The NIA Fitness questionnaire includes health data (body measurements, conditions, medication, menstrual cycle). The law treats this as sensitive data and we need your express authorization to process it. Please read this policy before submitting it.
1. Who is responsible for your data
NIA Fitness is the data controller: it decides what your data is used for and answers for it. Any request about your information goes to hello@nia-fitness.com, the only channel we use for these matters.
2. What data we collect
Only what we need to build and deliver your plan. Specifically:
- Identification and contact: name, email address and country of residence.
- Health data and body measurements (sensitive data): biological sex, age, weight, height, waist, neck and hip circumference, any health problems you report, physical limitations or injuries, medication and supplements, digestive issues (heartburn, reflux, bloating) and menstrual cycle where applicable.
- Habits and lifestyle: your goal, vegetarian or vegan diet, daily activity level, where you train, days per week, experience level, available equipment, occupation and usual activities.
- Follow-up: if you send a progress report, your new weight and measurements, your adherence to the plan, your energy level and the comments you write.
- Account, only if you sign in with Google: the name, email and profile picture Google provides through AWS Cognito. We never receive your Google password.
- Payment: the order reference, the amount, the currency and the payment status. Your card details are captured and processed by Bold: they never pass through our servers and we do not store them.
- Commercial: how you heard about us and, if you want to tell us, why you decided to sign up.
- Technical: the IP address and browser data our hosting and infrastructure providers automatically log when serving you the page.
We do not ask for a national ID number, a physical address or a phone number, and we do not collect your precise location: to localize the foods and portions in your plan we only use the country you declare in the questionnaire.
3. What we use it for
- Building your personalized plan. Your answers feed the calculation of your requirements and the design of your nutrition and training plan. This is the main purpose and the reason we ask for each piece of data.
- Reviewing it before delivery. A member of the NIA Fitness team reviews and approves your plan before you receive it, and can therefore see your answers.
- Delivering it and giving you access. We publish your plan at your private link and, if you signed in, in your plan history.
- Charging for the service and keeping the accounting record of the purchase.
- Supporting you and adjusting your plan when you ask by email, including the regeneration described in the General Terms and Conditions.
- Meeting legal obligations (accounting, tax and consumer protection).
- Knowing how you found us, in aggregate, to decide where to invest in outreach.
We do not sell, rent or transfer your data to third parties for advertising purposes, we do not send you other companies' ads, and we do not publish your case, your photos or your results on social media without your express written authorization.
4. Your plan is generated by an AI model and reviewed by a person
Your plan is written by an artificial-intelligence model (Claude, by Anthropic) from your answers and from official health and nutrition sources it looks up online. It is not an automated decision applied to you without human oversight: a NIA Fitness advisor reviews and approves it before delivery, can correct or reject it, and you can ask for it to be regenerated. We do not send the model your name or your email address — only the physical, health and lifestyle data needed for the calculation.
5. Sensitive data: express authorization and questions you may leave blank
Colombian Law 1581 of 2012 classifies health-related data as sensitive data and requires your express authorization to process it. By ticking the acceptance box in the questionnaire you expressly authorize NIA Fitness to process the health data listed in section 2 for the purposes listed in section 3.
- You are not obliged to answer the questions about sensitive data. Those that are not mandatory may be left blank: your plan will be built with the information available, though it will be less precise and less safe for you.
- You may withdraw your authorization at any time (section 8). Since we cannot calculate or maintain a plan without health data, withdrawing it means ending the service.
6. Who else processes your data
We have no commercial partners that receive your information. It is only processed by the technology providers that make the service work, each limited to what it needs:
- Anthropic (Claude API) — generates your plan from your answers. Under its commercial terms, data sent through the API is not used to train its models. United States.
- Amazon Web Services — storage and compute (database, functions and user accounts) in the
us-east-1 region, United States. The database is encrypted at rest. - Bold — payment gateway. It receives the amount and the order reference, and captures your payment details, for which it answers as its own controller under its own policy.
- Google — only if you choose "Continue with Google": it authenticates you and provides your name, email and picture. In addition, the site's fonts are served from Google Fonts and one animation from the unpkg.com CDN, which means your IP address reaches those providers when the page loads.
- Vercel — website hosting.
International transfer: our infrastructure is located in the United States, so your data is stored and processed there. By submitting the questionnaire you authorize that transfer.
7. How long we keep it
- Questionnaire, plan and follow-up reports: while we provide the service and for up to 24 months after your last interaction with us; after that they are deleted.
- Payment and invoicing records: 5 years, due to accounting and tax obligations. This is the only data we keep even if you ask us to delete everything else.
- Sign-in account (Google/Cognito): for as long as your account exists, until you ask us to delete it.
- Technical infrastructure logs: they store plan identifiers, dates and process statuses; they do not store your questionnaire answers.
- Session in your browser: the session token expires on its own and is cleared when you press "Log out".
Both retention-period deletion and the deletion you request are carried out manually on the database; there is no scheduled automatic purge.
8. How to ask us to delete it, and your other rights
Regarding your data you may: know what we hold and how we use it, request a copy, update or correct it, request its deletion, withdraw your authorization and file complaints with the data protection authority.
- How to request it. Write to hello@nia-fitness.com from the same email address you used for the purchase, with the subject "Delete my data" (or "Access my data", "Correct my data", as needed) and state your name. If you cannot write from that address, we will ask you for a detail from your questionnaire to verify it is you before doing anything.
- How fast we respond. Queries within 10 business days; complaints and deletion requests within 15 business days, in line with Law 1581 of 2012.
- What we delete. The full record of your questionnaire, your plan and your follow-ups in the database, and your sign-in user account. We keep only the payment record the law requires us to retain (section 7).
- It is irreversible. Once deleted you lose access to your plan and your history, and we cannot recover it. Download or save your plan before requesting deletion.
- Supervisory authority. If you believe we failed to handle your request properly, in Colombia you may complain to the Superintendency of Industry and Commerce (SIC). If you live elsewhere, to the data protection authority that applies to you.
9. Cookies and browser storage
We use no advertising cookies, no analytics and no third-party tracking pixels. We only store in your own browser what is indispensable for the site to work:
nia_lang — the language you chose, so we don't ask again.nia_auth_session — your session, if you signed in with Google.nia_auth_pkce_verifier — a temporary value that protects the login while it completes.planId — your plan's identifier, to take you from the questionnaire to your plan.
You can delete them from your browser at any time; you will only lose your session and your language preference.
10. Security
The site and the API run over HTTPS, the database is encrypted at rest, provider keys live in a secrets manager (never in the code) and the admin endpoints require sign-in plus a closed list of authorized email addresses. No measure is infallible: if an incident affects your personal data, we will inform you by email and report it to the authority where required.
11. Minors
The service is intended for people over 18 and we do not knowingly collect data from minors. If you believe a minor has sent us their data, write to hello@nia-fitness.com and we will delete it.
12. Changes to this policy
If we modify it, we will publish the new version on this same page with its update date. When a change substantially affects the purposes or the data we process, we will notify you and ask for your authorization again.
13. Contact
For any question about your data: hello@nia-fitness.com
Last updated: August 13, 2026.