Privacy policy

MFit (“MFit”, “we”, “us”) is the controller of the personal data described in this policy. Our legal details are listed in the contact section at the end.

This policy applies to the MFit mobile app, the MFit web portal and any MFit service that links to it (together, the “Service”). It is written to meet the Law of Mongolia on Personal Data Protection (2021) and its implementing regulations.

Gyms, studios, kitchens, shops and coaches that you deal with through MFit are independent businesses. When they use the details we pass to them to fulfil your order or booking, they are responsible for doing so lawfully.

The Service is for adults aged 18 and over. We do not knowingly collect data from anyone younger.

Data you give us:

• account details: name, phone number, email, language, and sign-in details when you use Google or Apple;
• health and fitness details: screening answers (such as PAR-Q+), goals, body measurements, injuries and symptoms you report, food and training logs, and progress photos;
• content: posts, comments, reviews, photos and videos, and messages to other users, coaches and partners;
• orders and bookings: items, delivery address, your e-barimt consumer number or company TIN, and support requests.

Data created when you use the Service:

• training plans and the reasons behind each change, readiness scores and progress statistics;
• your conversations with the AI coach and the outcome of safety checks;
• venue check-ins, class bookings, run routes you choose to record, and venue searches;
• technical data: device type, app version, crash reports and pseudonymous usage events.

Data from others, only with your permission or when needed for a transaction:

• Apple Health or Health Connect (steps, workouts, heart rate, sleep) when you connect them;
• Apple or Google, to confirm your subscription status (we never receive your card details);
• QPay and your bank, to confirm that a payment went through;
• coaches you have shared access with, who may add notes or programmes to your plan.

We do not collect your precise location in the background. The venue finder uses your location only while it is open.

Health, correspondence and location data are stored on servers in Mongolia, together with their backups. Administrative access to production systems is only possible from within Mongolia through a secured gateway.

The table below shows each class of data, where it is processed and whether any of it ever leaves Mongolia.

We use personal data only for the purposes below, and only on the legal basis shown:

• to provide the Service you signed up for (account, plans, logs, messaging, orders): your consent to the core service and our agreement with you;
• to process health data and personalise coaching safely: your separate, explicit consent to health data processing;
• to share data with a coach you choose: your consent, limited to the scope you select;
• to issue receipts, keep accounting records and meet tax, consumer-protection and law-enforcement obligations: our legal obligations;
• to keep the Service secure, prevent fraud and moderate content: our legal obligations and the protection of users;
• to send marketing or partner offers: your optional consent, which you can refuse without losing any feature.

If we want to use data for a new purpose, we will ask for your consent again first.

We do not sell personal data. We do not use health, food or body data to target advertising, and sponsored listings are never chosen using that data.

Each consent covers one purpose, is recorded with its version, date and method, and is confirmed with a code sent from your own phone number.

The consents we ask for are:

• Core service (account, plans, logs): required to use MFit.
• Health data processing: required for coaching features.
• Share with my coach: optional, per coach and per scope.
• Premium AI abroad: optional; shares de-identified requests with OpenRouter and the model providers listed in the app.
• Email via Amazon SES: optional; SMS is used instead if you decline.
• Marketing by SMS, email or push: optional.
• Partner offers: optional; offers are sent by MFit, and partners never receive your data.

You can withdraw any consent at any time in Settings → Privacy. Processing for that purpose stops within minutes. Withdrawing does not affect processing that took place before, and withdrawing a required consent means the related feature can no longer be provided.

Your training and nutrition targets are calculated by a rules-based engine with built-in safety limits. The AI coach explains and suggests; it cannot invent numbers, change a plan without your confirmation, or lift a safety restriction.

By default, the AI coach runs on servers in Mongolia. Only if you turn on “Premium AI abroad” are requests routed through OpenRouter, after your name, phone number, exact date of birth and location are removed, and only to providers that have agreed not to retain or train on the data. If you withdraw that consent, the coach switches back to in-country processing immediately.

Direct messages, group chats and coach chats are never sent to any AI service outside Mongolia.

Every plan change comes with a plain-language reason. You can ask for any automated decision to be reviewed by a person, and we will re-examine it.

We share personal data only as follows:

• Coaches: only the data you have agreed to share, with the coach you named. Every coach read of your health data is logged.
• Partners: when you order or book, the partner receives what it needs to fulfil it, such as your name, phone number, delivery address and the items ordered. Partners do not receive your health data.
• Service providers acting on our instructions: hosting in Mongolia, SMS verification (verify.mn), email (Amazon SES, with your consent), overseas AI (OpenRouter, with your consent), and error and usage monitoring (Grafana Cloud, Sentry, PostHog) using pseudonymous data with sensitive fields removed.
• Google, for analytics and advertising measurement in the MFit app and on the MFit website and web portal (Google Analytics with Google Signals; Firebase Analytics in the app): the pages and app screens you visit and the buttons you use, your MFit user ID when you are signed in, and the device and approximate location data Google collects itself. Health data, messages, names, phone numbers and email addresses are never sent, and the admin consoles are not measured.
• Payment and receipt systems: Apple, Google, QPay and the national e-barimt system receive what is needed to take payment and issue receipts.
• Authorities: when Mongolian law requires it, or to protect someone’s life or safety. Reports of child sexual abuse material are made to the competent authorities.

If MFit is reorganised, merged or sold, personal data may pass to the new operator, which will remain bound by this policy. We will notify you before that happens.

Data leaves Mongolia only in the cases shown in the table in section 3: de-identified AI requests if you opt in, email through Amazon SES if you opt in, and scrubbed technical telemetry.

Correspondence and location data are never transferred abroad, and neither is sensitive health data, except for the de-identified AI requests you have opted into.

Maps of shared activities are hidden by default, and start and end points are always trimmed.

You can set privacy zones (minimum 400 m) around places such as your home. Distances near a zone are rounded when shown to others.

Check-ins are private by default. If you share one, others see “trained at this venue today”, never that you are there now. There is no public heatmap.

Venue busy-times are aggregated and hidden when too few people contribute to identify anyone.

Under Mongolian law you have the right to:

• access your data and receive a copy: export everything as JSON (logs also as CSV) from the app; the download link is valid for 7 days;
• correct inaccurate data: edit your profile, logs and body measurements at any time;
• delete your data: delete your account in the app or on the web;
• withdraw consent: in Settings → Privacy;
• receive an explanation of, and a human review of, any automated decision;
• complain to the National Human Rights Commission of Mongolia, which supervises personal data protection.

We will respond to requests without undue delay and within the time limits set by law. We may need to confirm your identity first.

When you delete your account:

• your account, logs, health data and media are deleted;
• your posts and comments are deleted; other people’s replies remain, shown as from a “deleted user”;
• messages are removed from your side; the other participants see “deleted message”;
• orders, payments and receipts are kept only as long as tax and accounting law requires, de-identified where possible;
• moderation records are kept as long as needed to handle abuse and legal claims.

We keep data only as long as needed for the purpose it was collected for. Our default periods are:

• raw wearable samples: 24 months;
• daily summaries and training history: for the life of your account;
• AI coach conversations: 12 months;
• media held for moderation review: 30 days;
• security audit log: 5 years;
• receipts and accounting records: the period required by tax law.

When a retention period ends, the data is deleted or irreversibly anonymised.

Our safeguards include:

• encryption in transit (TLS) and at rest, including all disks and backups;
• messages encrypted with a separate key per conversation, protected by a master key held in Mongolia;
• least-privilege access controls, with every moderator decryption and every coach or staff read of health data recorded in an audit log;
• notifications, SMS and emails that never contain health data or message text;
• location and camera metadata (EXIF/GPS) removed from photos, with progress photos private by default;
• a designated security officer, written security procedures, regular risk assessments and independent audits.

No system is completely secure. Please use a device lock and keep your phone number up to date so that verification codes reach only you.

If a breach affects your data, we will notify you promptly, telling you what happened, what data is involved and what you can do.

We also notify the competent authorities as required by law, record every incident in our breach register, and file that register with the National Human Rights Commission each year.

The website and web portal use the cookies needed to keep you signed in, remember your language and protect against abuse, and Google Analytics cookies (_ga and related) to measure how the site is used and how well our advertising works. This includes Google Signals, which can link visits to signed-in Google accounts for cross-device reports and advertising audiences. You can opt out with Google’s browser add-on (tools.google.com/dlpage/gaoptout) or by blocking cookies in your browser.

You can turn off push notifications in your device settings and marketing messages in Settings → Privacy at any time. Security and transaction messages cannot be turned off while you have an account.

We will update this policy when our services or the law change. The date and version at the top show the current edition.

If a change materially affects how we use your data, we will tell you in the app before it takes effect and, where the law requires, ask for your consent again.