14109015 Canada Limited · Effective Date: March 12, 2026 · Last Updated: August 14, 2026
TotalFit Connect is a service operated by 14109015 Canada Limited (“we,” “us,” or “our”), a Canadian corporation with its principal place of business in Ontario, Canada. We are the controller or organization responsible for the personal information described in this policy. This Privacy Policy applies to our mobile app, website (totalfitconnect.com), and related services (the “Services”).
Our Privacy Officer is responsible for privacy compliance, requests, and complaints in every region where we offer the Services. Contact the Privacy Officer at privacy@totalfitconnect.com. The Services are currently offered through app stores in Australia, Canada, New Zealand, the United Kingdom, and the United States.
We collect data you give us directly, data generated by your use of the app, and limited data from third-party services you connect.
First name, last name, email address, username, and password (stored as a hashed value, never plain text). We also collect your birthdate before account creation to enforce the minimum age and age-based safety rules. Optional profile details include profile photo, bio, height, weight, fitness goals, and the energy-equation basis you choose for a calculated nutrition plan.
Training information you log, including workouts, exercises, body measurements, and performance data, as well as nutrition and body metric data you choose to track. This is your data. We consider it sensitive and treat it accordingly.
If you choose to connect Apple Health, we request permission before reading approved health data such as steps, distance, workouts, sleep, heart metrics, weight, and active energy. We use that data to power your health timeline, recovery context, and progress insights. You can disconnect Apple Health in the app, and iOS Health permissions remain controlled by you in the Apple Health app.
If you choose to connect Google Calendar, we receive your Google account identifier and email address, the calendars you select, and the calendar events needed to display and synchronize your TotalFit Connect schedule. Google refresh access is encrypted at rest. Event details are fetched only for the schedule dates you open; we store opaque synchronization identifiers and one-way change fingerprints rather than a separate copy of your Google calendar. On iPhone, Apple Calendar access is provided through the device permission you control in iOS settings.
Posts, comments, likes, follows, direct messages, shared workouts, and any other content you publish to your profile or feed.
Ideas, improvement suggestions, and bug reports you choose to submit through the app, together with limited technical context such as your platform and app version. Product feedback is sent privately to our team and is not published to the community.
Subscription status and entitlement data via RevenueCat. Billing is handled by the Apple App Store or Google Play; we never see or store your payment-card details.
When you turn on AI nutrition guidance or deliberately use an AI feature, we process the prompt, image, or voice transcript you submit, the response generated for you, and only the relevant account context needed for that feature. Depending on the feature and your choices, that context can include nutrition goals, dietary preferences, allergies or intolerances, food and workout logs, body metrics, connected-health summaries, and prior coach messages.
Device model, OS version, and platform or app-instance identifiers for internal analytics only. App usage data including screens viewed, session length, crash reports, and performance diagnostics used only to operate and improve the app through Sentry. Session replay is disabled, default identifying data is disabled, request bodies and query strings are removed, and user-authored workout names are excluded from diagnostic breadcrumbs. Push notification tokens are used only to deliver alerts you have opted into.
We do not collect precise location (GPS) data, access your contacts or address book, use Apple or Android advertising identifiers, use cross-app tracking, or use advertising or tracking cookies. Apple Health data is used only when you explicitly connect it and approve the requested categories.
We collect information directly from you; from Apple or Google when you use provider sign-in, billing, or a calendar connection; from Apple Health when you connect it and approve categories; from other members when they interact with you; and automatically from your device when the app sends security, crash, performance, or push-delivery information. We do not buy personal information from data brokers.
An eligible birthdate, account name, email address or supported provider identity, and authentication credentials are required to create and protect an account. If you do not provide them, we cannot create the account. Fitness, nutrition, body, connected health, calendar, Community, media, voice, and AI information is optional. Declining optional information disables only the related feature. No law requires you to provide personal information to us.
The website uses strictly necessary authentication cookies and local or session storage for sign-in, security, preferences, and unfinished workout recovery. We do not use advertising cookies or cross-site tracking technologies. Because these storage technologies are necessary to provide a requested service, they cannot be disabled within TotalFit Connect; you can clear them in your browser, which may sign you out or remove local preferences.
We use your data to run the app, improve it, and keep it safe. We do not use your health or fitness data for advertising, and we do not build advertising profiles. Specifically, we use your data to:
For processing covered by the UK GDPR and Data Protection Act 2018, we rely on the following legal bases. These bases do not reduce rights available under the privacy laws of another region.
| Purpose | UK GDPR basis |
|---|---|
| Create and secure your account; provide workouts, nutrition, Community, calendar, support, and subscription features you request | Performance of our contract with you |
| Process health, body, nutrition, recovery, and related sensitive information for optional personalized features | Your explicit consent under Article 9; you can withdraw it for future processing by disconnecting the source, disabling the feature, deleting the data, or contacting us |
| Prevent fraud and abuse, moderate Community content, protect accounts, diagnose failures, and improve service reliability | Our legitimate interests in operating a safe, reliable service, balanced against your rights and expectations |
| Keep records or disclose information when applicable law requires it | Legal obligation |
We do not use solely automated processing to make decisions that produce legal or similarly significant effects. Recommendations, scores, and suggested targets are advisory and remain subject to your review.
AI nutrition personalization is opt-in. When it is on, relevant nutrition goals, preferences, recent logs, body metrics, and health context may be included in an AI Coach request so the response can be tailored to you. Turning it off in Nutrition Plan → AI & Review stops that nutrition context from being included in future Coach requests. One-off tools such as meal-photo analysis, label scanning, voice logging, or cardio-machine parsing send data only when you start that tool.
AI responses are suggestions and can be inaccurate. They do not silently change an active calorie or macro target: you must review and confirm any proposed goal change. Do not rely on an AI response for diagnosis, treatment, allergy safety, or other medical decisions.
The following vendors may process data on our behalf for the stated purpose. A vendor receives only the categories needed for the feature or infrastructure service it provides.
| Vendor | Purpose | Country | Privacy Policy |
|---|---|---|---|
| RevenueCat | Subscription management | United States | View ↑ |
| Expo / EAS | Push notifications | United States | View ↑ |
| Amazon Web Services | File storage, email delivery, and user-submitted Community text/image moderation through Comprehend and Rekognition | United States | View ↑ |
| Neon | Managed PostgreSQL database hosting | United States | View ↑ |
| Open Food Facts | Food and barcode catalog lookups without TotalFit Connect account identity | France | View ↑ |
| Anthropic | Optional AI coaching, nutrition analysis & user-initiated AI tools | United States | View ↑ |
| Vercel | Hosting & edge functions | United States | View ↑ |
| Sentry | Crash reporting and performance diagnostics; session replay is disabled | United States | View ↑ |
| Apple | Authentication & billing | United States | View ↑ |
| Authentication, Google Calendar connection, Android app distribution & billing | United States | View ↑ |
For commercial API requests, Anthropic states that it acts as a processor, does not use inputs or outputs to train its generative models by default, and normally deletes API inputs and outputs within 30 days, subject to its documented legal, safety, and separately agreed exceptions. Review Anthropic’s linked Privacy Center for current details.
TotalFit Connect’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google Calendar data is used only to provide the calendar features you enable and is not used for advertising or to train generalized AI models.
Workout, body measurement, and nutrition data is sensitive personal information. We treat it with heightened care and do not share it with insurers, employers, or advertisers.
At your request, the app may calculate or suggest fitness and nutrition targets from information you provide. These recommendations are advisory, are shown for your review, and do not become active without your confirmation. We do not use solely automated processing to make legal or similarly significant decisions about you.
For UK users, our Article 9 condition for optional health and fitness data is explicit consent. For Australian users, we seek consent before collecting sensitive health information where the Privacy Act requires it. You can withdraw consent for future processing by disconnecting a health source, disabling the relevant optional feature, deleting the data, or deleting your account. Withdrawal does not affect lawful processing that occurred before withdrawal.
United States residents should also read our separate Consumer Health Data Privacy Policy, which describes consumer health data categories, sources, disclosures, and request rights.
Profile fields such as height, weight, and energy-equation basis are optional for the core app, but a complete profile and your explicit review are required before the app can activate a calculated nutrition target.
TotalFit Connect is not a medical service. Nothing in the app constitutes medical advice. Always consult a qualified professional before starting a new exercise or nutrition program.
TotalFit Connect requests only the permissions it needs. All optional permissions can be denied without losing core functionality.
We keep account information while your account is active. Workout, nutrition, health, calendar-binding, and Community data remains until you delete it, disconnect the relevant source with deletion selected, or delete your account. Active-session IP addresses and user-agent diagnostics are pruned after 30 days. Support, safety, fraud-prevention, and legal records are kept only for as long as needed to resolve the matter, enforce our rights, or meet a legal obligation. We determine those periods by the sensitivity of the information, the reason it was collected, applicable limitation periods, and legal or security needs.
You can delete your account at any time from Settings → Account → Delete Account. We require a recent sign-in before accepting that irreversible request. The active account database is deleted or anonymized as part of the request, active sessions and push registrations are removed, connected Google Calendar access is revoked, and owned media is placed in a durable deletion queue with retries. An Apple App Store or Google Play subscription is managed by that store and is not cancelled by deleting your TotalFit Connect account. Processor systems, security records, and backups may retain limited data for their documented contractual, recovery, fraud-prevention, or legal periods. Comments or references that must remain for other members’ conversation integrity are de-identified. Anonymous aggregate metrics may be retained.
To request deletion by email, contact privacy@totalfitconnect.com from your registered address. We respond within the period required by applicable law, normally within 30 days, and may ask you to verify your identity.
We use industry-standard security measures including TLS encryption in transit, bcrypt password hashing, network-level access controls, and limited production data access. We perform regular security reviews. We will never ask for your password via support email or in-app message. To report a vulnerability, email security@totalfitconnect.com.
No system is 100% secure. If a breach occurs that affects your rights, we will notify you as required by law.
Depending on where you live, you may have rights to know what we hold, access, correct, delete, or export your data; withdraw consent; restrict or object to certain processing; and complain to a privacy regulator. We will not discriminate against you for exercising a privacy right. To exercise any right, use the controls in the app or email privacy@totalfitconnect.com from your registered address. We may verify your identity and authority before acting. We respond within the period required by applicable law, normally within 30 days. If we deny a request, we will explain why and identify any available appeal or complaint path.
Canadian users may request access, correction, information about our use and disclosure, or challenge our compliance. Quebec users may also request portability of eligible computerized information and receive required information about exclusively automated decisions. The Privacy Officer handles complaints and escalates unresolved matters. You may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca. Quebec residents may also contact the Commission d'accès à l'information at www.cai.gouv.qc.ca.
UK users may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time for future processing. The legal bases and relevant legitimate interests are described in Section 3. You may lodge a complaint with the Information Commissioner's Office at ico.org.uk.
Your right to object: If we rely on legitimate interests, you may object to that processing by emailing the Privacy Officer. We will stop unless we demonstrate compelling legitimate grounds that override your rights or the processing is needed for legal claims.
We do not sell or share personal information for cross-context behavioral advertising. Where a state privacy law applies, you may have rights to know, access, correct, delete, or obtain a copy of personal information, opt out of covered sales or targeted advertising, limit certain uses of sensitive information, and appeal a denied request. An authorized agent may submit a request where state law permits it. Read the separate Consumer Health Data Privacy Policy for additional health-data rights.
Australian users may request access to or correction of personal information and complain to our Privacy Officer. We aim to acknowledge a complaint promptly and provide a substantive response within 30 days. If you are not satisfied, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au.
New Zealand users may request access to and correction of personal information and complain to our Privacy Officer. If the matter remains unresolved, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.
TotalFit Connect is for people age 16 and older. We request a birthdate before account creation, and an ineligible attempt does not create a TotalFit Connect account or authenticated session. We do not knowingly collect personal information through an account from anyone under 16. If you believe a child has created an account, contact privacy@totalfitconnect.com and we will delete it promptly.
TotalFit Connect is based in Canada. Personal information may be processed in Canada, the United States, and France by the providers listed in Section 5, and may be accessible to courts, law enforcement, or regulators under the laws of those places. For UK transfers, we rely on applicable UK adequacy regulations where available and appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum, where they are required. For Australian, New Zealand, and Quebec information, we use contractual, due-diligence, and accountability measures appropriate to the applicable cross-border rules.
The app is not currently offered through EEA app stores and we do not intentionally target people in the EEA. UK availability alone does not make the EU GDPR applicable. If we later offer or monitor Services in the EEA in a way that brings processing within EU GDPR Article 3, we will update this policy and complete the required EU compliance steps before launch.
We may update this policy from time to time. For material changes, we will notify you by in-app notification or email at least 14 days before the change takes effect. We will ask for new consent before using sensitive information for a materially new purpose where applicable law requires it.
Questions, complaints, and privacy requests can be sent to our Privacy Officer at privacy@totalfitconnect.com or security@totalfitconnect.com.
Privacy Officer14109015 Canada Limited · Ontario, Canada · © 2026 All rights reserved.