Yes. Fitycal is committed to protecting personal data in accordance with the General Data Protection Regulation (GDPR) for European users. https://www.fitycal.com/privacy-policyFitycal explains that although data may be processed in the United States (where laws may differ from EU standards), the company takes appropriate steps to handle information securely and responsibly in line with GDPR requirements.

User data is stored on secure servers hosted by reputable cloud providers such as Amazon Web Services (AWS) and DigitalOcean. AWS and DigitalOcean infrastructure complies with international privacy standards, including GDPR protections for European users. https://www.fitycal.com/privacy-policy Fitycal uses industry-standard technical and organizational security measures to protect data and only processes personal information to deliver the services you expect, such as generating scan reports and visualizing progress.

Ownership of scan data depends on how Fitycal is used. Business Use (Gyms, Clinics, Wellness Centers – B2B) When Fitycal ScanPro is used by a business: The business (gym, clinic, or wellness center) acts as the data controller The business is responsible for collecting consent and managing how client data is used Fitycal acts as the data processor, processing data only under the business’s instructions In all cases, scan data is not made public and is processed solely for the purpose of providing the service.

Yes. When Fitycal ScanPro is used in a business setting (such as a gym, wellness center, or lifestyle clinic), the business acts as the data controller and manages client data within its organization. Businesses can: Create and manage client accounts Control who within their team has access to scan data Download, share, or print reports for consultations Respond to client requests regarding access, correction, or deletion of data Define internal procedures for data handling and retention Fitycal acts as the data processor, meaning it processes data only to provide the service and under the instructions of the business. All access and processing are subject to applicable data protection regulations, including GDPR where applicable.