Thrive AI & Tech Sdn Bhd ("we", "us", or "our") operates the FLEX - MY Fitness Platform mobile application (the "App"). This Privacy Policy explains how we collect, use, share, and protect your personal data when you use FLEX. It applies to users worldwide, including those protected by the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the Malaysia Personal Data Protection Act 2010 (PDPA).
1. Data Controller
The data controller responsible for your personal data is:
Thrive AI & Tech Sdn Bhd
Block C-5-7, Level 5, Menara Uncang Emas 85, Jalan Loke Yew, 55200 Kuala Lumpur, W.P. Kuala Lumpur, Malaysia
Email: myprojectfit@gmail.com
2. Information We Collect
2.1 Information You Provide
Account information: phone number, name, email address (via phone OTP, Google, or Apple sign-in)
Profile and health data: age, gender, height, weight, body fat percentage, fitness goals, city/location
Nutrition data: calorie and macro goals, food diary entries, water intake, weight log
Food photos: images you take or upload for AI-powered calorie and nutrition analysis
Chat data: messages and interactions with Nova, the AI Fitness Coach
Workout data: workout sessions completed, exercise preferences, program enrolment and progress
Support requests: email address and message content when you contact us
2.2 Information Collected Automatically
Device data: device model, operating system version, app version, language, time zone
Usage data: features used, screens viewed, session duration, interaction events
Analytics identifiers: anonymous IDs assigned by analytics services (not tied to your real identity)
Push notification tokens: device tokens for delivering push notifications (only with your consent)
2.3 Information from Third-Party Integrations
Apple Health / Health Connect: step count, active calories burned (only with your explicit permission; we read but do not write to these services)
Subscription data: purchase status, subscription plan, expiration date (via our subscription management provider; we do not receive payment card details)
2.4 Points and Gamification Data
Points balance, earning history (from food logging, step tracking, workout completion, Instagram sharing, and other qualifying activities)
Points redemption history
3. Legal Basis for Processing (GDPR)
We process your personal data based on the following legal grounds:
Providing the App and its features: Contract performance (Art. 6(1)(b))
Processing food photos via AI: Contract performance (Art. 6(1)(b))
Providing AI Fitness Coach (Nova) responses: Contract performance (Art. 6(1)(b))
Responding to support requests: Legitimate interest (Art. 6(1)(f))
Instagram sharing for points: Consent (Art. 6(1)(a))
4. How We Use Your Information
Provide AI-powered food recognition and calorie/macro tracking
Calculate personalised nutrition goals, TDEE, and health scores
Deliver AI Fitness Coach (Nova) conversations and recommendations
Track and manage workout sessions, programs, and exercise history
Sync activity data (steps, active calories) from Apple Health or Health Connect
Operate the points and gamification system, including earning and redemption
Process and manage your subscription
Send push notifications (reminders, progress updates, workout schedules) — only with your consent
Analyse usage patterns to improve the App (aggregated, anonymised)
Respond to support requests
Comply with legal obligations
5. AI Processing
5.1 Food Photo Analysis
When you scan a food photo, the image and any accompanying text description are sent to a third-party AI service (e.g., OpenAI API or equivalent) for analysis. The AI provider processes this data solely to return nutrition results and does not use it to train their models. We do not send your name, email, or any identifying information to the AI provider — only the food image and description.
5.2 AI Fitness Coach (Nova)
When you interact with Nova, your messages and relevant context (such as your fitness goals, nutrition data, and recent activity) are sent to a third-party AI service for processing. This enables Nova to provide personalised, context-aware fitness and nutrition guidance. We do not send your name or email to the AI provider. Conversations with Nova are stored on our servers to maintain chat continuity and improve the service.
6. Data Sharing
We do not sell your personal data. We share data only with the following categories of service providers, solely for the purposes described in this policy:
AI Service Provider (e.g., OpenAI): food photo analysis, Nova chat processing — food images, text descriptions, chat messages
Subscription Management Provider (e.g., Apphud or equivalent): purchase events, subscription status
Cloud Infrastructure Provider (e.g., AWS): hosting and data storage — all app data is stored on secure cloud servers
All service providers are contractually obligated to process data only on our behalf and in accordance with this policy.
7. International Data Transfers
Your data may be transferred to and processed in countries outside your country of residence, including the United States (AI providers, analytics services, cloud infrastructure). These transfers are necessary for providing the App's functionality. Where required by GDPR, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or the service provider's adequacy certification, to ensure appropriate safeguards.
For Malaysian users, we comply with the cross-border data transfer requirements under the PDPA.
8. Data Retention
Nutrition and workout data: stored on our servers and associated with your account. Deleted when you delete your account or request data erasure.
Food photos: processed in real-time by the AI provider. Photos from successful scans are not stored on our servers after analysis is complete. However, if you submit a missing food report, the associated food photo may be retained on our servers for the purpose of reviewing and adding the item to our nutrition database. These photos are deleted once the food item has been added or the report has been resolved.
Nova chat history: retained for the duration of your account to maintain conversation continuity. Deleted upon account deletion.
Analytics data: retained for up to 26 months, then automatically deleted.
Support correspondence: retained for up to 12 months after resolution.
Subscription records: retained as required by tax and accounting regulations (typically 3–7 years).
Points and gamification data: retained for the duration of your account. Deleted upon account deletion.
9. Your Rights
9.1 Rights Under GDPR (EU/EEA/UK Users)
You have the following rights regarding your personal data:
Access — request a copy of the personal data we hold about you
Rectification — request correction of inaccurate or incomplete data
Erasure ("Right to be Forgotten") — request deletion of your personal data
Restriction — request that we limit processing of your data
Data portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interest
Withdraw consent — withdraw consent at any time (for consent-based processing)
Lodge a complaint — file a complaint with your local data protection authority
9.2 Rights Under CCPA (California Residents)
California residents have the right to:
Know — request disclosure of the categories and specific pieces of personal information we collected
Delete — request deletion of your personal information
Opt-out of sale — we do not sell personal information, so this right does not apply
Non-discrimination — we will not discriminate against you for exercising your rights
9.3 Rights Under Malaysia PDPA
Malaysian users have the right to:
Access — request access to your personal data held by us
Correction — request correction of personal data that is inaccurate, incomplete, misleading, or not up to date
Withdraw consent — withdraw consent for the processing of your personal data
Make complaints — lodge a complaint with the Department of Personal Data Protection
9.4 How to Exercise Your Rights
To exercise any of these rights, contact us at myprojectfit@gmail.com. We will respond within 30 days (GDPR/PDPA) or 45 days (CCPA). We may ask you to verify your identity before processing your request.
You can also delete your account and associated data through the App's settings.
10. Free Tier Usage Limits
The App may enforce daily usage limits for free-tier users (e.g., chat messages per day, food logs per day). These limits are managed through your account and do not involve the collection of additional personal data beyond what is described in this policy.
11. Security
We implement industry-standard security measures to protect your data, including encrypted data transmission (TLS/HTTPS), secure cloud infrastructure (AWS), and access controls. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.
12. Children's Privacy
FLEX is not intended for children under 16 (or under 13 in jurisdictions where that is the applicable age). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at myprojectfit@gmail.com.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the App and updating the "Last Updated" date. For significant changes, we may also notify you via push notification or email. We encourage you to review this policy periodically.
14. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:
Email: myprojectfit@gmail.com
Mail: Thrive AI & Tech Sdn Bhd, Block C-5-7, Level 5, Menara Uncang Emas 85, Jalan Loke Yew, 55200 Kuala Lumpur, W.P. Kuala Lumpur, Malaysia