EnglishFrançaisDeutschItalianoEspañol (Latinoamérica)Português (Brasil)日本語한국어繁體中文简体中文हिन्दीالعربية

Trainer Privacy Policy.

Effective September 1, 2026 · Supercomplicated LLC

Effective date: September 1, 2026

Version: 2026-09-01

This Privacy Policy explains how Supercomplicated LLC, a Delaware limited liability company with its principal place of business in Massachusetts ("HeyFitt," "Supercomplicated," "we," "us," or "our"), collects, uses, retains and shares information in connection with HeyFitt for Trainers — the trainer marketing site, trainer sign-in, trainer onboarding, the trainer portal, any public trainer profile or enquiry link we host for you, and the communications we send on your behalf (together, the "Trainer Service").

This Policy is for trainers. If you also hold a HeyFitt member account, the member Privacy Policy governs that account, and a trainer account is a separate account even on the same email address. Your use of the Trainer Service is governed by the HeyFitt for Trainers Terms of Service (the "Trainer Terms"); capitalized terms not defined here have the meanings given there.

Except for Section 5, which is a contract between you and us, this Policy is a statement of our information practices provided as a notice; it is not a contract and does not create contractual or other legal rights, except to the extent required by applicable law.

The Trainer Service is for adults only. You must be at least 18 years old, and every client you manage through it must be at least 18 years old.

1. The Two Roles: When We Decide, and When You Decide

Almost every question about privacy in a product like this one comes down to who decides what happens to a piece of information. There are three answers, and they do not overlap.

1. Trainer Information — we are the controller. Your account, your profile, your credentials, your billing, your use of the Trainer Service, and the communications you have with us. We decide the purposes and means of processing it, within what this Policy describes. Sections 2, 3 and 4 cover it.
2. Client Records — you are the controller and we act for you. Everything you create or collect about your own clients through the Trainer Service. You decide what is collected, why, from whom, and for how long. We process it as your processor and service provider, on your instructions, and not for our own purposes. Section 5 covers it and is our data processing agreement with you.
3. Member Information — we are the controller and you are given limited access. Information about HeyFitt members that reaches you through the gym floor, your enquiry page, or a member writing to you, before that person becomes your client. It is governed by the member Privacy Policy; your access to it is limited by Section 6 and by Section 14 of the Trainer Terms.

Where a single record sits in more than one category — a person who is both a HeyFitt member and your paying client, for example — each role applies to the part of the record it covers. Their member profile, floor entries and member account remain theirs and ours under the member Privacy Policy; the intake form they filled in for you, and the notes you wrote about them, are your Client Records under Section 5.

2. Trainer Information We Collect

Information you give us:

• Account. Your email address, your name, how you signed in (an emailed link, Google, or Apple), the gyms you add, and whether you run your own practice or joined someone else's team. There is no password; sign-in is passwordless.
• Profile. Your photograph, tagline, biography, specialisms, gallery images, your hourly rate, and the handle used in your enquiry link.
• Credentials. Your full legal name, your phone number, how long you have been training clients, your awarding body, certificate number and expiry month, your insurer, policy number and expiry month, and the certification and insurance documents you upload. Section 4 says exactly who can see which part of this, and Section 12 says how the documents are stored.
• Plan and billing. The plan you chose, your trial dates, and — for the card you leave for your HeyFitt subscription — the name on the card, the brand, the last four digits and the expiry, and identifiers for your customer and subscription records. We never receive or store your full card number, CVC or PIN; those go directly to our payment processor. If you activated an account with an invite code, we keep a one-way hash of it.
• Your Stripe connection. Your Stripe account identifier and the status flags Stripe reports to us. We never receive your bank account number, your government identification, or the identity and tax details Stripe collects from you. See Section 7.
• Practice content. Programs, routines, custom exercises, groups, packages, document templates you write, clone or upload, sessions and calendar entries, and anything else you build in the Trainer Service.
• Communications. Messages you exchange with members and clients through the Trainer Service, replies you send to enquiries, documents and emails you send through the Trainer Service, and anything you send us directly, including support requests.
• Team. Coach invitations you send or accept, and who is on your practice.

Information collected automatically:

• Device and log information: IP address, browser and device type, operating system, device identifiers, language and referring pages.
• Usage information: screens viewed, features used, actions taken, and counts and flags describing them — for example that an account was created, that a trial started, how many documents were included in a send, and whether a payment link was attached. These are counters and shapes, not copies of your content or your clients' records.
• Approximate location: a general location such as city or region, inferred from your IP address.
• Cookies and similar technologies: as described in Section 10.

Information from other sources:

• From members and prospective clients: enquiries submitted through your enquiry page, messages members send you, and — where relevant to safety or enforcement — reports about you.
• From Stripe: your connected-account status, invoice and subscription status, amounts, processing fees and net amounts, payout summaries, and the last four digits of a payout destination or a client's card. See Section 7.
• From gyms and awarding bodies: information we receive if a facility or an awarding body contacts us about you.
• Public sources: gym listings, compiled from publicly available sources. These describe businesses, not people.

3. How We Use Trainer Information

We use Trainer Information to:

1. Provide, operate, maintain and personalize the Trainer Service, including showing your profile, your stated credentials, your rate and your packages to gym members at the gyms you have added, and running your enquiry link;
2. Create, maintain and secure your account, and confirm eligibility;
3. Bill you, take payment for your plan, manage trials, renewals, failed payments, overage and collections, and keep the records that go with them;
4. Connect your Stripe account and pass your instructions to Stripe so that you can invoice your clients, and show you back what Stripe reports;
5. Send you administrative messages — security notices, billing notices, credential and insurance expiry reminders, changes to our terms — and, with the choices in Section 11, marketing messages;
6. Deliver, on your behalf, the messages, invitations, documents and reminders you send to members and clients through the Trainer Service, and apply the sending limits described in the Trainer Terms;
7. Promote safety and enforce our rules, including investigating reports and concerns, checking credential and insurance expiry dates, moderating content, suspending, restricting or removing accounts, preventing removed trainers from re-registering, and keeping records of reports, investigations and enforcement actions;
8. Respond to your requests and provide support;
9. Monitor, analyze and improve the Trainer Service, develop new features, perform analytics and research, and create aggregated or de-identified data;
10. Detect, investigate and prevent fraud, abuse, security incidents and other harmful or unlawful activity;
11. Comply with legal obligations, respond to legal process, and establish, exercise or defend legal claims; and
12. Protect the rights, property and safety of HeyFitt, our members, your clients and others.

We may combine Trainer Information from different sources for these purposes. We may use and retain aggregated or de-identified data — which cannot reasonably be used to identify you, your practice or any individual — for any purpose and indefinitely, including to improve and develop our products and features; we commit to maintaining such data in de-identified form and not attempting to re-identify it except as permitted by law.

We do not use Client Records for the purposes in this Section. What we may do with Client Records is limited by Section 5.

4. What Members, Clients and Your Team Can See About You

Your credentials are shown in three tiers, and the tiers are deliberate.

• Anyone who can open your public profile or enquiry page sees how long you have been training clients, the name of your awarding body, that you hold insurance, and when you last updated the filing. No certificate number, no policy number, no phone number, no legal name, and no documents.
• Someone holding an invitation from you, deciding whether to become your client, additionally sees the legal name on your certificate, your phone number, your certificate number and expiry, and your insurer, policy number and expiry — everything needed to check your claim against a register or an insurer without us in the middle. Your phone number is shown here because you gave it for that purpose; it is never put on your enquiry page. Still no documents.
• A client who is training and paying can be given the certificate and insurance documents themselves — but only if you have ticked the box asking us to share them. Nothing is shown to anyone until you do. The documents are never on your enquiry page, never shown to someone still deciding, and never searchable.

Wherever your credentials appear, they appear as your own statement, carrying the words "These are as the trainer gave them. HeyFitt has not checked them and does not vouch for them." We do not verify them, and displaying them is not an endorsement.

Also visible: your profile, rate and packages to members at your gyms; your name and gym on messages and documents you send; your name, initials, email and role to other trainers on your team. Never visible to members or clients: your card details, your billing and plan, your Stripe figures, your private notes, and anything in your account we have not described here as shared.

Members keep their own private space too. A member's personal training notebook is returned by no route you can call, appears on no client page, and is in no email you receive — the mirror image of your private notes about them.

5. Client Records: We Hold Them for You

This Section 5 is the data processing agreement between you and HeyFitt. It is contractual, and it forms part of the Trainer Terms.

1. What Client Records are. Everything you create, collect or upload about your own clients and prospective clients through the Trainer Service: their names and contact details; intake and health history responses; clinician guidance; injuries, conditions and health changes; touch, measurement and recording preferences; consents and releases; body and exercise statistics; session logs, attendance and cancellations; your private notes; documents you send and the signed copies that come back; incident records; packages, agreements and invoices. Client Records are the same thing the Trainer Terms call Client Data; the two names mean one set of information.
2. Roles. As between you and HeyFitt, you are the controller and business, and we are the processor and service provider. You determine the purposes and means; we process on your behalf.
3. Our instructions are your use of the product. We process Client Records only to provide, secure, support, maintain and improve the Trainer Service for you; to deliver the messages and documents you send; to comply with law and legal process; to establish, exercise or defend legal claims; and to create aggregated or de-identified data. We follow your documented instructions, which are given by your use of the Trainer Service and by these terms, and we will tell you if we believe an instruction breaks the law.
4. What we will not do. We do not sell Client Records. We do not share them for cross-context behavioral or targeted advertising. We do not use them to advertise to your clients, to market HeyFitt to your clients on our own behalf, to build a profile of your clients for our own purposes, or to combine them with information from another practice. We do not retain, use or disclose them for any purpose outside our direct business relationship with you or outside what this Section permits.
5. Confidentiality and people. We limit access to personnel who need it to run the Trainer Service and to support you, and those people are bound by confidentiality obligations.
6. Security. We apply the safeguards described in Section 12 to Client Records.
7. Sub-processors. We use the sub-processors listed in Section 8 to host, store, deliver and secure Client Records. Each is bound by written terms no less protective than this Section. We remain responsible to you for their performance. If we add or replace a sub-processor that processes Client Records, we will update Section 8 and, where it is material, give notice.
8. Your clients' requests. If a client asks us directly to access, correct, export or delete their records, we will generally direct them to you, since the records are yours, unless the law requires otherwise. On your request, and taking into account the nature of the processing, we will give you reasonable assistance in responding to a client's request and in any assessment, audit or consultation the law requires of you.
9. Incidents. If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Client Records, we will notify you without undue delay and give you the information reasonably available to us so you can meet your own notification obligations. Notifying your clients and any regulator is your responsibility.
10. Return and deletion. You may export your data at any time from the Trainer Service. On termination, Client Records are handled as Section 9 describes; we will delete or return them on your written request, except where we are required to keep them by law, and subject to routine backups cycling out.
11. What is yours to do. You are responsible for: deciding what to collect and why; having a lawful basis for it; giving your clients the privacy notice the law requires of you, including naming HeyFitt as a processor; obtaining and recording every consent and authorization required, including for health information, touch and measurement, recording, and photography; honoring your clients' rights and requests; setting your own retention; and deciding which of your Coaches may see which records.
12. What you must not put in. The Trainer Service is not built for, and must not be used to hold, protected health information subject to HIPAA. HeyFitt is not a business associate and will not sign a business associate agreement. You must also not enter Social Security or other government identification numbers, payment card or bank account numbers, biometric identifiers, information about anyone under 18, or any other regulated or special-category data beyond what a field in the Trainer Service expressly asks for. If you do, you do so in breach of the Trainer Terms and at your own risk.
13. Health information is sensitive. Intake and health history responses are among the most sensitive things this product holds. Collect the minimum you actually need to train someone safely, tell your clients plainly what you are collecting and why, and do not enter a clinical detail into a note that would be better left with their clinician.

6. Member Information on the Gym Floor

While you are attached to a gym, the Trainer Service may show you what members at that gym have chosen to share on their floor, along with enquiries, messages and profile details. We are the controller of that information and the member Privacy Policy governs it. Members choose what to share, and we re-check that choice each time a floor is read; you see a gym's floor only while you work there.

Your access is a limited permission, not a transfer. Under Section 14 of the Trainer Terms you may use member information only to provide training through the Trainer Service. You may not export, copy, scrape, harvest, store outside the Trainer Service, sell, share or publish it; add a member to any mailing list, CRM or advertising audience without that member's separate, informed, documented consent; contact a member outside the Trainer Service other than as they have agreed; or use it to develop or train any machine-learning or artificial-intelligence system.

We may log and audit access to member information and to stored documents, and we may act on what those logs show.

7. Payments: What We See, and What Only Stripe Sees

There are two separate money flows, and we see very different things in each.

Your subscription to HeyFitt. You give a card so we can charge you for your plan when your trial ends and at each renewal. The card is captured by our payment processor. We store only the name on the card, the brand, the last four digits and the expiry — never the full number, never the CVC.

Your clients paying you. Client payments run through a Stripe account that you own and control, opened by you directly with Stripe. Stripe collects your identity documents, business details, bank account and tax information directly from you, under Stripe's own agreements and Privacy Policy. HeyFitt never receives them. Your clients enter their card details on Stripe's pages; no client card number ever reaches HeyFitt.

What we do receive from Stripe, so we can show it to you: your connected-account status flags; invoice and subscription status, numbers, amounts, line items and dates; processing fees and net amounts as Stripe calculates them; refunds and credit notes; payout summaries and the last four digits of a payout destination; and the brand and last four digits of a card used to pay one of your invoices. These figures are shown for convenience, can be delayed or incomplete, and Stripe's own records govern — as Section 11 of the Trainer Terms explains.

Your relationship with Stripe is between you and Stripe. We are not responsible for Stripe's handling of your information or your clients' information.

8. How We Share Information

We share information in the following circumstances, and no others:

• With members and clients, as described in Sections 4, 5 and 6.
• With your team, where you have invited Coaches into your practice. The practice owner and the Coaches share the practice's client roster, programs, groups, exercises, packages, leads, sessions, notes and invoices. Deciding who to invite is deciding who sees your clients' records.
• With service providers and sub-processors that perform services for us under written obligations to protect the information and use it only for the services they provide to us. Those we currently rely on for the Trainer Service are: Google Cloud and Firebase (hosting, database and file storage), Stripe (payments and Connect), Resend (email delivery), Google Analytics (product analytics), Sentry (error and performance monitoring), Google Places (gym listing data), and Google and Apple (sign-in, where you choose it).
• With professional advisers, such as lawyers, accountants and insurers, where reasonably necessary.
• For safety, integrity and legal reasons: we may disclose information if we believe in good faith that disclosure is reasonably necessary to (a) comply with a law, regulation, legal process or governmental request; (b) enforce the Trainer Terms or other agreements; (c) detect, prevent or address fraud, abuse, security or technical issues; or (d) protect the rights, property or safety of HeyFitt, our members, your clients or any person. This includes disclosing to a gym, an awarding body, an insurer, a regulator, a professional body or law enforcement where we have reason to believe a credential, insurance or gym-authorization statement is false, or where someone may be at risk.
• In a business transfer: in connection with, or during negotiations of, any merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our business, information may be transferred to the successor or acquirer, subject to this Policy.
• With your consent or at your direction.
• Aggregated or de-identified information, which we may share for any purpose.

We do not sell personal information, and we do not share it with third parties for cross-context behavioral (targeted) advertising. This applies to Trainer Information and to Client Records alike. If that ever changes for Trainer Information, we will update this Policy first, provide any legally required opt-out — including recognizing the Global Privacy Control browser signal — and obtain any legally required consent. For Client Records it will not change, because Section 5 forbids it.

9. Data Retention

We retain information for as long as your account is active and thereafter for as long as reasonably necessary for the purposes described in this Policy. In particular:

• Your account, profile, practice content and Client Records are retained while your account is active.
• Credential and insurance documents are deleted when your account closes and its retention window passes, and are deleted sooner if you remove them. Documents attached to a withdrawn or declined trainer application are deleted within ninety (90) days.
• After your account closes: programs and private notes are kept for thirty (30) days and then deleted, as the cancellation dialog says. Client, group and invoice rows are kept as records of what happened, with the client rows no longer pointing at a trainer.
• Safety, moderation and enforcement records — reports, investigation records, enforcement outcomes, and information about suspended or removed accounts, retained in pseudonymized form where practicable — are retained for up to five (5) years after the account is closed, and longer where needed to prevent removed trainers from returning, to resolve disputes, or to comply with legal obligations. These survive account deletion.
• Billing and tax records are retained for as long as applicable law requires.
• Routine backups cycle within ninety (90) days.
• Aggregated or de-identified data is retained indefinitely.
• Stripe keeps its own records of your account and your clients' payments under its own retention practices, which we do not control. Closing your HeyFitt account does not close your Stripe account.

Export before you close. Once an account closes and its retention window passes, we have no obligation to retain, restore, export or produce anything, and generally cannot.

10. Cookies and Analytics

We use cookies and similar technologies that are necessary to operate the Trainer Service — keeping you signed in and securing your session — to remember preferences, and to understand how the Trainer Service is used so we can improve it. You can control cookies through your browser settings; disabling essential cookies will prevent the Trainer Service from working. We use third-party analytics and error-monitoring providers, including Google Analytics and Sentry, which may collect device and usage information on our behalf under contractual limits. For information about how Google uses data from sites that use its services, and the opt-outs available, visit https://policies.google.com/technologies/partner-sites. We do not use cookies for advertising, and we do not run third-party advertising or behavioral-tracking technologies in the trainer portal.

11. Your Rights and Choices

Account tools. You can access, update and correct your account, profile and credential information, remove uploaded documents, export your data, and close your account, at any time from the trainer portal.

State privacy rights. Depending on where you live — including California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana and a growing number of other U.S. states with comprehensive privacy laws — you may have the right to: (a) confirm whether we process your personal information and access it; (b) correct inaccuracies; (c) delete personal information; (d) obtain a portable copy; (e) opt out of targeted advertising, "sales" of personal information and certain profiling — as noted above, we do not sell personal information or use it for targeted advertising; and (f) limit or withdraw consent for certain uses of sensitive information. Some of these laws exclude information processed in a purely business-to-business or commercial context; where a right applies to you we will honor it, and we will not argue an exemption we do not need. You may exercise these rights from your settings or by contacting us at our legal inbox (the address is shown at the end of this page). We will verify your request using information associated with your account, and you may use an authorized agent where the law allows. We may decline or limit a request where applicable law permits, including where a statutory exception applies or where we cannot verify your identity. We will not discriminate against you for exercising your rights. If we decline, you may appeal by replying to our decision, and if your appeal is denied you may contact your state Attorney General.

Requests about Client Records. Requests we receive about a client's records are directed to you, as Section 5.8 explains. A request you make to us cannot delete a client's record that the law requires you, as controller, to keep.

Marketing choices. You may opt out of marketing emails using the unsubscribe link in any marketing message. We will still send administrative, billing, security and expiry messages, which are part of the service.

European Economic Area and United Kingdom. For Trainer Information we are the controller, and our legal bases are: performance of our contract with you (providing the Trainer Service and billing you); our legitimate interests (safety, security, enforcement, fraud prevention, and improving the Trainer Service); compliance with legal obligations; and your consent where required. You may have rights to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, to withdraw consent, and to lodge a complaint with your supervisory authority. For Client Records we are the processor and you are the controller, and Section 5 governs; your clients' requests go to you.

12. Security

We maintain administrative, technical and physical safeguards designed to protect personal information, consistent with applicable law including the Massachusetts data-security regulations, 201 CMR 17.00. Information is encrypted in transit and at rest with our hosting providers, and access by our personnel is limited to those who need it.

Credential and insurance documents get their own treatment, because a legal name, a policy number and a scan of somebody's certificate are the most sensitive things we hold about a trainer. They are stored in a separate private bucket with public access prevention enforced, are never publicly addressable, are reached only through short-lived signed links minted per request, and every read is logged before the link is issued.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for the security of the email account and sign-in providers attached to your trainer account, for your devices, for which Coaches you grant access to, and for keeping your own copies of anything you need. If a breach affecting personal information occurs, we will notify you and, where required, regulators, as applicable law requires — and for Client Records, on the timeline in Section 5.9.

13. Children

The Trainer Service is not directed to, and may not be used by, anyone under 18, and you may not use it to manage, program for, bill or communicate with any client under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it and may suspend or terminate the associated account. If you believe a minor's information is in the Trainer Service, contact us at our legal inbox immediately.

14. International Users

The Trainer Service is operated from the United States. Information is processed and stored in the United States and in other countries where our service providers operate, which may have data-protection laws different from those of your jurisdiction. By using the Trainer Service you understand that your information, and Client Records you enter, will be transferred to and processed in the United States. Where a transfer mechanism is required by law for personal data originating in the EEA, the UK or Switzerland, the Standard Contractual Clauses apply to that transfer and are incorporated into Section 5 by reference.

15. Third-Party Links and Services

The Trainer Service links to and integrates with third-party services, including Stripe, gym websites, and sign-in and calendar providers. This Policy does not apply to them, and we are not responsible for their privacy practices. Your use of a third-party service is governed by that provider's own policy, which you are responsible for reading.

16. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice — for example by email or in-product notice — and update the effective date above. Changes take effect on posting unless otherwise stated, and your continued use of the Trainer Service after they take effect constitutes acknowledgment of the updated Policy. Changes to Section 5 that materially reduce the protections given to Client Records will not be made without notice to you.

17. Contact Us

Supercomplicated LLC (operator of HeyFitt)

PO Box 43, Winchester, MA 01890

Our legal inbox

Shown as an image, not as text, to keep it out of the hands of address harvesters. Type it into your mail client to reach us.