Privacy Policy — K&L Fit

This is a translation provided for convenience. The Portuguese version prevails in case of any divergence, and Brazilian law applies.

Last updated: October 30, 2026 Version: 1.9. What's new in this version: account country and time zone, professional registration for trainers outside Brazil, country of the card's issuing bank, and the rights of people in the European Economic Area or the United Kingdom (1.9, sections 2, 6 and 8A); Help with AI and problem reports (1.8, sections 2, 3, 4, 5 and 6); "Continue with Google" (1.7, sections 2, 4 and 6); detailed security measures, logging of administrative access, and a summary of the Data Protection Impact Report (1.6, sections 7, 7A and 9); Trainer Portfolio and "Find a trainer" (1.5, sections 2, 3 and 4); Friends, Timeline and Body log of body photos (1.4, sections 2, 2.1, 3, 4, 6 and 9); VIP plan payments through Stripe, with the corresponding international transfer (1.3, sections 2, 4 and 5); the app is now called K&L Fit, operated by K&L Fitness (Kalita & Lucas), with a new contact and privacy e-mail (1.2); message notifications on your phone (1.1, sections 2, 3, 4, 5, 6 and 10).

This Policy explains how K&L Fit handles your personal data, in accordance with Brazil's General Personal Data Protection Law (Lei Geral de Proteção de Dados Pessoais — Lei nº 13.709/2018, "LGPD") and the Marco Civil da Internet (Brazil's Internet Civil Rights Framework — Lei nº 12.965/2014).

1. Controller and Data Protection Officer

• Controller: K&L Fitness (Kalita & Lucas), a brand maintained by Lucas Ferreira do Carmo Souza (individual), Goiânia/GO.
• Data Protection Officer (Encarregado / DPO) / privacy channel: Lucas Ferreira do Carmo Souza, e-mail contact.klfitness@gmail.com.

2. What data we collect

We do not collect your full card number or security code. They are entered in Stripe's secure form and handled directly by Stripe.

2.1 Sensitive data (health)

Information about workouts, weights and, above all, chat messages about pain, injuries or physical conditions may reveal health-related data, which the LGPD considers sensitive personal data (art. 5º, II). We handle this data based on your specific and highlighted consent (art. 11, I), requested at sign-up and, for sharing with the trainer, at the moment you accept the invite. You can withdraw your consent at any time (section 8), but without it some features stop working.

Body photos (Body log) may also reveal health data. They are only stored after a specific consent, requested the first time you open the Body log, and are visible only to you: they do not appear on the Timeline, to friends or to your trainer, and K&L Fit does not use them for any other purpose. To withdraw consent, use "Delete all photos and turn off": the photos are deleted immediately.

The photos you upload (on the Timeline or in the Body log) are resized and converted on your own device before upload, which removes the location and other data your phone saves with the photo.

3. What we use it for and on what legal basis

We do not sell your data and do not use it for third-party advertising.

4. Who we share it with

• All K&L Fit clients and users, if you are a Trainer and publish your profile in the portfolio: they see your name, CREF, photo, introduction, specialties, city/state, type of service and, if you authorize it, your mobile number for contact through WhatsApp. In a conversation started through the portfolio, the trainer sees the name of the person who wrote and whatever is sent in the chat.
• Your friends on K&L Fit: they see the posts you publish as "Friends" (text, photos, workout summary), and the likes and comments on them. "Private" posts and the Body log are never shown to anyone. In search by name, those who allow it appear with their name only, without e-mail or other data.
• Your trainer, only after you accept the invite and while the connection is active. They see your name, contact details, the workouts they prescribed, your attendance, the logged weights and the chat with them. They do not see the workouts you created in "My workouts". For the use they make of this data in providing their services to you, the trainer acts as an independent controller.
• Google: if you choose "Continue with Google", Google learns that you signed in to K&L Fit, according to its privacy policy. You can remove K&L Fit's access in your Google Account at any time; to keep signing in, create a password using "Forgot my password".
• Stripe (Stripe Brasil Soluções de Pagamento – Instituição de Pagamento Ltda. (CNPJ 22.121.209/0001-46)): processing of VIP plan payments. It receives your name, e-mail, the card details you enter in its form and the billing history.
• Infrastructure providers: hosting of the app, the database and the audio (Cloudflare, Inc.); storage of Timeline and Body log photos (Backblaze, Inc., on a private, encrypted server accessed only by K&L Fit) and, when configured, an e-mail delivery provider. They act as processors and follow our instructions.
• Artificial intelligence provider (Huawei Cloud ModelArts): when you use "Create workout with AI", we send only the text you typed and the list of exercises in the library. We do not send your name, e-mail, age, sex, client data or workout history. For this reason, do not write personal or health data in your request. In Help, we send your question, the conversation at that moment, whether you are a trainer or a client/user, your plan, and the app screen you are on; we also do not send your name, e-mail or account data. The provider acts as a processor.
• Notification services from Apple, Google, Mozilla or Microsoft, depending on your device and browser: they deliver message notifications. The content (sender's name and the beginning of the message; audio only shows as "Voice message") travels end-to-end encrypted: these services cannot read it and only see the time and size of each delivery. The notification may appear on the lock screen; you can hide its content in your phone settings.
• YouTube (Google): demonstration videos are shown through the YouTube player in privacy-enhanced mode (youtube-nocookie.com). When you press play, YouTube may collect data according to Google's policy.
• Authorities: when there is a legal obligation or a court order.

The K&L Fit administrator only accesses sign-up, plan and subscription data and usage statistics. The administrator does not read chat content, except to investigate a report of abuse, by court order or by legal obligation.

5. International transfer

K&L Fit runs on the network of Cloudflare, Inc. (a US company). We ask for the data to be stored in South America, but it may be processed or copied on servers in other countries, such as the US. Timeline and Body log photos are stored by Backblaze, Inc. on servers in the US. VIP plan payments may also be processed by Stripe, Inc. (US), a company in the same group as Stripe Brasil. These transfers follow art. 33 of the LGPD and the rules of the ANPD (Autoridade Nacional de Proteção de Dados, Brazil's data protection authority), with appropriate contractual clauses.

Requests made in "Create workout with AI" and Help questions are processed by the AI provider on servers outside Brazil (Singapore). Since they do not include data that identifies you, the transfer is limited to the typed text and the information described in section 4.

Notifications go through the notification services mentioned in section 4, which may be outside Brazil. Since the content is end-to-end encrypted, they only receive technical delivery data.

6. How long we keep it

Account deletion and chat: when you delete your account, the messages and audio you sent are deleted. Since the connection is also ended, the conversation no longer appears to the other person.

7. Security

We adopt technical and administrative measures to protect your data:

• encrypted connections (HTTPS, with HSTS) and security headers;
• passwords stored only as an irreversible hash (PBKDF2-SHA256, with salt and a secret key kept outside the database) and a limit on login attempts per IP;
• role-based access control: each person only sees what their role allows;
• administrative dashboard with mandatory two-step verification and logging of every access (who, what, when and IP), kept for 6 months;
• photos in private, encrypted storage, with no public link, and with location removed on your own device before upload;
• card details entered directly with Stripe, without going through our servers, and service keys stored encrypted (AES-256-GCM);
• backups that allow the database to be restored to any point in the last 30 days.

The details, in plain language, and the channel for reporting security flaws are on the Security page.

No system is 100% secure. In the event of an incident that may create relevant risk or harm, we will notify you and the ANPD, as required by art. 48 of the LGPD.

7A. Data Protection Impact Report (RIPD) — summary

We prepared a Personal Data Protection Impact Report (Relatório de Impacto à Proteção de Dados Pessoais, art. 5º, XVII, and art. 38 of the LGPD), because K&L Fit handles health data (workouts, weights, conversations about pain and injuries, and body photos), accepts accounts from teenagers aged 16 and 17, and allows contact between people who do not know each other (Trainer Portfolio). This is the summary.

Prepared on: October 29, 2026, by the Data Protection Officer (section 1). Review: with each new feature that handles sensitive data or changes who data is shared with, and at least once a year.

Processing activities assessed: sign-up and sign-in; workouts, weights and attendance; connection with the trainer; chat (text and audio); Friends and Timeline; Body log (body photos); Trainer Portfolio; payments; AI requests; notifications.

Conclusion: with these measures, we assess that the residual risk to data subjects is low and that the processing activities are necessary and proportionate to the purposes in section 3. There has not yet been an independent audit; when there is one, the result will be published on the Security page. The ANPD may request the report at any time (art. 38 of the LGPD).

8. Your rights (art. 18 of the LGPD)

You can, at any time:

1. confirm whether we process your data;
2. access your data;
3. correct incomplete, inaccurate or outdated data;
4. request anonymization, blocking or deletion of unnecessary or excessive data;
5. request portability of your data (export of your workouts and history);
6. request deletion of data processed based on consent;
7. know who we share your data with;
8. be informed about the possibility of not consenting and the consequences;
9. withdraw consent, for example by ending the connection with your trainer;
10. file a complaint with the ANPD (www.gov.br/anpd).

Many of these rights can be exercised directly in the app, through the options in your Profile: edit data, end connection, delete account and export data. For the others, write to contact.klfitness@gmail.com. We will reply within 15 days.

8A. People in the European Economic Area or the United Kingdom

If you use K&L Fit from the European Economic Area (European Union, Iceland, Liechtenstein and Norway) or from the United Kingdom, the General Data Protection Regulation (GDPR) and UK law also protect you. In short:

• Equivalent legal bases: performance of a contract (art. 6(1)(b) GDPR) for the account, workouts, chat and subscription; consent (art. 6(1)(a)) and explicit consent for health data (art. 9(2)(a)) in the same cases where section 3 mentions consent; legal obligation (art. 6(1)(c)) for access logs and tax data; and legitimate interest (art. 6(1)(f)) for security, fraud prevention and product improvement.
• Your rights: access, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, and withdrawal of consent at any time, without affecting what was done before. Use the options in your Profile or write to contact.klfitness@gmail.com; we reply within 30 days.
• Complaint: you can complain to the data protection authority of the country where you live or work.
• Transfer: the controller is in Brazil, and your data is processed in Brazil and in the countries mentioned in section 5. The European Union does not yet recognize Brazil as a country with adequate protection; these transfers are necessary to provide the service you signed up for (art. 49(1)(b) GDPR) and are carried out with the security measures in section 7.
• No automated decisions: K&L Fit does not make decisions with legal effects on you solely by automated means.

9. Minors

• Trainers must be 18 or older.
• Clients and Users must be 16 or older. Anyone aged 16 or 17 declares that they have their legal guardian's authorization.
• We do not allow accounts for people under 16. If we identify an irregular account, it will be deleted.

Teenagers' data (ages 16 and 17) is always handled in their best interest (art. 14 of the LGPD and Lei nº 15.211/2025, the "ECA Digital", Brazil's Digital Statute of Children and Adolescents). To this end:

• we use the most protective settings by default;
• we do not do advertising or profiling for commercial purposes;
• chat only happens with the trainer the teenager accepted or with a portfolio trainer the teenager personally looked up; trainers cannot start a conversation with teenagers (or with anyone) through the portfolio, and the teenager can end the conversation at any time;
• teenagers do not appear in search by name by default: they only become friends with people who have their invite link, unless they turn on search;
• the body photos in the Body log are always private and cannot be posted;
• the legal guardian can request, at any time, access to the data or deletion of the account, through the privacy channel.

10. Cookies and local storage

We only use essential cookies and local storage: keeping you signed in and saving interface preferences. If you turn on notifications, the browser installs a small K&L Fit program (service worker) that only serves to display them and does not store your data. We do not use advertising cookies. The YouTube player may set its own cookies when a video is played.

11. Changes

Relevant changes to this Policy will be announced by e-mail and in the app at least 15 days in advance.

12. Contact

contact.klfitness@gmail.com · K&L Fitness (Lucas Ferreira do Carmo Souza) · Goiânia/GO