Last changed: 2026-11-13
This policy covers the website refitness.se (including Min sida, the shop, the competitions and the chat) and the reFitness app for iOS and Android. It is one service with one account.
The controller is reFitness AB, company reg. no. 556968-4318, Drottninggatan 13, 702 10 Örebro, Sweden ("reFitness", "we"). reFitness AB owns and runs the service.
The reFitness app is published on the App Store and Google Play by MJ Strategi Tech Solutions S.L., CIF B22575567, Carrer Nou, 12, 2 2b, 17001 Girona, Spain. MJ Strategi Tech Solutions S.L. develops and operates the app and the platform for reFitness AB and processes personal data only on behalf of reFitness AB (processor, see section 6).
For anything about your personal data, contact support@refitness.se or write to reFitness AB at the address above. Support information: refitness.se/support. We have not appointed a data protection officer.
| Data | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account and contact details | Name, email, password (stored only as a hash), address, mobile number, date of birth, gender, height | Create and run your account, deliver the service, customer service | Contract (Art. 6(1)(b) GDPR) |
| Health data | Answers in the health form (for example injuries, illnesses, allergies, goals and training experience), starting weight and waist, weekly check-ins (weight, waist and other measurements, how training and diet went, free text), training log (sessions, sets, weights, reps, notes), meals ticked off, your meal plan and training programme | Personal coaching and follow-up | Your explicit consent (Art. 9(2)(a)) and contract (Art. 6(1)(b)) |
| Progress photos | Photos from the front, side and back | Your coach follows your progress | Your explicit consent (Art. 9(2)(a)) |
| Messages | Chat with your coach in the app and on Min sida, emails to us | Coaching and customer service | Contract (Art. 6(1)(b)). Health data in messages: your explicit consent (Art. 9(2)(a)) |
| AI suggestions for coaches | See section 4 | Coaches reply faster and more consistently | Legitimate interest (Art. 6(1)(f)). Health data: your explicit consent (Art. 9(2)(a)) |
| Food questions | Brand, product name, category and two photos of the packaging that you send on Min sida | Assess whether the product fits your meal plan | Contract (Art. 6(1)(b)) |
| Purchases and payments | What you bought, amounts, payment method, invoices, payment status. Card type and last digits (never the full card number). Personal identity number if you enter it at checkout | Take payment, send invoices and meet bookkeeping rules | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Shop deliveries | Name, address, phone and email | Ship products you bought | Contract (Art. 6(1)(b)) |
| Competitions | Start and end weight, waist, competition photos, your choice about publication, votes | Run the competition and pick winners | Contract (competition rules). Health data: your explicit consent (Art. 9(2)(a)). Publishing photos: your separate consent (Art. 6(1)(a)) |
| Chat and contact form on the website | Name, email, phone if you give it, your messages | Answer your questions | Legitimate interest (Art. 6(1)(f)) or, if you want to become a client, steps before a contract (Art. 6(1)(b)) |
| App technical data | Push token (the address that lets your phone receive notifications), platform (iOS or Android), sign-in key stored in the phone's secure storage | Notify you of new messages and keep you signed in | Contract (Art. 6(1)(b)). Notifications also require your permission in the phone |
| Operations and security | IP address, time, type of browser or app, the address requested, sign-ins and changes made by staff | Operations, troubleshooting and protection against intrusion and abuse | Legitimate interest (Art. 6(1)(f)) |
| Statistics and advertising cookies on the website | See section 9 | Statistics and ad measurement | Your consent (Art. 6(1)(a)) in the cookie banner |
| Marketing | Name and email | Newsletters and offers about our own services to current and former clients | Legitimate interest (Art. 6(1)(f)). You can opt out at any time, see section 10 |
About your consent to health data: Consent is voluntary and you can withdraw it at any time. This does not affect processing that has already taken place. We cannot coach you without health data, so withdrawing consent ends the coaching, and we delete the health data as described in section 11.
Do you have to provide the data? Account and contact details are needed to deliver the service. Health data and progress photos are voluntary, but without them your coach cannot tailor and follow up your coaching.
Suggested replies for coaches. When you have written to your coach and not yet had a reply, an AI tool drafts a suggested reply. The tool receives your first name, your client number, your latest message and up to 8 earlier messages in the same thread (at most 120 days back), plus what is needed for the reply to fit you: your last three weekly check-ins, starting weight, starting waist and height, your meal plan's calories and macros, the name of your training programme, a summary of your health form answers (for example injuries, allergies and goals), your client status and your coach's first name.
Food questions. When you ask on Min sida whether a product fits your meal plan, the AI service Claude from Anthropic reads the label in the photos and suggests an assessment. Anthropic receives the photos and the product details, but not your name or other client details. Suggestions the AI is very confident about may be approved automatically. Other suggestions are approved by a coach.
Automated decisions. We make no decisions about you based solely on automated processing that have legal effects or similarly significantly affect you.
Providers that process data on our behalf (processors)
| Provider | What they do | Data | Location |
|---|---|---|---|
| MJ Strategi Tech Solutions S.L. | Publishes the app, and develops and operates the app, the website and the platform (including the chat case system and the AI tool for coaches) for reFitness AB | The data in section 3 needed for operations, troubleshooting and support | Spain (EU) |
| Bahnhof AB | Server, database and file storage for the website, the app's server, email and progress photos | All data in section 3 | Sweden |
| Expo (650 Industries, Inc.) | Forwards the app's notifications to Apple and Google | Push token and the notification text ("New message from your coach"). Notifications never contain your messages or health data | USA |
| Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) | Deliver notifications to your phone | Push token and the notification text | USA and EU |
| Anthropic | AI assessment of food products (section 4) | Packaging photos and product details, no client details | USA |
| Klaviyo | Sending newsletters | Name and email | USA |
| Vimeo | Plays videos, for example live sessions on Min sida | IP address and browser details when the video loads | USA |
Recipients responsible for their own processing
We do not disclose your data to anyone else.
Some of the providers above are in the USA or may process data there: Expo, Apple, Google, Anthropic, Klaviyo, Vimeo, Meta and LinkedIn. Transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework for certified companies, and otherwise on the European Commission's standard contractual clauses. You can get a copy of the safeguards by emailing us.
All other data, including health data, progress photos and messages, is stored in Sweden.
| Data | How long |
|---|---|
| Account, profile, meal plan, training programme, weekly check-ins, training log, messages and AI suggestions | As long as you have an account. When you request deletion: see section 11 |
| Health form answers | Deleted 30 days after your period ends if you are no longer an active client. We ask for new answers when you start a new period |
| Progress photos | As long as you have an account. If you have not been active for a year, we move the photos from the server to an encrypted backup. You can ask us to restore or delete them |
| Competition photos | Deleted 183 days after your latest competition photo. Photos you agreed to publish stay visible until you ask us to remove them |
| Card type and last digits | 90 days |
| Invoices and bookkeeping records | 7 years after the end of the calendar year in which the financial year ended, as the Swedish Bookkeeping Act requires |
| Error logs | 30 days |
| Server request logs (IP address, time, address) | [30 days] |
| Push token | Until you sign out of the app, the app is uninstalled, or the account is deleted |
| Chat and contact form on the website | [12 months] after your latest message, unless you become a client |
| Database backups | Overwritten within [30 days] |
The app uses no cookies and no tracking. On refitness.se we use cookies and similar technologies:
| Category | Cookie | From | Purpose | Lifetime |
|---|---|---|---|---|
| Necessary | PHPSESSID | refitness.se | Keeps you signed in and remembers your basket during the visit | Until you close the browser |
| Necessary | refkod | refitness.se | Keeps you signed in between visits if you chose that | 365 days |
| Necessary | rf_consent | refitness.se | Stores your choice in the cookie banner | 365 days |
| Necessary | Visitor token in browser storage (not a cookie) | refitness.se | Shows your chat conversation after you have written to us | Until you clear browser storage |
| Statistics | _ga, ga* | Google Analytics | Statistics on how the website is used | Up to 2 years |
| Marketing | _fbp, _fbc | Meta | Measure and target ads on Facebook and Instagram | Up to 90 days |
| Marketing | Google Ads cookies | Measure ads | Up to 90 days | |
| Marketing | li_*, bcookie, lidc | Measure ads on LinkedIn | Up to 1 year | |
| Marketing | __kla_id | Klaviyo | Link visits to the newsletter | Up to 2 years |
Statistics and marketing cookies are only set if you accept them. Saying no is as easy as saying yes, and you can change your choice at any time:
Vimeo videos are embedded with the "do not track" setting, which sets no cookies.
You have the right to:
Email support@refitness.se. We reply within one month. To protect your data we may need to confirm that it is you, for example by asking you to write from the email address registered on the account.
You can also complain to a data protection authority in the country where you live or work, or where we are established. reFitness AB is established in Sweden, where the authority is Integritetsskyddsmyndigheten (IMY), www.imy.se. In Spain, where the app publisher is based, it is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.
How to request deletion
What happens next
All traffic between the app or your browser and our servers is encrypted (HTTPS). Passwords are stored only as a hash. The app's sign-in key is stored in the phone's protected storage (the iOS Keychain or Android's encrypted storage). Progress photos are stored encrypted and can only be fetched after signing in, through links that expire after a short time. Only staff who need the data for their work have access to it.
If a personal data breach occurs, we report it to the supervisory authority within 72 hours. If the breach may pose a high risk to you, we tell you directly.
The app is for people aged 18 or over. Purchases on the website follow the age limit in the terms of purchase. We do not knowingly collect data about children.
We update this policy when our processing changes. For material changes we notify you in the app or by email before they take effect. The date at the top shows when the policy was last changed.
