FitHQ Privacy Policy

Last Updated: 31 October 2026 | Effective Date: Upon publication

This Privacy Policy explains how FITHQ LIMITED ("FitHQ", "we", "us", "our") collects, uses, discloses, transfers, and protects personal data when you use the FitHQ mobile application, website, and related services (the "Platform"). It is issued in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO") and reflects the six Data Protection Principles ("DPPs") in Schedule 1 to the PDPO. It also serves as a Personal Information Collection Statement under DPP1(3).

If anything in this policy is unclear, please write to our privacy contact at clause 13.

1. Data Controller

The data user under the PDPO is:

2. Who Uses the Platform

The Platform serves three types of user, all of whom hold accounts:

• Independent fitness professionals ("Trainers"), who book space at Venues and may offer training sessions
• Gym and studio operators ("Venues"), who list space for Trainers to book
• Individuals who book training sessions with a Trainer ("Clients")

All self-serve registrations create a Client account. Trainer and Venue access is granted only after a request is reviewed and approved, so a Client account is what every new registration produces. Clients hold accounts, make and pay for bookings, exchange messages, leave reviews, and can take part in the Platform's community features. This Policy covers all three groups.

3. What Personal Data We Collect

3.1 Data You Provide

• Account data: name, email, password (hashed), profile photo (optional), and your role on the Platform
• Waitlist data: if you join the waitlist on our website, your first and last name, email address, and the role you select (for example, gym or trainer)
• Role request data: if you apply to become a Trainer or a Venue, the information in that application, including your phone number, business details, and any qualifications, certifications, insurance, or licensing documents you choose to upload
• Venue data: business name, Business Registration Number, contact details, facility details, pricing, and usage restrictions
• Trainer data: professional qualifications or certifications you choose to upload, bio, service offerings, rates
• Booking and communications data: bookings, scheduling, any notes or special requests you add to a booking, messages between users, reviews, and ratings
• Community content: posts, comments, likes, community and forum membership, meetup participation, and referrals you create through the Platform's community features
• Moderation data: reports you submit about other users or content, and users you block
• Payment data: transaction and payout history. Full bank account and card details are collected and held by our payment service providers. FitHQ does not receive or store full card or bank account numbers
• Consent records: which version of the Terms of Service and Privacy Policy you accepted, when, and in which language; and, separately, whether you opted in to direct marketing and any later withdrawal of that opt-in

3.2 Data We Collect Automatically

• Server and technical data: when the app communicates with our servers, those requests are logged, including your IP address and basic request metadata
• Push notification tokens: if you enable notifications, we store a notification token and a device identifier for your device so we can deliver notifications to it. You can turn notifications off in your device settings
• Precise location: only with your explicit permission via an operating system prompt, and used to show nearby Venues and to set your location on the map. It is used on the device to find nearby Venues; we do not store your coordinates. The permission is revocable at any time in your device settings, and we do not collect location in the background
• Website technical data: our hosting and security services process information such as your IP address, request metadata, and browser or device signals to operate the website and prevent abuse. See clause 12
• The mobile app does not currently use an analytics tool or a crash-reporting tool. That means the app does not collect product usage data such as screens viewed, features used, search queries, tap events, or session duration. If either is introduced in the app, we will update this Policy, explain the relevant data processing, and obtain consent where required before it goes live

3.3 Data From Third Parties

• Sign-in providers: if you use a third-party sign-in service, we receive the account information it shares with us, such as your name, email, and a verified identifier
• Payment service providers: transaction status, payout status, and connected-account status
• Backend infrastructure providers: database, authentication, and file storage services hosted on cloud infrastructure in Singapore
• Push notification providers: services that deliver notifications through your device platform
• Mapping providers: services used to display Venue locations
• The mobile app does not currently use an analytics or crash-reporting provider. If we introduce one, we will explain the relevant data processing and obtain consent where required before it goes live
• Website service providers: hosting, security, email delivery, and waitlist management services process technical data and waitlist submissions to provide those services

3.4 Sensitive Data

We do not ask for, and our systems do not have any field for, health, medical, or similarly sensitive data. We do not use it to match Trainers with Clients or for any other purpose.

One thing to be aware of: some fields are free text, including the notes or special requests you can attach to a booking and the messages you send to other users. If you choose to type health information into one of those fields, it is stored and shown to the other party to that booking or conversation in the same way as anything else you write there. Please share health information directly with your Trainer and only to the extent you want to.

4. Purposes of Use (DPP1 & DPP3)

We collect and use personal data only for the following purposes, and will obtain fresh consent before using it for any new purpose:

• Service delivery: creating and managing accounts, matching Trainers with Venue space, connecting Clients with Trainers, enabling bookings, payments, payouts, messaging, reviews, and community features
• Trust and safety: verifying identity where required, reviewing Trainer and Venue applications, handling reports and blocks, preventing fraud and abuse, enforcing our Terms of Service
• Customer support: responding to inquiries, complaints, and incident reports
• Improving the Service: quality monitoring and performance tuning
• Direct marketing (opt-in only): see clause 5
• Waitlist: if you join the waitlist on our website, confirming that you joined, and telling you when FitHQ launches and how to get early access
• Optional website analytics and advertising: if introduced, these technologies may help us understand website use and measure advertising performance. We will explain the data involved and obtain consent before enabling them. See clause 12
• Legal compliance: responding to lawful requests from authorities; complying with the PDPO, Trade Descriptions Ordinance (Cap. 362), and other applicable laws
• Corporate transactions: in connection with a merger, acquisition, restructuring, or sale of assets, subject to equivalent confidentiality and protection

5. Direct Marketing (PDPO Part 6A)

We will only use your personal data for direct marketing if you have given explicit, opt-in consent. We have not sent any marketing communications to date.

How consent is given. The opt-in is a separate, unticked checkbox presented when you create your account. It is never bundled with your acceptance of these documents, and leaving it unticked has no effect on your ability to use the Platform. Opting in is recorded with the date and the language you were shown.

What we would use. The categories of data used are your name and contact details. The classes of marketing subjects are: (a) Platform updates and offers; and (b) curated content relevant to Trainers, Venues, and Clients.

How to opt out. You may withdraw consent at any time, free of charge, by turning "Marketing emails" off in your account settings, or by writing to us at clause 13. Any marketing message we send will also include an unsubscribe link. Withdrawal takes effect on receipt and is recorded alongside the original opt-in, so we can show both that consent was given and that its withdrawal was honored.

We do not sell, trade, rent, or transfer your personal data to any third party for that third party's own direct marketing.

6. Disclosure and Sharing (DPP3)

We share personal data only as follows:

• With the Trainer, Venue, or Client you book or message with: enough information to enable the booking (name, contact channel, and relevant booking details)
• Publicly within the Platform: community content you post, including posts, comments, likes, and meetup participation, is visible to other signed-in users along with your name and profile photo. Reviews and ratings you leave are shown alongside the Trainer or Venue they concern. Do not post anything there you would not want other users to see
• With service providers engaged on our behalf: including payment, hosting, database, authentication, storage, notification, mapping, email delivery, and waitlist management providers. These processors are contractually bound to use personal data only on our instructions and to protect it to a standard equivalent to ours
• With website security providers: technical data needed to detect bots, fraud, and abuse. Some providers also process this data under their own terms and privacy policies for security and service improvement
• With professional advisers: lawyers, auditors, and insurers, where confidentiality is preserved
• With authorities: where required by law, court order, or regulatory request, or to protect life, safety, or our legal rights
• In a corporate transaction: to a buyer or successor entity in connection with a merger, acquisition, or sale, subject to equivalent confidentiality and protection

We do not sell personal data.

7. Your Data Rights (DPP6)

Under the PDPO you have the right to:

• Access the personal data we hold about you, and request a copy in a readable form
• Correction of inaccurate, incomplete, or out-of-date personal data
• Deletion of personal data we no longer need or have no lawful basis to retain
• Withdraw consent for any purpose that relies on consent, including direct marketing
• Object to processing where the law permits
• Data portability: receive a structured, commonly used, machine-readable copy of data you provided, where technically feasible
• Complain to the PCPD (see clause 11)

Submit a request using the contact details in clause 13. We handle access and correction requests manually; we will respond within 40 calendar days as required by section 19 of the PDPO. We may verify your identity and may charge a fee that is not excessive, in line with the PDPO.

Some rights are not absolute; for example, we may retain certain data where law requires it (e.g. tax records, court orders) or for the establishment or defense of legal claims.

8. Data Retention and Deletion (DPP2)

This clause describes what actually happens today, rather than a schedule we aspire to.

Two things to understand first.

Deleting your account is immediate and permanent. You can delete your account from within the app. When you do, your account record is deleted straight away, and that deletion cascades to the data attached to it. It is not a "soft delete", there is no grace period, and we cannot restore it afterwards. If you are a Venue owner, deleting your account also removes the Venue you administer along with its listings, availability, bookings, and reviews.

While your account is open, we do not automatically delete data. We have not yet built an automated retention or purge process. In practice this means data associated with an open account is kept for as long as the account exists. Building that process is planned work, and we will update this clause when it is in place rather than describing it before it exists.

What happens to each category:

When retention ends, or where we no longer need data, it is deleted or de-identified.

9. Data Security (DPP4)

We take practicable steps to protect personal data appropriate to its sensitivity and our size as a business. Data in transit between the app and our servers is encrypted (TLS). Data at rest on our backend infrastructure is protected using our infrastructure providers' platform-level encryption. Access to backend systems is limited to authorized personnel.

On your own device, the app stores your sign-in session so you do not have to log in each time. It uses your device's secure storage where that is available; on a device where it is not, it falls back to the app's ordinary storage. Data held on your device is also protected by your device's own lock screen and encryption, which are outside our control.

As an early-stage platform, our security program is still maturing. We are actively working on formalizing password strength requirements, backup and disaster-recovery procedures, and a documented incident response process, and will update this clause as those measures are put in place.

If we become aware of a personal data breach likely to result in significant harm, we will notify affected users and, where appropriate, the PCPD, without undue delay and in line with PCPD breach-handling guidance.

To report a suspected security issue: support@fit-hq.com

10. Cross-Border Data Transfer

Personal data is stored and processed outside Hong Kong. Our database, authentication, and file storage run on cloud infrastructure located in Singapore. Several of our service providers (including our payment processor, backend infrastructure provider, and push notification and mapping services) are based outside Hong Kong and may process personal data there.

Where personal data is transferred outside Hong Kong, we take reasonable contractual and technical steps to require a standard of protection for that data comparable to the protection required under the PDPO.

Website service providers may process waitlist submissions and technical data outside Hong Kong, including in countries where they or their infrastructure operate. The safeguards described above apply to these transfers.

11. Complaints

If you are not satisfied with our handling of your personal data, please first contact us using the details in clause 13. You also have the right to complain to:

12. Cookies and Similar Technologies (Website Only)

This clause applies to our website. We use hosting and security technologies to deliver website content, operate forms, and prevent bots, fraud, and abuse.

• Necessary technologies: our security services process technical information such as IP addresses and browser or device signals. They may use cookies or similar browser storage to provide these functions
• Optional technologies: we do not currently use optional analytics or advertising tracking on the website. If introduced, we will describe the data collected, purposes, recipient categories, and available choices, and obtain consent before enabling them

Declining optional analytics or advertising technologies will not prevent you from using the website or joining the waitlist.

You can manage cookies and browser storage through your browser settings. Blocking necessary technologies may affect features such as the waitlist form. You can contact us using clause 13 about your privacy choices.

13. Contact

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes, such as new purposes of use or new categories of recipient, will be notified to you in advance by in-app message or email. We will seek fresh consent where required by the PDPO. Each version you accept is recorded separately, so a later acceptance does not overwrite an earlier one. The revision date and when the policy takes effect are shown at the top of this page.

15. Language

This Privacy Policy is issued in English. Where a translation is provided for convenience, the English version prevails to the extent permitted by law.

Acknowledgment of Consent

By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy, and, where required by the PDPO, you are providing your explicit, voluntary, and informed consent to the collection, use, and disclosure of your personal data for the purposes described above.