s on:
- AI estimates the food in your meal photos, so the photo is sent to our AI provider;
- your coach can use AI to summarise your week, draft a message to you or draft your next week of meals and workouts. For this, facts about your goals, targets, training, food needs and recent logs are sent to our AI provider.
Your name and email are not sent. Our AI provider is Anthropic. Under its commercial terms, it does not use this data to train its models. When you turn AI Help off, nothing more is sent; work already done stays in your account.
Coaches and Businesses
You can join a coach with an invite code. Nothing is shared until you agree on the joining screen. From then on, people at that coach’s business who work with you (your coach and anyone they add to your care team) can see:
- your name, goals, targets and food needs;
- your plan and what you’ve done, including workouts and meals you log after joining, with their photos;
- your average steps and sleep;
- your weight, only if you choose to share it;
- a flag if one of your safety answers needs care.
Coaches don’t see your health notes. You can see each time someone at the business looked at your information, and you can stop coaching at any time (Profile, then Coaching), which ends their access straight away.
If you don’t have your own coach, you’re looked after by RaFit Coach, our own team, who can see the same information in the same way.
The business you join decides how it uses what it sees to coach you, and is responsible for that use. If you have questions about a coach’s own practices, ask them directly.
People who run a business on RaFit. We keep the business name, the names, emails and roles of its team, invite codes and its AI use.
Our own support. People who run RaFit can see account details such as your email and signed-in devices to help you and keep RaFit secure. They can’t see your health data in our admin tools.
If You Contact Us
If you use the Talk to Us form on the RaFit website, we collect your name, email, business name, roughly how many clients you coach and your message, and use them only to reply. We keep enquiries for up to 24 months. The RaFit website sets no cookies and uses no analytics.
Why We Use Your Data
| What we do | Legal basis (EU and UK) |
|---|---|
| Run your account and RaFit’s features: plans, logs, sync and coaching | Our contract with you |
| Use health data, read Apple Health or Health Connect, share with a coach, use AI Help | Your explicit consent, which you can withdraw at any time |
| Keep RaFit secure, prevent abuse and fix problems | Our legitimate interest in a safe, working service |
| Answer your questions and requests | Our contract with you, or our legitimate interest |
| Keep records the law requires | Legal obligation |
We don’t use your data for advertising, we don’t sell it, and we don’t make decisions about you that have legal or similarly significant effects by automated means alone.
Who Handles Data for Us
| Company | What for | Where |
|---|---|---|
| Hetzner Online | Hosts RaFit’s servers and database | Hillsboro, Oregon, United States |
| Anthropic | AI Help, only when you turn it on | United States |
| Amazon Web Services | Sends account emails, such as sign-in codes, if we email you | United States |
Each handles data only on our instructions and under a data processing agreement. Apple and Google distribute the app; Apple Health and Health Connect stay under your control on your devices. We may share data if the law requires it, to protect someone’s safety, or with a company that takes over RaFit, which would have to keep this policy’s promises.
Where Your Data Is Stored
RaFit’s servers are in the United States. If you live elsewhere, including the EU, UK, UAE or India, your data is transferred there. For transfers from the EU and UK we rely on the European Commission’s standard contractual clauses (and the UK addendum), and we choose providers that protect data to the same standard.
How Long We Keep It
| Data | How long |
|---|---|
| Your account, profile, plans and logs | Until you delete your account |
| Meal photos | As long as the meal they belong to; other photos within two days |
| Signed-in devices | Until you sign out, or 30 days without use |
| IP addresses used to limit abuse | About a day |
| Records of background tasks | Up to 30 days |
| Talk to Us enquiries | Up to 24 months |
| A note that an account was deleted, with its email | 12 months, to answer questions about the deletion |
| Backups | Overwritten within [backup period] |
When you delete your account, it and everything in it are removed from RaFit straight away. Copies in backups disappear as the backups are overwritten.
Your Choices and Rights
You can do most things yourself in the app:
- See and correct your information in Profile, Your Routine and Your Goals.
- Download a copy of your data in Profile, Your Information.
- Turn off Apple Health or Health Connect, AI Help or coach sharing at any time.
- Delete your account and everything in it. See how to delete your account.
You can also email [contact email] to ask for a copy of your data, a correction, deletion, or to object to or restrict how we use it. We may ask you to confirm the request from your account’s email address, and we’ll answer within 30 days. Withdrawing consent doesn’t affect what was done before.
Rights Where You Live
EU and UK. You have the rights above under the GDPR and UK GDPR, including data portability, and you can complain to your local data protection authority (in the UK, the Information Commissioner’s Office).
United Arab Emirates. Under the UAE Personal Data Protection Law you can ask for access, correction, deletion, restriction and to stop processing, and you can complain to the UAE Data Office.
India. Under the Digital Personal Data Protection Act 2023 you can ask for a summary of your data, correction, completion and erasure, and nominate someone to act for you. Grievances go to [contact email]; if you’re not satisfied, you can complain to the Data Protection Board of India.
United States. We don’t sell or share personal information for targeted advertising. Depending on your state, including California, Washington, Nevada and Connecticut, you may have rights to know, access, delete and correct your data and to appeal our decision. Consumer health data is collected only to provide RaFit, as described above, and is shared only with the companies listed and coaches you join. To use these rights or appeal, email [contact email].
Security
Connections to RaFit are encrypted. Passwords are stored only as secure hashes, your sign-in is kept in your phone’s secure storage, and coaches’ views of your data are logged. No system is perfectly secure; if a breach affects you, we’ll tell you and the authorities as the law requires.
Age
RaFit is for people aged 18 and over. We don’t knowingly collect data from anyone younger. If you think a child is using RaFit, email [contact email] and we’ll delete the account.
Changes
If we change this policy, we’ll update the date above. If a change affects how your data is used, we’ll tell you in the app before it takes effect and ask again where consent is needed.
Contact
Mohamed Saleem, trading as Sporade. Email: [contact email].