PRIVACY POLICY

1. Personal data we collect

We may collect and process the following categories of personal data:

1.1 Information you provide directly

• Account details: name, email address, password or authentication tokens, profile photo, biography, timezone, preferred language.
• Contact details: email address, telephone number, billing address.
• Trainer information: professional profile, qualifications, experience, pricing, availability, content you upload (e.g. class descriptions, programmes, media).
• Client information: bookings, subscriptions, preferences, any information you choose to share with Trainers about your goals or experience.
• Communications: messages you send to us (e.g. support requests) and, where applicable, messages exchanged between Trainers and Clients on the Platform.

We do not ask Clients to provide detailed medical records and you should not upload sensitive health information unless strictly necessary and you understand the risks of doing so.

1.2 Payment and transaction data

Payments on the Platform are processed by our payment provider, currently Stripe. We do not store full card numbers. We receive and process:

• Limited payment information (e.g. last 4 digits of card, card brand);
• Transaction details (amounts, currency, timestamps, payment status);
• Payout information for Trainers (bank details via Stripe Connect tokens, payout amounts and dates);
• Fund holding records (amounts held pending Trainer payment onboarding, holding duration, and release or refund status);
• Stripe onboarding status and verification information (we receive confirmation of verification status from Stripe, but do not receive or store identity documents submitted to Stripe).

1.3 Usage and technical data

When you use the Platform we may collect:

• Device information (device type, operating system, app version, unique identifiers);
• Log data (IP address, access times, pages viewed, links clicked);
• Approximate location (based on IP address, not precise GPS) to help with localisation and fraud prevention;
• Information about how you interact with the Platform, such as which features you use.

This data helps us to operate, secure and improve the Platform.

1.4 Cookies and similar technologies

We use cookies and similar technologies on the web version of the Platform. For more information about the cookies we use and how to manage them, please see our Cookie Notice.

1.5 Video and audio data

The Platform enables live video sessions between Trainers and Clients. To participate in these sessions, the Platform requires access to your device's camera and microphone. You will be asked to grant explicit permission for this access through your device or browser settings.

When you participate in a video session:

• Real-time transmission only: Video and audio streams are transmitted in real-time between participants and are not recorded or stored on our servers.
• Session metadata: We may collect metadata about video sessions, including session duration, timestamps, participant identifiers, and connection quality information for troubleshooting purposes.
• No recording: Recording of video sessions is strictly prohibited on the Platform. Neither Trainers nor Clients may record sessions.
• Encryption: Video streams are encrypted using industry-standard security measures, including TLS 256-bit encryption for connections and AES-128 encryption for media streams.

You can revoke camera and microphone permissions at any time through your device or browser settings, though this will prevent you from participating in live video sessions.

2. How we use personal data and legal bases

We use personal data for the following purposes and legal bases under UK GDPR and EU GDPR:

2.1 To provide and operate the Platform

(Art. 6(1)(b) - performance of a contract)

• Creating and managing your account;
• Enabling Trainers to create and manage classes, programmes and sessions;
• Enabling Clients to find, book and attend classes or sessions;
• Managing payments, subscriptions and payouts.

2.2 To communicate with you

(Art. 6(1)(b) - contract; Art. 6(1)(f) - legitimate interests)

• Responding to your enquiries and support requests;
• Sending service messages (e.g. booking confirmations, payment receipts, changes to these Terms).

2.3 To process payments and prevent fraud

(Art. 6(1)(b) - contract; Art. 6(1)(f) - legitimate interests; Art. 6(1)(c) - legal obligation)

• Processing payments and issuing payouts via Stripe;
• Holding and managing funds pending Trainer payment onboarding;
• Monitoring Trainer onboarding status to determine when payouts can be released;
• Processing refunds where required (including where a Trainer does not complete onboarding);
• Detecting and preventing fraud, misuse or illegal activity;
• Complying with financial, tax and accounting obligations.

2.4 To improve and develop the Platform

(Art. 6(1)(f) - legitimate interests)

• Analysing how the Platform is used;
• Fixing bugs and improving performance;
• Developing new features.

2.5 Marketing

(Art. 6(1)(a) - consent; Art. 6(1)(f) - legitimate interests)

Sending you information about features, news or offers that we think may interest you.

You can opt out at any time by using the unsubscribe link or contacting us.

We will only send electronic marketing to individual consumers where permitted by law (for example, with your consent or because you are an existing customer and have not opted out).

2.6 To enable live video sessions

(Art. 6(1)(b) - performance of a contract)

• Transmitting video and audio streams in real-time between Trainers and Clients during scheduled sessions;
• Facilitating live communication for fitness classes, one-to-one training, and consultations;
• Collecting session metadata for troubleshooting, quality assurance, and Platform improvement.

2.7 Automated decision-making

We do not currently use automated decision-making or profiling that produces legal or similarly significant effects on you. If this changes in the future, we will update this Policy and, where required, seek your consent.

3. Sharing personal data

We may share personal data with:

• Trainers and Clients: to the extent necessary for bookings, sessions and communications.
• Service providers: such as hosting providers, video streaming and real-time communication providers (for live video sessions), email/SMS providers, customer support tools, analytics providers and payment processors (including Stripe, through which we process payments, hold funds pending Trainer onboarding, and manage payouts via Stripe Connect). Our video streaming provider is SOC 2 Type 2 certified and GDPR compliant.
• Professional advisers: such as lawyers, accountants and insurers, where necessary for our business.
• Authorities: where required by law, regulation or legal process, or to protect our rights or the rights of others.
• Business transfers: if we are involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction.

We do not sell your personal data.

4. International transfers

Our servers and some of our service providers may be located outside the UK or European Economic Area.

Where we transfer personal data to a country that does not provide an equivalent level of protection, we will use appropriate safeguards, such as:

• UK or EU-approved standard contractual clauses; and/or
• Other measures recognised by data protection authorities.

You can contact us if you would like more information about these safeguards.

5. Data retention

We keep personal data only for as long as necessary for the purposes set out in this Policy, including to meet legal, accounting or reporting requirements.

In general:

• Account information is kept while your account is active and for a reasonable period afterwards.
• Transaction records may be retained for at least 6 years to comply with tax and accounting obligations.
• Fund holding records (amounts held pending Trainer onboarding, release dates and refund details) are retained for at least 6 years after the funds are released, refunded or otherwise dealt with, to comply with financial record-keeping obligations.
• Technical logs are retained for a shorter period, typically 12-24 months.
• Video session metadata (such as session duration and timestamps) is retained for up to 12 months. Video and audio content is transmitted in real-time only and is not stored.

We may anonymise data so that it can no longer be linked to you. We may use such anonymised information indefinitely.

6. Security

We use appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (e.g. HTTPS);
• Video stream encryption using TLS 256-bit for connections and AES-128 for media streams;
• Access controls and authentication;
• Regular monitoring and backups;
• Third-party video infrastructure that is SOC 2 Type 2 certified and GDPR compliant.

However, no system is completely secure. You are responsible for keeping your login details confidential and for notifying us if you suspect unauthorised access to your account.

7. Children

The Platform is not intended for use by children under 18 as account holders.

Trainers may provide services to younger Clients offline or via their own arrangements, but the account holder using the Platform must be an adult (for example, a parent or guardian).

If we learn that we have collected personal data from a child without appropriate consent, we will take steps to delete it.

8. Your rights

Depending on where you are located and subject to certain conditions, you may have the following rights in relation to your personal data:

• Right to access a copy of your personal data;
• Right to correct incomplete or inaccurate data;
• Right to delete your data in certain circumstances;
• Right to restrict how we use your data;
• Right to object to certain types of processing, including direct marketing;
• Right to data portability;
• Right to withdraw consent where we rely on consent.

To exercise any of these rights, please contact us at contact@nforge.fit. We may need to verify your identity before responding.

Account and data deletion: You can request deletion of your account and personal data at any time using the "Delete account" option in the NForge app, or by emailing us. We will process your request within 30 days. For full details, see our data deletion page.

You also have the right to complain to your local data protection authority:

• UK: the Information Commissioner's Office (ICO) — ico.org.uk
• EU: the supervisory authority in the EU Member State where you live, work, or where the alleged infringement occurred. A list of EU data protection authorities is available at edpb.europa.eu.

9. Trainers as independent controllers

Trainers may also be "controllers" of personal data they receive about their Clients through the Platform.

This means Trainers are responsible for:

• Complying with applicable data protection laws;
• Providing their Clients with an appropriate privacy notice;
• Handling any requests from Clients regarding their personal data that the Trainer controls.

We are not responsible for how Trainers handle personal data outside the Platform.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version on the Platform and change the "Last updated" date above. Where appropriate we may notify you by email or in-app.

Please check this page regularly to stay informed.