Privacy Policy

1. Data controller

The controller of personal data is:
IVK Fitness OÜ
Registry code: 17342970
Address: Mäe tee 2-4, Kirna village, Türi parish, Järva county, 72231, Estonia
Email: ivkfitness@mail.ee

For privacy questions, contact us at this email address. If you are another trainer's client in FORM., see section 6 for the exception.

2. Scope of this policy

This policy applies to the IVK Fitness website (ivkfitness.ee), the booking form, the FORM. app (app.ivkfitness.ee and the iPhone app), the services we offer, and communication with us by email or message.

3. What data we process

Which data we process depends on which service you use.

Contact and booking data. Name, email address, phone number (if you enter it), preferred date and time, chosen training location and the message you write in the booking form. If you book for several participants, also the name, email and phone of the other participants you enter. Please enter another person's data only if they agree to it.

FORM. user account. Name, email address, language, user role and the link to your trainer. We do not see or store your password in readable form: it is handled by the authentication service, which keeps it encrypted.

Free account you create yourself. If you create a FORM. account yourself in the app (without a trainer's invitation), we process your name, email address and chosen password (in encrypted form) and record that the account was self-created and belongs to the free tier. To activate the account we send a confirmation link to your email address from noreply@ivkfitness.ee. You must confirm your email address to use the account.

Profile and training data. Date of birth, goal, desired training days per week, available equipment, programs prepared for you, results of completed workouts (e.g. weights, repetitions, times, distances), steps, habits, running and hybrid workout data, and trainer notes.

Health data. Answers in check-ins (e.g. energy, sleep, stress, appetite, pain, safety symptoms), body weight and other body measurements, body fat percentage, progress photos, food diary, calorie and macronutrient goals, and other information about your health or fitness for training that you provide yourself. We treat this data as special-category personal data (see section 5).

Apple Health data (only in the FORM. iPhone app and only if you connect it). If you turn on the Apple Health connection in the FORM. app and give permission in the iOS prompt, we read the last 14 days of data from Apple Health: steps, sleep, water, body weight, body fat percentage, calories and macronutrients (protein, carbohydrates, fat), and workouts (type, duration, distance, calories and laps) together with the heart rate and distance measured during the workout. We do not read or store location (GPS routes). The app reads Apple Health data under read permission only; if you use the FORM. watch app, it saves the workout you start on the watch (workout, heart rate, distance) to Apple Health. The data is stored in your FORM. account in the same places as steps, sleep, water, measurements and nutrition you enter yourself, and it is special-category data (see section 5).

Garmin workout data (only if you bring it yourself). If you upload a .fit file downloaded from Garmin Connect to FORM., or (where this option is available on your account) connect your Garmin Connect account, we receive the activity type, start time, duration, distance, laps and their times, heart rate (average, maximum, heart rate zones), pace, cadence, power, elevation, temperature, Training Effect, running dynamics and calories. We do not store GPS routes. See section 5A for details.

Purchase and payment data. Order contents, amount, time of purchase, version of the terms accepted and the times of consents, withdrawal and refund requests, and billing details. We do not receive or store full payment card details; these are processed by the payment service provider.

Technical data. IP address, device and browser data, and error messages that arise when using the website and FORM. If you allow notifications in FORM., we store your device's notification identifier so that we can send notifications to you or your trainer.

Communication. Emails, messages and complaints you send us, and our replies.

Trainers. For users who are trainers in FORM., we also process the data needed to confirm the account and the branding data the trainer configures (logo, display name, colour) that their clients see in FORM.

4. Why we use data and on what basis

Performance of a contract (GDPR Art. 6(1)(b)). To receive and confirm bookings, create a FORM. account, prepare and provide programs, give feedback on check-ins, activate a purchased service and communicate with you about the service.

Legal obligation (Art. 6(1)(c)). To prepare and retain accounting documents, to fulfil consumer rights (e.g. withdrawal requests) and to respond to legal requests and obligations.

Legitimate interest (Art. 6(1)(f)). To keep the service secure and prevent misuse, to find and fix technical errors, to establish, exercise and defend legal claims, and to maintain service quality. When we rely on legitimate interest, we first weigh that it does not disproportionately affect your rights and freedoms.

Consent (Art. 6(1)(a)). Web analytics and related cookies, and direct marketing, where used. You can withdraw consent at any time.

Health data (Art. 9(2)(a)). We process health data only on the basis of your explicit consent (see section 5).

Based on the workouts you complete (e.g. number of workouts done, perceived exertion RPE, strength-training RIR, test run result), FORM. may make suggestions about next week's load, for example an easier week or new running paces. These are rules based on coaching practice and suggestions, not a guarantee. The final decision is made by your trainer or, if you have no trainer, by you.

We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you.

5. Health data and consent

Preparing and monitoring a training program requires us to process health data, for example check-in answers, body measurements, progress photos and nutrition data. This is special-category personal data and we process it only on the basis of your explicit consent.

In FORM. we ask for consent at your first login. Consent is not pre-filled: you must give it actively and we record the time it was given. You do not have to provide health data, but without it we may not be able to prepare a suitable and safe program for you.

You can withdraw consent at any time by writing to ivkfitness@mail.ee. Withdrawal does not affect the lawfulness of processing before withdrawal, but it may make it impossible to provide the FORM. service.

Your health data is visible to your trainer (and to the platform's technical administrator as far as necessary for the service to work). We do not sell it or share it for marketing purposes.

Apple Health. We use Apple Health data only to show you and your trainer the development of your workouts, heart rate, body weight, sleep, nutrition and activity, and to compare workouts with each other in FORM. We do not use it to train AI models. We do not use it for advertising, do not sell it, and do not share it with data brokers or other third parties other than the processors named in section 7 that store data on our behalf. The connection is voluntary. You can switch it off in the FORM. diary at any time and also revoke the Apple Health read permission in iPhone settings (Settings → Health → Data Access & Devices). Data already stored in FORM. is deleted at your request (see section 10) or when your account is deleted.

5A. Garmin Connect and Garmin data

You can bring Garmin workouts into FORM. in two ways: by uploading a .fit file (or its ZIP) downloaded from Garmin Connect or, where this option is available on your account, by connecting your Garmin Connect account to FORM. Both are voluntary.

What data we receive. Activity type, start time, duration, distance, laps and their times, heart rate (average, maximum, heart rate zones), pace, cadence, power, elevation, temperature, Training Effect, running dynamics and calories. We do not take or store GPS routes, location, sleep, stress or other health metrics from Garmin.

What we use it for. Only to add the activity to your FORM. training diary, show it next to the plan prepared for you, and calculate progress and personal records for you and your trainer. Garmin data is visible to you and your trainer (or IVK Fitness, if you are a direct IVK Fitness client). We treat heart rate as health data (see section 5).

Who receives it. We do not sell Garmin data or share it for marketing, with data brokers or with other third parties. It is processed only by the processors named in section 7: Supabase (database and server-side functions; data is stored in the European Union) and Vercel (application hosting). Garmin itself processes its own data as a separate controller; see the Garmin Connect privacy notice: garmin.com/privacy/connect.

Artificial intelligence. We do not use Garmin data in artificial intelligence systems, nor to train, evaluate or improve AI models. FORM. load suggestions (see section 4) are based on fixed calculation rules.

Consent and withdrawing it. By connecting your Garmin account or uploading a file you give explicit consent to the processing of this data. You can end the connection at any time in FORM. settings (where a connection exists) or in your Garmin Connect account settings, where you can manage the permissions you have given to apps. After that we will not receive new data. Workouts already imported remain in your training diary until you ask us to delete them.

Access, correction, deletion and export. Write to ivkfitness@mail.ee and within one month we will delete the data received via Garmin, correct it or give you a copy. The data is also deleted when your account is deleted (see sections 9 and 10).

Garmin, Garmin Connect and the Garmin logo are trademarks of Garmin Ltd. or its subsidiaries. FORM. is not a Garmin product and is not endorsed by Garmin.

6. If you are another trainer's client

Other trainers also use FORM. to coach their clients. If your trainer is someone other than IVK Fitness, they are the controller of your data and IVK Fitness processes the data on their behalf as a processor, only to provide the FORM. platform. In that situation, contact your trainer first with questions about your data and rights.

Clients of such trainers may see their trainer's logo, name and colour in FORM. This is branding the trainer uses themselves.

7. Who we share data with

To provide the service we use trusted service providers (processors) who process data according to our instructions:

• Supabase — database, user authentication, file storage (e.g. progress photos) and server-side functions;
• Vercel — hosting of the website and the FORM. application;
• OneSignal — notifications to your device;
• Resend — sending system emails (e.g. account confirmation link and password reset);
• Merit Aktiva (accounting software) — managing invoices and accounting data;
• Google — Google Fonts typefaces used on the website (your browser fetches them from Google's servers, so Google receives your IP address) and introductory questionnaires when we use Google Forms.

In addition, we may disclose data where required by law (e.g. to a competent authority) or where necessary to establish or defend a legal claim. We do not sell data to third parties.

8. Transfers outside the EEA

Some of the service providers named above may process data outside the European Economic Area, including in the United States. In that case we ensure that a safeguard required by the General Data Protection Regulation is in place for the transfer, such as the European Commission's standard contractual clauses or a framework based on a European Commission adequacy decision (including the EU-US Data Privacy Framework).

9. How long we keep data

We keep data only as long as necessary for the purpose or as required by law:

• Booking requests and contact messages — up to 12 months after the last contact, if no service is provided;
• FORM. account and training data (including health data, progress photos and imported Garmin workouts) — until the account ends and generally up to 24 months after last activity; we delete them earlier on request (see section 10);
• Giving and withdrawing consent to health data processing — 3 years after processing ends, so that we can prove that consent existed if needed;
• Orders, payments, invoices, withdrawal requests and accepted versions of terms — 7 years, because the Estonian Accounting Act requires accounting documents to be retained;
• Complaints and related correspondence — 3 years because of the limitation period for claims;
• Technical logs — as long as necessary for security and fixing faults, generally a few months.

When the retention period has passed, we delete the data or make it anonymous. Data retained by law cannot be deleted before the period ends.

10. Your rights

You have the right to:

• ask whether and what data we process about you, and receive a copy of it;
• request correction of inaccurate data;
• request deletion of data, unless the law requires us to keep it;
• restrict processing of data;
• object to processing based on legitimate interest;
• receive the data you provided in a machine-readable format (data portability);
• withdraw consent at any time.

To exercise your rights, write to ivkfitness@mail.ee. We reply within one month. Before releasing or deleting data we may ask you to verify your identity.

If you believe your data is being processed unlawfully, you have the right to contact the Estonian Data Protection Inspectorate (aki.ee, info@aki.ee) or a court.

11. How we protect data

We apply organisational and technical measures to protect data. For example, access in FORM. is restricted by role: a client sees their own data and their trainer sees their own clients' data. Progress photos are kept in a private file store that only the client and their trainer can access. Data is transferred over an encrypted connection. We do not see passwords.

No system is entirely free of risk. If we identify a personal data security incident that endangers your rights, we will notify you and, where necessary, the Data Protection Inspectorate as provided by law.

12. Cookies and web analytics

The website stores your cookie choice in the browser's storage. To measure website visits we use cookieless statistics (Vercel Web Analytics), which do not store cookies on your device, do not identify you personally and do not track you on other sites. We use no other web analytics or tracking cookies; if we add them in future, we will update this policy and ask for your consent first.

The FORM. application stores technical information on your device that is needed for login and smooth use (e.g. session and preferences). These are strictly necessary for the application to work.

13. Minors

The service is offered mainly to adults. We process data of a minor (under 18) only with the knowledge and consent of their legal representative. If you are a parent and believe your child's data has been provided without your knowledge, write to us and we will delete it.

14. Changes to this policy and contact

We may change this policy, for example when a new service or system is added or legislation changes. The current version is always on this page with the version date. We will notify you of important changes separately where needed.

Contact:
IVK Fitness OÜ
Registry code: 17342970
Email: ivkfitness@mail.ee