Privacy Policy

1. Who this Policy Applies To

This policy applies to two categories of data subjects:

• Studio accounts — businesses (pilates studios, gyms, yoga studios, personal training practices) that register for and use the HealthStudio platform to manage their operations.
• Client accounts — individuals who book classes or sessions through a studio that uses HealthStudio.

2. Personal Information We Collect

Studio accounts

• Business name, trading address, and contact details
• Name and email address of the account owner and any staff users
• Billing information (payment method details handled via our payment processor; we do not store raw card numbers)
• Studio configuration data (class schedules, service descriptions, instructor profiles)
• Marketing lead data submitted via our contact / trial-request form

Client accounts

• Full name and email address
• Booking and attendance history (classes attended, sessions booked)
• Credit pack type, credit balance, and on-account billing status
• Payment history (amounts paid, dates, reference numbers)
• Communications sent through the platform between you and your studio

3. Special Personal Information (Health-Related Data)

POPIA section 26 imposes heightened protections on special personal information, which includes information about a person’s health or sex life. The following data held by HealthStudio may constitute special personal information:

• Class attendance records — participation in pilates, yoga, rehabilitation, or other fitness activities may reveal information about a person’s physical health or fitness condition.
• Credit pack type — pack names a studio chooses (e.g., rehabilitation programme, senior fitness, post-natal pilates) may disclose health status.
• Health notes — any health or injury notes a studio captures about a client at the studio’s request.

We process this information only to deliver the booking and management service and do so with the explicit or implied consent of the client (by virtue of booking a health or fitness class). We do not process special personal information for profiling, advertising, or purposes unrelated to the studio’s service delivery. Studios remain responsible for obtaining any additional consent required from their clients.

4. Purpose of Processing

We process personal information for the following lawful purposes (POPIA s. 11):

• To create and manage studio and client accounts on the platform
• To facilitate class scheduling, booking, and attendance tracking
• To process subscription payments for studio accounts, and credit pack or on-account payments for clients
• To send transactional communications (invoices, account and billing notifications)
• To provide customer support and respond to queries
• To improve and maintain the platform (aggregated, anonymised analytics)
• To comply with our legal obligations (tax records, POPIA compliance)

5. Retention of Personal Information

We retain personal information only as long as necessary for the purpose for which it was collected, or as required by law:

• Active studio account data is retained for the duration of the studio’s platform subscription; active client account data is retained for as long as the client remains active with the studio.
• After account closure, we retain data for a further period of up to 5 years to comply with financial record-keeping obligations (SARS / VAT Act).
• Marketing lead data is retained until the lead converts or requests deletion, whichever is earlier.
• Anonymised, aggregated analytics data may be retained indefinitely as it cannot identify individuals.

6. Sharing Personal Information

We do not sell your personal information. We share it only where necessary:

• Paystack — our payment processor. Paystack processes payment card data on our behalf under its own PCI-DSS and POPIA-aligned terms.
• Supabase — our cloud database and authentication provider. Data is stored in Supabase’s infrastructure.
• Resend — our transactional email provider, used to deliver booking confirmations and notifications.
• Your studio — if you are a client, your booking data is visible to the studio you book with. The studio is a separate responsible party for its own use of that data.
• Law enforcement or regulatory authorities, where required by South African law.

7. Your Rights Under POPIA

As a data subject you have the following rights (POPIA ss. 23–25):

• Right of access — you may request a description of the personal information we hold about you and the identity of any third parties with whom we have shared it.
• Right to correction or deletion — you may request that we correct inaccurate information or delete information we are no longer lawfully authorised to retain.
• Right to object — you may object to our processing of your personal information on grounds relating to your particular situation, where we rely on legitimate interests as our lawful basis.
• Right to withdraw consent — where processing is based on your consent (e.g., analytics cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint — you may approach the Information Regulator of South Africa if you believe your rights have been infringed (www.inforegulator.org.za).

8. Security

We implement appropriate technical and organisational measures to safeguard personal information against loss, theft, unauthorised access, disclosure, copying, use, or modification. These measures include encrypted data storage, role-based access controls, and regular security reviews. In the event of a security compromise that materially affects you, we will notify you and, where required, the Information Regulator.

9. Cookies and Analytics

We use two categories of cookies:

Essential cookies

These are strictly necessary for the platform to function (e.g., authentication session tokens) and cannot be switched off. They are set in response to your actions and do not track you across other websites. No consent is required for essential cookies.

Analytics cookies (optional)

With your consent, we use PostHog to collect anonymised analytics data about how visitors use our marketing site (pages viewed, session duration, referral source). This helps us understand which features and content are most useful. Analytics cookies are not used for advertising or shared with advertising networks.

How to manage your cookie preference

When you first visit our site a cookie consent banner appears at the bottom of the page. You can accept or decline analytics cookies at that point. To change your preference later, clear your browser’s local storage for this site (Browser settings → Privacy → Clear site data) and reload — the banner will reappear. You can also disable cookies entirely in your browser settings, although this may affect essential site functionality.

10. Contact for Data Requests

To exercise any of your POPIA rights, or to raise a concern about how we handle personal information, please contact our Information Officer:

We will respond to data requests within 30 days of receipt, in accordance with POPIA.

11. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. We encourage you to review this policy periodically. Continued use of the platform after changes are posted constitutes acceptance of those changes, to the extent permitted by law.