Privacy policy
Version privacy-2026-01
imhfit processes health data. This policy explains in plain language which data is processed, why and for how long.
1. Controller
The operator of this installation is the controller. Contact details are published in the imprint of the respective installation.
2. Which data we process
Account data (email, password hash), profile data (age, height, weight, activity level), health and behaviour data (steps, sleep, water, meals, alcohol, mood), challenge results, chat messages to the coach and technical data such as device information for push notifications.
3. Legal basis
Health data is processed solely on the basis of your explicit consent under Art. 9(2)(a) GDPR. Without this consent the app cannot be used, because it is its core purpose.
4. Purpose limitation and data minimisation
Your data is used only to create and adapt your plan and to show your progress. Operational statistics are evaluated in pseudonymised form.
5. AI processing
AI usage is optional and has three levels: no AI, AI with reduced data (aggregates without free text) or AI with full context. Without consent no health data is transferred to an AI provider. Raw payloads of AI calls are deleted after 30 days; anonymous metrics are kept.
6. Retention
Account data is stored until the account is deleted. AI raw data is removed after 30 days, audit logs after 12 months. After a deletion request all personal data is permanently removed following a 14 day grace period.
7. Recipients
Data is only transferred to the AI provider you approved and to your browser’s push service, as far as required for the feature. There is no sale of data and no advertising networks.
8. Security
HTTPS only transport, modern password hashes, rate limiting, CSRF protection, a content security policy and audit logs that contain no personal health values.
9. No medical advice
imhfit makes no diagnosis and does not replace medical advice. If you have complaints, please contact a healthcare professional.
Your rights
- Access to all stored data (data export as JSON).
- Correction of wrong entries directly in the app.
- Deletion of individual entries or of the whole account.
- Withdrawal of any consent, at any time and without giving reasons.
- Restriction of processing, for example by switching the AI off.
- Data portability through the machine readable export.
- Complaint to a data protection authority.
This app is not a substitute for medical advice. Listen to your body and consult a doctor if you have health complaints.