Privacy Policy
Effective 17 October 2026 · Acecode Technologies Limited · Terms of Service
1. Who we are and what this policy covers
Fitlify is gym management software. Gyms and studios use it to run memberships, check-in, classes, personal training and billing. Their members use the Fitlify app and web portal to check in, book and see their plan.
Fitlify is a product of Acecode Technologies Limited, a company registered in Nigeria (RC 7240384), of 10 Joy Akpugo Close, Isheri Magodo, Lagos ("Fitlify", "we", "us"). This policy explains how we handle personal data in the Fitlify mobile app, the member web portal, the gym dashboard, the kiosk app and fitlify.co. It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the NDPC's General Application and Implementation Directive.
Your gym and Fitlify have different roles
- Your gym decides what it records about you. Your membership, attendance, invoices, health questionnaire and signed waivers are your gym's records. Your gym is the data controller for them. We store and process them for the gym, under a written data processing agreement, and only on its instructions.
- We are responsible for your Fitlify account itself. That means your sign-in details, the list of gyms you belong to, your devices and our security logs. For these, Fitlify is the data controller.
- We are also the controller for information about the gym owners and staff who use the dashboard, and for anything you send us through fitlify.co.
If you belong to more than one gym, each gym sees only its own records about you. Questions about what a gym holds can go to the gym or to us; we will help either way.
2. Information we collect
We collect what a gym needs to run your membership, and what we need to run your account safely. Some comes from you, some from your gym's staff, and some is created as you use the app.
Members (app and portal)
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, phone number, date of birth, gender, home address, password (stored only as a secure hash), profile photo | You, or your gym when it registers you |
| Membership records | Membership number, your member QR code, plan, start and end dates, freezes, sessions left, member credits, home branch | Your gym and you |
| Check-in and attendance | Date and time, branch, how you checked in (staff scanning your member QR code at the desk or kiosk, or a check-in code). The app never accesses your phone's location. | Created when you check in |
| Bookings and training | Classes booked, waitlists, personal training sessions and how many are left | You and your gym |
| Health questionnaire | Answers to the health and fitness questions your gym asks before you train, such as medical conditions, injuries or medication | You |
| Emergency contacts | Name, relationship and phone number of the person to call | You |
| Documents and photos | ID or other documents you upload, your profile photo | You, using your camera or photo library |
| Signatures | Your signature on waivers and agreements, with the date and time you signed | You |
| Payments | Invoices, receipts, amounts paid and owed, payment method type and status. If you pay online, Paystack collects your card or bank details; we receive a payment reference and status, never your full card number | You, your gym and Paystack |
| Messages | Receipts, booking confirmations and renewal reminders sent to you by email or SMS, and by push notification if you allow notifications, and a log of what was sent | Created by the service |
| Device and security | Device model, operating system, app version, IP address, sign-in times and security events; if you allow notifications, a push-notification token | Your device |
| Support | What you tell us when you contact us | You |
Your health answers are sensitive personal data under the NDPA. We collect them only because your gym asks for them, and we treat them with extra care (see sections 3 and 9).
Gym owners and staff (dashboard and kiosk)
Name, email address, phone number, role, branch, and a log of actions taken in the dashboard (for example, who issued a refund). For the gym's own subscription: business name, address, billing contact and subscription payments.
Visitors to fitlify.co
What you type into our demo, waitlist or contact forms: usually your name, gym name, email, phone or WhatsApp number, member count and message. Cookies are covered in section 9.
What we don't collect
The app has no advertising, and it does not track you across other companies' apps or websites. We do not collect advertising identifiers, and the app never accesses your location. It uses your camera only when you take a photo or scan a gym's QR code, and your photo library only when you choose a picture or document. We do not sell personal data.
3. How we use it, and our lawful basis
We use personal data only to run Fitlify for you and your gym, keep it secure and meet the law. The NDPA requires a lawful basis for each use; ours are below.
| What we use it for | Lawful basis |
|---|---|
| Creating and running your account, signing you in, linking you to your gym | Contract with you |
| Keeping your gym's records: memberships, check-in, bookings, training, invoices and receipts | Your gym's instructions (we act as its processor); the gym relies on its contract with you |
| Checking each check-in against your plan, so access matches what you've paid for | Contract; your gym's instructions |
| Holding your health questionnaire so your gym can train you safely | Your explicit consent, given when you fill it in |
| Taking online payments through Paystack and issuing receipts | Contract |
| Sending service messages: receipts, booking confirmations, renewal reminders | Contract; legitimate interest in your membership not lapsing by surprise |
| Security: preventing fraud, misuse and double charges, and investigating problems | Legitimate interest |
| Answering support requests | Contract; legitimate interest |
| Keeping invoices and payment records for tax and accounting | Legal obligation |
| Improving Fitlify using usage figures that don't identify you | Legitimate interest |
| Replying to demo, waitlist and contact requests from fitlify.co, and sending product news to gyms | Consent, which you can withdraw at any time |
We do not use your health answers for anything except your gym's safety screening. We do not use them for marketing, and we do not share them with anyone other than your gym.
Automated decisions. Fitlify checks your plan automatically when you check in, using rules your gym sets (for example, an expired plan is turned away at the door). Gym staff can always review and override this. We make no other automated decisions about you.
4. Who we share it with
We share personal data only with your gym, the service providers that run Fitlify, and authorities where the law requires it. We never sell it or share it for advertising.
Your gym. Your gym's staff see your records according to the role the gym gives them. A trainer, for example, cannot see billing. Each gym's data is kept in its own separate database, so one gym never sees another gym's records about you.
Service providers. These companies process data for us under contracts that limit them to providing their service:
| Provider | What they do for Fitlify | Data involved |
|---|---|---|
| DigitalOcean | Hosts our servers and databases | All data held in Fitlify |
| Cloudinary | Stores photos, documents and signature images | Profile photos, uploaded documents, signatures |
| Resend | Sends email | Name, email address, message content |
| Termii | Sends SMS | Phone number, message content |
| Paystack | Processes online payments into your gym's own Paystack account | Name, email, amount; your card or bank details go to Paystack directly |
| Apple and Google | Distribute the app and, if you allow notifications, deliver push notifications | Push token and notification content, only if you allow notifications |
| Vercel | Hosts the kiosk web app | Technical data such as IP address |
| Google Workspace | Delivers the demo, waitlist and contact forms from fitlify.co to our inbox, and hosts our email | What you type into a form; emails you send us |
Paystack also processes your payment details as an independent company under its own privacy policy, and settles the money to your gym's bank account.
Legal and safety. We may disclose data where the law, a court or a regulator requires it, or to protect someone's safety.
Business changes. If Fitlify is reorganised, merged or sold, for example moved into a new Fitlify company, your data moves with the service under this policy. We will tell you before it becomes subject to a different policy.
5. Data stored outside Nigeria
Some of our providers store or process data outside Nigeria, including in the United States and Europe, where most of them are based. Our main database is hosted by DigitalOcean in Frankfurt, Germany.
We transfer data abroad only as the NDPA allows: to countries the NDPC recognises as giving adequate protection, under contracts with protections such as standard contractual clauses, or where another basis in the NDPA applies. You can ask us for details of the safeguards for any provider.
6. How long we keep it
We keep personal data only as long as we need it for the purposes in section 3, or as long as the law requires.
| Data | How long |
|---|---|
| Account details, profile photo | While your account is open. Deleted or anonymised straight away when you delete your account |
| Health answers, emergency contacts, uploaded documents | While you are a member, or until you or your gym removes them. Deleted straight away, including the stored files, when you delete your account |
| Attendance and booking history | While your account is open. Kept afterwards only in anonymised form, so it no longer identifies you |
| Invoices, payments and receipts | As long as Nigerian tax and company law requires your gym to keep financial records, generally at least six years. Kept after account deletion |
| Signed waivers and agreements | Kept by your gym as a record of what was agreed, for as long as the gym may need it as evidence, generally at least six years. Kept after account deletion |
| Security and sign-in logs | 90 days |
| Backups | Deleted data can remain in encrypted backups for up to 30 days until they are overwritten |
| Gym and staff data | While the gym uses Fitlify. When a gym leaves, it has 30 days to export its data, which we then delete |
| Website form submissions | 24 months, or sooner if you ask |
7. Deleting your account
You can delete your Fitlify account at any time, from the app or without it. Deletion is immediate and covers every gym you belong to.
How to delete
- In the app: go to Account → Security → Delete account, re-enter your password and confirm.
- Without the app: use the form at fitlify.co/delete-account, or email privacy@fitlify.co from the email address on your account. We confirm by email once it is done, within 7 days.
Uninstalling the app does not delete your account.
What happens straight away
- Your account is closed at every gym you belong to.
- Your bookings, personal training sessions, memberships and packages are cancelled.
- Your health answers, emergency contacts, profile photo and uploaded documents are permanently deleted, including the stored files.
- Your profile is anonymised, and you are signed out on every device.
What is kept
Invoices, payments, receipts and signed agreements are kept, because gyms must keep them for tax, accounting and legal reasons. They are held for the periods in section 6 and then deleted.
Before you delete
Deletion cannot be undone. Cancelling a membership this way does not by itself give you a refund: refunds are between you and your gym. If you want to leave one gym but keep using Fitlify with another, ask that gym to end your membership instead.
8. Your rights
Under the NDPA you can ask us, free of charge, to:
- Tell you what personal data we hold about you and how we use it.
- Give you a copy of it, in a commonly used format you can take elsewhere.
- Correct anything that is wrong or incomplete. You can update most details yourself in the app.
- Delete it (see section 7), unless we must keep it by law.
- Restrict how we use it while a concern is looked into.
- Object to uses based on our legitimate interests, and to marketing at any time.
- Withdraw consent, for example to your health questionnaire. This won't affect what happened before, but your gym may then be unable to let you take part in some training.
- Not be subject to decisions made only by automated means that significantly affect you.
To use any of these rights, email privacy@fitlify.co. We may ask you to confirm your identity first. We reply within 30 days. If your request is about records your gym holds, we will pass it to the gym and help it respond.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
9. Security, children, cookies and changes
How we protect your data
- Data is encrypted in transit between your device and our servers.
- Passwords are stored only as secure hashes; we can't see them.
- Each gym's data sits in its own separate database.
- Gym staff see only what their role allows, and an activity log records who changed what.
- Card and bank details are handled by Paystack and never stored by Fitlify.
- Access to production systems is limited to the people who need it.
If a breach puts your data at risk, we will notify the NDPC within 72 hours of becoming aware of it, tell your gym without delay, and tell you directly where the risk to you is high.
Children
You must be 18 or older to create your own Fitlify account. A gym may register a member under 18 only with a parent's or guardian's consent, and the parent or guardian can exercise that member's rights. If you think a child has created an account, contact us and we will delete it.
Cookies
The Fitlify app does not use cookies for advertising or tracking. fitlify.co uses only the cookies needed for the site to work, and no analytics or advertising cookies. If we add analytics, we will use them only with your consent, which you can change at any time.
Changes to this policy
We will post any update here and change the effective date. If a change matters to how your data is used, we will tell you in the app or by email before it takes effect.
Contact us
- Privacy questions and requests: privacy@fitlify.co
- General support: support@fitlify.co or fitlify.co/contact
- Post: Acecode Technologies Limited (RC 7240384), 10 Joy Akpugo Close, Isheri Magodo, Lagos, Nigeria
- We have not appointed a Data Protection Officer. privacy@fitlify.co reaches the person responsible for data protection at Fitlify.