Privacy Policy

1. Who is responsible for your data

The controller of the data processed in EvoluaFit is NAMIX LTDA - ME, CNPJ 44.990.589/0001-98, based in Brazil.

For any privacy matter — access, correction, portability, deletion or withdrawal of consent — the channel is privacy@evoluafit.site. We reply within 15 days, extendable when a request requires additional identity verification.

2. Data we collect

We collect only what the app needs to work and what you need to follow your progress.

We do not collect credit card data, bank details, your address book, your precise location or your browsing history outside our services. Payments happen entirely inside Apple or Google.

3. Why we may process this data

Every processing activity has a declared legal basis, under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018) and, for data subjects in the European Economic Area and the United Kingdom, under the GDPR.

• Performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)): creating and maintaining your account, saving and syncing your assessments, delivering the features of your plan.
• Consent (LGPD art. 7, I and art. 11, I; GDPR art. 6(1)(a) and art. 9(2)(a)): processing your health data — body measurements, photos, treatment records — and sending your data for artificial intelligence analysis. This consent is specific, informed and revocable at any time, without affecting processing already carried out.
• Legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)): security, fraud and abuse prevention, aggregate usage metrics to improve the product. We balance that interest against your rights and you can object through the privacy channel.
• Legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c)): retaining records required by law, including those under the Brazilian Internet Civil Framework and tax legislation.

If you do not consent to the processing of health data, the app remains usable for features that do not depend on it, but the core body assessment becomes unavailable — that is the very object of the service.

4. How we use the data

• To show your timeline, comparisons, charts and body composition.
• To generate analyses, summaries and projections with artificial intelligence, when you ask for them.
• To produce PDF reports that you choose to share.
• To share your progress with the personal trainer you linked, while the link exists.
• To send operational notifications and the assessment reminders you configured.
• To provide support, investigate errors and keep accounts secure.
• To understand in aggregate which features are used, so we know what to improve.

We do not use your data for automated decisions with legal effect on you, we do not profile you for advertising and we do not train artificial intelligence models on your content.

5. Artificial intelligence

AI features are optional and only run when you trigger them. When you use them:

• We send our inference providers only what is needed to answer — for example, the relevant slice of your measurement history or the image you chose to analyse.
• We contractually require providers not to use that content to train models and to retain it only for the technical duration of the processing.
• Postural analysis is different: body point detection runs on your device, using the operating system's own vision engine, without sending the image to any server.

AI output is an estimate and educational support. It can be wrong. It is not a diagnosis or a prescription.

6. Who we share with

We do not sell your personal data and we do not hand it to data brokers, ad networks or third parties for marketing purposes. We share only with those who operate the service infrastructure, acting as processors under our instructions:

We may also disclose data when there is a valid court order or legal request, or to protect the rights, safety and integrity of our users and the service. In a corporate reorganisation, data may be transferred to the successor, keeping the commitments in this policy and with prior notice to you.

On top of that, a personal trainer only sees your data if you accepted the link. You can undo that link whenever you want, and access stops immediately.

7. International transfers

Our infrastructure is global, so your data may be processed outside your country. When that happens, the transfer relies on standard contractual clauses, the applicable adequacy decisions and our providers' security commitments, as set out in articles 33 and following of the LGPD and chapter V of the GDPR.

8. How long we keep it

• Account data and assessments: as long as the account exists. You decide when that ends.
• After account deletion: immediate removal from production systems; copies in security backups disappear during rotation cycles, within 90 days.
• Application access logs: 6 months, under article 15 of the Brazilian Internet Civil Framework.
• Tax and transaction records: for the period required by tax law, in a separate base and without your body data.
• Support messages: up to 24 months, for service history.

Full details are in the Data Deletion Policy.

9. Security

We apply technical and administrative measures proportionate to the sensitivity of the data: TLS-encrypted traffic, encryption at rest at our storage providers, access rules that stop one user from reading another's data, authentication delegated to Firebase Authentication (we never store your password), least-privilege access for the team and logging of administrative access.

No system is infallible. If a security incident occurs with material risk to your rights, we will notify you and the Brazilian National Data Protection Authority within the legal deadlines.

10. Your rights

At any time you may:

• Confirm that processing exists and access your data.
• Correct incomplete, inaccurate or outdated data — most of it directly in the app.
• Request anonymisation, blocking or erasure of unnecessary data or data processed unlawfully.
• Port your data to another provider, in a structured, machine-readable format.
• Withdraw consent and ask for the deletion of data processed on that basis.
• Object to processing based on legitimate interest.
• Be informed about who we share your data with.
• Complain to the ANPD in Brazil, or to the data protection authority in your country.

To exercise any of them, write to privacy@evoluafit.site from your registered email. To erase everything right now, without waiting for support, use the Delete my account page.

11. Children and teenagers

EvoluaFit is not intended for children under 13 and we do not knowingly collect their data. Between 13 and 18, use depends on the consent and supervision of a parent or legal guardian, and the account must be created by them. If we identify an account belonging to someone under 13, it is deleted. Guardians who suspect misuse can write to privacy@evoluafit.site and we will erase the data.

12. Cookies and technologies on this site

This site is static and uses no advertising or cross-site tracking cookies. We use only strictly necessary storage: your language preference and, on the sign-in and account deletion pages, the authentication session state kept by Firebase. Details are in the Advertising and Cookie Policy.

13. Changes to this policy

We may update this policy to reflect changes in the product or in the law. The last updated date is always at the top of this page. If a change is material — a new purpose, a new data category, a new sub-processor with material impact — we will tell you in the app or by email before it takes effect. Continuing to use the service afterwards means accepting the version in force.

14. Contact

Privacy and data: privacy@evoluafit.site
General support: suport@evoluafit.site

NAMIX LTDA - ME — CNPJ 44.990.589/0001-98 — Brazil