Privacy Policy

We, Hey Trainer (Hey Lifestyle Coaching and Sports Training LLC (Reg. No: CN-6636176)), respect your privacy and are committed to protecting the personal data of all users. This Privacy Policy explains what data we collect, why we collect it, how it is used, how it is protected, and the rights of users and parents. This policy applies to the Hey Trainer mobile application, website, and all related services. By using Hey Trainer, you agree to the practices described in this policy. This policy was last updated on 11 October 2026.

We collect only the information necessary to provide and improve our services.

• • Personal Information (Provided by Users): Name or nickname; Email address; Phone number; Age or date of birth; Gender (optional); Fitness goals and preferences; Trainer selections and session details
• • Health & Fitness Data (User-Provided): Height, weight, BMI (optional); Workout activity details; Training progress and performance metrics; Lifestyle preferences (sleep, habits, routines); Health data is collected only with user consent and is not shared publicly
• • Children's Data (Under 13), where an account is used to book or manage training for a child: Child's name or nickname; Age; Training progress; Session attendance; Does not include precise location data; Does not include advertising identifiers; Does not include social media data; Does not include unnecessary personal information. See 'Children's Privacy' below
• • Automatically Collected Data: Device type and OS version; App usage data (screens visited, actions taken); IP address (for security and fraud prevention); Crash logs and diagnostics

If you choose to connect a health app or wearable device, we receive the data below only to power the features you've enabled, and never for advertising.

• • Sources: Apple Health (HealthKit), Android Health Connect, Samsung Health, and, if you connect them, Fitbit (via the Google Health API), Whoop, and Oura
• • Data types: steps, distance, heart rate, sleep, and active calories burned, depending on the source you connect. Data received from Google through the Google Health API is limited to steps, active calories burned, sleep, and heart rate
• • We use this data only to show your activity and progress, track your goals, and calculate HeyCoins rewards
• • Your assigned trainer can view this data to personalize your training and track your progress. All trainers are bound by confidentiality obligations and a Data Processing Agreement that prohibits unauthorized use or disclosure of your data
• • We do not sell this data, use it for advertising, or share it with data brokers, insurers, or employers
• • We do not use this data to train artificial intelligence or machine learning models
• • Hey Trainer's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements
• • Apple Health and Health Connect data is used only to provide health and fitness features within the app, and is never used for advertising
• • Wearable account connection tokens are stored encrypted
• • You can disconnect a wearable at any time in the app, which revokes our access and deletes the stored connection token
• • Deleting your account also revokes all wearable connections and deletes the stored connection tokens
• • Disconnecting a wearable or deleting your account stops new data from being collected. Health data that was already synced is kept until you ask us to delete it. To request deletion, email support@heytrainer.ae

We use collected data to operate and improve Hey Trainer services.

• • Provide personal training and lifestyle services
• • Match users with suitable trainers
• • Schedule sessions and process payments
• • Track progress and improve user experience
• • Ensure safety and platform security
• • Comply with legal obligations
• • We do not sell personal data

Hey Trainer uses Ziina as a secure third-party payment processor.

• • We do not store credit or debit card details
• • All transactions are encrypted and processed securely by Ziina
• • Ziina's privacy practices apply to payment information

Our website uses cookies and similar technologies to operate correctly and understand how visitors use our services.

• • Essential cookies: required for the website and app to function (e.g., session management). These cannot be disabled
• • Analytics cookies: we use anonymized analytics to understand usage patterns and improve the service. No personally identifiable information is shared with analytics providers
• • We do not use third-party behavioral tracking or advertising cookies
• • Children under 13 are not subject to any tracking beyond what is strictly necessary to provide the service
• • You can manage cookie preferences through your browser settings. Disabling essential cookies may affect functionality

We share limited data only when necessary, with the service providers below, each bound by a data processing agreement and permitted to use your data only to provide their service to us. None of them may use it for their own advertising or resell it to other parties.

• • Assigned trainers (only relevant session information; trainers are bound by confidentiality and data processing obligations)
• • Amazon Web Services (AWS): hosts our servers and file storage (Cloudflare R2)
• • MongoDB Atlas: our primary database
• • Cloudflare: content delivery, security, and bot protection (Turnstile) for our website and app
• • Google / Firebase: sign-in, push notifications, and Google Sheets (used internally to track orders and session bookings)
• • Ziina: payment processing (see 'Payments & Financial Data')
• • Twilio: SMS delivery for phone number verification (OTP)
• • Apple: push notifications to iOS devices
• • Sentry: error monitoring, if and when enabled, to help us find and fix bugs
• • Legal authorities if required by applicable law
• • Children's data is never shared for advertising or marketing purposes

Hey Trainer limits advertising and analytics practices, especially for children.

• • No personalized ads for children
• • Analytics data is anonymized
• • No third-party behavioral tracking for children under 13

Hey Trainer offers personal training services that may be suitable for children under 13. We advise that any account used to book or manage training for a child be set up and operated by a parent or legal guardian, who remains responsible for the information submitted and for supervising the child's use of the service. We do not independently verify the age of an account holder or require parental consent before a session is booked.

• • We encourage parents and guardians to create and manage the account, rather than the child, and to review this policy before submitting any information about a child
• • A parent or guardian may request access to, correction of, or deletion of their child's data at any time by emailing support@heytrainer.ae with the subject 'Child Data Request'. We will verify the request and act on it within a reasonable timeframe
• • We do not serve advertising to any user, and we do not use children's data for any commercial purpose
• • Children's data is never shared with third parties for advertising or marketing
• • If we become aware that a child has provided personal data without appropriate parental involvement, we will take reasonable steps to delete that data promptly upon request

We use industry-standard safeguards to protect user data.

• • Encrypted data storage
• • Secure servers
• • Role-based access control
• • Regular security audits
• • No system is 100% secure, but we take reasonable and appropriate measures to protect your data
• • If a data breach occurs that is likely to result in a risk to your rights or freedoms, we will notify affected users and the relevant supervisory authority without undue delay, and in line with the timeframes required under applicable law (including the UAE PDPL and, where applicable, GDPR)

We retain personal data only for as long as necessary to fulfil the purposes described in this policy or as required by law.

• • Active accounts: data is retained for the duration of your account
• • Inactive accounts: accounts with no activity for 24 months may be anonymized or deleted after prior notice
• • Session and transaction records: retained for up to 5 years to meet financial and legal obligations
• • Health and fitness data: retained until you request deletion. Disconnecting a wearable or deleting your account stops new data from being collected, but does not by itself delete data that was already synced
• • Automatically collected data (device type, IP address, app usage, crash logs): retained for up to 12 months for security, diagnostics, and fraud prevention, then deleted or anonymized
• • Children's data: deleted promptly upon a verified parent or guardian request
• • You may request immediate deletion of your data at any time by contacting support@heytrainer.ae

Your rights vary depending on your region of residence. We respect and honour rights under applicable laws including the UAE Personal Data Protection Law (PDPL), GDPR (for EEA/UK residents), and COPPA (for US residents).

• • Access your personal data
• • Correct inaccurate or incomplete information
• • Request deletion of your data
• • Withdraw consent at any time (where processing is based on consent)
• • Object to or restrict processing of your data
• • Export your data in a portable format
• • Lodge a complaint with your local data protection supervisory authority (for EEA/UK users) or the UAE Data Office (for UAE users), if you believe we have not handled your data properly
• • To exercise any of these rights, email support@heytrainer.ae with the subject 'Data Rights Request'. We will respond within 30 days

Hey Trainer is operated by Hey Lifestyle Coaching and Sports Training LLC (Reg. No: CN-6636176), based in the UAE. We comply with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) as our primary applicable data protection framework.

• • Our servers and database are hosted with Amazon Web Services (AWS) and MongoDB Atlas, both of which operate infrastructure in the United States. This means your data, regardless of where you are located, is stored and processed in the United States
• • We require our hosting and infrastructure providers to maintain industry-standard security and confidentiality protections equivalent to those described in this policy, through their own data processing terms
• • For users in the European Economic Area (EEA) or United Kingdom: where we transfer your personal data outside the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission or the UK equivalent
• • For users in other jurisdictions: we apply the data protection standards described in this policy regardless of where you are located. Where local laws provide stronger protections, we will honour those rights
• • We do not transfer personal data to countries that do not provide an adequate level of protection without appropriate contractual safeguards in place

As our primary applicable framework, we process your personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) on the following bases.

• • Consent: for health and fitness data and optional features, which you may withdraw at any time
• • Performance of a contract: to provide the training and lifestyle services you have booked, including on behalf of a child where applicable
• • Legitimate interest: for platform security, fraud prevention, and improving our services, balanced against your rights
• • Compliance with a legal obligation: where UAE law requires us to process or retain data

If you are located in the EEA or UK, we process your personal data on the following legal bases under the GDPR.

• • Contract performance: to provide the services you have signed up for
• • Consent: for health data and optional features, which you may withdraw at any time
• • Legitimate interests: for platform security, fraud prevention, and service improvement, where these interests are not overridden by your rights
• • Legal obligation: where processing is required by applicable law

We may update this Privacy Policy periodically. The 'Last Updated' date at the top of this policy will reflect the most recent revision.

• • Users will be notified of material changes via the app or email at least 14 days before the changes take effect
• • Continued use of Hey Trainer after changes take effect constitutes acceptance of the updated policy

For privacy questions, rights requests, or concerns, please reach out to us. The email below is our designated privacy contact point for all regions, including for EEA/UK users under GDPR and UAE users under the PDPL.

• • Privacy contact: support@heytrainer.ae
• • Company: Hey Lifestyle Coaching and Sports Training LLC (Reg. No: CN-6636176)
• • Website: https://www.heytrainer.ae
• • We aim to respond to all privacy enquiries within 30 days