Who this policy covers
This policy describes CMA Solutions' role as publisher of CMA Fitness Coach Suite and distinguishes it from information held by Personal users and Trainers. It covers Windows Trainer, Windows Personal, Android Personal and this website. Contact CMA Solutions through the Contact page linked below. A Trainer's own privacy information should explain their separate use of client records.
Information in the applications
Depending on use, local records may include client and profile details, fitness goals, prescribed and independently created Training, workout achievements, Nutrition plans and diaries, hydration, Progress, body measurements, acknowledgements, settings, package history and relationship security state. Some fitness and measurement information can be personal information or receive additional protection as health-related information.
The applications use this information to provide the requested planning, recording, management and exchange functions. Medical histories and health-screening records should be maintained separately. Do not enter medical or health information into Notes fields.
Local storage and direct exchange
Normal identifiable client, Training, Nutrition, Progress and measurement records are stored locally on the user's or Trainer's device. CMA Solutions does not centrally collect or retain these identifiable client records, does not operate a central client-records account or database, and does not automatically receive routine exchanged client packages.
When you choose to exchange a file, you decide the intended recipient and transport. A delivery or file-storage service you select may handle that file and associated account or connection information under its own terms. Copies can remain in downloads, sharing caches, backups or the recipient's records.
Different package protections
Routine encrypted Trainer–Personal packages are bound to the intended installation and relationship using recipient-specific encryption and authentication. The private relationship keys are held by the participating applications; CMA Solutions does not possess the private recipient keys needed to decrypt those routine packages.
The initial Personal-to-Trainer enrolment file uses separate shared-key protection for basic client identity and public-key information. This is not the same as installation-specific recipient confidentiality: someone with the compatible shared bootstrap key may be able to open it. Use a trusted exchange route, check the intended client and Trainer, and follow the supported enrolment controls. Do not use that initial file as a channel for medical histories or full client records.
Encryption does not prevent a legitimate recipient from viewing information or remove the need to protect devices and additional copies. Lost recipient keys cannot be replaced by a publisher-held decryption key.
Licensing and support
CMA Solutions handles the information you provide for licensing, activation, consultation, enquiries or support. This may include contact and business details, installation/request identifiers, edition and version information, licence correspondence, descriptions of problems and technical information you choose to supply. It is separate from automatic collection of local fitness records.
Provide only information needed for the request. Do not send private keys, passwords, medical screening or identifiable client databases or packages through ordinary support correspondence. If supporting information is needed, minimise or redact it first and agree an appropriate route.
For information CMA Solutions handles, purposes include responding to enquiries, providing requested support, administering licences and meeting applicable legal obligations. Depending on the circumstances, the basis may be steps requested before a contract, performance of a contract, legitimate interests in supporting and securing the software, or a legal obligation. A notice checkbox is not relied upon as universal consent for those activities.
Optional Nutrition services
Optional online food searches, barcode lookups and product-image requests contact Open Food Facts and its image services. Requests may reveal the search words or product barcode, requested image, relevant language or market parameters where used, and ordinary connection information such as IP address and application user agent. Do not type identifiable client or medical information into a product search.
These lookups do not send your CMA client profile, full diary, measurements or Trainer database as part of the implemented lookup request. Local records can still be managed without using online product lookup. The external provider's handling of requests is governed by its own privacy information.
Website and platform services
This website is hosted using GitHub Pages. Website delivery involves ordinary network information; GitHub states that visitor IP addresses are logged for security purposes. Opening a legal-document link or checking its availability also requests the relevant public page. CMA's document checks do not send client records or unique installation or relationship identifiers.
The website's Contact page uses email links. Your email provider and the recipient's email services handle the message you choose to send. Operating-system, browser, Google Play, Microsoft Store and associated installation or diagnostic services may handle information independently under their own privacy terms. This policy does not promise that those providers perform no logging or processing.
Security and backups
Keep devices and accounts secure, use supported access controls, protect backups and exported files, and review intended recipients. Application backup exclusions do not remove copies you manually save or share. Keep recovery information using supported arrangements. CMA Solutions does not remotely manage or erase local client data on your behalf.
Retention and deletion
Personal users manage their local information through available application and device controls. Trainers set appropriate retention arrangements for their client records and must address applicable professional, contractual and legal requirements. Removing a local record does not automatically remove copies held by another recipient, in an export, in a backup or with a transport service.
CMA Solutions retains licensing and support information only for the purposes for which it is needed, including handling the request, relevant licence administration, security and applicable legal or record-keeping needs. Ask through the Contact page about information CMA Solutions holds about you. We cannot delete local records we do not hold; direct requests about a Trainer's copies to that Trainer as well.
UK privacy principles and rights
Where UK data-protection law applies, handling should be lawful, fair and transparent, limited to appropriate purposes and necessary information, accurate, retained only as needed and appropriately protected, with accountability for these arrangements. Extra conditions may apply to protected categories of information.
Rights may include access, correction, erasure, restriction, portability and objection, depending on the circumstances and applicable exceptions. You can usually manage your own local CMA records directly. For information handled by CMA Solutions, use the Contact page; for a Trainer's records, contact the Trainer. You may raise a concern with the Information Commissioner's Office where relevant. These acknowledgements do not replace any separate consent or lawful basis that may be required.
United States privacy considerations
US federal and state requirements depend on the activity, the information and the parties involved. Fitness and consumer-health information can receive protection even where HIPAA does not apply. This policy does not claim HIPAA certification or exemption from other privacy rules.
Depending on applicable state law and the circumstances, rights can include access, correction, deletion, a copy of information, objection or opt-out rights, and an appeal of a declined request. Use the Contact page for information CMA Solutions handles, and contact a Trainer about their own records. CMA Solutions does not sell local CMA fitness records or use them for targeted advertising. Any separately applicable consumer-health notice or authorisation requirements must be met where relevant; this general policy and its acknowledgement do not replace them.
International handling
A direct exchange may cross borders when you choose an overseas recipient or transport service. Website hosting, email, optional lookup and platform providers may process connection or correspondence information in other countries. Do not assume that local fitness storage means every website or email request stays within your country. Where applicable transfer requirements arise, the responsible party must use an appropriate lawful arrangement or safeguard. Contact CMA Solutions about the services used for information it handles.
Changes and contact
Document revisions are identified on this page. Applications record the relevant edition, version, document revisions and explicit acknowledgements locally; revised documents are not silently marked accepted. Use the Contact page for privacy enquiries or concerns. Do not include unnecessary client or medical information in your enquiry.