Privacy Policy — KINEVA FIT
Version: 2.11
Last updated: 3 October 2026
Language: English
Information notice under Articles 13–14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 (Italian Privacy Code), as amended by Legislative Decree 101/2018.
Disclaimer: operational text aligned with GDPR practice and the app’s features; have counsel/DPO review it before relying on it as final legal advice for production publication.
1. Data controller
Controller: SYNAPSE DIGITAL Advanced App Development (company of the KINEVA FIT application)
Registered address: Largo Molinetto n. 1, 20900 Monza (MB), Italy
Phone: +39 371 7364261
VAT: 14895130962 · D-U-N-S: 302873219
Support / privacy contact: [email protected]
Company website: synapse-digital-adv-app.com
To exercise GDPR rights, write to the privacy address above with the subject line “KINEVA FIT privacy request”.
No DPO is appointed (not required under the Controller’s current setup). If appointment becomes mandatory in the future, the DPO’s contact details will be published in this notice.
2. Scope and nature of the service
The application is published as KINEVA FIT on the Apple App Store and Google Play.
KINEVA FIT is a fitness application (running, gym and Apple Watch training) and a workout-organisation tool, including multi-client features for trainers/gyms.
It is not a medical device (MDR / Italian Legislative Decree 46/1997 as amended), and does not provide diagnosis, treatment or medical advice.
Educational content in the app (exercise illustrations, muscle-group indications, descriptions and silhouettes) is purely informational and illustrative: it is not healthcare advice and not a personalised biomechanical analysis.
“Focus areas” / physical limitations and self-declared conditions entered by the user or trainer are training preferences / declarations, not clinical records. If such data may qualify as health data (GDPR Art. 9), processing takes place only with the data subject’s explicit consent (Art. 9(2)(a)), collected through in-app acceptance flows and system permissions.
3. Categories of data processed
| Category | Examples | Typical legal basis |
|---|---|---|
| Profile / identifiers | name, optional email/phone, notes, goals | Art. 6(1)(b) contract / (a) consent |
| Training data | routines, sets, session history, notes | Art. 6(1)(b) |
| Self-declared fitness biometrics | weight, height, BMI, optional body composition | Art. 6(1)(a)/(b); if health-related → Art. 9(2)(a) |
| Focus areas / self-declared conditions | physical focus tags, free text | Art. 9(2)(a) explicit consent |
| Technical usage data | app preferences, legal/onboarding flags | Art. 6(1)(f) / (b) |
| In-app purchases | subscription and add-on status (via App Store / Google Play / RevenueCat) | Art. 6(1)(b) |
| HealthKit (iOS, if authorised) | writing completed workouts (and outdoor route when present) to Apple Health / Fitness | Art. 6(1)(a) + Apple authorisation |
| Location and GPS track (if authorised) | coordinates during outdoor runs, downsampled track, distance and pace | Art. 6(1)(a) + system permission |
| Map snapshot / tiles | street background image for the route summary | Art. 6(1)(b)/(a); bounding box only to the provider |
| Images (photo import of a routine) | photo of a paper routine sent to AI APIs (if you use the feature) | Art. 6(1)(a)/(b) |
| AI prompts / inputs | text and, where applicable, profile data (age, sex, weight, conditions, sports) and/or image | Art. 6(1)(a)/(b) |
| Device licence data | local identifier and subscription “seat” registry (Keychain / Keystore; iCloud Keychain sync if enabled) | Art. 6(1)(b)/(f) |
| App protection credentials | hashed trainer PIN and recovery code (not plaintext); biometric unlock flag (Face ID / fingerprint) | Art. 6(1)(b)/(f) |
The app does not require identity documents or payment data handled directly by the Controller (payments go through Apple / Google).
4. Purposes of processing
- Provide fitness features (routines, timers, history, export, Watch).
- Manage athlete/client profiles and training preferences (including multi-trainer).
- Sync workouts with Apple Watch (when enabled).
- Write completed workouts to Apple Health / Fitness (iOS, if authorised).
- Measure distance, pace and route for outdoor runs (Athlete Pro plan or higher).
- Show the street map of the route after a session.
- Manage subscriptions, device seats, AI credits and add-ons (e.g. Pilates pack).
- Protect access to the trainer area / App Lock (PIN, device biometrics).
- Improve product stability and security (local technical diagnostics).
- Comply with legal obligations.
We do not use data for third-party advertising profiling or sale to data brokers. There is no KINEVA FIT backend that centralises users’ routines, GPS or biometrics.
5. Means and place of storage
- Offline-first architecture: most data stays on the device (local encrypted Hive database and, where applicable, Keychain / Keystore).
- GPS coordinates and the route track stay on the device (and on Apple Watch, if used). They are not sent to KINEVA FIT servers.
- To draw streets under the route, the app may request a map snapshot or tiles from Apple Maps, Esri or OpenStreetMap: the provider receives the geographic area (bounding box) needed for rendering, not the full GPS track.
- Backup, export or sync occur only when started by the user (File / Email / WhatsApp / ZIP archive to Files/iCloud/Drive) or required by a feature (e.g. WatchConnectivity).
- The licence seat registry may sync via iCloud Keychain if the user has iCloud Keychain enabled (licence metadata only, not workout routines).
- Retention period: until deletion of data in the app, uninstall, or an erasure request to the Controller; billing data remains with Apple / Google under their policies.
6. Recipients and processors
Data may be processed, within the limits of the service, by:
| Party | Role | Typical data |
|---|---|---|
| Apple Inc. / App Store | iOS payments, HealthKit, Apple Maps snapshots, Watch | Purchases, permissions, map area, workouts written to Health |
| Google Play / Google LLC | Android payments; Gemini APIs (optional AI) | Purchases; content/prompts/images sent to AI APIs |
| Esri / OpenStreetMap | Street map tiles or static export | Run bounding box |
| RevenueCat | Subscription / add-on entitlements | Subscription identifiers (not Hive routines) |
| User-chosen channels | Export sharing (Email, WhatsApp, File, Drive/iCloud) | User-generated files (PDF/JSON/ZIP) |
| Device / iCloud (system backup or Keychain) | System backup or sync enabled by the user | Per Apple / Google settings |
Extra-EEA transfers (e.g. USA) take place, where applicable, with Chapter V GDPR safeguards (adequacy decisions, SCCs and providers’ measures).
Trainers / Studio: if you use Pro/Studio plans, toward your clients’ data you typically act as an independent controller. You are responsible for legal bases, notices and instructions to your clients. Routine export/transfer features may include client identity and biometric data: use them only with an adequate legal basis.
7. Data subject rights (GDPR Chapter III)
You may exercise at any time:
- access (Art. 15)
- rectification (Art. 16)
- erasure (Art. 17)
- restriction (Art. 18)
- portability (Art. 20)
- objection (Art. 21)
- withdrawal of consent (Art. 7), without affecting the lawfulness of processing before withdrawal
- complaint to the Italian Data Protection Authority (Garante) (www.garanteprivacy.it) or to the supervisory authority of your EU Member State of residence
To delete data from the app: use the profile/data deletion features in Settings, or contact the Controller. Uninstalling removes residual local data on the device, without prejudice to system backups created by the user.
8. Children
The service is intended for users of an age that meets store requirements and, in Italy, generally at least 14 years for autonomous digital consent (Art. 2-quinquies of the Privacy Code), unless otherwise capable. If you are under 14, parental/guardian consent is required. In other EU Member States, the age set by national implementing law applies (between 13 and 16).
9. Security and confidentiality
Technical and organisational measures adopted, proportionate to the risk:
- encryption of the local Hive database (key in Keychain / Keystore);
- trainer PIN and recovery code stored as hashes (not plaintext);
- App Lock with timeout and optional unlock via device biometrics (Face ID / fingerprint);
- selective routine sharing that does not include email, phone, conditions or full client biometrics (id and name only), unless an explicit full trainer export/transfer is used;
- no KINEVA FIT application server for routines/GPS;
- cleartext HTTP traffic disabled on the Android client.
No system is 100% secure: protect the device with a passcode/biometrics and do not share unencrypted backups. If the device is compromised or you use export channels you choose (email/WhatsApp), responsibility for that transmission rests with whoever starts the share.
10. Cookies / web tracking
The native app does not use profiling cookies or the Controller’s advertising analytics SDKs. Linked sites (landing / legal documents on Cloudflare) may use technical cookies of the hosting provider; we do not profile visitors for marketing.
11. Changes
We will update this notice if material changes occur. The date at the top indicates the current version. Where changes require new consent, it will be requested in-app (disclaimer / system permissions).
12. Contact
Support / privacy email: [email protected]
Phone: +39 371 7364261
For general legal matters about the product: the same channel or the address shown on App Store Connect / Google Play Console.