Security and data protection

How we protect your center's data

• Encryption in transit

  Everything that travels between your browser or the app and our servers is encrypted with TLS (HTTPS). We also send the HSTS header, which forces the browser to always use HTTPS with us for one year.

• Encryption of sensitive data

  Special-category data in the regulatory health records (such as ethnic origin, gender identity, disability or health insurer) is stored encrypted. The credentials of the payment gateways and of each branch's integrations are also stored encrypted, and the private keys of certificates are protected by a password reinforced with a server secret that is not in the database.

• Each gym, isolated from the others

  Each person works with a profile tied to one company and one branch, and permissions and queries are limited to that scope. One center cannot see another center's data, and within a center each role only sees what its branch allows.

• Encrypted, tested backups

  We make a daily backup of the databases. Each backup is encrypted (AES-256) before it leaves the server and is stored in encrypted storage; backups are kept for 15 days. To be sure they really work, we run a restore test that brings up a backup in a separate environment and checks that the data is inside.

• Single-use access QR codes

  The QR code the member shows at the turnstile is generated randomly, is single-use and is renewed as soon as it opens a door. If it is not used, it expires after 24 hours and is replaced by another one. There is no fixed key that can be copied or forwarded.

• Audit log

  Relevant actions are logged with who performed them and through which channel (panel, app or assistant), so that you can review what happened and when.

Account protection

• Passwords

  New passwords must be at least 8 characters long (and at most 72). They are never stored in plain text.

• Limits on sign-in attempts

  If someone enters the wrong password repeatedly, access is blocked for a while. The block lifts by itself and does not leave the account unusable.

• Two-step verification (2FA)

  Available with any authenticator app (Google Authenticator, Authy and similar), with recovery codes in case you lose your phone. It is mandatory for platform administrators and for the staff of the branches that decide to require it; anyone who turns it on by themselves can no longer skip it when signing in. If you mark a device as trusted, you are not asked again for 7 days.

• Session expiry

  Panel sessions expire after 7 days and you have to sign in again. You can see and close your active sessions.

Where the data lives

The platform's servers and databases are on Amazon Web Services, in a data center in Spain (European Union). The LAIA assistant works with AI models run on servers in the European Union. More detail on data processing in the privacy policy.

Providers that process data (sub-processors)

These are the providers that process your center's data so that the service works. They only use the data following our instructions.

If the center enables integrations with other services (body composition scales, management software), data is shared with them because the center decides so. When a provider is outside the European Economic Area, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

Data processing agreement (DPA)

If your center needs to sign a data processing agreement with us, we will send it to you when you ask for it by writing to info@fitmewise.com.

Vulnerability disclosure policy

If you think you have found a security flaw in Fitmewise, we want to know. Thank you for reporting it to us responsibly.

How to report

Write to us at info@fitmewise.com. The contact details are also at /.well-known/security.txt.

What to include in your report

• What you found and where (web address, screen or endpoint).
• The steps to reproduce it, with a proof of concept if you have one.
• What impact you think it has and which data could be affected.
• Your contact details, in case we need more information (you can write anonymously, but then we will not be able to reply to you).

What is in scope

• fitmewise.com
• the Dashboard (the center's management panel)
• the Fitmewise API
• the Fitmewise mobile apps and each center's own apps

What is out of scope

• Denial-of-service attacks (DoS/DDoS) or load testing.
• Social engineering against staff, centers or members (phishing, phone calls, etc.).
• Physical attacks against offices, equipment or facilities.
• Sending spam or bulk messages through our forms or channels.

Good faith

If you act in good faith, do not access more data than necessary to demonstrate the flaw, do not modify or destroy it, do not affect the service and give us a reasonable period to fix it before making it public, we will not take legal action against you for that research.

Response times

We acknowledge receipt within a maximum of 5 working days and keep you informed of how the fix is progressing.

Rewards

We do not have a monetary rewards program (bug bounty): we do not pay for reports, although we are very grateful for the effort.