1. Scope

This policy applies to HolaCoach services for finding Gym & Fitness coaches, managing programs, schedules, consents, and coaching communications.

2. Data we may process

The data involved depends on the features you use and the information you choose to provide.

• account identity, Coach or member profile, and fitness preferences
• consent data, PAR-Q screening, schedules, packages, and workout notes you enter
• payment data or confirmations needed for the services you choose
• the minimum technical data needed for account security, notifications, and operations

3. Sources and collection

Data may come from you, another member's action connected to your account, an authorized party in a service process, or your browser and device when a feature is used. We seek to explain the need when data is requested and do not request unrelated data without a reasonable purpose.

• You may provide data through forms, settings, Chat, uploads, email, support, or a service workflow.
• Technical data such as sessions, devices, times, and security signals may be created automatically to operate the service.
• When an account is created, we record the connection IP address and its estimated country for account history and security. The estimate uses reference data held on our server without sending the IP address to a location lookup service. A VPN or the network you use can affect the result; the connection country does not establish nationality or home address. It also helps set the initial language. You can still choose Indonesian or English.
• Data from another party is processed only when connected to a function, access decision, report, or lawful obligation.

4. Why data is used

Data is used only for legitimate purposes connected to the service.

• match, manage, and run the Coach-member relationship
• assess readiness for coaching based on the information you provide
• manage schedules, packages, payments, and support
• protect the community and handle reports or disputes

5. Visibility and sensitive data

Some visibility choices can be managed in product settings.

• Screening data and fitness notes are used only for the service you agree to and are not public on a general profile by default.
• Progress or notes shown on a public profile are published only when you allow it.

6. Profile, screening, and consent data

We may process names, photos, usernames, Coach/member profiles, fitness preferences, PAR-Q screening, consent, program goals, workout notes, schedules, packages, and communications you provide. Sensitive data is used only as relevant to the flow you choose and the applicable access controls.

Data may come from you, a Coach, operations personnel, or a valid booking activity. When you enter another person's data, ensure that you have authority and have provided any required explanation.

• Screening supports coaching readiness and does not automatically become a diagnosis or medical decision.
• Consent status is recorded so shared data can be traced and not used outside the agreed context.
• We seek not to request health data that is not needed for the selected feature or service.

7. Coach, member, and operations access

A Coach may see only the member data needed for an agreed service and while that access is valid. A member may see Coach information and notes made available to the member. HolaCoach personnel may access limited data for verification, safety, payment, support, or report handling.

Being signed in alone is not enough to open coaching data. Access is determined by role, service relationship, consent, session, and server-side checks.

• Screening and fitness notes are not public on a general profile by default.
• Progress, photos, or testimonials appear publicly only when you give appropriate permission.
• Coach or staff access may be removed when the service relationship ends, a role changes, or a security risk occurs.

8. Schedules, payment, and communication

Schedule data, package details, session status, invoices, payment confirmations, and communications are used to run the Coach-member relationship, send reminders, resolve changes, and provide support. Sensitive payment information should not be entered into Chat and is not needed by a Coach.

Email, in-app, and Push notifications may be used according to active channels. Delivery and session data helps prevent notifications from being sent to the wrong account.

9. Public data, reports, and providers

A public profile contains only data marked for public display, such as a display name, username, photo, expertise, or program information you allow. A safety or abuse report may retain a minimum snapshot and metadata for internal review.

Hosting, email, payment, storage, or technical providers may process limited data to operate a feature. They receive no more data than needed for their task and may have their own privacy notices.

10. Retention and control of fitness data

Retention depends on account status, service relationship, sessions, transactions, safety records, reports, audits, and applicable obligations. When data is no longer needed, it may be deleted, anonymized, or restricted. Backups and records needed for disputes or safety may follow separate cycles.

You may request access, correction, update, or deletion of certain data through the privacy channel. We may verify identity and may not be able to delete records that must be retained or data relating to another user.

11. Sharing

We do not sell personal data as a commodity. Data may be shared on a limited basis with:

• the Coach or member involved in a service you agree to
• HolaCoach personnel who need to verify an application, payment, safety issue, or support request
• providers that help operate the service under the applicable controls

12. Retention and security

Data is retained only as long as needed to operate the service, protect users, resolve disputes, or meet applicable obligations. It is then deleted, anonymized, or restricted as appropriate.

We use technical and organizational controls proportionate to risk. No digital transmission or storage can be guaranteed 100% secure, so users must also protect their accounts and devices.

13. Your requests

Subject to applicable law, you may request access, correction, restriction, or deletion of certain data. Some information may need to be retained for security, audit, service, or legal reasons. We will explain a decision where reasonably possible.

14. Cookies and similar technology

Cookies or similar technologies may be used for sessions, language preferences, security, and product operation. Disabling necessary cookies may prevent parts of the service from working.

15. Updates

This policy may be updated when the product, processing practices, or legal requirements change. The latest version is identified by the update date above; material changes may receive an additional notice through an appropriate channel.