Privacy Policy

1. Who we are

EvoFitness is a platform that fitness and nutrition professionals use to support their clients — workouts, meal plans, physical progress, scheduling and billing.

The service is operated by André Roberto Salvador, an individual, in Pederneiras/SP, Brazil.

Data protection officer: André Roberto Salvador — salvador.andre@outlook.com.br.

This policy explains which personal data we process, why, and what you can do about it. Questions and requests: contato@evofitness.com.br.

2. Data we collect

Account and identification: name, email address, national identification number (CPF), phone number and profile picture.

Health and fitness data, when you or your professional record it: date of birth, sex, height, weight, goal, body measurements, skinfold measurements and progress photos.

App usage: workouts performed (sets, loads, repetitions), meals logged, appointments and last access date.

Support: the content of the messages you send through "Report a problem".

Billing (subscribing professionals only): subscription identifiers held by the payment processor. We do not store card numbers.

Minimal technical data for each request: a request identifier, the route accessed and your account identifier, recorded for diagnostics and security. Your IP address is used at request time to limit abusive attempts, but is not stored alongside those records.

3. Why we process this data

To perform the agreement: without workout, nutrition and measurement data there is no service to provide.

To authenticate you and protect your account (email verification, password recovery, attempt limiting).

To comply with legal and tax obligations, in the case of billing records.

Health and fitness data — measurements, skinfolds, body composition and progress photos — is processed for a single purpose: to let the professional supporting you assess your progress and adjust the prescription. It is provided by you or recorded by the professional during an assessment, is not used for any other purpose, and is not transferred to third parties.

4. Who we share it with

With the professional who supports you: they prescribe and assess, and they see only their own clients — never clients of other professionals.

With processors that carry out part of the service on our behalf: Amazon Web Services (hosting and database), Cloudinary (image storage), Resend (transactional email) and Stripe (payment processing for professional subscriptions).

When error monitoring is enabled, application failure messages — carrying the request identifier and the account identifier, never your health data — may be sent to Sentry, a diagnostics service. The Android app sends no such reports.

We do not sell, rent or transfer your data for advertising. The app contains no third-party trackers.

5. Where your data is kept

Our servers and database are located in the São Paulo region, in Brazil.

Some of the services we use operate outside the country: images uploaded through the app — profile picture and progress photos — are stored by Cloudinary, and transactional emails are processed by Resend; both keep that data in the United States.

This means part of your data is transferred internationally. If you want to know exactly which, write to the contact address in this policy.

6. Security

All traffic between the app and our servers uses HTTPS. Passwords are stored only as a hash (bcrypt) — not even we can read them.

In the app, the session token is kept in the operating system secure storage (Keychain on iOS, Keystore on Android), and you may require biometrics or a PIN to open the app. The PIN never leaves the device.

Progress photos have no permanent public address: each view uses a temporary link, generated only for someone allowed to see that photo.

7. How long we keep it

For as long as your account exists, and afterwards as described below. Three situations differ, and the difference matters.

Client account deactivated by the professional: access is blocked, but the history of workouts, assessments, measurements and photos is preserved — this is what allows the follow-up to resume later, with the same professional, without losing the recorded progress.

Account deletion at your request: your identifying data — name, email, national identification number, phone number, date of birth and notes — is replaced by meaningless values at that very moment, irreversibly, and your session is terminated on every device.

In the same operation, your profile picture and ALL your progress photos are deleted: both the file and the reference to it.

What remains: the history of performed workouts, meals, body measurements and assessments. Those records no longer carry the data that identifies you directly, but they remain linked to an internal identifier of your file — that is, they are pseudonymised, not anonymised. In practice, the professional who supported you can still relate them to the service they provided.

Definitive erasure of those records: we have no automatic deadline, and we will not invent one. It happens once retention is no longer necessary, taking legal and tax obligations into account, and may be brought forward at your request — write to the contact address in this policy.

Records required by legal or tax obligation may be kept for the period the law determines.

8. Your rights

The LGPD guarantees that you may confirm processing, access your data, correct it, request portability, withdraw consent and request erasure.

Access and correction are available in the app itself, under Settings. Account deletion as well: Settings → Account → "Delete my account".

You do not need to open the app to request deletion: the page evofitness.com.br/legal/en/account-deletion explains how to request it by email, and applies whether or not you still have access to the app.

To request definitive erasure of the records that remain after deletion, write to contato@evofitness.com.br — we honour the request for everything not subject to a legal retention duty.

For the remaining rights, write to contato@evofitness.com.br. We respond within 15 days.

9. Minors

EvoFitness is not intended for anyone under 18. The client account is created by the fitness or nutrition professional who follows them, and it is that professional’s responsibility to register only clients of legal age.

10. Changes to this policy

If we change this policy in a relevant way, we will notify you in the app before the change takes effect. The date at the top indicates the latest revision.

11. Language and applicable law

This is a translation provided for convenience. The service is operated under Brazilian law, and the Portuguese version of this policy prevails in case of divergence.