This Privacy Policy explains how MaxFit Technologies FZ-LLC (“MaxFit”, “we”, “us”) collects, uses, discloses, and protects your personal data when you use the MaxFit Platform. We handle personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL) and other applicable UAE regulations.
1. Who is responsible for your data
MaxFit is the data controller for personal data processed through the Platform. You can reach our privacy team at privacy@maxfit.io.
2. Data we collect
- Account & profile data — name, email, password (stored hashed), date of birth, and role (member, coach, gym owner).
- Health & fitness data — goals, activity, body metrics, dietary preferences, allergens, and other information you provide so the AI can personalise plans. This is treated as sensitive data.
- Voice & conversation data — audio and transcripts of voice-coach sessions and chat messages, where you choose to use those features.
- Subscription & transaction data — plan, billing history, and payment status. Full card details are handled by Dodo Payments and are never stored on our servers.
- Gym & scan data — QR scan events, gym check-ins, and, where required for entry validation, approximate location at the moment of a scan.
- Device & usage data — device type, app version, IP address, and interaction logs used for security, analytics, and diagnostics.
3. How we use your data
- To operate the Platform, create AI-generated plans, recipes, and coaching responses tailored to you.
- To run the allergen and safety checks that protect you when generating nutrition content.
- To process subscriptions, payments, and gym-entry scans, and to pay coaches and gym owners.
- To provide support, send service and transactional messages, and (with your consent) marketing.
- To secure the Platform, prevent fraud and scan abuse, and comply with legal obligations.
4. Legal bases for processing
We process personal data where: (a) you have given consent; (b) processing is necessary to perform our contract with you (delivering the subscription you bought); (c) we have a legitimate interest such as security and service improvement that does not override your rights; or (d) we must comply with a legal obligation.
5. AI processing of your data
To generate coaching, plans, and recipes, relevant profile and health inputs are processed by AI models, including third-party model providers acting as our processors under contract. We do not sell your data, and we apply safety filtering to AI output. You control whether voice transcripts are stored — see our AI Usage & Disclaimer Policy.
6. When we share data
We share personal data only as needed:
- Service providers (processors) — payment processing (Dodo Payments), AI model, email, hosting, and analytics providers, bound by data-processing agreements.
- Coaches & gyms — limited information required to deliver a booking or validate a gym entry (for example your name and the fact of a valid scan).
- Legal & safety — authorities where required by law, or to protect the rights and safety of users and the public.
- Business transfers — in a merger or acquisition, subject to this Policy.
7. International transfers
Some processors may store or process data outside the United Arab Emirates. Where we transfer personal data abroad, we do so only to jurisdictions with adequate protection or under appropriate contractual safeguards, as required by the UAE PDPL.
8. Data retention
We keep personal data only as long as necessary for the purposes described here or as required by law (including tax and accounting rules). When data is no longer needed, we delete or anonymise it. Sensitive fields (such as bank details, TOTP secrets, voice transcripts, and chat bodies) are encrypted at rest.
9. Your rights
Subject to the UAE PDPL, you have the right to:
- Access the personal data we hold about you and request a copy (data portability).
- Correct inaccurate or incomplete data.
- Request erasure of your data (subject to legal retention obligations).
- Restrict or object to certain processing, and withdraw consent at any time.
- Lodge a complaint with the UAE Data Office.
You can exercise most of these rights directly in the app (account settings and data export), or by emailing privacy@maxfit.io. We respond within the timeframes set by applicable law.
10. Security
We use technical and organisational measures including encryption in transit and at rest for sensitive data, access controls, audit logging, and secure payment handling via Dodo Payments. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a qualifying breach as required by law.
11. Cookies & tracking
Our website uses strictly necessary cookies to run the service and, with your consent, analytics cookies to understand usage. You can manage non-essential cookies through the consent controls presented on our site.
12. Children
MaxFit is not directed to children under the applicable minimum age. We do not knowingly collect data from children without verified parental consent. If you believe a child has provided us data, contact privacy@maxfit.io and we will delete it.
13. Changes to this Policy
We may update this Policy and will post the revised version with a new effective date. Material changes will be notified through the Platform or by email.
14. Contact us
Data Protection Contact — MaxFit Technologies FZ-LLC
Dubai, United Arab Emirates
privacy@maxfit.io