Who is responsible for your data

Kallos Gym is the data controller for the personal data described in this policy. We decide what is collected and why.

For any question about your data, or to exercise any of the rights in this policy, contact us at kallos@kallosfitness.com. We aim to respond within 30 days.

What we collect

Account and identity: your first, middle and last name, email address, mobile number, date of birth, preferred language, profile photo if you upload one, and the gym location you are registered at.

Emergency contact: the name and phone number of the person you nominate. Please tell that person you have given us their details — this policy applies to their data too.

Membership and payment records: which plan you hold, its start and end dates, remaining class credits, renewal status, and a record of each payment showing the amount, its status and a reference from the payment provider.

Attendance and bookings: the classes you book, join a waitlist for, attend, cancel or miss, and your check-ins at the gym.

Fitness records: workout results you log, personal records, and any note you attach to a result.

Communications: messages you send to gym staff through the app, and private-class requests including any preferences or notes you write.

Staff notes: our staff can record operational notes about your membership — for example an agreed payment arrangement or an injury you have told a coach about. You cannot see these in the app, but you may ask us for a copy at any time and we will provide it.

Waiver: the version of the membership waiver you accepted and the date you accepted it.

Activity log: a record of significant actions taken on your account, including by staff, so that changes to memberships and bookings can be audited.

What we do not collect

We never see or store your card number, expiry date or security code. When online payment is enabled, card details are entered on the payment provider’s own page and we receive only a reference and the result of the transaction.

We do not track your location, read your contacts, or use advertising identifiers. We do not sell your data to anyone, for any purpose.

Why we use it, and on what basis

To provide the membership you have bought: booking classes, tracking credits, admitting you to the gym, and keeping your account accurate. This is necessary to perform our contract with you.

To keep you and others safe: your emergency contact and any injury information exist so we can act if something happens to you at the gym.

To meet legal and accounting obligations, including retaining records of payments.

To contact you about your membership — a class cancellation, an expiring plan, a failed renewal. These are service messages, not marketing.

We will only send you marketing with your explicit, separate consent, and you can withdraw it at any time without affecting your membership.

Fitness and health information

Qatar’s data protection law gives special protection to data about a person’s health or physical condition. We treat the fitness results you log, and anything you tell us about an injury or medical condition, as data of that kind.

We collect it only because you choose to record it or tell us, we use it only to show you your own progress and to keep you safe while training, and we do not share it outside the gym.

You can ask us to delete your fitness records at any time and keep your membership.

What other members can see

Class leaderboards show members’ names alongside their results for a session. You are included by default.

You can turn this off at any time from your account settings, and your results become visible only to you and to gym staff. Turning it off does not affect anything else about your membership.

Your email address, phone number, date of birth, emergency contact and payment records are never shown to other members.

Who we share it with, and where it is stored

We use a small number of service providers to run the app. They process data on our instructions and may not use it for their own purposes.

Our database and file storage are provided by Supabase, hosted on Amazon Web Services in Mumbai, India. This means your personal data is stored outside Qatar.

Our website and application servers are provided by Google Cloud, hosted in Doha, Qatar.

When online payment is enabled, payment processing will be provided by Sadad, in Qatar. We will send them only what is needed to take the payment: the amount, an order reference, and your name, email and mobile number.

We may disclose data where the law requires it, or to establish or defend a legal claim.

By using the app you consent to your data being transferred and stored outside Qatar as described above. If you would rather it were not, contact us — we can discuss what is possible, though it may mean we cannot offer you the app.

How long we keep it

We keep your account and membership records for as long as you are a member, and for a further period afterwards where we are required to retain financial records or may need to defend a legal claim.

Messages, fitness records and bookings are kept while your account is open. If you ask us to delete your account, we remove your personal data except where we must retain a payment record, in which case we keep only the transaction and not your fitness or message history.

The activity log records who changed what and when. Entries about actions taken on your account are kept for security and accountability, and are not deleted on request, because their purpose is to be a reliable record.

Your rights

You may ask us to confirm what personal data we hold about you and to give you a copy of it, including the staff notes described above.

You may ask us to correct anything that is wrong, and you can change most of your own details in the app at any time.

You may ask us to delete your data, or to stop a particular use of it. Where we must keep something — a payment record, for example — we will tell you what and why.

You may withdraw any consent you have given, including consent to marketing and to the storage of your fitness records, without affecting your membership.

To exercise any of these, write to kallos@kallosfitness.com. If you are not satisfied with our response, you may complain to the National Cyber Governance and Assurance Affairs in Qatar.

Children

If you are under 18, a parent or guardian must give consent before you use the app, and we will ask for it at sign-up.

A parent or guardian may ask to see the data we hold about their child, and may ask us to delete it. We will verify who is asking before acting.

How we protect it

Access to member data is restricted by role: coaches see only what they need to run a class, front-desk staff see what they need to serve you at the counter, and full records are limited to administrators. These limits are enforced by the database itself, not only by the app.

Data is encrypted in transit and at rest, and access to our systems is limited to named accounts.

If a breach occurs that is likely to harm you, we will notify the National Cyber Governance and Assurance Affairs within 72 hours of becoming aware of it, and we will tell you directly.

Changes to this policy

If we change how we use your data in a way that materially affects you, we will tell you in the app before the change takes effect, and where the law requires it we will ask for your consent again.

The date at the top of this page is the date of the current version.