DRAFT — under review and not yet in force.

Privacy policy

Yoyo Gyms connects gyms with their members and runs each gym's own system. It is operated by MuleSoo Digital Solutions. Questions about this policy: the contact address will be added before this policy takes effect.

Who is responsible for what

If you are a gym member, your gym decides what it collects about you and why, and is responsible for it. We store and process it for your gym, and nothing else. Each gym's records are kept separate from every other gym's.

If you own a gym, we are responsible for the information about you and your business.

What your gym may collect about you

• Identity and contact: name, date of birth, gender, ID or passport number, nationality, phone, email, address, and an emergency contact. For a minor, a guardian's consent.
• Your membership: plan, dates, payments your gym records, check-ins, class bookings, training notes, progress entries you add, and messages with your gym.
• Health: your answers to the PAR-Q health questions, injuries you tell your gym about, and whether you have medical aid. Used for your safety when you exercise.
• A photo for your membership card.
• Face data, only if you agree to it: a set of numbers made from your photo, used to recognise you at check-in and sign-in. It is not a picture, and you can use the gym without it.

What we collect about gym owners

• Your name, email, password (stored only in a form that cannot be reversed) and your gym's details.
• The documents you upload with your application.
• For your subscription, Paystack handles your card. We keep only a token that lets us charge the same card again, and the card type and last four digits so you can recognise it. We never see or store the card number.

The app

• Camera: only when you press Scan, to read a gym's QR code. No image is kept.
• Location: only when you press "Use my location", to show the nearest gyms first. It is not saved to your account.
• The app remembers which gym you chose, on your phone only. You can make it forget.

Who else handles it

• Supabase stores the databases. Vercel runs the service.
• Brevo sends emails — membership confirmations, reminders and account emails.
• Paystack takes gym owners' subscription payments.
• CallMeBot, if your gym switches it on, sends the gym owner WhatsApp or Telegram alerts. A new-member alert includes the member's name, membership number, phone, email and whether the PAR-Q health questions need a doctor's clearance.

These providers may store information outside your country.

How long it is kept

• A member's records are kept until the gym deletes them, or until you ask for them to be deleted.
• When a gym closes, its records are kept for 90 days in case it reopens, and then deleted after we have confirmed it with the gym.
• Documents from an application we decline are deleted 90 days after the decision.

Your rights

You can ask to see, correct or delete what is held about you. Members: ask your gym, or use Delete my account in the app or the member area. Everyone: how to delete your account. In South Africa you may also complain to the Information Regulator.

Changes

If this policy changes, the new version is published here with its date.