Privacy Policy

1. Who we are

This Privacy Policy describes how CorFitX ("we", "us") collects, uses, and shares information when you use our website and application.

2. Information we collect

We may collect:

• Account data: name, email, phone, and profile details you provide.
• Health and fitness data: goals, measurements, logs, and content you or your coach enter into the Platform.
• Messages and progress photos: the text, images, and weekly transformation photos you exchange with your assigned coach or dietitian through in-app messaging and check-ins.
• Usage and technical data: device, browser, IP address, and logs used for security and reliability.
• Payment data: processed by our payment partner Whish and, where applicable, its service providers. We do not store full card numbers on our servers when the processor handles card data.
• Referrals: if you use or share a referral code, we may store the code, attribution, and related usage to apply discounts or platform rules described in the product.

3. How we use information

We use information to provide and improve the Platform, authenticate users, communicate with you, personalize your experience, process payments, detect abuse, and comply with legal obligations.

4. Sharing

We may share information with service providers who assist us (hosting, email, analytics, payments — including Whish for transaction processing) under appropriate safeguards. Coaches and dietitians may see client data assigned to them within the product. We may disclose information if required by law or to protect rights and safety.

5. Private messaging and transformation check-ins

If your plan includes them, in-app messaging and weekly photo check-ins let you communicate privately with your assigned coach or dietitian. These features are governed by additional safeguards:

• Limited audience: messages and check-in photos are visible only to you and your assigned professional. They are not shared with other clients or used for advertising.
• Access-controlled media: chat images and progress photos are stored privately and served only through authenticated requests — they are never placed on a public URL.
• Administrator access: our staff can view conversation and check-in metadata (such as participants, timestamps, and status) for moderation and support. Opening the actual message content or photos is restricted to authorized administrators and is recorded in an audit log.
• Your control: you can stop sharing at any time, and your professional can disable a conversation. Contact us to request deletion of specific messages or photos.

Please share only what you are comfortable storing on the Platform, and do not send sensitive information you do not wish your professional to retain.

6. Cookies and similar technologies

We use cookies and local storage as needed for sign-in sessions, preferences (such as theme), and security. You can control cookies through your browser settings; disabling some cookies may limit functionality.

7. Retention

We retain information for as long as your account is active and as needed for legal, accounting, or reporting requirements, then delete or anonymize it where appropriate.

8. Your rights

Depending on your region, you may have rights to access, correct, delete, or export your personal data, or to object to certain processing. Contact us to exercise these rights; we may verify your identity before responding.

9. Security

We apply layered access controls, secure authentication, and continuous monitoring to protect account and client data.

We implement reasonable technical and organizational measures to protect information. No method of transmission over the Internet is 100% secure.

10. Changes

We may update this policy from time to time. The "Last updated" date will change when we do. Continued use after updates means you accept the revised policy.

11. Contact

For privacy requests or questions, email support@corfitx.com.