Privacy Policy

1. General provisions

This Policy has been drawn up in accordance with the Law of the Republic of Uzbekistan "On Personal Data" No. ZRU-547 of 2 July 2019 and sets out the procedure for collecting, processing, storing, and destroying users' personal data.

The Policy applies to the UZFIT mobile application, the website, the personal account, membership purchases, and communication with users.

Company details:

• Full name: MCHJ «FIT SOFT»
• Tax ID (INN): 312 419 712
• Registered address: 39 Zarqaynar St., "Gulbozor" MFY, Shaykhantakhur district, Tashkent
• Email: admin@uzfit.uz

This version of the Policy takes effect on 20 August 2026 and remains in force until replaced. Previous versions are retained by the Company and provided on request to admin@uzfit.uz. The Company gives advance notice in the application of any changes that materially affect the User's rights.

2. Data we process

2.1. Identification data

First and last name, mobile phone number, gender, date of birth, profile photo.

2.2. Account data

Account identifier, details of purchased memberships and classes, history of visits to sports facilities, QR-code check-in records.

2.3. Payment data

Transaction identifier, amount, currency, payment status and date, payment-service identifier. The Company does not store full bank card details — these are processed by the payment organisations.

2.4. Technical data

IP address, device and operating-system information, application version, interface language, installation identifiers, cookies, activity logs, and application crash data.

2.5. Data received from Partners

Information about actual visits to sports facilities, confirmation of services rendered, and information about breaches of visit rules.

2.6. Health and physical-activity data

With the User's separate permission, the application reads physical-activity data from the Apple Health (iOS) and Health Connect (Android) system services: step count, calories burned, distance covered, and workout duration. This data is processed exclusively on the User's device, is displayed in the application, and is not transmitted to the Company's servers, to Partners, or to any other third parties. Permission can be withdrawn at any time in the operating system's settings; once withdrawn, the application stops receiving this data.

The User may voluntarily enter health- and lifestyle-related information in the application: height, current and target weight, chest, waist, and hip measurements, water intake, duration of daily activity, and nutrition information (clause 2.9). This information is stored on the Company's servers, is used to calculate personal targets and display statistics, and is deleted together with the account.

2.7. Camera, photos, and gallery access

With the User's permission, the application uses the device camera and, with separate permission, access to the photo gallery:

• scanning a QR code when checking in at a sports facility and scanning a product barcode — the image from the camera is processed directly on the device in real time; frames are not stored or transmitted;
• profile photo — a picture taken with the camera or chosen from the gallery is uploaded to the Company's servers and displayed in the personal account; it may be replaced or deleted by the User;
• a meal photo in the food diary — transmitted to the Company's servers and to the automatic recognition service (clause 2.9).

Permissions to use the camera and gallery are requested the first time the relevant feature is used and can be withdrawn in the operating system's settings.

2.8. Location data

With the User's permission, the application determines the device's current location in order to show nearby sports facilities on the map and sort the list of gyms by distance. Location is requested only while these features are in use, is not collected in the background, and is not stored as a location history. If permission is refused, the application continues to work and the list of gyms is shown without sorting by distance.

2.9. Requests and feedback

Support requests, complaints, reviews of sports facilities, and app ratings.

3. Purposes and grounds for processing

Data is processed to perform the contract with the User, to provide services and the application's functionality, to process payments, to communicate with the User, for marketing (where consent has been given), for analytics and improving the Service, to ensure security, and to comply with legal requirements.

Legal grounds for processing: the User's consent, the necessity of performing the contract, compliance with legal requirements, and the Company's legitimate interests.

4. Transfer to third parties

Data is transferred to Partners (sports facilities), payment organisations, information-technology service providers, and, in cases provided for by law, to government authorities.

The Company does not transfer personal data to third parties for their own independent marketing purposes without the User's separate consent.

The Company engages the following service providers, which process data on its instructions:

• Payme, Click — payment amount, identifier, and status; to accept payment.
• Google Firebase (Analytics, Crashlytics, Cloud Messaging) — device and installation identifiers, operating-system model and version, application version, in-app events, crash reports, push-notification token; for analytics, crash diagnostics, and delivering notifications.
• AppMetrica — device identifier, in-app events, technical data; for product analytics.
• Google Maps — coordinates; to display the map of sports facilities.
• Automatic image-recognition service — a meal photo or its text description; to determine composition and calorie content.
• SMS delivery operator — phone number and confirmation-code text; to confirm sign-in.
• Hosting provider — data hosted on the Company's servers; to host the infrastructure.

Some service providers are located outside the Republic of Uzbekistan. Personal data is transferred to them only to the extent necessary to provide the relevant services, under agreements that require them to maintain confidentiality and protect the data.

5. User rights

The User has the right to:

• obtain information about the processing of their personal data;
• have inaccurate data rectified, corrected, or blocked;
• restrict processing;
• withdraw previously given consent;
• have data destroyed ("the right to be forgotten");
• opt out of marketing messages;
• lodge requests and complaints about the Company's actions.

To exercise any of the rights listed above, the User may contact admin@uzfit.uz.

6. Data protection

The Company applies legal, organisational, and technical protection measures: limiting employees' access to personal data, authentication, transmitting data over secure protocols, encrypted storage of access tokens on the User's device, backups, and staff training.

7. Retention periods

Personal data is not kept longer than required by the purposes of its processing:

• profile and account — until the User deletes their account;
• health, habit, body-metric, and nutrition data, including meal photos — until the relevant entry or the account is deleted;
• payment records and related accounting documents — for the period established by the accounting legislation of the Republic of Uzbekistan;
• records of actual visits to sports facilities — for the period necessary to settle accounts with Partners and resolve any disputes;
• technical logs and crash data — for the period necessary to ensure security and diagnostics;
• analytics events — for the retention period set by the relevant analytics service's settings.

8. Account deletion and data destruction

The User may delete their account independently in the application or by sending a request to admin@uzfit.uz.

When an account is deleted, the following are deleted: the profile, photo, entered health and nutrition data, habit and metric history, saved meals, and posted reviews.

The following are retained for the period established by law: records of payments made and related accounting documents, and data on actual visits to sports facilities needed to settle accounts with Partners. Such data is kept separately and is not used to contact the User.

Purchased, unused memberships are not refunded when an account is deleted, unless otherwise provided by the terms of the specific membership.

Data is also destroyed once the purposes of processing have been achieved, upon withdrawal of consent, upon expiry of retention periods, upon discovery of unlawful processing, or by court order.

Destruction methods: deletion from databases, overwriting server media, shredding paper documents, and physically destroying information carriers.

9. Changes to the Policy and contacts

The Company may make changes to this Policy. The current version is always available in the application and at uzfit.uz.

For any questions related to the processing of personal data, the User may contact admin@uzfit.uz.