Privacy Policy

1. Scope

This Privacy Policy (“Policy”) describes how Guten Group US Holdings, Inc., doing business as “Fysigo” (“Fysigo,” “we,” “us”), collects, uses, stores, shares, and protects information when you use the Fysigo marketplace and software platform — the websites, mobile apps, and APIs at fysigo.com, app.fysigo.com, coach.fysigo.com, and related domains.

Fysigo is a neutral technology platform that connects independent wellness, fitness, nutrition, bodywork, massage, and coaching professionals (“Providers”, called “Coaches” in our Terms of Service) with individuals who book them (“Clients”). Fysigo is not a healthcare provider and does not deliver the services Providers offer.

2. What we collect

We collect only what we need to operate the platform. Categories include:

• Account and profile information. Name, email address, password hash, role (Client, Provider, or admin), profile photo, locale, timezone, and optional demographic fields you choose to provide (for example date of birth, sex, height, or weight).
• Booking and marketplace information. Engagements between Clients and Providers, session times, booking notes, service selections, delivery mode, pricing snapshots, cancellation and payment status, and consent records (including marketplace terms and recording consent).
• Payment information. Fysigo does not store full payment-card numbers. Stripe Connect processes payments and payouts on our behalf; we receive transaction identifiers, amounts, and payout status — not card data.
• Health-related information you provide. Intake answers, contraindication attestations, conditions or goals you disclose to a Provider, lab results and biomarkers you upload, wearable readings you authorize (for example Oura sleep and recovery data), nutrition logs, supplements, protocols, coach-authored programs and notes, and medical questionnaire responses. This information may qualify as sensitive personal information or consumer health data under applicable law.
• Session recordings and transcripts. When you and the other participant have each given affirmative recording consent, video and audio of online coaching sessions may be cloud-recorded and transcribed. See Recording & transcription terms and Section 10 below.
• Communications. Messages sent through the platform, support requests, and engagement with the promotional emails described in Section 11.
• Device and usage data. IP address, browser user-agent, error reports, and operational logs used to secure and improve the platform.
• Integrations you authorize. OAuth tokens and sync metadata for services you connect (for example Oura or Google Calendar).
• Approximate location.If you ask the app to set your circadian light window for you, it reads your device’s approximate location once, at that moment. Fysigo rounds the reading to roughly one kilometre before storing it on your profile and never stores a more precise value. Location is not collected in the background, is not used to track you, and is not used for advertising. You can decline the prompt and set your window manually, you can clear a stored location at any time from Settings, and you can revoke the permission in your device settings.
• Camera, microphone, and photos. On mobile, Fysigo asks for camera access to scan food barcodes and to take progress or injection-site photos, photo-library access when you attach an image you already have, and microphone access so you can be heard during a video session. Photos you choose to save are stored as described above. Barcode scanning is performed on your device and only the resulting product code is sent to Fysigo — the camera image is not. The pre-session audio and video check runs entirely on your device and is neither recorded nor transmitted.

3. Health information

Fysigo facilitates bookings and collaboration between Clients and Providers. Information you share — including intake forms, health conditions, lab results, wearable metrics, session notes, and transcripts — may relate to your health.

• How we use it. To deliver the service you booked, enable your Provider to prepare for and conduct sessions, operate safety and consent workflows (for example massage intake and contraindication gates), provide session recaps and collaboration tools, resolve disputes, and comply with law.
• Who sees it. Your engaged Provider sees the Client information relevant to your booking and ongoing engagement, subject to platform permissions. Fysigo personnel and subprocessors access health-related data only as needed to operate, secure, and support the platform — not for unrelated marketing.
• Fysigo is not a healthcare provider. We do not diagnose, treat, or provide medical advice. Providers are independent businesses responsible for their own professional obligations.
• Consumer health data. Where applicable, we handle self-directed health information under explicit consent and applicable consumer-health and privacy laws (including state laws such as the FTC Health Breach Notification Rule where relevant).

4. How we use information

• To create and manage your account and authenticate you.
• To list, discover, book, and deliver Provider services.
• To process payments and Provider payouts through Stripe.
• To host video sessions and, when consented, record and transcribe them.
• To send transactional messages (confirmations, security alerts, booking updates).
• To operate, secure, monitor, and improve the platform.
• To send the few promotional emails described in Section 11 — renewal offers and coach invitations — each with a one-click unsubscribe that we honor for every later send.
• To train and improve AI features you choose to use or consent to — see AI training terms.
• To comply with legal obligations and enforce our terms.

5. Marketplace data sharing

When a Client books a Provider, Fysigo shares identifying information, booking details, and relevant intake or health information with that Providerso they can deliver the booked service. The Provider is an independent business with its own privacy practices and legal obligations; how the Provider uses Client information outside the platform is the Provider's responsibility.

Fysigo does not sell your personal information. We share information only as described in this Policy, with subprocessors that help us operate the platform, when required by law, or in connection with a business transition subject to notice.

6. Where data is stored

• Supabase (primary application database). Profiles, bookings, engagements, messages, consents, and operational data live in Postgres with row-level security, encrypted at rest, in a US-hosted region.
• Health-data storage. Lab artifacts, session recordings, transcripts, biomarkers, and related health records may be stored in Fysigo-controlled private storage and, where enabled, a dedicated health-data environment with server-only access and audit logging.
• Object storage. Uploaded files and recording artifacts are stored in private buckets; access uses time-limited signed URLs.
• Vercel. Application hosting and edge delivery. Application code and short-lived operational logs only — not the canonical home of health records.

7. Sub-processors

We use trusted service providers to run the platform. They process data only under our instructions and contractual safeguards:

• Supabase — database, authentication, and file storage.
• Stripe — payment and payout processing (operational metadata only; we do not send health content to Stripe).
• Daily.co — live video, cloud recording, and transcription for consented sessions.
• Vercel — application hosting, plus Vercel Web Analytics and Speed Insights: page views, referrer, browser and device type, country, and page-load timings, collected without cookies and not linked to your account.
• Sentry — error monitoring. When something breaks, Sentry receives the error, the page or request it happened on, and browser and device details. Session replay (recording of your screen) is off. We do not send your name or email with errors, and request bodies, cookies, and headers are removed for health-data pages.
• Resend — email delivery: booking, billing and account notifications, and the few promotional emails described in Section 11 (message bodies are operational, not clinical records).
• Anthropic — AI features you invoke in the product.
• TypeSafe — AI classification of entries you make in the product (for example a typed meal, a dosing frequency, your training log, or a chat report).
• DeepL / OpenAI — message translation when enabled.
• Oura — wearable data sync when you connect your account.

We may update this list as our stack evolves. Sub-processors that receive health-related data are engaged with data-protection terms appropriate to the data they handle.

8. HIPAA and Business Associate Agreements

Fysigo is not a HIPAA covered entity. Some Providers may be covered entities or their business associates under HIPAA. Where a Provider is a covered entity and Fysigo processes protected health information (“PHI”) on the Provider's behalf, a Business Associate Agreement (“BAA”) governs that PHI.

Providers who require a BAA may request one at legal@fysigo.com. Until a BAA is executed, do not treat the platform as HIPAA-certified infrastructure. Fysigo does not make “HIPAA-compliant” marketing claims unless and until appropriate agreements and safeguards are in place.

9. Security and breach notification

We use industry-standard technical and organizational measures: encryption in transit (TLS), encryption at rest, row-level security, scoped service credentials, and audit logging on sensitive operations. No system is perfectly secure.

If we become aware of a breach of security affecting personal information, we will investigate, mitigate harm, and notify affected individuals and regulators as required by applicable law, including the Florida Information Protection Act of 2014 (Fla. Stat. §501.171) for Florida residents when notification thresholds are met. Notifications will be made without unreasonable delay and will describe what happened, what information was involved, and steps you can take.

Report suspected security issues to legal@fysigo.com.

10. Recordings and transcripts

Online coaching sessions are not recorded by default. Recording and transcription occur only when both the Client and the Provider have given affirmative, separate consent under the Recording & transcription terms. Consent is captured as its own step — not bundled into general Terms acceptance — and may be revoked in Account settings; future sessions will not be recorded after revocation.

• Storage. Daily.co processes the live session and delivers recordings; Fysigo stores artifacts in private, access-controlled storage linked to the booking.
• Access. The Client and engaged Provider for that session can review transcripts in the app when recording was enabled for both parties.
• Retention and deletion. Transcripts remain available in session recap while your account is active unless deleted. To delete stored recordings or transcripts, contact privacy@fysigo.com. Revoking consent stops new recordings; it does not automatically erase prior artifacts.

11. Your choices

Depending on where you live, you may have rights to access, correct, delete, export, or restrict processing of your personal information (for example under GDPR, CCPA, or analogous state laws).

• Access, correction, and deletion. Email privacy@fysigo.com with your request. We respond within 30 days where required. We will not retaliate for exercising a privacy right.
• Recording consent. Toggle in Account settings or contact support.
• Promotional email. Fysigo sends few promotional emails: membership renewal offers and invitations a coach sends through Fysigo. Each one carries an unsubscribe link; one click stops all of them for that address. Receipts, billing, security, and account emails are not promotional and still arrive.
• Integrations. Disconnect Oura or Google Calendar in settings; synced data already stored may be deleted on request.
• Account closure. Close your account in Settings, or email privacy@fysigo.com.

12. Retention

• Active accounts — data retained while your account is active and as needed to provide services and meet legal obligations.
• Closed accounts — kept for a 30-day soft-delete window so a mistake can be undone, then deleted or anonymized, subject to legal hold, tax, audit, or dispute requirements.
• Consents and audit logs — retained to demonstrate what terms and consents were in effect when you accepted them.
• Operational logs — typically retained up to 30 days unless implicated in a security investigation.
• Backups — rolling backup windows; deleted data may persist in backups until those cycles expire.

13. International transfers

Fysigo operates primarily from the United States. Your information may be processed in the U.S. and other countries where our subprocessors operate. Where required, we use appropriate transfer mechanisms such as Standard Contractual Clauses.

14. Children

Fysigo serves young athletes. This section explains what we collect from children under 13 and from teens aged 13 to 17, and the rights of their parents and legal guardians. For children under 13 it is our notice to parents under the Children’s Online Privacy Protection Act (COPPA) and the FTC’s COPPA Rule. Fysigo (Guten Group US Holdings, Inc., 850 E Lime St, P.O. Box 1057, Tarpon Springs, FL 34689, USA; privacy@fysigo.com; telephone +1 (628) 899-7620) is the only operator collecting a child’s information through Fysigo.

Children under 13: before a parent approves

• Signup asks for date of birth first. If the person is under 13, we stop and collect only the child’s first name and a parent’s email address, and use them only to ask that parent for approval. We use the date of birth the child types only in that moment to route the signup, and do not store it.
• A coach who adds a child gives us the same two things and nothing more.
• If the parent declines, we delete the request at once. If the parent does not answer, we send at most two reminders and delete the request 30 days after it was made.

How a parent approves

• The federal COPPA Rule requires a parent’s verifiable consent before we collect, use or disclose any personal information from a child under 13 beyond what we used to contact the parent, and we collect, use and disclose none of it without that consent. The email we send a parent about a request is our direct notice and links to this section, which is our full online notice.
• The parent signs in to their own adult account with the email address we wrote to, reads this notice, confirms they are the child’s parent or legal guardian, enters the child’s date of birth, and chooses the child’s username and password.
• The parent pays for the child’s membership by card, on the parent’s own payment account. The card payment is how we verify that an adult parent agreed. One payment can approve several children. We record, for each child, when the parent approved, which parent account approved, the payment reference, the version of this notice, and each function the parent allowed. We do not record the parent’s IP address.
• If we make a material change to how we collect, use or disclose children’s information, including a new function or a new recipient, we tell the parent at their account email and ask for consent again before the change applies to the child.

The seven functions the parent controls

At approval the parent ticks, one box each, which of these functions the child may use. Every box starts unticked. Nothing the parent leaves unticked is available to the child, and the parent can change any box later in the app.

1. AI assistant.The child’s questions and the training data needed to answer them are sent to our AI service provider (Anthropic) to produce the answer. A child’s information is never used to train AI models.
2. Coach chat.Messages with the child’s own coach or provider. Both sides see that a parent can read the chat.
3. Messaging other members.Direct messages with Fysigo members other than the child’s coach.
4. Community. Joining groups and communities, posting, replying, and a profile other members can see.
5. Labs.Uploading lab results, bloodwork markers and medical records, and sharing them with the child’s coach or provider. A lab test ordered for the child goes to the lab partner that runs it, with only what the test needs.
6. Marketplace.Asking for programs and provider lab tests. A child never pays: each item is a request the parent approves and pays for, or declines. For an approved order we send the provider or seller only the child’s first name and what that order needs to be fulfilled.
7. Recordings.Taking part in live sessions that are recorded. The recording is visible only to the session’s coach, its participants and the parent, and is never published. Unticked, the child is left out of recorded sessions.

Choosing the AI assistant, messaging other members, community or recordings is the parent’s separate consent to disclose the child’s information to that recipient (Anthropic, other members, or a session recording). A parent may consent to our collection and use of the child’s information without consenting to any of these disclosures; we do not limit the child’s account because the parent withholds that consent.

What we collect and how we use it

• After approval: the account, profile and training information described in Section 2 for any member, and whatever the functions the parent allowed involve. Peptide tracking is never shown to anyone under 18.
• We use a child’s information only to run the account and the coaching the parent signed up for, to keep it secure, and to meet legal duties. We do not sell or share a child’s information, show a child advertising, send a child marketing, use session replay, or let a child connect a third-party app. Analytics and error monitoring on a child’s session carry no persistent identifier beyond what running the service needs. We do not send a child push notifications, prompts or reminders designed to increase the child’s use of Fysigo; messages to a child are limited to account, safety and service communications.
• We do not make a child’s information available to the public. The community function, if the parent allows it, makes the child’s profile and posts visible to other Fysigo members only.
• Who sees it: the child’s coach or provider, the parent, our service providers listed in Section 7 (only to run the service, under contracts that bind them to keep it confidential and secure), and the recipients of any function the parent allowed.
• The date of birth the account holds is the one the parent entered. It can only be changed through support, and every change is logged.

How long we keep it (our written retention policy)

We collect a child’s information only to run the account and the coaching the parent pays for. The periods below are the longest we keep each kind of information, set by the time needed to close out billing, disputes and legal duties; we never keep a child’s information indefinitely. “Deleted” means removed so that it cannot be read or rebuilt in the ordinary course of business.

• Unanswered request: deleted 30 days after it was made; a declined request is deleted at once.
• Active account: kept while the membership is paid.
• Frozen account (refund or chargeback): kept, unusable by the child, until the parent pays again or deletes it. If it is still unpaid 60 days after the refund or chargeback, the membership counts as lapsed from that day and the lapsed schedule below runs.
• Lapsed membership: chats and photos are deleted 90 days after the membership ends, and the rest of the account 6 months after it ends. We email the parent before each step.
• Parent deletes the account: deleted at once from the live service; copies in encrypted backups are deleted within 30 days as the backups cycle.
• Consent and payment records:kept for three years after the child’s account is deleted, as proof of the parent’s consent, with the child’s name, username and other direct identifiers removed; then deleted.
• Clinical recordsa licensed provider wrote about a child belong to that provider and its own retention duties; deleting the Fysigo account removes the child’s and the parent’s access and Fysigo’s own copies.

How we protect it

We keep a written information security program for children’s information. It names an owner; identifies and assesses internal and external risks to children’s information; puts in place safeguards in proportion to those risks, including access limited to staff who need it, logged access to child records, encryption in transit and at rest, and database rules that keep each child’s data to the child, the parent and the people the parent allowed; tests and monitors those safeguards regularly; is reviewed at least once a year and whenever our operations or risks change materially; and covers our service providers, which we choose for their ability to protect children’s information and bind by written contract to keep it confidential and secure.

Parents’ rights

From their own account a parent can see everything on their child’s account, including messages; switch any of the seven functions on or off; download the child’s data; delete the child’s account; and cancel the membership. These rights stay open while an account is frozen. A parent may also refuse any further collection or use of the child’s information at any time by switching off the functions, by deleting the account, or by writing to us at privacy@fysigo.comor the postal address above. We answer within 30 days. If we learn that we hold information from a child under 13 without a parent’s approval, we suspend the account and ask a parent to approve it, or delete it.

Teens 13 to 17

• Teens sign up for themselves with a parent’s permission (see our Terms). A teen’s profile is private by default; we do not sell or share a teen’s information, show a teen targeted advertising, or send a teen marketing without the teen opting in; and the AI assistant stays off until the teen switches it on.
• A teen can upload their own lab results; before the first upload we show the teen what is collected and the teen agrees. Buying on the marketplace, including provider lab tests, is a request that a linked parent approves and pays for.
• A teen can invite a parent to link. A linked parent can see everything on the teen’s account, including messages, and both the teen and the coach see that a parent can read the chat. The link lasts until the teen turns 18; at 18 it ends on its own and the account and its data stay with the adult.
• A child who turns 13 keeps the parent link and the parent’s choices until 18.
• A teen, or a linked parent, can delete the teen’s account or any of the teen’s posts at any time. After a user turns 18, what was collected while they were a minor stays in their adult account, which they can delete at any time.

15. Changes

We may update this Policy. Material changes are communicated via in-app notice and, where required, a re-acceptance step. The version and effective date at the top of this page are the authoritative record.

16. Contact

Privacy questions and rights requests: privacy@fysigo.com.

General legal and BAA inquiries: legal@fysigo.com.