Privacy Notice

For account details of gym owners and trainers, AS Fitness is the data controller.

For client records (training, nutrition, measurements, appointments and memberships), the gym or trainer you train with decides what is recorded and why. They are the data controller and AS Fitness processes that data on their behalf. Questions about what your gym records should go to your gym first. We will help them answer.

• Account details: name, email address, optional phone number and profile photo.
• Workspace details: business name, branches, staff, subscription and payment history (we never see or store your full card or mobile money PIN; payments are handled by Pesapal).
• Training records: workout plans, logged workouts, sets, weights and personal records.
• Nutrition records: foods and drinks you log, water intake and daily targets.
• Progress measurements: body weight, body-fat percentage and body measurements. We treat these as sensitive.
• Appointments, gym memberships and check-ins.
• Trainer notes: private notes written by staff about a client. Clients cannot see them.
• Technical data needed to run the service securely, such as sign-in times, device type and the push-notification token of your phone.

• To provide the service you or your gym signed up for (performance of a contract).
• To send service messages such as invitations, password resets, appointment and subscription reminders. You can turn most notifications off in your settings.
• To keep the service secure and prevent misuse, and to meet legal obligations such as tax records.
• With your consent, for anything else. We do not sell personal data and we do not use client training or health data for advertising.

• You.
• Clients: only the owners and managers of the gym you train with and the trainers assigned to you. Front-desk staff see your name, contact details, membership and attendance, but not your training, nutrition or measurements.
• Each gym's or trainer's data is kept separate. A trainer you work with independently cannot see records from your gym, and the reverse.
• AS Fitness platform administrators can manage workspaces and subscriptions but are blocked by the system from viewing clients' training, nutrition and measurement records.
• Service providers who host or deliver the service for us, under contract and only for that purpose: Supabase (database and sign-in), Netlify (website hosting), Expo (phone app updates and push notifications), Google (email delivery) and Pesapal (payments).
• Authorities, only when the law requires it.

Our service providers store data on secure cloud servers that may be outside Uganda. We only use providers whose security protections are at least as strong as those required by Ugandan law. By using the service you agree to this transfer. Data is encrypted in transit, and access is controlled by strict permission rules in the database.

We keep data while your account or workspace is active. When a client deletes their account, their personal data and records are deleted. Some records, such as invoices and security logs, are kept for as long as the law requires, then deleted or anonymised.

Under the Data Protection and Privacy Act you have the right to:

• access the personal data held about you (download it any time from Account → Privacy);
• have inaccurate data corrected, and have data deleted or blocked;
• object to processing that causes you harm or distress, and stop direct marketing;
• withdraw consent at any time;
• complain to the Personal Data Protection Office (PDPO) of Uganda.

To use these rights, use Account → Privacy or contact us by email at hello@asfitness.app. We respond within the time limits set by law.

The service is meant for adults. A gym or trainer may only add a client under 18 with the consent of a parent or guardian.

If personal data is accessed without authorisation, we will act immediately to contain it, notify the Personal Data Protection Office, and inform affected people and workspaces as required.

We will post any changes here and tell you in the app or by email if they are significant.