Privacy Policy
Last updated: August 21, 2026
Gruvman PT & Coaching ENK
Organization Number: 915 079 954
Email: support@novafitness.no
1. Introduction
This Privacy Policy describes how Nova ("we", "us", "our") collects, uses, stores, and protects your personal data when you use the Nova app and related services (the "Service").
We are committed to protecting your privacy in accordance with:
- EU General Data Protection Regulation (GDPR): Regulation (EU) 2016/679
- Norwegian Personal Data Act (personopplysningsloven): implementation of GDPR in Norway
- Norwegian Data Protection Authority (Datatilsynet) guidelines for health-related data
2. What Personal Data We Collect
2.1 Information You Provide Directly
| Category | Examples | Purpose |
|---|---|---|
| Account Information | Name, email, password (encrypted) | Create and manage your account |
| Profile Information | Profile photo, bio, municipality, gender | Personalize service and trainer matching |
| Training Goals | Goals (strength, weight loss, etc.), experience level | Recommend suitable trainers and programs |
| Communications | Messages, images, audio files in chat | Enable communication with trainer |
| Date of birth | The day, month and year you were born | Your date of birth is used to confirm that you are over the age limit, to calculate your calorie needs, and to send birthday greetings. |
2.2 Health-Related Information (Special Categories)
| Category | Examples | Legal Basis |
|---|---|---|
| Training Data | Exercises, weight, repetitions, duration | Consent (GDPR Art. 9(2)(a)) |
| Body Measurements | Weight, height, body measurements | Consent (GDPR Art. 9(2)(a)) |
| Progress Photos | Photos to track physical changes | Consent (GDPR Art. 9(2)(a)) |
2.3 Automatically Collected Information
- Device Info: Device type, operating system, app version
- Usage Data: Features used, timestamps, duration
- Crash Reports: Error messages to improve stability
We do NOT collect: GPS location, contact lists, call logs, or other data from your device without explicit consent.
3. Legal Basis for Processing
We process your personal data based on the following legal grounds (GDPR Article 6):
| Basis | Application |
|---|---|
| Contract (Art. 6(1)(b)) | Deliver the service you registered for |
| Consent (Art. 6(1)(a)) | Health data, marketing, progress photos |
| Legitimate Interest (Art. 6(1)(f)) | Improve service, prevent fraud, security |
| Legal Obligation (Art. 6(1)(c)) | Retention per accounting and tax laws |
4. How We Use Your Information
- Deliver and maintain the Service
- Connect you with suitable personal trainers
- Track training progress and personal records
- Send notifications about workouts and messages
- Improve and develop new features
- Prevent fraud and abuse
- Fulfill legal obligations
5. Sharing of Personal Data
5.1 Sharing with Trainers
When you connect with a personal trainer, the following is shared:
- Name and profile photo
- Training goals and experience level
- Training history and progress
- Messages in your chat
Progress photos are NOT shared with trainers unless you explicitly choose this.
5.2 Third-Party Providers (Data Processors)
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase | Authentication, database, storage | EU (multi-region eur3: europe-west1/west4) |
| Google Cloud Platform | Hosting and infrastructure | EU |
| Stripe | Payment processing | EU/USA (SCC) |
| Mailjet | Email delivery | EU |
All data processors are bound by Data Processing Agreements (DPA) per GDPR Article 28.
5.3 We NEVER Sell Your Data
Nova does not sell, rent, or trade your personal data to third parties for marketing purposes.
6. Storage and Security
6.1 Where Data is Stored
All personal data is stored on servers within the EU/EEA (Google Cloud, multi-region eur3: europe-west1/west4). For transfers outside EU/EEA, we use EU Commission Standard Contractual Clauses (SCC).
6.2 Security Measures
- Encryption in transit (TLS 1.3)
- Encryption at rest (AES-256)
- Access control based on least privilege
- Regular security audits
- Firebase App Check to prevent abuse
6.3 Retention Period
| Data Type | Retention Period |
|---|---|
| Account Information | Until account deletion + 30 days |
| Training History | Until account deletion |
| Chat Messages | Until you or the other party deletes the chat |
| Progress Photos | Until you delete them |
| Payment Information | 5 years after last transaction (accounting law) |
7. Your Rights
Under GDPR, you have the following rights:
7.1 Right of Access (Art. 15)
You have the right to obtain confirmation of whether we process your personal data, and if so, access to the data.
7.2 Right to Rectification (Art. 16)
You can request correction of inaccurate information about you.
7.3 Right to Erasure (Art. 17)
You can request deletion of your personal data ("right to be forgotten").
7.4 Right to Restriction (Art. 18)
You can request restriction of processing of your data.
7.5 Right to Data Portability (Art. 20)
You can request your data in a structured, machine-readable format.
7.6 Right to Object (Art. 21)
You can object to processing based on legitimate interest.
7.7 Right to Withdraw Consent
You can withdraw consent at any time.
How to Exercise Your Rights
- In the app: Settings → Privacy → [Option]
- Email: support@novafitness.no
- Delete account: Settings → Account → Delete Account
We respond to all requests within 30 days.
8. Age limit
Nova is for adults only. You must be at least 18 years old to create an account, and we ask for your date of birth at registration to verify this. We do not knowingly collect personal data from children. If we discover that an account belongs to someone under 18, it is blocked.
9. Cookies
The Nova app does not use cookies. Our web application uses necessary technical cookies for authentication, security and to remember your consent choice.
In addition, the website uses Google Analytics for usage statistics — but only if you consent in the consent banner (GDPR Article 6(1)(a)). Without consent, no analytics tools are loaded and no analytics cookies are set. The statistics tell us which pages are visited and which features are used; we do not use them for advertising.
You can withdraw or change your consent at any time via the “Cookies” link at the bottom of the page. If you withdraw it, measurement stops immediately and the analytics cookies are deleted.
In addition, the website keeps fully anonymous, aggregated visitor statistics: the number of views per page, which website visitors came from, and whether a mobile or a desktop device was used. This counting uses no cookies and no identifiers, stores or reads nothing on your device, and the numbers cannot be linked to you. The legal basis is our legitimate interest in understanding how the website is used (GDPR Article 6(1)(f)).
10. Changes to Privacy Policy
We may update this Privacy Policy from time to time. For material changes, we will notify you via email or in the app at least 30 days before the changes take effect.
11. Complaint to Supervisory Authority
If you believe we are processing your personal data in violation of regulations, you can file a complaint with the Norwegian Data Protection Authority:
P.O. Box 458 Sentrum
0105 Oslo, Norway
Phone: +47 22 39 69 00
Email: postkasse@datatilsynet.no
Web: www.datatilsynet.no
12. Contact Us
For questions about this Privacy Policy or our processing of your personal data:
13. Services we use
Nova uses the following third-party services to deliver the Service. All processors are bound by Data Processing Agreements (DPA) pursuant to GDPR Article 28, and any transfer outside the EU/EEA is covered by the European Commission's Standard Contractual Clauses (SCC).
Firebase
- Provider:
- Google LLC
- Purpose:
- Authentication, database (Firestore), storage, analytics, crash reporting (Crashlytics) and Cloud Functions.
- Data shared:
- Email address, user ID (uid), and user-generated content, used for sign-in and cross-device synchronisation.
- Processing location:
- Servers in the EU (multi-region eur3: europe-west1/west4).
Stripe
- Provider:
- Stripe, Inc.
- Purpose:
- Payment processing, subscriptions and payouts to trainers (Stripe Connect).
- Data shared:
- Email address, name and payment metadata (full card numbers are never stored by Nova; they are handled directly by Stripe).
- Processing location:
- Processed in the US and EU under Stripe's Data Processing Agreement and SCCs.
Polar
- Provider:
- Polar Electro Oy
- Purpose:
- Optional health-data synchronisation, only activated if you connect your Polar account to Nova.
- Data shared:
- OAuth token along with activity data such as heart rate, heart-rate variability (HRV) and sleep data.
- Processing location:
- Servers in Finland (EU).
Apple Health / Health Connect
- Provider:
- Apple Inc. / Google LLC
- Purpose:
- Optional reading and writing of workout and health measurements on your device.
- Data shared:
- On-device access only: no health data is sent to Nova servers unless you explicitly enable synchronisation.
- Processing location:
- On-device only.
Mailjet
- Provider:
- Sinch / Mailjet SAS
- Purpose:
- Sending system notifications and transactional emails.
- Data shared:
- Recipient email address and the content of the notification being sent.
- Processing location:
- Servers in the EU.
Google Analytics (website only, only with consent)
- Provider:
- Google Ireland Limited
- Purpose:
- Usage statistics for the website: page views and events such as registration, quiz use and clicks to the app stores. Only activated after your consent in the consent banner.
- Data shared:
- Pseudonymous client ID (cookie), page views, events and approximate location derived from the IP address (GA4 does not store the IP address). Not linked to your name or email.
- Processing location:
- Collection via EU endpoints; Google may transfer data to the US under the EU-U.S. Data Privacy Framework and standard contractual clauses (SCC).
You can request a complete list of our data processors at any time by contacting support@novafitness.no.
© 2026 Nova Fitness. All rights reserved.