This platform processes health data. Weight, measurements, progress photos, training and diet are sensitive personal data and receive reinforced protection. See Sensitive health data.

1. Who is the controller and our roles

This Policy explains how we process personal data in NutriTrain. For the professional’s account and usage data and platform operations, the controller is Nexxfixx Soluções Digitais LTDA, inscrita no CNPJ 40.675.453/0001-32, com sede em Rua Rio Grande do Sul, sala 4, Paranavaí/PR, CEP 87709-070. For client data, the professional who manages it is the controller and the platform acts as processor, handling it under that professional’s instructions (LGPD arts. 37 and 39). If you are a client, exercise your rights first with your professional; we still offer supporting channels and tools.

2. What data we process

From the professional: name, email, password (stored encrypted), profession, service modality, Instagram (optional), billing data (handled by the payment processor) and usage records. From clients, entered by the professional or the client: identification and contact, intake, training, cardio, hydration and diet protocols, check-ins, weight, measurements, progress photos, messages and device identifiers for notifications. We also process technical data (IP, device type, logs) for security and pseudonymized usage metrics.

3. Purposes and legal bases

Performing the contract and delivering the service: run the dashboard and app, authenticate, provide support. Complying with legal and regulatory duties: tax, accounting and record-keeping. Security, fraud prevention and defense of rights (legitimate interest): logs, App Check, anti-abuse, audit. Billing and payments (contract performance). Aggregated/pseudonymized usage metrics to improve the product (legitimate interest, with minimization). Operational communications (contract); marketing only with your consent, revocable anytime. We do not sell personal data.

4. Sensitive health data

Weight, measurements, progress photos, training and diet are sensitive data relating to health. They are processed for the tracking purpose defined by the professional and with specific, highlighted consent of the data subject when required (LGPD art. 11), with role-restricted access, per-professional isolation and reinforced protection. Training and diet screens include screenshot blocking as configured. This data is not used for advertising.

We share data only with essential processors, under contract and to the minimum necessary: cloud infrastructure and database (Google Firebase / Google Cloud), payment processing (Stripe), transactional email and push notifications. We may also disclose data to comply with legal obligations, orders from competent authorities or to defend rights. We do not sell or share data for third-party advertising.

6. International transfer

The primary database is hosted in a region in Brazil (São Paulo). Some of our processors (for example authentication, email and metrics) may process data on servers outside Brazil. In such cases we use providers offering adequate safeguards and contractual protection clauses compatible with LGPD art. 33.

7. How long we keep data

We keep data while the account is active and as long as needed for the purposes above. After closure, we delete or anonymize data within defined retention periods, keeping the minimum required by legal obligation (for example, tax records) or for the regular exercise of rights. Usage metrics are pseudonymized and purged by automatic routines (for example, analytics events within 14 months). Encrypted backups expire in the normal retention cycle.

8. Your rights and how to exercise them

You have the rights under LGPD art. 18: confirmation and access; correction; anonymization, blocking or deletion of unnecessary or non-compliant data; portability; information on whom we share with; and withdrawal of consent, as easy as giving it. In the product we offer account export and deletion as features. To exercise any right or ask questions, contact our Data Protection Officer at app.coachbr@gmail.com. Clients should first contact their professional (controller of their data).

9. Children and adolescents

The professional account is intended for adults (18+). If a professional serves minors, processing that data must observe the minor’s best interest and requires specific, highlighted consent from at least one parent or legal guardian, obtained and evidenced by the professional (LGPD art. 14). We do not run advertising targeted at minors.

10. How we protect your data

We apply layered security: encryption in transit (TLS) and at rest, strict per-professional isolation (multi-tenant), role- and permission-based access (deny-by-default), database and storage rules, server-side validation, App Check and rate limiting against abuse, monitoring and audit logs of sensitive actions. No system is infallible, but we work continuously to reduce risk.

11. Cookies

On the site we use strictly necessary cookies (theme, security and consent record) and, only with your consent, pseudonymized analytics cookies. Details and management in our Cookie Policy.

12. Security incidents

We keep an incident response plan. If a security incident occurs that may create relevant risk or harm to data subjects, we will notify the Brazilian Data Protection Authority (ANPD) and affected data subjects within the deadlines and manner required by the LGPD and ANPD rules, with the mitigation measures taken.

13. Data Protection Officer and contact

To exercise rights, clarify doubts or file complaints about privacy, contact our Data Protection Officer (DPO) at app.coachbr@gmail.com. You may also petition the ANPD directly (gov.br/anpd).

14. Changes to this Policy

We may update this Policy to reflect changes in the service or the law. The effective date is shown at the top; material changes will be communicated by reasonable means. Continued use after it takes effect means awareness of the current version.