Privacy policy

1. Data we process

• Account information: name, phone number and country code, email, address, country and city when provided, and an optional profile image. Registration includes an identity-number field depending on the registration flow used.
• Sign-in information: password verification data, verification and recovery codes, and sign-in identifiers. For Apple or Facebook sign-in, we process the identifier and information supplied by that provider, such as name, email and Facebook profile image, depending on the sign-in flow.
• Fitness information: weight and height if you provide them, subscription purpose, and InBody appointments and results, including images, notes and session confirmation codes. This information may reveal sensitive health or physical information.
• Service and transaction information: favourites, orders and order items, subscriptions and their duration, usage and freezes, discount codes, wallet balance and transactions, and payment references, amounts and status. A supporting image may be uploaded to establish eligibility for an offer.
• Operational information: push notification token, device OS and notification history; a visitor session identifier for some orders or favourites before sign-in; and a QR code linked to your account. Server operation logs can include request information, errors and transaction references used to diagnose operation.

2. Use and permissions

We use data to create, verify and update your account, provide services and bookings and display InBody results, manage subscriptions, orders, payments, wallet transactions and offers, send service codes, messages and notifications, and investigate issues.

Uploading a profile image, eligibility image or InBody result sends that file to the service. Manage photo or camera access and notifications in your device settings according to the options available in your app version. Disabling notifications may prevent alerts from arriving. Revoking a device permission does not remove data already submitted; request its deletion through Support.

3. Sharing and service providers

Authorised staff access information needed to manage services, bookings and transactions. Hosting and storage services process data to operate the system, and information may be shared to meet a legal obligation or handle a service dispute.

• Google Firebase Cloud Messaging: device tokens and notification content to deliver alerts.
• Taqnyat: phone number and message content to send service and verification SMS.
• ImageKit: account-linked QR files for storage and delivery. Avoid sharing your account QR with unauthorised people.
• Apple and Meta/Facebook: when you choose their sign-in option, according to the data and permissions available in that flow.
• Neoleap, Tabby, Tamara and Madfu: depending on the available payment method you choose, order details, transaction references and customer information needed for payment are processed. Payment details entered with a provider are also governed by its policy and terms.

Email, WhatsApp and social links also process messages and visits under the external service's policy. Providers may process information outside your country.

4. Retention and deletion

Account, service and transaction data remain stored to operate the service and manage subscriptions and bookings. The current deletion action marks the account as inactive; it does not automatically erase the profile, images, InBody results or linked transaction records. Explicitly request account and data deletion through Support to identify the data to remove and follow up on processing.

Some payment, invoice or other records may need to be retained for legal obligations, fraud prevention or dispute resolution. Any retained data and the reason should be explained when processing your request. No uniform deletion or retention period is specified here; ask Support for the period applicable to your data, including backups and provider-held data.

5. Correction and privacy requests

Update the profile fields made available by the app through your profile. To request access, correction of other information or deletion, use the contact options on Support and include your registered phone or email and request type. Account ownership may need to be verified; do not send passwords, card details or verification codes in a support message.

6. Policy updates

This policy may change as the service or data processing changes. The date at the top identifies the last revision of this content.