Privacy Policy

Last Modified: 2 September 2026

This Privacy Policy outlines the practices of DEMOTU Inc. ("Company," "we," "us," or "our") with respect to how we collect, use, share, and protect your personal information. Our commitment to safeguarding your data extends to all our Services, which include:

  • The use of our mobile application (DEMOTU) and other applications linked to this Privacy Policy
  • Engagement with our Services through marketing, sales, and events

We value your trust and are committed to protecting your privacy. Please read this Privacy Policy carefully to understand our data practices and your rights. If you have any questions, do not hesitate to reach out to us at support@demotuapp.com.



1. Scope

This Privacy Policy applies to personal information processed by DEMOTU Inc. across our websites, mobile applications, and any related online or offline platforms (collectively referred to as "Services"). It describes our data practices and the choices available to you. Where consent is required, we request it separately.



2. Changes to Our Privacy Policy

From time to time, we may update this Privacy Policy to reflect changes in our practices, technological advancements, or applicable laws. Significant updates will be accompanied by a notification, such as an email or an alert within our Services. The "Last Modified" date at the top of this document indicates the most recent revision.



3. Personal Information We Collect

We collect personal information to provide, improve, and tailor our Services to meet your needs. This information may be collected directly from you, automatically through your use of our Services, or from third-party sources.

A. Information You Provide Directly:

  • Account Information: Details such as your name, email address, username, and password when you create an account.
  • Assessment Data: Metrics, motion recordings, and other movement assessment data collected through our mobile application.
  • Health and Body Composition Data: Body composition metrics (such as weight, body fat percentage, and muscle mass) collected through integrations with third-party devices and services. This may also include health-related information provided during consultation intake forms, such as injury history, fitness goals, and physical limitations.
  • Wearable and Fitness Device Data: If you choose to connect a wearable or health platform (such as Apple Health, Samsung Health, WHOOP, Oura, or Google, including Fitbit and Pixel Watch devices), we collect the health and fitness data you authorize, which may include activity (steps, active calories, active minutes, workouts), heart rate and related measurements (resting heart rate, heart rate variability, blood oxygen, respiratory rate), and sleep (duration and sleep stages). We use this data to calculate and display your recovery, sleep, and strain insights, and share it with your trainer only if you choose to. You can disconnect a source at any time, and disconnecting deletes the data synced from that source from our systems.
  • Consultation Data: Information you provide during consultation sessions, including responses to intake questionnaires and custom forms created by your trainer or practitioner.
  • Purchases: Payment information processed securely through third-party vendors.
  • Communication and AI Interaction Data: Your email address, phone number, inquiries, in-app messages, and the content of your conversations with Demotu AI.
  • Survey Responses and Contest Entries: Data you provide when participating in surveys, sweepstakes, or contests.

B. Information Collected Automatically:

  • Device Data: Technical information, such as your device type, operating system, browser type, and IP address.
  • Usage Data: Information about how you interact with our Services, including pages viewed and actions taken.
  • Cookies and Tracking Technologies: Data collected through cookies, pixel tags, and similar tools to enhance user experience and track analytics.

C. Information from Third Parties:

  • Social Media Platforms: Data shared with us when you log in through or interact with social media accounts linked to our Services.
  • External Vendors: Information provided by third-party services we collaborate with to improve our offerings.


4. How We Use Your Information

We use the information collected to:

  • Provide, maintain, and improve our Services
  • Facilitate secure account access and transactions
  • Communicate important updates, marketing offers, and policy changes
  • Process payments and maintain transaction records
  • Ensure the security and integrity of our platforms
  • Analyze broad usage trends to enhance user experience
  • Improve Demotu’s products and models using de-identified data and, where you enable the optional setting in Section 5, identifiable data
  • Comply with applicable legal and regulatory obligations

We may also de-identify or aggregate data for purposes such as research, reporting, and service optimization.

When we use data in de-identified form, we take reasonable measures to prevent it from being associated with an individual, maintain it in de-identified form, and do not attempt to reidentify it except to test our safeguards.

Legal Basis for Processing (GDPR / LGPD):

For users in jurisdictions that require a legal basis for processing personal data, we rely on the following:

  • Contractual Necessity: Processing your account information, assessment data and workout programs is necessary to deliver the Services you signed up for.
  • Explicit Consent: We process health and body composition data, which is considered a special category of personal data, only with your explicit consent. This data is provided voluntarily by you or by your trainer or practitioner on your behalf. We also process other data based on your explicit consent, such as document signatures, screening waivers, and the optional identifiable reuse described in Section 5. For users in the European Economic Area or United Kingdom, marketing communications are also processed based on your explicit consent, which you will be asked to provide separately. Users outside the EEA and UK consent to marketing communications by creating an account and may opt out at any time. You may withdraw consent at any time by contacting us, though this may limit certain features of the Services.
  • Legitimate Interest: We process limited technical data for error monitoring, platform security, and service improvement, where our interests do not override your rights and freedoms.
  • Legal Obligation: We may process data as required to comply with applicable laws and regulations.


5. AI and Automated Processing

Our Services use artificial intelligence (AI) and machine learning technologies developed by Demotu or provided by third-party services to deliver personalized features, including:

  • Generating personalized workout programs and exercise recommendations based on your assessment data, body composition, and consultation responses
  • Producing consultation summaries, progress reports, and actionable insights from your health and fitness data
  • Analyzing movement assessment results to identify areas for improvement

To provide these features, relevant data (such as body composition metrics, assessment scores, consultation responses, and fitness goals) is sent to third-party AI service providers for processing. We take steps to minimize the personally identifiable information sent to these services, such as removing names, email addresses, and other direct identifiers before processing.

AI-generated outputs may be provided directly to users or to trainers and practitioners as decision-support tools. They may be inaccurate and should be reviewed as appropriate. No automated decisions with legal or similarly significant effects are made about you solely by AI without human oversight. AI-generated outputs are not a substitute for professional medical advice.

When you complete a movement assessment, we process the recording to measure your movement and deliver results to you and authorized trainers. Movement data derived from the recording may also be used in de-identified form to improve Demotu. This does not require the optional setting below.

Separately, you may choose in Settings to let Demotu use or license your identifiable movement recordings, movement data, and conversations with Demotu AI for product development, AI training, robotics, and movement research. This choice covers data we already hold when you enable it. Turning it off stops new identifiable use and new licensing disclosures but does not undo processing or disclosures completed before you turned it off.

We do not authorize third-party AI providers that process data on Demotu’s behalf to use it to train their own models.



6. Sharing Your Information

We may share your personal information with the following categories of recipients:

  • AI and Machine Learning Providers: Third-party AI services that process your data to generate personalized workout programs, consultation summaries, and other AI-powered features as described in Section 5.
  • Research and commercial licensees: Research labs and companies working on AI, robotics, or movement may receive identifiable movement recordings, derived movement data, or conversations with Demotu AI under contract, but only when you have enabled the optional setting in Section 5.
  • Cloud Infrastructure Providers: Services that host and store your data securely.
  • Payment Processors: Third-party services that securely handle payment transactions.
  • Error Monitoring and Analytics: Services that help us identify and fix technical issues and understand usage patterns. These services may receive limited technical and usage data.
  • Body Composition Integrations: Third-party device and service providers that transmit body composition data to our platform at your direction.
  • Legal Authorities: When required by law, subpoena, or to protect our legal rights.
  • Business Transfers: In connection with mergers, acquisitions, or other corporate changes.

We require all third-party service providers to handle your data in accordance with applicable data protection laws and our contractual obligations.



7. Tracking Technologies and Cookies

We use a small set of tracking technologies on our website to measure performance, understand how visitors use our Services, and improve marketing. We name them explicitly below so you know what is in use, what each one collects, and how to control it.

Meta Pixel (Facebook Pixel). Loaded from connect.facebook.net. Captures page views and a limited set of conversion events (e.g., views of pricing, demo, and signup pages) and sends that information to Meta Platforms, Inc. for ad measurement and audience building. We do not intentionally transmit form-input contents to Meta.

TikTok Pixel and Events API. The Pixel is loaded from analytics.tiktok.com. Captures page views and a limited set of conversion events, such as demo bookings and account registrations. For those conversions, our server may also send hashed contact identifiers and browser attribution data to TikTok for ad measurement and campaign optimization. Automatic advanced matching and enhanced data postback are disabled.

Google Tag Manager. A tag-management container loaded from googletagmanager.com. Tags loaded through GTM may include Google Analytics 4 and other measurement tags. Data collected includes page views, referrer, device type, and aggregated usage events.

RB2B. A B2B visitor-identification service that matches anonymous website visitors against business contact data and shares the result with Demotu’s sales team. RB2B is loaded from b2bjsstore.s3.us-west-2.amazonaws.com.

PostHog (first-party analytics). Loaded from a subdomain of demotuapp.com. Captures pageviews, and, only with your consent, autocapture of clicks and session recordings. PostHog is configured to mask sensitive form fields by default.

Strictly necessary cookies and storage. We also use cookies and browser storage to keep you signed in, maintain session state, process payments through Stripe, and remember your cookie-consent choice. These are required for the site to function and are not gated behind consent.

Consent and opt-out. Visitors in the European Economic Area, the United Kingdom, and California are shown a consent banner on first visit. Marketing trackers (Meta Pixel, TikTok Pixel, Google Tag Manager, and RB2B) do not load until you accept. Visitors in other regions are auto-opted-in; you can opt out at any time by emailing support@demotuapp.com with the subject line “Opt out of tracking.” You may also block these technologies through your browser’s built-in privacy controls (e.g., blocking third-party cookies) or extensions such as Privacy Badger or uBlock Origin.

Do Not Track. Our website does not currently respond to Do Not Track browser signals. We rely on the consent banner and direct opt-out request mechanism above.



8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our Services. If you request deletion of your account or personal data, we will delete or anonymize your information within 30 days, except where we are required to retain it for legal, regulatory, or legitimate business purposes (such as resolving disputes or enforcing our agreements). Turning off the optional setting in Section 5 does not delete your data. Deletion requests are handled as described below.

To request deletion of your data, contact us at support@demotuapp.com.



9. Your Data Rights

You have certain rights concerning your personal information, depending on your jurisdiction. These may include:

  • The right to access, correct, or delete your personal information
  • The right to receive a copy of your personal data in a structured, commonly used, and machine-readable format (data portability)
  • The right to know which third parties your personal data has been shared with
  • The right to withdraw consent where processing is based on consent, including by turning off the optional setting in Section 5
  • The right to object to or restrict processing under certain circumstances

Under the GDPR, you may submit a Data Subject Access Request (DSAR) to obtain a copy of the personal data we hold about you, learn how it is processed, and exercise any of the rights listed above. To submit a DSAR or exercise any of your data rights, contact us at support@demotuapp.com. We will respond to your request within 30 days.

To opt out of new licenses, turn off the optional setting in Section 5 or email support@demotuapp.com with the subject “Do Not Sell or Share My Personal Information.”



10. International Data Transfers

Your data is stored and processed in the United States. If you are accessing our Services from outside the United States, including from the European Economic Area (EEA), United Kingdom, or other jurisdictions, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

Where required by the General Data Protection Regulation (GDPR) or UK GDPR, we ensure that appropriate safeguards are in place for these transfers. Specifically, our third-party service providers, including our cloud infrastructure, error monitoring, and AI processing providers, have entered into Data Processing Agreements with us that incorporate the European Commission's Standard Contractual Clauses (SCCs) as approved under Commission Implementing Decision (EU) 2021/914. For transfers subject to the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner's Office is applied alongside the SCCs.

In addition, we rely on your explicit consent and the necessity of the transfer for the performance of our contract with you as supplementary legal bases for these transfers. By creating an account and using our Services, you consent to the transfer of your information to the United States. You may withdraw your consent at any time by contacting us, though this may affect your ability to use certain features of the Services.



11. Security Measures

We implement industry-standard security measures to protect your data, including encryption in transit and at rest, access controls, and regular security assessments. However, no system is completely secure, and we cannot guarantee the absolute security of your personal information.



12. Health Information and HIPAA

Our Services are not covered by the Health Insurance Portability and Accountability Act (HIPAA) by default. While our platform may be used to collect and store health-related information, HIPAA-compliant data handling is available only to organizations that have executed a Business Associate Agreement (BAA) with DEMOTU Inc.

Users who are HIPAA-covered entities (such as healthcare providers, clinics, or other organizations subject to HIPAA) must not submit Protected Health Information (PHI) through our Services without first executing a BAA with us. Submitting PHI without an executed BAA is a violation of our Terms of Service, and the submitting party assumes all responsibility for any resulting regulatory exposure.

To inquire about HIPAA-compliant services or to request a BAA, please contact us at support@demotuapp.com.



13. Google API Limited Use Disclosure

Demotu’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Demotu uses Google Calendar data only to provide calendar-related functionality requested by the user. Demotu does not use Google Workspace API data to develop, improve, or train generalized AI or machine learning models.

If you connect your Google account as a health data source, Demotu accesses your Google health and fitness data (activity, heart rate and related health measurements, and sleep) through the Google Health API only with your explicit consent, and only to provide user-facing features: calculating and displaying your recovery, sleep, and strain insights and, if you opt in, sharing them with your trainer. Demotu does not use this data for advertising, does not sell it, does not transfer it to third parties except as required to provide these features or comply with law, and does not use it to develop, improve, or train generalized AI or machine learning models. Disconnecting Google in the app revokes Demotu’s access and deletes your synced Google data from our systems; you can also revoke access at any time in your Google Account security settings.



14. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how your data is handled, please contact our Privacy Team:

For users in the EEA or UK, this contact serves as our privacy point of contact for purposes of the GDPR. For users in Brazil, this contact serves as our person in charge (Encarregado) under the LGPD.