This Policy describes how Fitally collects, uses, stores, shares, and protects its users' personal data, in compliance with Law 1581 of 2012, Decree 1074 of 2015 (which compiles Decree 1377 of 2013), and other applicable personal-data protection rules in Colombia.
1. Identity of the Data Controller
- Controller: FITALLY S.A.S., identified with NIT 902080977-4.
- Address: Medellín, Antioquia, Colombia.
- Data-protection email:
support@fitally.mobile - Phone:
+57 305 340 44 55
Any request relating to the processing of personal data may be directed to the channels above.
2. Scope and acceptance
2.1. This Policy applies to personal data processed through the Fitally mobile and web application, its website, and associated services (the "Platform").
2.2. By registering and accepting this Policy, the Data Subject authorizes the processing of their personal data as described here. This Policy complements the Terms and Conditions of Use.
3. Definitions
In accordance with data-protection regulations:
- Data Subject: the natural person whose personal data is processed (the user).
- Personal data: any information linked to or associable with a determined or determinable natural person.
- Sensitive data: data affecting the Data Subject's privacy or whose misuse may lead to discrimination, such as health-related data.
- Processing: any operation on personal data, such as collection, storage, use, circulation, or deletion.
- Data Controller: the party that decides on the database and/or the processing (Fitally).
- Data Processor: the party that processes data on the Controller's behalf (for example, infrastructure providers).
- Authorization: the Data Subject's prior, express, and informed consent to process their data.
- Transfer: sending data to a recipient that is a Controller, within or outside the country.
- Transmission: processing of data by a Processor on the Controller's behalf, within or outside the country.
4. Personal data we collect
We collect only the data necessary to provide the Platform:
4.1. Account and identity data. Email and/or username, password (stored encrypted by our authentication provider), name, and date of birth.
4.2. Physical profile data. Sex/gender, height, current and goal weight, activity level, and fitness experience.
4.3. Sensitive health data. Dietary restrictions, allergies, and medical conditions that the Data Subject chooses to record, as well as nutritional and activity goals. See Section 5.
4.4. Activity logs. Logged foods and calorie/macronutrient counts, hydration logs, routines, workout sessions and sets, strength records (1RM), and configured goals.
4.5. Food photos. When the Data Subject uses photo-based food logging, the image is processed to estimate its nutritional content (see Sections 8 and 9).
4.6. App preferences. Language, theme, unit system, time zone, and Platform settings.
4.7. Payment data. If the Data Subject purchases a Premium Subscription, payment is processed by the app store or a payment provider. Fitally does not store full card details; it receives limited transaction information (for example, subscription status and validity).
4.8. Technical data. Minimal data necessary for operation and security (for example, technical session identifiers and access logs). Fitally does not use third-party advertising analytics or tracking tools (see Section 10).
5. Processing of sensitive data
5.1. Health data (allergies, medical conditions, weight, nutrition, and physical activity) are sensitive data. Under the law, the Data Subject is not obligated to provide them.
5.2. The Data Subject may use the Platform without recording sensitive data, although some features (for example, more precise recommendations) may be unavailable or less accurate.
5.3. By voluntarily recording sensitive data, the Data Subject expressly authorizes its processing for the purposes in Section 6. We apply reinforced security measures and restricted access for this data.
6. Purposes of processing
We process personal data to:
a) create and manage the account and authenticate the Data Subject; b) provide the Platform's features (calorie counting, food and hydration logging, routines and workouts, goals and statistics); c) personalize goals, recommendations, and content; d) operate the artificial-intelligence features (nutritional estimates, photo-based food recognition, and the assistant/coach); e) manage subscriptions, payments, and billing; f) enable social features when the Data Subject chooses to use them; g) send service communications (account, security, subscription) and — with prior authorization and an opt-out — commercial communications (see Section 11); h) ensure security, prevent fraud and abuse, and provide support; i) comply with legal obligations and respond to requests from competent authorities.
7. Authorization and legal basis
7.1. Processing is based on the Data Subject's authorization, granted upon accepting this Policy, and on any other bases recognized by law (for example, compliance with legal obligations or performance of the usage contract).
7.2. Authorization for sensitive data is explicit and optional, as set out in Section 5.
8. Processors and third parties with whom we share data
8.1. To operate the Platform we rely on providers acting as Processors, bound to protect the data and to use it only on our instructions. By category, they are:
- Cloud infrastructure: hosting of the app and website, database, authentication, file storage, and delivery of the account's transactional emails.
- Artificial intelligence providers: processing of the AI Features (food photo analysis, assistant/coach, and content translation).
- Nutrition and exercise content providers: the food and exercise catalogues shown in the Platform.
- Payment and billing processing: management of purchases, subscriptions, taxes, and refunds, including our Merchant of Record and, where the purchase is made that way, the app stores.
- Third-party account sign-in: authentication when the Data Subject chooses to sign in with an external account instead of a password.
8.2. We publish categories rather than a named list of providers, which may change over time. The Data Subject may at any time request the identity of the current Processors handling their data by writing to support@fitally.mobile.
8.3. In the future, and subject to an update of this Policy where applicable, we may add integrations with health devices or platforms.
8.4. We do not sell personal data. We share it only where necessary to provide the service, with the Data Subject's authorization, or where required by law or a competent authority.
9. International transfers and transmissions
9.1. Some of our Processors — in particular those providing cloud infrastructure and artificial intelligence — process and store data outside Colombia, including in the United States.
9.2. By accepting this Policy, the Data Subject authorizes the international transfer and transmission of their personal data — including sensitive data when recorded — for the purposes described here. We seek to ensure these providers offer adequate protection levels and we enter into the appropriate data-processing agreements.
10. Cookies and local storage
10.1. The Platform uses device local storage (for example, localStorage) solely for functional purposes, such as remembering the visual theme, navigation preferences, and session.
10.2. We do not use advertising cookies or third-party analytics or tracking tools. If we incorporate analytics or diagnostic tools in the future, we will update this Policy and inform the Data Subject.
11. Communications and commercial messages
11.1. We will send service messages (relating to the account, security, or subscription), which are necessary and do not constitute advertising.
11.2. We may send commercial communications (news, promotions, affiliate program, reminders) only if the Data Subject authorizes it. The Data Subject may withdraw consent or object at any time, via the unsubscribe link in the messages, the Platform settings, or by writing to support@fitally.mobile.
12. Minors
12.1. The Platform is intended for individuals aged sixteen (16) or older and does not knowingly collect data from children under 16.
12.2. Where it processes data of minors (16 or 17 years old), processing will respect their best interest and fundamental rights, in accordance with the law. If a parent or guardian believes a minor has provided data without proper authorization, they may contact us for its deletion.
13. Data retention and deletion
13.1. We retain personal data while the Data Subject keeps an active account and for as long as it is necessary for the described purposes.
13.2. Deletion of the account itself is immediate (see 13.4). Backups and derived copies are purged on their own cycle, within approximately thirty (30) days. Data we must retain by legal obligation (for example, accounting or tax records) or to handle claims is kept for as long as the law requires.
13.3. How to delete the account. The Data Subject may delete their account at any time, without contacting us: in the app, under Settings → Delete account, and on the web at the same Settings screen. The password is requested again to confirm, because the action cannot be undone. The step-by-step instructions, including how to proceed if the Data Subject can no longer sign in, are published at Account and Data Deletion.
13.4. What is deleted. Deletion is immediate and permanent, and covers the account itself and all data associated with it: profile, physical and health data recorded during onboarding, workouts and routines, food, water, weight and fasting logs, recipes, custom exercises, and every image uploaded to the Platform (profile photo, workout photos, meal photos, recipe images). It also covers content shared with other users — posts, comments and reactions — which disappear from other users' feeds.
13.5. What is retained, and why. The record that the Data Subject accepted these documents (which document, which version, and when) is retained as an anonymised entry: the identifier, IP address, and user agent are erased, so the entry no longer identifies anyone. It is retained because Law 1581 of 2012 requires the Controller to be able to demonstrate that authorization was obtained. Anything we must keep by legal obligation — accounting or tax records, for example — is retained for the period the law requires.
14. Information security
We adopt reasonable technical, administrative, and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure — including per-user access control, encryption in transit, and reinforced access restrictions for sensitive data. No system is completely infallible; in the event of a relevant security incident, we will act in accordance with the law.
15. Data Subject rights
Under Article 8 of Law 1581 of 2012, the Data Subject has the right to:
a) access, update, and rectify their personal data; b) request proof of the authorization granted; c) be informed about the use given to their data; d) file complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law; e) revoke the authorization and/or request deletion of the data where applicable; f) access their personal data free of charge.
16. Procedure for inquiries and claims
16.1. Channel. The Data Subject or their successors may exercise their rights by writing to support@fitally.mobile, stating their identification, the specific request, and contact details.
16.2. Inquiries. Inquiries will be handled within a maximum of ten (10) business days. If not possible, the interested party will be informed and the inquiry handled within the five (5) business days following the expiry of the first term.
16.3. Claims. If the request is a claim (for example, correction, deletion, or revocation), it will be resolved within a maximum of fifteen (15) business days. If the claim is incomplete, the interested party will be asked within the following five (5) days to complete it; after two months without a response, it will be deemed withdrawn. Where it is not possible to resolve within the term, this will be communicated and the matter handled within the following eight (8) business days.
16.4. Claim before the authority. The Data Subject may turn to the SIC once the claim procedure before the Controller has been exhausted.
17. Transfer in business reorganizations
In the event of a merger, acquisition, assignment, or business reorganization, personal data may be transferred to the successor, which will be obligated to respect this Policy and applicable regulations.
18. Validity and changes to this Policy
18.1. This Policy is effective from its publication date. Databases will be retained for as long as necessary for the described purposes or as required by law.
18.2. We may update this Policy. Where changes are material, we will inform the Data Subject by reasonable means and, where the law requires, request a new authorization.
19. Supervisory authority
The competent authority for personal-data protection in Colombia is the Superintendence of Industry and Commerce (SIC).
20. Contact
FITALLY S.A.S.
Medellín, Antioquia, Colombia
Privacy email: support@fitally.mobile
Phone: +57 305 340 44 55
21. Controlling language
This Policy is published in Spanish and English. In case of discrepancy, the Spanish version prevails.