Download PDF ↗

GlobalHub WellFit – Privacy Policy

This Privacy Policy applies to all individuals interacting with the WellFit Platform, including registered users ("Users") and fitness professionals ("Coaches").

Introduction and Purpose

GlobalHub WellFit acknowledges the critical importance of data privacy in the digital wellness sector. This Privacy Policy is designed to empower our Users with a transparent understanding of how their personal and physiological information is handled. We operate on a foundation of "Privacy by Design," ensuring that every feature of the Platform — from workout tracking to nutritional analysis — is built with robust security protocols. Our commitment is twofold: to provide a superior, data-driven fitness experience and to safeguard the fundamental right to digital privacy under the laws of the United Arab Emirates.

1. Data Controller and Regulatory Scope

1.1 The Controller: GlobalHub WellFit (the "Company", "We", "Us") operates the mobile application, website, and digital wellness infrastructure (the "Platform") and acts as the Data Controller regarding all personal information processed therein.

1.2 Regulatory Framework: This Privacy Policy (the "Policy") establishes the rigorous protocols for data collection, storage, and processing in strict adherence to the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE Data Law") and the General Data Protection Regulation (GDPR).

1.3 Acknowledgment: By accessing the Platform, you acknowledge the processing activities described in this Policy. This document is a mandatory regulatory disclosure and does not constitute a bilateral contract or "Agreement".

2. Categories of Data Collected

We collect and process data necessary to provide a high-performance fitness experience. This includes:

  • Identity & verification: Name and gender (ID and certifications for Coaches only).
  • Contact information: Email, phone, and address.
  • Health & fitness (Users only): Body metrics, heart rate, and performance data.
  • Financial & payouts: Payment processing for Users; bank details (IBAN/SWIFT) for Coaches. To facilitate professional fee settlements and global commissions, the Company collects and processes verified bank account details (IBAN/SWIFT) and necessary tax documentation. This data is used exclusively to ensure timely payouts for services rendered.

3. Legal Basis for Processing

Pursuant to Article 4 of the UAE Data Law, we process data based on:

  • 3.1 Contractual performance: Essential processing to provide the digital services requested by the User.
  • 3.2 Explicit consent: Processing of sensitive health data is strictly contingent upon your affirmative, informed consent provided during onboarding.
  • 3.3 Legitimate interest: Including cybersecurity monitoring, fraud prevention (specifically "account-sharing" detection), and UI/UX optimization.
  • 3.4 Statutory obligation: To comply with UAE financial reporting, VAT regulations, and anti-money laundering (AML) protocols.

4. Data Retention and Disposal

4.1 Retention period: Data is maintained throughout the duration of the User's active engagement with the Platform.

4.2 Statutory grace period: Following account deactivation, GlobalHub WellFit shall retain specific identifiers for a period of five (5) years to satisfy legal, audit, and tax requirements under UAE Federal Law.

4.3 Secure erasure: Upon expiration of the retention period, the Company employs cryptographic erasure to ensure data is permanently unrecoverable.

5. Data Residency and International Transfers

5.1 Global infrastructure: You acknowledge that your data may be stored on secured cloud servers located outside the UAE (e.g., AWS or Azure regions).

5.2 Safeguards: All extra-territorial transfers are protected by Standard Contractual Clauses (SCCs), ensuring a level of protection commensurate with UAE and international standards.

6. Disclosure to Third Parties

6.1 Operational sub-processors: We share data with vetted third-party providers (hosting, CRM, analytics) under strict confidentiality obligations.

6.2 Independent coaches: Coaches are granted limited access to specific User metrics solely to facilitate personalized instruction. This access is governed by a Data Processing Addendum (DPA).

6.3 No commercial sale: GlobalHub WellFit maintains a zero-tolerance policy regarding the sale or leasing of User data to third-party marketing entities.

7. Comprehensive Data Subject Rights (DSR)

In accordance with the UAE Data Law and the GDPR, Users possess the following statutory rights:

  • 7.1 Right to access: You have the right to obtain confirmation as to whether or not your personal data is being processed, and access to information regarding the purposes of the processing.
  • 7.2 Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON or CSV) for transmission to another controller.
  • 7.3 Right to rectification: You possess the right to mandate the immediate correction of inaccurate or incomplete personal data concerning you.
  • 7.4 Right to erasure ("right to be forgotten"): You have the right to request the deletion of personal data where it is no longer necessary for the purposes collected, subject to legal retention obligations.
  • 7.5 Right to restriction of processing: You have the right to request the restriction of processing where the accuracy of the data is contested or the processing is unlawful.
  • 7.6 Right to object: You have the right to object to processing based on legitimate interests or direct marketing.
  • 7.7 Right to withdraw consent: Where processing is based on explicit consent (sensitive health data), you have the irrevocable right to withdraw it at any time via the Platform's settings.

8. Systemic Security and Encryption

8.1 Encryption standards: All sensitive health data is protected by AES-256 encryption at rest and TLS 1.3 encryption in transit.

8.2 Access control: GlobalHub WellFit employs a "least privilege" access policy, ensuring that only essential personnel can interact with User databases.

8.3 Breach notification: GlobalHub WellFit shall notify the UAE regulatory authority and affected Users within 72 hours of discovering a security breach.

9. Cookies and Anti-Fraud Tracking

9.1 Session tokens: We use mobile identifiers to maintain session continuity and prevent unauthorized multi-device login (account-sharing prevention).

9.2 Opt-out: Users can manage tracking preferences via the Platform settings or their mobile OS privacy dashboard.

10. Governing Law and Jurisdiction

10.1 Governing law: This Privacy Policy and any dispute or claim arising out of it shall be governed by and construed in accordance with the law of Dubai Emirates and the federal laws of the United Arab Emirates.

10.2 Jurisdiction: The parties irrevocably agree that the courts of the United Arab Emirates shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Policy.

11. Contact and Grievances

For any inquiries regarding this Policy or to exercise your Data Subject Rights (DSR), please contact our team at contact@globalhub-wellfit.com.

Entity: GlobalHub WellFit LLC