Privacy Policy – PetiFit

1. What is this policy?

This explains how PetiFit Sp. z o.o. processes personal data of users of the PetiFit mobile application and the petifit.com website, in line with the GDPR (EU Regulation 2016/679).

2. Data we collect

a) Account & sign-in

• E-mail address and password (stored as a hash).
• Apple / Google Sign-In (enabled): external ID and e-mail. We do not receive your Apple/Google passwords.

b) Pet data

• Species, breed (including “unknown/mixed”), name, gender, birth/adoption date, weight, allergies, diseases, microchip/tattoo, color and all other information added by a user.
• Photos you upload.

c) Health & nutrition

• Visits, vaccinations, medications, symptoms, measurements (e.g., weight, temperature), notes.
• Meals, pet food, calorie & macro targets, food photos, goals (e.g., steps).

d) Media (photos)

You may upload specifically selected photos from your gallery or take a picture directly within the App. PetiFit only accesses the camera while taking a photo – it does not have continuous access to your camera or the entire photo library.

e) Technical data & location

• Logs and diagnostics (app version, OS, error timestamps).
• Push notification token.
• Location—only after permission (e.g., route maps, “find a clinic”).
• Cookies and similar technologies on the Website (see “Cookies”).

3. Why we process data

AI data processing

Some features (e.g., recognizing text from health booklet photos, symptom analysis, nutrition recommendations) use AI models, including OpenAI services. Data sent for analysis (e.g., photos, text) are processed solely to perform the requested function and transmitted over encrypted channels (TLS).

4. How long we keep data

• Account data—while your account is active and up to 6 months after deletion.
• Pet & health records—until you delete them or together with the account.
• Technical logs—typically up to 12 months.
• Consent records—until withdrawn (and up to 12 months for evidential purposes).
• Accounting records—as required by law (typically up to 5 years).
• AI training data — selected and encrypted pet-related data may be stored and processed to improve our AI models. These data remain protected and are not accessible in a form that allows direct identification of the User. Datasets are securely stored within infrastructure controlled by PetiFit Sp. z o.o. and are periodically reviewed to remove outdated or unnecessary information.

5. Where and how we store data

• Currently: a secure local server controlled by PetiFit Sp. z o.o.
• Planned: migration to a company-owned EU/EEA cloud (we will notify users and update this policy).
• Security: HTTPS/TLS, password hashing, access control, admin event logging.

6. Who we share data with

We share data only when necessary and only with:

• IT providers (hosting/cloud) under data processing agreements (Art. 28 GDPR),
• Apple/Google for authentication according to their policies,
• OpenAI or other AI providers — when using features that rely on external AI technology (e.g., image or text analysis). Data are shared automatically and only to the extent necessary for that function. By accepting these Terms, you consent to such processing, as described herein,
• Public authorities — when required by law.

Sharing with Other Users (Family & Community)

When you use social features within the App, certain data will be shared with other users based on your actions:

• Family Sharing: If you invite other users (e.g., family members) to manage your pet’s profile, they will have access to the pet's full data, including health history, location logs, and photos.
• Peti-Friends & Community: If you connect with friends or participate in rankings, your basic profile information (Avatar, Pet Name) and activity statistics may be visible to them. Your real-time location is shared only if you explicitly enable “Live Status” or similar tracking features for your friends.

We do not sell personal data. If data are transferred outside the EEA, we apply appropriate safeguards (such as Standard Contractual Clauses under Art. 46 GDPR).

Note: Data shared with external AI providers are encrypted, processed securely, and used only for the requested function. They are not stored or reused by those providers for their own purposes.

7. Your rights

You have the right to access, rectify, erase, restrict processing, data portability, object, and withdraw consent (without affecting prior lawful processing). Contact: contact@petifit.com. We reply within 30 days.

You may lodge a complaint with a supervisory authority. In Poland: President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

8. Children

The app is intended for users aged 16+. We do not knowingly collect data from children without parental consent.

9. Cookies and similar technologies (Website)

We use essential cookies. Analytics/marketing cookies operate only with your consent via a cookie banner. If we embed Apple/Google sign-in elements, those providers may use their own identification mechanisms under their policies.

10. Policy updates

As features evolve, we may update this policy. The version and date appear at the top. Material changes will be notified in the app and/or on the Website.

11. AI Model Training

To improve the accuracy of analysis and the quality of health and nutrition recommendations, PetiFit may use data generated in the app to train its own AI models. Data used for training are encrypted. Training is performed solely within infrastructure controlled by PetiFit Sp. z o.o. and aims to enhance app features (e.g., symptom detection, food recommendations, behavior analysis).

The legal basis is user consent (Art. 6(1)(a) GDPR).

Your Rights Regarding AI Training

We use anonymized data to improve our AI models (e.g., for food recognition or document scanning). You have the right to opt-out of having your data used for this purpose at any time. To withdraw your consent, please contact us via email at contact@petifit.com. We will process your request and ensure your data is excluded from future training datasets.