Privacy Policy

Version 1.4 · Effective from 8 July 2026

FitQ Studio OÜ and Geneto OÜ (together, "we") respect your privacy and are committed to protecting your personal data. This Privacy Policy describes how we collect, use, retain and protect your data when you use our services, including:

the FitQ web application (fitq.me), FitQ mobile applications (iOS and Android) and FitQ TV applications (Apple TV, Android TV, Samsung Smart TV)
the Geneto Lifestyle web application (geneto.com) and mobile applications (iOS and Android)
the Gymwolf web application (gymwolf.com) and mobile applications
the SparQ web and mobile applications

1. Data Controllers

The joint controllers of your personal data are:

FitQ Studio OÜ

Registry code: 16016552
VAT number: EE102393398
Address: Metsa tn 10, 61503 Elva, Tartumaa, Estonia
E-mail: privacy@fitq.ee

Geneto OÜ

Registry code: 14091673
Address: Narva mnt 9, 51009 Tartu, Tartumaa, Estonia
E-mail: info@geneto.com

For privacy matters, the primary contact point is privacy@fitq.ee; for questions concerning the Geneto services you may also contact info@geneto.com. You may exercise your rights through either controller.

2. Data We Collect

2.1 Account Data

Name and e-mail address
Phone number (optional)
Profile picture (optional)
Date of birth and gender (for personalising the service)

2.2 Health and Training Data

Height, weight and body mass index
Workout history, goals and progress
Video and training programme viewing history (including in the FitQ TV apps)
Nutrition diary: meals, foods and recipes, quantities and nutrition goals (primarily Geneto Lifestyle)
Health condition data (only with your explicit consent)

2.3 Genetic Data (Geneto)

We collect genetic data only if you have opted in to the relevant functionality, i.e. ordered a genetic test. The test is carried out together with our genetic testing partner laboratory, which receives only your sample and the code generated for it — the laboratory does not receive your name or any other identifying data. We have concluded a contract with the laboratory ensuring that the data is used solely for providing our service.

We process genetic data on the basis of your explicit consent (GDPR Art. 9(2)(a)). If you withdraw your consent, we will delete your genetic data and no further recommendations or risk scores based on genetic information will be calculated; you may continue to use the other parts of the service. We will ask for your separate consent before using your genetic information for research and development or for personalised offers.

2.4 Family Member Data (Geneto)

If you enter data about your family members into the service (e.g. physical characteristics for nutrition recommendations), you are responsible for having the right to provide that data. We process family member data only for providing the service.

2.5 Payment Data

Subscription and payment history
We do not store your payment card details ourselves – they are processed by our payment providers (e.g. Stripe)

2.6 Technical Data

IP address and device information
Browser type and version
Login time
App usage statistics

3. Health Platform Integrations (Health Connect, Apple Health, Google Fit)

If you connect our app to your device's health platform — Android Health Connect, Apple Health (HealthKit) or Google Fit — or to an external service (e.g. Strava, Gymwolf), we read the following data with your permission:

steps and physical activity
workouts (type, duration, time)
energy burned (calories)
weight

We read only the data types listed above — no more than is necessary to fill your diary and calculate your energy needs (the principle of data minimisation / minimum scope). On Android, the app may read Health Connect data in the background, even when the app is not open, so that your diary stays automatically in sync.

We use this data solely to display and record your workouts, activity and weight in your own diary and to calculate your energy needs. Data read from health platforms:

is not used for advertising or marketing;
is not sold or shared with third parties;
is processed only on the basis of your consent, which you give through your device's health platform permissions.

You can withdraw the permission at any time in your device settings (e.g. Health Connect or Apple Health permission management) — in that case no new data will be read. Data read from health platforms is deleted together with your account.

4. Purposes and Legal Bases of Processing

We process your data for the following purposes and on the following legal bases:

Providing the service and managing your account – performance of a contract (GDPR Art. 6(1)(b))
Creating personalised training and nutrition plans and tracking progress – performance of a contract and your consent
Processing health data (incl. weight, health condition, data read from health platforms) – your explicit consent (GDPR Art. 9(2)(a)), which you may withdraw at any time
Processing genetic data for the genetic test and personalised feedback – your explicit consent (GDPR Art. 9(2)(a)), which you may withdraw at any time
Processing payments and accounting – performance of a contract and legal obligation (GDPR Art. 6(1)(c))
Improving the service, fixing errors and statistics – our legitimate interest (GDPR Art. 6(1)(f))
Newsletters and marketing messages – your consent (GDPR Art. 6(1)(a)), which you may withdraw at any time

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy or to comply with legal obligations:

Account data, diaries and workout/viewing history – until you delete your account. Upon account deletion, we delete or anonymise your personal data within 30 days.
Health and body data – until account deletion or withdrawal of consent, whichever comes first.
Genetic data – until account deletion or withdrawal of consent, whichever comes first.
Payment and billing data – 7 years from the transaction (requirement of the Estonian Accounting Act).
Technical logs (IP address, device information) – up to 12 months.
Customer support correspondence – up to 3 years.
Newsletter subscription – until you withdraw your consent.

After the retention period expires, the data is irreversibly deleted or anonymised.

6. Processors and Third Parties

To provide the service, we use the following carefully selected service providers who process data on our behalf and under our instructions:

Google Cloud – server hosting (data centre in the European Union, Finland)
Stripe Payments Europe Ltd – payment processing
Google Firebase – authentication, push notifications and app crash reporting (Crashlytics)
Twilio SendGrid – sending e-mails
Google Analytics and Google Tag Manager – usage statistics (with your consent)
Meta (Facebook) Pixel – marketing analytics (with your consent)
Plausible Analytics – privacy-friendly visitor statistics
Genetic testing partner laboratory – analysis of the genetic test (receives only a pseudonymised sample and code, not your name or contact details)

We do not sell or rent your personal data to third parties. We disclose data to public authorities only where required by law.

7. Data Transfers Outside the European Union

We store your data primarily in data centres located in the European Union. Some of our service providers (e.g. Stripe, Google, Meta, Twilio) may also process data in the United States. In such cases we rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on Standard Contractual Clauses approved by the European Commission.

8. Your Rights

Under the GDPR, you have the following rights:

Right of access to your data
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability
Right to object
Right to withdraw consent at any time

To exercise your rights, contact us at privacy@fitq.ee (or info@geneto.com). We will respond to your request within 30 days at the latest.

9. Account and Data Deletion

You can delete your account and the personal data associated with it:

in the app or on the web: Settings → Delete account, or
by sending a request to privacy@fitq.ee.

We will delete or anonymise your personal data within 30 days. After deletion, we retain only the data we are required to keep by law (e.g. accounting records).

10. Cookies and Similar Technologies

We use cookies and similar technologies:

Necessary cookies – for login and session functionality; the service does not work without them
Analytics and marketing cookies – only with your consent

You can manage your cookie preferences in your browser settings. Declining analytics and marketing cookies does not limit the use of the core features of the service.

11. Security Measures

We apply appropriate technical and organisational measures to protect your data:

Encrypted data transmission (TLS)
Access restrictions and role-based access to data
Data storage in secure data centres located in the European Union
Pseudonymisation of genetic samples (the laboratory sees only a code)
Regular review of security measures

12. Children's Data

Our services are not directed at children under the age of 16. A person under 16 may use the service only with the consent of a parent or guardian. If we become aware that we have collected data of a child under 16 without parental consent, we will delete it without delay.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes in the app or by e-mail before the changes take effect. Each version is marked with a version number and effective date.

14. Supervisory Authority

If you are not satisfied with how we process your data, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate:

Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)

E-mail: info@aki.ee
Website: www.aki.ee

If you have any questions, contact us at privacy@fitq.ee or info@geneto.com

This is a translation. In the event of a dispute, the Estonian-language version of this Privacy Policy prevails.