Privacy Policy

Cedra Kaddour FZ-LLC is the operator of VISOR. VISOR and VISOR Fitness are product and brand names, not separate legal entities.

• Legal entity: Cedra Kaddour FZ-LLC
• Registration No.: 0000004084353
• Licence No.: 7017101
• Registered address: FDRK7137, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates

Contact privacy@visorfitness.com for privacy questions and rights requests.

Account and profile information. Name, username, email address, phone number, authentication and account identifiers, profile image, age information used for eligibility and personalisation, gender, user-entered city and country, goals and preferences. Required fields are identified when requested. We use your phone number for account management, not marketing. Without information needed for an account or feature, we may be unable to provide it.

Fitness and health information. Workout plans and history, activity and nutrition logs, calorie estimates, body measurements, weight, sleep, recovery information and other health or wellness details you choose to provide or connect. Health information may also appear in photos, notes or AI conversations. We obtain explicit consent for health-information processing and explain the information and purposes involved.

Photos and generated images. Profile photos, food images, body photos and other images you upload, together with generated transformation images and related inputs. An image is treated as health information where its content or the way we use it reveals information about your health.

Community and communications. Posts, comments, direct and group messages, user-entered profile details, member searches, likes, group membership, reports, support correspondence and related records. Visibility depends on whether you send a private message, post to a group or publish content more widely.

Subscription information. Product identifiers, purchase and renewal information, receipt or transaction identifiers, subscription status and entitlements from the relevant app store and our subscription service provider. VISOR does not receive your full payment card number from app-store purchases.

Device and technical information. IP address, device type and operating system, app version, installation and notification identifiers, connected-device identifiers where needed for pairing or synchronisation, and technical records about requests, errors, security and service performance.

If you enable a supported connection, VISOR can read the health or activity categories that you authorise from Apple Health through HealthKit, Android Health Connect or a supported wearable device. Available categories depend on your device and connection and may include steps, exercise and activity records, energy expenditure, heart rate, heart-rate variability, blood oxygen, respiratory rate and sleep. The permission screen identifies the categories requested.

Readings selected for synchronisation are sent to VISOR's backend to store your history and provide the features you enable. We obtain your explicit consent before using health information for personalised AI processing and identify the relevant information, purposes and AI providers. Device permissions do not replace this consent. We request only the health categories needed by the features you enable.

You can manage access in the relevant device or health-service settings and disconnect integrations in VISOR. Revoking access stops future collection from that connection but does not automatically erase information already imported. You can separately withdraw health or AI processing consent through VISOR privacy controls and request deletion of imported information as described below.

We do not sell health information or use connected health information for advertising, marketing, cross-app tracking or data-broker purposes.

We do not use your personal information, health records, body photos, community content or AI conversations to train or fine-tune VISOR models or general-purpose AI models. Our AI service arrangements restrict use of submitted content for general-purpose model training or product improvement. Providers may process and retain limited information for security, abuse prevention and legal compliance, including policy-enforcement systems, as explained below.

Where EU or UK data-protection law applies, we identify both an ordinary lawful basis and an additional condition where health or other special-category information is involved:

• Contract: information necessary to create and manage your account, provide the features you request and administer subscriptions.
• Consent: optional processing that requires your permission. We obtain explicit consent for health information and health-related AI processing, together with the applicable ordinary lawful basis. Optional marketing or analytics consent is separate.
• Legitimate interests: proportionate security, fraud prevention, service reliability, support and protection of legal rights, after considering your interests and rights. This basis alone does not permit processing of special-category health information.
• Legal requirements: retaining records or responding to binding requirements where the relevant law supplies a lawful basis. For EU or UK processing, we assess the applicable local legal basis for obligations arising under other countries' laws.

Acceptance of our Terms is not explicit consent to process health information. We explain the relevant processing before asking for consent and keep a record of your choices. You can withdraw consent through VISOR privacy controls as easily as you give it. We stop new collection and processing that depends on the withdrawn consent, including pending work that has not started. Withdrawal does not make earlier lawful processing unlawful. A feature that needs the withdrawn processing may become unavailable.

• Create and manage accounts, authenticate users and synchronise requested information.
• Provide and personalise workouts, nutrition tools, transformation and recovery guidance using the information and permissions relevant to those features.
• Generate requested AI responses, image analyses, plans and illustrative transformation images.
• Deliver community posts and messages, support member searches and group participation, and investigate reports or abuse.
• Manage subscriptions, restore purchases and resolve billing or access issues.
• Send service communications and notifications, subject to relevant preferences, and send optional marketing only where permitted and with consent when required.
• Maintain service reliability, prevent unauthorised access and comply with applicable legal requirements.

Our AI features send the relevant prompt, selected profile context, conversation context, images or health information to an AI processing service to generate the requested output. Google Gemini is one such service. Before you enable the relevant processing, the feature disclosure identifies the provider, information sent and purpose. We use Gemini under its paid-service data-processing terms and limit submissions to what the feature needs. Any alternative provider must meet our data-protection requirements and be covered by the relevant disclosure and consent before receiving your information.

Google's Gemini API retains prompts, context and outputs for 55 days for abuse monitoring, security and required disclosures. Authorised personnel may review flagged material, and monitoring data may support models used specifically for policy enforcement. This is separate from general-purpose model training. Provider security or legally required records may therefore remain after you remove an item from VISOR.

AI outputs can be incomplete or inaccurate. They provide general transformation, fitness and wellness guidance and are not medical advice or guaranteed outcomes. We do not use these features to make solely automated decisions that have legal or similarly significant effects on you. Contact us if you believe an automated result has affected your rights; we will consider the request and provide the safeguards required by applicable law.

Body-transformation features process the full image you submit, which may include your face and surroundings, to produce the requested analysis or visual illustration. Image processing may involve assessing image suitability and locating body or face regions; it is not limited to pixels outside the face. Upload only images you are entitled to use, and avoid including other people or unnecessary identifying details.

We do not use these images to identify you by comparing your face with other people, create an identity-recognition database or verify your identity through facial recognition. Health-related processing requires the applicable explicit consent. Generated images are illustrations, not predictions of a particular physical outcome.

We do not sell personal information. We do not disclose health or fitness information for advertising, marketing or cross-context behavioural tracking.

Service providers. We use providers for infrastructure, storage and content delivery, authentication, notifications, AI processing, subscription administration and support. They receive the information needed for the relevant service under the applicable contractual safeguards. Examples include Firebase and Google services for authentication and messaging, Google Gemini for AI processing, and RevenueCat for subscription entitlements. We do not send health records or body photos to RevenueCat for subscription administration.

App stores and other independent services. Apple, Google and other services you interact with may independently process information for their own billing, account, fraud-prevention or legal purposes under their own notices. Their role is not identical to a vendor acting solely on VISOR's instructions.

Other users. Content is disclosed to the people or groups you choose to communicate with. Public or group content may be copied by its recipients; private-message content is not made public merely because VISOR processes it to deliver the message.

Legal and safety disclosures. We may disclose limited information where lawfully necessary to meet binding legal obligations, protect rights or safety, investigate abuse or establish or defend legal claims. Health information remains subject to the additional conditions required by law.

Business changes. A lawful reorganisation or transfer of the business may involve information necessary for that transaction, subject to confidentiality, applicable law and notice where required. This is not permission to monetise health information or introduce unrelated uses without a valid basis.

VISOR is operated from the United Arab Emirates, and our providers may process information in other countries, including the United States and countries in Europe. The location can vary by service and configuration. Where a transfer is restricted by applicable law, we use a valid transfer mechanism and any necessary additional safeguards.

For relevant EEA transfers, this may include an applicable adequacy decision or European Commission Standard Contractual Clauses. For relevant UK transfers, this may include UK adequacy arrangements, the UK International Data Transfer Agreement or the UK Addendum to the EU clauses. A data-privacy framework is used only where the recipient and transfer are covered by the relevant certification and applicable rules. We also comply with applicable UAE transfer requirements. You may request information about the safeguards and a copy where required by law.

We keep personal information only for as long as needed for the stated purpose, your requested service and applicable legal requirements. We then delete it or make it irreversibly anonymous. The following rules apply:

• Account, health, community and AI history: kept while needed for your account and the features you use, subject to your deletion requests and the deletion process below. Individual-item deletion applies where offered. We consider inactivity and necessity when reviewing continued retention.
• Uploaded and generated images: kept for the feature and your accessible history until removed through an available control or a verified deletion request, subject to the limited exceptions described here.
• Backups: residual copies are isolated from normal service use and expire within 90 days after removal from active systems. If a backup is restored, deletion instructions are reapplied. This backup period is separate from the account-deletion processing period, and describes our retention limit rather than immediate erasure from every copy.
• Accounting and transaction records: relevant UAE corporate-tax records are retained for at least seven years after the end of the tax period concerned. Other records follow the applicable statutory period. We retain only the information needed for the obligation; this does not justify retaining unrelated photos or health history.
• Security, support and technical records: retained according to the purpose and risk, the time needed to investigate an incident or resolve a request, and any applicable claim or statutory period. Access and continued retention are reviewed. We do not retain these records indefinitely merely because storage is available.
• Provider records: a provider may retain security, abuse-prevention, transaction or legally required records under its applicable terms, including the Gemini monitoring period described above. We instruct processors to delete or return information as required by the relevant contract and law.

Where we must retain information after a deletion request, we restrict it to the relevant obligation or legitimate purpose and delete it when that basis ends. We explain applicable exceptions in response to a request.

Depending on the law that applies, you may request access, correction, erasure, restriction, objection, a portable copy of eligible information and safeguards for certain automated decisions. These rights have conditions and exceptions. You may withdraw consent at any time without affecting earlier lawful processing.

Use VISOR's privacy controls or email privacy@visorfitness.com to make a request or withdraw consent. Health-platform permissions can also be changed in your device or health-service settings. Withdrawing permission for future access is different from deleting previously imported records. We request only proportionate information needed to verify identity and protect another person's account.

We respond without undue delay and within the period required by applicable law. Under the EU GDPR, this is normally one month; a permitted extension for complexity or volume will be explained within the initial month. We apply the corresponding rules that govern your request. We do not charge a fee except where the law permits one.

You may complain to the competent UAE authority or, where applicable, your local EEA supervisory authority or the UK Information Commissioner. You may contact us first, but this does not prevent you from approaching a regulator.

To request deletion in the app, open Profile, go to Settings and select Delete Account. You can also start at visorfitness.com/delete-account or email privacy@visorfitness.com or support@visorfitness.com with the subject Delete My Account. We verify ownership before scheduling deletion or changing an account's access in response to a deletion request.

We acknowledge account-deletion requests within five business days and normally complete deletion from active systems within 30 days of receiving a verified request. Any recovery period is included in that 30-day period and is explained when you confirm deletion. You can cancel a pending request before permanent deletion using the instructions provided or by contacting privacy@visorfitness.com.

We process requests without undue delay and meet any earlier deadline required by law. Contact privacy@visorfitness.com if you need an earlier erasure assessment. A recovery period does not permit further health or AI processing after you withdraw consent. If a lawful exception prevents full erasure, we explain what information is retained and why.

We remove the account and associated profile, health and fitness records, uploaded and generated images, AI history and community content from active systems, subject to the limited legal exceptions above. We also arrange required deletion by our processors and confirm completion after the required deletion steps have finished. Backups expire within 90 days after active-system removal. Content independently copied by other users, and records lawfully retained by independent providers, may remain outside our control.

Deleting your account does not automatically cancel an Apple App Store or Google Play subscription. Cancel the store subscription separately to stop future renewals. We show this distinction during the deletion process.

We use cookies, tokens and similar storage where needed for sign-in, security and requested functionality. Optional analytics or marketing technologies, if offered, are explained separately and enabled only after consent where required. You can change the relevant preference using the provided controls. Device or browser settings may limit some technologies but may also affect functionality.

We encrypt personal information in transit between VISOR applications, our servers and service providers, and encrypt stored health information. We restrict access to authorised people and systems, protect authentication data, and limit sensitive information in technical logs. We monitor and investigate security incidents and provide notifications where required by law. No service can guarantee absolute security.

VISOR is available only to adults aged 18 and over. We apply age-eligibility checks before enabling health, photo and AI features and may take proportionate steps to verify age information. We do not knowingly permit under-18 use. If we discover an ineligible account, we restrict access and remove its personal information unless a limited legal or safety obligation requires retention. Contact privacy@visorfitness.com if you believe a child has supplied information.

We will update the revision date when this policy changes. We will notify you of material changes through the app, email or another appropriate channel, before new processing begins where required. We obtain fresh consent where the change requires it. Continued use alone is not consent to a new health-data, training or marketing purpose.

Controller: Cedra Kaddour FZ-LLC (Registration No. 0000004084353, Licence No. 7017101)
Registered address: FDRK7137, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates
Privacy: privacy@visorfitness.com | Support: support@visorfitness.com
Legal: legal@visorfitness.com | Website: www.visorfitness.com