Privacy Policy

Afia · Last updated 15 October 2026

Afia is an AI-assisted personal training platform that connects clients with coaches. This policy explains what we collect, why, who we share it with, and what you can ask us to do about it.

Afia is operated by Afia Technologies (FZE), a free zone establishment registered in the United Arab Emirates under trade licence 11871, issued by SRTIP (Sharjah Research Technology and Innovation Park), at Block B, Office B59-134, SRTI Park, Al Dhaid Road, University City, Sharjah, United Arab Emirates. That company is the data controller for the personal data described here, and can be reached at admin@afia.fit.

For any question about this policy or your data, write to privacy@afia.fit.

Who this applies to

Afia has two kinds of user, and this policy covers both.

Coaches hold an Afia account, pay for the service, and use it to manage their clients. Clients are invited by a coach and use Afia to follow programmes, log training and nutrition, and communicate with that coach. Clients do not pay Afia anything.

Afia is for adults. You must be 18 or older to use it, and we do not knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

What we collect

Account and identity

Your name, email address, and whether you are a coach or a client. Coaches may add a business profile. We never see or store your password — authentication is handled by Supabase.

Health information

This is the most sensitive category we hold, and it is central to what Afia does. Depending on what you provide, it includes:

• Your answers to the PAR-Q pre-exercise screening questionnaire, including questions about heart conditions
• Current and previous injuries, and the body areas affected
• Medications and medical conditions you tell us about
• Body measurements, body weight, and progress photographs
• Nutrition information including food logs, meals, macronutrient targets and supplements
• Reproductive and female health information, where you choose to provide it — menstrual cycle and regularity, pregnancy status, contraception, and menopausal status

The reproductive health section is optional. It exists because training and nutrition needs change across a cycle, through pregnancy and after it, and a coach cannot programme around something they have not been told. Leaving it blank does not restrict any other part of Afia.

Under data protection law this is special category data and it gets stricter treatment. We collect and use it only with your explicit consent, which you give during onboarding and can withdraw at any time. Withdrawing it means we can no longer generate safe programmes for you, so in practice it ends your use of the service.

Training and activity

Programmes assigned to you, sessions completed, the exercises, sets, repetitions, loads and RPE you record, habits, check-ins, and progress entries over time.

Communications

Messages between you and your coach, coach notes about a client, and voice notes where used.

Technical

Push notification tokens for your device, and diagnostic information when something goes wrong — see the table below for what our error monitoring receives.

Payment

Coaches pay through Stripe. Afia never receives or stores your card details. We hold only the subscription status and billing events Stripe reports back to us.

How we use it

• To run the service — deliver your programme, record your training, show your progress, and carry messages between you and your coach.
• To generate programmes safely — your injuries and PAR-Q answers are used to exclude exercises that are inappropriate for you. This is the primary reason we ask for health information at all.
• To communicate — transactional email such as invitations and account notices, and push notifications you can turn off.
• To take payment — for coaches only.
• To keep the service working — diagnosing errors and preventing abuse.

We do not sell your data. We do not use it for advertising. The Afia app contains no analytics of any kind. On our website we use Plausible to count visits: it sets no cookies, does not store your IP address, and keeps its data in the European Union. There are no marketing trackers anywhere.

AI processing

Afia uses Anthropic's Claude API for every AI feature in the service. Information about a client is sent to Anthropic when a coach uses the AI chat, generates a meal plan or a training programme, or drafts a note, message or session with the coach assistant; when a client's intake answers are summarised for their coach; and in a nightly analysis that tells a coach which clients may need attention.

Depending on the feature, what is sent can include:

• Name, age, date of birth, height, weight and goals
• All seven PAR-Q answers, medical conditions, medications, current and previous injuries, and allergies
• Sleep, stress, smoking and alcohol
• Reproductive and female health information, where you have provided it
• Check-in, session and progress notes, the sets you log, and your body measurements
• What a coach types into the AI features
• Photographs of menus and nutrition labels, when you use the app to read one

These are the inputs that make a programme safe and advice specific to you. Progress photos and voice notes are never sent to Anthropic.

Anthropic processes this on our behalf as a sub-processor. Your data is not used to train Anthropic's models.

Legal bases

Where GDPR or comparable law applies, we rely on:

• Contract — to provide the service you or your coach signed up for.
• Explicit consent — for all health information, under Article 9(2)(a).
• Legitimate interests — to secure the service, diagnose faults and prevent abuse.
• Legal obligation — where we must retain records, for example for tax.

Who we share it with

Your coach sees the data you enter — that is the point of the service. Beyond that, we use the following processors. Each handles data only on our instructions.

Push notifications pass through Expo and, on Android, Google Firebase Cloud Messaging. For a message notification they carry the sender's name and the first 100 characters of the message.

Exercise pages link out to YouTube search results. Google receives your IP address and may set cookies, under its own privacy policy which we do not control, only if you follow one of those links. Where a coach has attached a video directly to an exercise it plays in an embedded YouTube player, and Google receives the same data when that player loads.

We may also disclose data where the law requires it, or to protect someone's safety or our legal rights.

International transfers

Your data is stored in Japan. Our database, your account and every file you upload sit in Tokyo, in the Asia Pacific (Tokyo) region of our database provider. Nothing you put into Afia is stored in the United States.

It is processed in several places on its way to and from there. Our backend runs in Singapore, and the web app is served from a global network whose server-side rendering also runs in Singapore. Error reports, which carry your user ID and email address, go to the European Union. AI processing is carried out by Anthropic in the United States. Payments are handled by Stripe on an account registered in the United Arab Emirates. The table above lists every processor and where each one operates.

Where data leaves a jurisdiction that restricts transfers, we rely on Standard Contractual Clauses with the processors concerned.

How long we keep it

• While your account is active — we keep your data so the service works and your history stays intact.
• If your subscription lapses — we keep your data. Some coaching features stop working until you renew, but nothing is deleted.
• When you delete your account — see Deleting your account below.
• Where law requires — some billing records are kept longer to meet tax and accounting obligations.

Deleting your account

This applies to the Afia Coaching app on Google Play, developed by Afia Technologies (FZE), and to every other Afia app and the Afia website.

• In the app — any client or coach can delete their account from their Profile screen. It takes effect immediately: your account and your data are deleted permanently, and a deleted account cannot be recovered.
• Coaches who still have clients — the request is accepted in the app straight away. Your subscription is cancelled, you are signed out and the account is closed, and the deletion is completed within 30 days.
• Without the app — anyone, including someone who has uninstalled it, can ask us to delete their account by emailing privacy@afia.fit. There is no need to reinstall the app.

Some records are kept after deletion with the link to you removed. When a client deletes their account, the coach keeps the programmes, workout plans and calendar events they created for that client, but these no longer identify the client. Some billing records are kept longer where the law requires, as set out above.

Your rights

You can ask us to:

• Give you a copy of the data we hold about you
• Correct anything inaccurate
• Delete your account and your data
• Export your data in a portable format
• Restrict or object to particular processing
• Withdraw your consent to health data processing

Write to privacy@afia.fit and we will respond within 30 days. You can also delete your account from within the app — see Deleting your account.

If you are a client, some of what your coach holds about you — their own notes, for instance — is theirs. We will help you reach them.

Security

Data is encrypted in transit and at rest. Access is controlled per-account through row-level security, so one coach cannot see another's clients. We limit what our error monitoring receives: request bodies, headers, cookies and query strings are filtered before an error report leaves our servers, and IP address and location are not attached.

Profile pictures are served from a public web address, so anyone who has that address can view the image without signing in. Progress photos and voice notes are not: they are stored privately and shown only through links that expire after a short time.

No system is perfectly secure. If a breach affects your data, we will tell you and the relevant regulator as the law requires.

Cookies

We use only what the service needs to work: an authentication token so you stay signed in, and hosting cookies set by Netlify. There are no analytics, advertising or tracking cookies. Embedded YouTube videos may set their own — see above. Our website analytics, Plausible, sets no cookies either.

Changes

If we change this policy we will update the date at the top, and tell you directly when the change is significant.

Contact

Privacy and data requests: privacy@afia.fit
General support: support@afia.fit

Afia, Dubai, United Arab Emirates. This policy is governed by the laws of the United Arab Emirates, and disputes are subject to the courts of Dubai.