PRIVACY POLICY

1. Data Fiduciary

The Data Fiduciary responsible for your personal data is Epic Fitness Coach, operating from Kolkata, West Bengal, India.

Epic Fitness Coach is a Sole Proprietorship (Proprietary) owned by Soumojit Naskar, with its registered address at 12G, Magnolia Merlion, Bishnupur Road, Rajarhat, Kolkata, West Bengal 700135. The business is registered under UDYAM as a Micro Enterprise under the MSME Act (Micro, Small and Medium Enterprises Development Act, 2006), UDYAM Registration Number UDYAM-WB-14-0261441. Registered email for official notices: epicfitnessscoach@gmail.com.

For all privacy queries, requests, or grievances contact coach@epicfitnesscoach.com, epicfitnessscoach@gmail.com, or +91 75017 70606.

2. Scope

This Policy applies to information collected through the EFC Core web app, intake forms, WhatsApp communications, email correspondence, and any associated payment flows used to deliver coaching services.

It does not cover third-party websites you may reach through links shared by your coach. Those sites operate under their own privacy policies.

3. Categories of Data We Collect

Identity & contact: full name, date of birth, gender, email, WhatsApp number, phone number, city, photograph.

Health & biometric: height, weight, body measurements (chest, waist, hips, thigh, arm, neck), body-fat estimates, progress photos, medical conditions, allergies, food intolerances, blood markers (when shared), and menstrual cycle data (where relevant and provided voluntarily).

Program data: training logs, sets/reps/weights, daily check-in entries (steps, calories, macros, water, sleep, mood, energy, supplements taken), weekly check-ins, session feedback.

Account & technical: encrypted login credentials, device/browser metadata used to deliver and secure the service, app preferences, notification settings.

Financial: payment status, transaction references, invoice records. We never store full card numbers, CVV, or banking credentials — these are handled by our payment processor.

4. Purposes & Legal Basis

We process your data to deliver coaching services you have agreed to receive, including building nutrition and training plans, tracking adherence, generating reports, and communicating about your program.

Legal bases we rely on: (a) performance of the coaching agreement between you and EFC; (b) your explicit consent for sensitive categories such as health, biometric data, and progress photos; (c) compliance with tax, accounting, and other legal obligations; and (d) our legitimate interest in keeping the platform secure and improving service quality.

5. AI-Assisted Processing

Certain features of EFC Core use AI models (currently Anthropic Claude) to assist your coach with insights such as adherence summaries and progress notes. Data sent to these models is limited to what is required for the feature, is transmitted over secure channels, and is not used by the AI provider to train their models under our service agreement.

Your coach reviews AI-generated suggestions before acting on them. AI output is never the sole basis for a clinical or medical decision.

6. Sub-Processors

We use the following service providers to operate EFC Core: Supabase (managed PostgreSQL database, authentication, and file storage, hosted in European Union data centres); Resend (transactional email delivery); Razorpay (payment processing and invoicing); Anthropic (AI-assisted coaching summaries); Cloudflare (edge hosting and DDoS protection).

Each sub-processor receives only the minimum data required to perform their function, under contractual confidentiality and security commitments.

7. Where Your Data Is Stored & Cross-Border Transfers

Your account records, health and biometric data, training and nutrition logs, and progress photos are stored on Supabase infrastructure located in European Union data centres, which operate under recognised security certifications (including SOC 2 Type II) and EU data-protection standards.

Because some sub-processors host infrastructure outside India, your data may be transferred across borders. Where this happens we rely on the recipient's certifications, industry-standard transport encryption (TLS), and contractual data-protection obligations to safeguard your information. Health data and progress photos are not copied to any storage outside these named, encrypted systems.

8. Storage & Security

Data is encrypted in transit (HTTPS/TLS) and at rest. Progress photos and personal documents live in private storage buckets and are accessible only through time-limited signed links to your coach.

Database row-level security ensures one client can never read another client's records. Passwords are hashed using industry-standard algorithms — we never store them in plain text.

Despite these controls, no online system is perfectly secure. You agree to notify us immediately if you suspect unauthorised access to your account.

Breach notification: in the event of a personal data breach affecting your information, we will notify you and, where applicable, the Data Protection Board of India without undue delay, describing the nature of the breach, the likely consequences, and the steps taken to mitigate it.

9. Progress Photos

Progress photos are sensitive personal data and are treated as such. They are collected for one purpose only: allowing your coach to assess body-composition change over the course of your program.

Photos are stored in private storage buckets, are never publicly accessible, and are surfaced only to your assigned coach through short-lived signed links. They are never shared with other clients, never used to train AI models, and never disclosed to any third party except where compelled by law.

We will not use your photos in any marketing, testimonial, social media, or promotional material without your separate, specific, written opt-in — general acceptance of this Policy is not consent for marketing use. Any such consent can be withdrawn at any time, after which we will stop future use of the material.

You may request deletion of any or all progress photos at any time by writing to us, and we will remove them from active storage promptly.

10. Data Retention

Active client data is retained for the duration of your coaching engagement plus the period required for tax, accounting, and dispute-resolution purposes (typically seven years from the last invoice, as required by Indian law).

Progress photos and biometric data are retained for the active program duration unless you request earlier deletion under Section 11.

11. Your Rights

You have the right to: (a) access the personal data we hold about you; (b) correct inaccurate or incomplete data; (c) request erasure of your data (subject to legal-retention exceptions); (d) export your data in a structured format; (e) withdraw consent at any time; (f) nominate another person to exercise these rights on your behalf in the event of death or incapacity; and (g) lodge a grievance with us or with the relevant Data Protection Authority.

To exercise any right write to coach@epicfitnesscoach.com. The Account → Privacy & Security tab in EFC Core also provides one-click "Download My Data" and "Request Deletion" controls. We respond to requests within 30 days.

12. Children's Privacy

EFC Core is intended for users aged 18 and above. We do not knowingly collect data from minors. If you believe a minor has registered without verifiable parental consent, contact us so we can remove the account and associated data.

13. Cookies & Local Storage

EFC Core uses local browser storage to keep you logged in, remember preferences, and cache plan content for offline reading. We do not use third-party advertising cookies and we do not sell behavioural data.

14. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced inside the app and by email to active clients. Continued use of EFC Core after a notified change constitutes acceptance of the updated Policy.

15. Grievance Redressal & Contact

This Policy is intended to operate consistently with the Digital Personal Data Protection Act, 2023 and applicable Indian data-protection rules. Our Grievance Officer for data-protection matters is Soumojit Naskar, Proprietor, Epic Fitness Coach, 12G, Magnolia Merlion, Bishnupur Road, Rajarhat, Kolkata, West Bengal 700135.

For any privacy question, request, or complaint contact coach@epicfitnesscoach.com, the registered email epicfitnessscoach@gmail.com, or WhatsApp +91 75017 70606. We acknowledge grievances within 7 days and aim to resolve them within 30 days.

If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India or, if you reside outside India, to the supervisory authority in your jurisdiction.