Privacy policy

FitWise AI, Inc. (“FitWise,” “we,” “us,” or “our”) provides an AI-enabled sports movement analysis platform that helps professional sports organizations analyze athletes’ movement in match and training footage to support performance and injury-prevention work, together with our websites and related services (collectively, the “Services”). We provide the Services on a business-to-business basis to professional sports leagues, clubs, teams, and federations (“Customers”).

This Privacy Policy explains what personal data we process, why and how we process it, when we act as a controller and when we act as a processor on behalf of our Customers, and what rights individuals have.

Company. FitWise AI, Inc., a Delaware corporation. Mailing address: 1908 Thomes Ave, STE 12046, Cheyenne, WY 82001, USA.

Affiliate. Our wholly owned subsidiary FitWise AI Cyprus LTD, Republic of Cyprus, provides engineering, product development, and support services to FitWise. It processes personal data only on FitWise’s behalf and in accordance with FitWise’s instructions.

Privacy contact. Questions, requests, and complaints about this Privacy Policy or our handling of personal data may be sent to our privacy team at privacy@thefitwise.com.

2.1 Where FitWise Acts as a Controller

FitWise determines the purposes and means of processing, and is the controller, for the following personal data:

• personal data of Customers’ authorized users (such as coaches, analysts, and club staff) relating to their accounts and use of the Services;
• personal data of business contacts, prospective customers, partners, and vendors;
• personal data of visitors to our websites and of individuals who contact us.

2.2 Where FitWise Acts as a Processor

When a Customer uploads footage of athletes to the Services and uses the Services to analyze it, FitWise processes that footage, and all data derived from it, on behalf of the Customer and under a written data processing agreement (“Customer Data,” described in Section 4). For Customer Data, the Customer is the controller and is responsible for establishing a valid legal basis, informing athletes about the processing, and responding to their requests.

If you are an athlete whose footage is analyzed through the Services, please refer to the privacy notice of the league, club, team, or federation that provided your data, and direct your requests to that organization. If you contact us directly, we will forward your request to the relevant Customer and assist the Customer in responding, as required by our agreement with it and applicable law.

2.3 What This Policy Does Not Cover

• Personal data of FitWise’s job applicants, employees, and contractors, which is covered by a separate notice provided to those individuals. Such personal data is not covered by FitWise’s Data Privacy Framework certification described in Section 18.
• Our Customers’ own processing of personal data, which is governed by their privacy notices.
• Third-party websites and services linked from our Services, which are governed by their own privacy policies.

Depending on how a Customer uses the Services, Customer Data may include:

• Sports footage and metadata: match or training footage uploaded by the Customer and related metadata.
• Derived media: clips, frames, and crops generated from that footage.
• Pose and movement data: joint positions, skeletal keypoints, movement classifications, and annotations.
• Analytical outputs: biomechanical indicators, technique assessments, and injury-risk indicators.
• Athlete identifiers provided by the Customer: such as name, jersey number, team, and playing position, used to associate analysis results with the relevant athlete.

FitWise processes Customer Data only to provide, maintain, support, and improve the Services for the Customer, in accordance with the Customer’s documented instructions under the applicable data processing agreement, and as required by law. FitWise does not use Customer Data to train or fine-tune machine-learning models and does not use Customer Data for its own independent purposes.

The table below describes the purposes for which FitWise processes personal data as a controller and, where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies, the legal basis for each purpose.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights and freedoms. You may request information about that assessment by contacting us. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

FitWise does not use Customer Data, including footage, derived media, pose and movement data, athlete identifiers, or analytical outputs, to train or fine-tune its machine-learning models.

FitWise uses Customer Data only to provide the Services to the relevant Customer and to maintain, support, and improve the Services, for example to troubleshoot errors, monitor the accuracy and performance of the Services, and resolve quality issues. FitWise carries out this processing as a processor on the Customer’s behalf and in accordance with its instructions, as described in Section 2.2.

Subject to our Customer agreements, FitWise may also create aggregated or de-identified information that can no longer reasonably be linked to an identified or identifiable individual. FitWise maintains such information in de-identified form and does not attempt to re-identify it, and does not use it to train or fine-tune machine-learning models.

7.1 Health-Related Information

Analytical outputs such as injury-risk indicators and technique assessments may reveal information about an athlete’s physical condition, injuries, or rehabilitation status, and may therefore constitute data concerning health or sensitive personal data under applicable law. FitWise processes such outputs solely as a processor on behalf of the Customer. The Customer is responsible for ensuring that an applicable legal basis and any additional conditions required for processing sensitive data, including explicit consent where required, is in place.

FitWise protects such outputs through need-to-know access controls, encryption, and retention in accordance with the Customer’s instructions.

FitWise does not provide medical diagnosis, treatment, or medical advice. Analytical outputs are indicators intended to support the work of qualified personnel and are not a substitute for medical assessment.

7.2 No Biometric Data

FitWise does not process biometric data. We do not use facial recognition, face geometry, gait recognition, or any other technique to uniquely identify or authenticate individuals from footage, pose data, or movement patterns. Pose and movement data is used only to analyze how the body moves, and results are associated with an athlete only through identifiers provided by the Customer.

7.3 Other Sensitive Data

FitWise does not intentionally collect other categories of sensitive data, such as data revealing racial or ethnic origin, political opinions, religious beliefs, or sexual orientation. We ask Customers and users not to submit such data through the Services.

The Services analyze athletes’ movement and generate indicators about technique and injury risk.

FitWise does not make decisions about individuals. Analytical outputs are delivered to the Customer’s authorized personnel, who decide whether and how to use them. FitWise does not make decisions based solely on automated processing that produce legal effects concerning individuals or similarly significantly affect them within the meaning of Article 22 GDPR.

FitWise designs the Services to support, not replace, human judgment, and informs Customers that outputs should be reviewed by qualified personnel and should not be used as the sole basis for decisions affecting an athlete’s employment, selection, or medical treatment.

FitWise discloses personal data only as described below. Customer Data is disclosed only in accordance with the Customer’s instructions.

• Affiliates. Our subsidiary FitWise AI Cyprus LTD, Republic of Cyprus, which provides engineering, product development, and support services on our behalf.
• Service providers and sub-processors. Providers of cloud hosting, data storage, infrastructure, security, communications, each bound by written contracts that require them to process personal data only on our instructions and to protect it. Customers may obtain the current list of sub-processors under their data processing agreement.
• Customers and their authorized users. Analytical results and related data are made available to the Customer and the users it designates.
• Professional advisers. Lawyers, auditors, accountants, and insurers, subject to confidentiality obligations.
• Corporate transactions. Actual or prospective counterparties, investors, and their advisers in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to confidentiality obligations. Any successor will be required to handle personal data in accordance with this Privacy Policy.
• Authorities. Courts, regulators, law enforcement, and other public authorities where required by applicable law. We review such requests, challenge them where appropriate, and, for Customer Data, notify the Customer where legally permitted.
• Other parties with your direction or consent.

FitWise does not sell personal data, whether for money or other valuable consideration. FitWise does not share personal data for cross-context behavioral advertising or targeted advertising, and does not use Customer Data for advertising of any kind.

FitWise is based in the United States, and our affiliate is located in the Republic of Cyprus. Our service providers may process personal data in the United States, the European Economic Area, and other countries.

Where personal data subject to the GDPR, the UK GDPR, or Swiss data protection law is transferred to a country that has not been recognized as providing an adequate level of protection, FitWise relies on:

• for personal data received by FitWise AI, Inc. in the United States, the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, as described in Section 18;
• the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, together with the UK International Data Transfer Addendum and the adaptations required under Swiss law, as applicable; for Customer Data, the appropriate module of the Standard Contractual Clauses is incorporated into our data processing agreements with Customers; and
• an adequacy decision, where one applies to the destination country.

FitWise supplements these mechanisms with technical and organizational measures, including encryption in transit and at rest, access controls, and a procedure for assessing and responding to government access requests. You may request a copy of the relevant transfer safeguards by contacting privacy@thefitwise.com; commercial terms may be redacted.

FitWise retains personal data only for as long as necessary for the purposes described in this Privacy Policy, in accordance with the following periods:

Where longer retention is required to comply with a legal obligation or to establish, exercise, or defend legal claims, we retain the relevant data for that purpose only. At the end of the applicable period, we delete personal data or irreversibly anonymize it.

FitWise implements technical and organizational measures appropriate to the risks of the processing and the nature of the personal data, including access controls and role-based permissions, multi-factor authentication for administrative access, encryption in transit and at rest, logging and monitoring, secure development practices, vendor due diligence, and incident response procedures.

No system is completely secure. If a personal data breach occurs, FitWise will notify affected Customers without undue delay in accordance with our agreements with them, and will notify supervisory authorities and affected individuals where required by applicable law.

14.1 EEA, UK, and Switzerland

Where the GDPR, the UK GDPR, or Swiss data protection law applies, and subject to applicable exceptions, you have the right to:

• access your personal data and obtain a copy of it;
• have inaccurate or incomplete personal data corrected;
• have your personal data erased;
• restrict the processing of your personal data;
• receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent where processing is based on consent;
• not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (see Section 8); and
• lodge a complaint with a supervisory authority, in particular in the country of your habitual residence, place of work, or place of the alleged infringement. In the UK, this is the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner.

14.2 How to Exercise Your Rights

To exercise your rights, contact privacy@thefitwise.com. We may ask for information reasonably necessary to verify your identity. We will respond within one month of receiving your request; this period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you. We do not charge a fee unless a request is manifestly unfounded or excessive.

Individuals in the EEA, the UK, and Switzerland also have the access and recourse rights under the Data Privacy Framework described in Section 18.

Requests relating to Customer Data will be forwarded promptly to the relevant Customer as controller, as described in Section 2.2.

If you reside in the United States, see Section 17.

Cookies are small text files stored on your browser or device. Similar technologies, such as browser local storage, store information on your device in a comparable way.

FitWise uses only the following first-party technologies, which are strictly necessary to provide the Services securely:

We do not use analytics, advertising, or third-party cookies on our websites or in the Services. Because the technologies above are strictly necessary, consent is not required for them. If we introduce non-essential cookies or similar technologies, we will update this Privacy Policy and obtain consent where required by applicable law.

You can control cookies and local storage through your browser settings. Disabling the technologies listed above will prevent you from signing in to the Services.

Website analytics

To understand how our website is used and to improve it, we use Plausible Analytics, a cookie-free web analytics service provided by Plausible Insights OÜ, which acts as our processor under a data processing agreement. Plausible does not set cookies, does not store an identifier on your device, and does not track you across websites.

FitWise provides the Services on a business-to-business basis to Customers operating professional sports leagues and teams. Access credentials to the Services are issued only to adult staff, coaches, and authorized personnel of Customers, and are not issued to minors. FitWise does not knowingly collect personal data from children as a controller.

Where an athlete whose data is processed through the Services is a minor, the relevant Customer, as controller, is responsible for ensuring a valid legal basis for that processing, including any parental or guardian consent required by applicable law. FitWise processes such data solely as a processor acting on the Customer’s instructions.

17.1 Applicability

This section supplements this Privacy Policy for residents of U.S. states with comprehensive consumer privacy laws, to the extent those laws apply to FitWise and to the personal information concerned. If this section conflicts with another part of this Privacy Policy, this section governs for the individuals and personal information it covers.

Several state laws exempt personal information processed in an employment or business-to-business context. Where FitWise processes Customer Data as a service provider or processor, requests should be directed to the relevant Customer, as described in Section 2.2.

17.2 Personal Information We Collect and Disclose

In the preceding 12 months, FitWise has collected the following categories of personal information as a business or controller: identifiers (such as name, email address, IP address, and user ID); internet or other electronic network activity information (such as usage and security logs); professional or employment-related information (such as job title and organization); and account login credentials, which certain state laws classify as sensitive personal information.

The sources of this information are described in Section 3, the purposes for which we use it in Section 5, the categories of recipients to whom we disclose it for business purposes in Section 9, and the applicable retention periods in Section 12. FitWise uses sensitive personal information only for purposes permitted without offering a right to limit, such as providing and securing the Services.

17.3 Your Rights

Depending on your state of residence and subject to applicable exceptions, you may have the right to:

• confirm whether FitWise processes your personal information and access it;
• correct inaccurate personal information;
• delete personal information;
• obtain a portable copy of certain personal information;
• opt out of the sale of personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects; and
• not receive discriminatory treatment for exercising your privacy rights.

As described in Section 10, FitWise does not sell or share personal information or use it for targeted advertising, and FitWise does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. FitWise treats a Global Privacy Control signal as a valid opt-out request where required by applicable law.

17.4 How to Exercise Your Rights

To exercise your rights, contact privacy@thefitwise.com. FitWise may request information reasonably necessary to verify your identity and authority to make the request.

You may designate an authorized agent to submit a request on your behalf, subject to verification of the agent’s authority and, where permitted by applicable law, of your identity. FitWise will respond within the timeframe required by applicable law.

If FitWise declines to act on your request, you may appeal the decision by emailing privacy@thefitwise.com with the subject line “Privacy Rights Appeal.” FitWise will respond to the appeal within the timeframe required by applicable law and, if the appeal is denied, will inform you how to contact the attorney general or other regulator of your state.

18.1 Participation

FitWise AI, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. FitWise AI, Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. FitWise AI, Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles (together, the “DPF Principles”), the DPF Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

18.2 Scope of Our Certification

FitWise is subject to the DPF Principles all personal data it receives from the European Union, the United Kingdom, and Switzerland in reliance on the DPF. Our certification covers the categories of personal data described in Sections 3 and 4, including (a) personal data for which FitWise acts as a controller, and (b) Customer Data that FitWise receives from Customers and processes on their behalf as a processor. Our certification does not cover human resources data, meaning personal data of FitWise’s job applicants, employees, and contractors, which FitWise transfers in reliance on other lawful transfer mechanisms.

Our affiliate FitWise AI Cyprus LTD is established in the Republic of Cyprus and does not participate in the DPF. Where FitWise transfers personal data received under the DPF to that affiliate, the affiliate acts as FitWise’s agent under Section 18.4.

18.3 Types of Data and Purposes

The types of personal data FitWise processes, and the purposes for which it processes them, are described in Sections 3 through 8. FitWise processes personal data received under the DPF only for purposes that are compatible with the purposes for which it was collected or subsequently authorized by the individual.

18.4 Disclosures and Onward Transfers

FitWise discloses personal data received under the DPF only to the categories of third parties, and for the purposes, described in Section 9. Where FitWise transfers such personal data to a third party acting as a controller, it does so only for limited and specified purposes and under a contract requiring the recipient to provide the same level of protection as the DPF Principles. Where FitWise transfers such personal data to a third party acting as an agent on its behalf, including its affiliate and its service providers, FitWise enters into a written contract requiring the agent to process the data only for limited and specified purposes consistent with FitWise’s instructions, and to provide at least the same level of protection as the DPF Principles.

In cases of onward transfer to third parties of personal data of EU, UK, and Swiss individuals received pursuant to the DPF, FitWise remains liable under the DPF Principles if its agent processes such personal data in a manner inconsistent with the DPF Principles, unless FitWise proves that it is not responsible for the event giving rise to the damage.

18.5 Your Choices

Where FitWise acts as a controller of personal data received under the DPF, FitWise will offer you the opportunity to opt out before that personal data is (a) disclosed to a third party acting as a controller, other than where the disclosure is required by law or otherwise permitted by the DPF Principles, or (b) used for a purpose that is materially different from the purposes for which it was originally collected or subsequently authorized by you. You may exercise these choices at any time by contacting privacy@thefitwise.com. Choice is not required where personal data is disclosed to an agent acting on FitWise’s behalf and under its instructions.

For sensitive personal data, including data concerning health, FitWise will obtain your affirmative express (opt-in) consent before disclosing it to a third party acting as a controller or using it for a purpose other than those for which it was originally collected or subsequently authorized by you, except where an exception under the DPF Principles applies.

Where FitWise processes Customer Data as a processor, the relevant Customer, as controller, is responsible for providing the choices required by applicable law.

18.6 Data Integrity, Retention, and Security

FitWise limits personal data received under the DPF to what is relevant for the purposes of processing, takes reasonable steps to ensure that such personal data is reliable for its intended use, accurate, complete, and current, and retains it in identifiable form only for as long as it serves a purpose compatible with the purposes for which it was collected or subsequently authorized, in accordance with Section 12. FitWise protects such personal data using the measures described in Section 13.

18.7 Access

You have the right to access the personal data about you that FitWise holds and has received under the DPF, and to correct, amend, or delete it where it is inaccurate or has been processed in violation of the DPF Principles, subject to the limited exceptions set out in the DPF Principles. To exercise these rights, contact privacy@thefitwise.com. Where FitWise holds your personal data as a processor on behalf of a Customer, FitWise will forward your request to the relevant Customer and assist it in responding, as described in Section 2.2.

18.8 Inquiries and Complaints

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, FitWise commits to resolve DPF Principles-related complaints about our collection and use of your personal data. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the DPF should first contact FitWise at privacy@thefitwise.com or by mail at FitWise AI, Inc., 1908 Thomes Ave, STE 12046, Cheyenne, WY 82001, USA. FitWise will respond to such complaints within 45 days upon receipt.

18.9 Dispute Resolution

If a privacy complaint or dispute relating to Personal Data received by FitWise AI, Inc. in reliance on the Data Privacy Framework (or any of its predecessors) cannot be resolved through our internal processes, we have agreed to participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure. Subject to the terms of the VeraSafe Data Privacy Framework Dispute Resolution Procedure, VeraSafe will provide appropriate recourse free of charge to you. To file a complaint with VeraSafe and participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure, please submit the required information here: https://www.verasafe.com/privacy-services/dispute-resolution/submit-dispute/

If a complaint or dispute cannot be resolved through our internal process, we have also agreed to cooperate with the EU and UK data protection authorities and the Swiss Federal Data Protection and Information Commissioner and to participate in the dispute resolution procedures of the panel established by such data protection authorities.

18.10 Binding Arbitration

If your dispute or complaint related to your Personal Data that we received in reliance on the Data Privacy Framework cannot be resolved by us, nor through the dispute resolution mechanism mentioned above, you may have the right to require that we enter into binding arbitration with you under the Data Privacy Framework “Recourse, Enforcement and Liability” Principle and Annex I of the Data Privacy Framework.

18.11 Enforcement

FitWise is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission with respect to its compliance with the DPF Principles.

18.12 Disclosures to Public Authorities

FitWise may be required to disclose personal data received under the DPF in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. FitWise handles such requests as described in Section 9.

18.13 Continued Protection

If FitWise ceases to participate in the DPF, it will continue to apply the DPF Principles to personal data it received in reliance on the DPF for as long as it retains such data, or will otherwise provide adequate protection for such data by another authorized means, or will return or delete it.

FitWise may update this Privacy Policy to reflect legal, technical, or business developments. We will post the updated version with a revised “Last updated” date. For material changes, we will notify Customers and account users by email or in-product notice before the changes take effect, and obtain consent where required by applicable law.

FitWise AI, Inc.

1908 Thomes Ave, STE 12046, Cheyenne, WY 82001, USA

Email: privacy@thefitwise.com