This DPIA summary describes the processing carried out by FitDesk and the safeguards we apply. Trainers using FitDesk as data controllers can rely on it as a starting point for their own DPIA where one is required (for example because they handle health-related data about their Clients on a large scale).
1. Description of processing
- Nature: SaaS platform hosting personal data on managed cloud infrastructure provided by our sub-processors (see section 5 of our Data Processing Agreement).
- Scope: account, profile, booking, payment, messaging, workout, progress and analytics data.
- Context: personal trainers and their clients, primarily in the UK and EU. FitDesk is for people aged 16 or over. Some users, trainers or clients, may be 16 or 17.
- Purposes: running an independent training business: bookings, payments, communication, training plans, progress tracking.
2. Necessity and proportionality
- Data fields are limited to what is needed to operate each feature.
- Special category (health) data is only stored where the Trainer enters it, and Trainers must have a valid legal basis, including a condition for special category data, before they do.
- Retention is limited, and account deletion is available from Settings.
3. Risks identified and mitigations
Unauthorised access to Client records
- Row Level Security limits access to Client records to the Client and their linked Trainer.
- Server functions enforce role-based authorisation in addition to RLS.
Data breach at a sub-processor
- Sub-processors are limited to established providers, as listed in section 5 of our Data Processing Agreement: Supabase, Lovable, Stripe, Cloudflare, Expo, Apple, Google, OpenAI and Google as AI model providers reached through the Lovable AI gateway, and Firecrawl.
- Data is protected by encryption in transit and at rest, provided by our hosting and storage providers.
- Our breach process aims to notify the affected controller without undue delay, and within 72 hours where feasible.
Excessive data collection
- Optional fields are clearly marked.
- Free-text fields include guidance to discourage entering more sensitive data than necessary.
International transfers
- Our main database is hosted in the EU (Sweden). Some of our providers may process data outside the UK. We are confirming the transfer safeguards each provider uses and will update this section.
- Encryption applied as a supplementary measure.
Users aged 16 and 17
- FitDesk is for people aged 16 or over. This is set through our Terms and the app store age ratings, and accounts found to belong to anyone under 16 are deleted.
- Users aged 16 or 17 get the same privacy protections as everyone else, and we never use their details for advertising.
- Trainers must not add details of anyone under 16. Where a client is 16 or 17, the Trainer decides whether that client can give their own consent to the health information the Trainer records (Data Processing Agreement, section 3).
- Stripe requires anyone taking card payments to be 18 or over and checks this when a trainer connects Stripe.
Misuse by an authorised user
- Trainers are bound by section 7 of our Terms on how they collect and use Client Health Information.
- Access to production systems is restricted to people and tools that FitDesk has authorised.
4. Residual risk
After applying the mitigations above we assess the residual risk to the rights and freedoms of data subjects as low to medium. We continue to monitor risk through ongoing security scanning, incident reviews and customer feedback.
5. Review
This DPIA is reviewed at least annually and whenever a material change is made to the Service. Questions or feedback can be sent to privacy@fitdesk.co.uk.