Scope

This policy applies to HolaCoach services for finding Gym & Fitness coaches, managing programs, schedules, consents, and coaching communications.

Data we may process

The data involved depends on the features you use and the information you choose to provide.

• account identity, Coach or member profile, and fitness preferences
• consent data, PAR-Q screening, schedules, packages, and workout notes you enter
• payment data or confirmations needed for the services you choose
• the minimum technical data needed for account security, notifications, and operations

Sources and collection

Data may come from you, another member's action connected to your account, an authorized party in a service process, or your browser and device when a feature is used. We seek to explain the need when data is requested and do not request unrelated data without a reasonable purpose.

• You may provide data through forms, settings, Chat, uploads, email, support, or a service workflow.
• Technical data such as sessions, devices, times, and security signals may be created automatically to operate the service.
• When an account is created, we record the connection IP address and its estimated country for account history and security. The estimate uses reference data held on our server without sending the IP address to a location lookup service. A VPN or the network you use can affect the result; the connection country does not establish nationality or home address. It also helps set the initial language. You can still choose Indonesian or English.
• Data from another party is processed only when connected to a function, access decision, report, or lawful obligation.

Why data is used

Data is used only for legitimate purposes connected to the service.

• match, manage, and run the Coach-member relationship
• assess readiness for coaching based on the information you provide
• manage schedules, packages, payments, and support
• protect the community and handle reports or disputes

Visibility and sensitive data

Some visibility choices can be managed in product settings.

• Screening data and fitness notes are used only for the service you agree to and are not public on a general profile by default.
• Progress or notes shown on a public profile are published only when you allow it.

Profile, screening, and consent data

We may process names, photos, usernames, Coach/member profiles, fitness preferences, PAR-Q screening, consent, program goals, workout notes, schedules, packages, and communications you provide. Sensitive data is used only as relevant to the flow you choose and the applicable access controls.

Data may come from you, a Coach, operations personnel, or a valid booking activity. When you enter another person's data, ensure that you have authority and have provided any required explanation.

• Screening supports coaching readiness and does not automatically become a diagnosis or medical decision.
• Consent status is recorded so shared data can be traced and not used outside the agreed context.
• We seek not to request health data that is not needed for the selected feature or service.

Coach, member, and operations access

A Coach may see only the member data needed for an agreed service and while that access is valid. A member may see Coach information and notes made available to the member. HolaCoach personnel may access limited data for verification, safety, payment, support, or report handling.

Being signed in alone is not enough to open coaching data. Access is determined by role, service relationship, consent, session, and server-side checks.

• Screening and fitness notes are not public on a general profile by default.
• Progress, photos, or testimonials appear publicly only when you give appropriate permission.
• Coach or staff access may be removed when the service relationship ends, a role changes, or a security risk occurs.

Schedules, payment, and communication

Schedule data, package details, session status, invoices, payment confirmations, and communications are used to run the Coach-member relationship, send reminders, resolve changes, and provide support. Sensitive payment information should not be entered into Chat and is not needed by a Coach.

Email, in-app, and Push notifications may be used according to active channels. Delivery and session data helps prevent notifications from being sent to the wrong account.

Public data, reports, and providers

A public profile contains only data marked for public display, such as a display name, username, photo, expertise, or program information you allow. A safety or abuse report may retain a minimum snapshot and metadata for internal review.

Hosting, email, payment, storage, or technical providers may process limited data to operate a feature. They receive no more data than needed for their task and may have their own privacy notices.

Retention and control of fitness data

Retention depends on account status, service relationship, sessions, transactions, safety records, reports, audits, and applicable obligations. When data is no longer needed, it may be deleted, anonymized, or restricted. Backups and records needed for disputes or safety may follow separate cycles.

You may request access, correction, update, or deletion of certain data through the privacy channel. We may verify identity and may not be able to delete records that must be retained or data relating to another user.

Sharing

We do not sell personal data as a commodity. Data may be shared on a limited basis with:

• the Coach or member involved in a service you agree to
• HolaCoach personnel who need to verify an application, payment, safety issue, or support request
• providers that help operate the service under the applicable controls

Retention and security

Data is retained only as long as needed to operate the service, protect users, resolve disputes, or meet applicable obligations. It is then deleted, anonymized, or restricted as appropriate.

We use technical and organizational controls proportionate to risk. No digital transmission or storage can be guaranteed 100% secure, so users must also protect their accounts and devices.

Your requests

Subject to applicable law, you may request access, correction, restriction, or deletion of certain data. Some information may need to be retained for security, audit, service, or legal reasons. We will explain a decision where reasonably possible.

Cookies and similar technology

Cookies or similar technologies may be used for sessions, language preferences, security, and product operation. Disabling necessary cookies may prevent parts of the service from working.

Updates

This policy may be updated when the product, processing practices, or legal requirements change. The latest version is identified by the update date above; material changes may receive an additional notice through an appropriate channel.

Purposes, roles and processing grounds

Data is processed to deliver requested features, perform transactions, protect security, handle support and meet relevant duties. Grounds may include contract performance, legal duties, valid consent, vital interests, legally established public tasks or legitimate interests balanced against individual rights. The ground depends on the purpose and circumstances, rather than blanket consent to every use.

Insimen determines purposes for its own account and operational processing. For business workspaces, healthcare facilities or organisation documents, another party may act as controller and Insimen as processor according to actual roles and agreements. Uploading another person’s data requires authority and a lawful ground; reuse outside original instructions or purposes requires separate assessment.

Minimum data, recipients and international transfers

Data depends on the service: identity and contact details; submitted content and documents; transaction records; and necessary technical, session and audit data. Health, personal financial and children’s data require additional care. Do not upload unnecessary secrets. The service section below explains its specific data context.

Recipients may include people you choose, necessary service providers, authorised support personnel and authorities acting on lawful requests. Sharing is limited by purpose and need; recipients do not receive a blanket right to reuse data for themselves. Authority requests are assessed for legal power, grounds and scope.

Where processing requires a transfer outside Indonesia, applicable cross-border data-protection requirements must be met, including protection-level assessment, adequate binding safeguards or another legally permitted basis. This policy is not unrestricted consent to send all data to any country or recipient.

Choices, rights and handling requests

Subject to law, you may request processing information, access and copies, correction, cessation or restriction, deletion or destruction, withdrawal of consent, objections to certain automated decisions, and other rights including portability where applicable. Withdrawing consent does not invalidate prior lawful processing; some features may stop if a necessary ground is no longer available.

Send requests to cs@insimen.com with your account and service context. Identity or authority verification is proportionate and does not require passwords or one-time codes. Requests are assessed against your rights, others’ rights, retention duties and statutory time limits. Where a request cannot be fully met, the reason and available next steps are explained through an appropriate channel.

Retention, backups, cookies and incidents

Data is kept for as long as justified by purpose, service status, legal duties, transaction evidence or relevant disputes. Removing a view or account does not always immediately erase every archive and backup. Lawfully retained copies must have restricted access and use; deletion or anonymisation follows applicable processes when retention grounds end.

Necessary cookies or device storage may support sessions, security, language and requested functions. Additional processing requiring consent must respect valid choices. Using the service does not authorise every form of tracking.

If a data-protection incident occurs, Insimen assesses impact, restricts risky access and takes response measures. Notifications to individuals and authorities follow applicable statutory requirements and deadlines. This policy does not promise absolute security or shift incident-response duties to users.

Screening, progress, and Coach communications

Screening answers, disclosed health conditions, programs, progress, schedules, and communications are used for relevant coaching. Members should share only necessary information; coaches must not use it for promotion, portfolios, research, or photograph publication without an appropriate basis and permission.

Access follows the service relationship and applicable authority. A package ending does not automatically justify retaining or using copies on personal devices without a lawful need. Certain records may be retained for safety, transactions, complaints, and applicable obligations.