These summaries are a reading aid written in plain English. They are not legal advice and they are not binding. Where a summary and the policy below differ, the policy is what applies.

01Contact Information for Data Protection

Privacy questions and data subject requests are handled by Kahunas FZE. Reach us at support@kahunas.io, or by post at our registered address in Sharjah, United Arab Emirates.

02Kahunas as Controller and Processor

Kahunas acts in two capacities. As a processor, we handle client data on behalf of the coaches who use the platform: they decide what to collect and why, and we process it on their instructions. As a controller, we process data about our own users, such as account and billing details, for our own purposes.

Which role applies determines who you direct a request to. If you are a client of a coach, your coach is the controller of your training data.

03Your Data Protection Rights

You can request access to the personal data we hold about you, correct it if it is wrong, ask for it to be deleted, restrict how it is processed, or receive it in a portable format.

You may also opt out of your data being used to train AI models, and request redaction of chat history.

To exercise any of these rights, email support@kahunas.io. If you are in the UK or EU and unhappy with our response, you can complain to your supervisory authority (see UK Residents).

04What Information We Collect

We collect four broad categories:

Automatically collected — server logs, device and browser information, IP address, and usage patterns.
Information you provide — name, contact details, profile information, payment details, chat messages, and files you upload.
Health and fitness data — cardiovascular metrics, physical activity, body composition, sleep, nutrition, biomarkers, heart rate variability, blood pressure, glucose and respiratory metrics, and recovery indicators.
Third-party integrations — data from Apple Health, Google Fit, Health Connect SDK, and connected fitness devices, where you have connected them.

Health data is special category data. Under GDPR it carries additional protection, and we process it on the basis of your explicit consent. You can withdraw that consent at any time by disconnecting the integration or contacting support.

05How We Use Your Information

To deliver and maintain the service, personalise your experience, produce analytics, communicate with you including marketing where you have opted in, improve our AI algorithms, and generate health scores.

06Legal Bases for Processing

We rely on performance of a contract, your explicit consent, our legitimate interests, compliance with legal obligations, and in rare cases the protection of vital interests.

08Children's Privacy

The service is not directed at anyone under 13. If we discover we hold data belonging to a child, we delete it within 30 days.

09Data Retention

Retention depends on the category:

Account data — for as long as the account is active, plus 3 years
Health data — 3 years
Payment records — 7 years, to meet financial record-keeping obligations
Server logs — 12 months

10Cookies and Tracking

We use essential cookies to run the site, analytics cookies to understand usage, and marketing cookies where you have consented. You can manage your preferences through the consent banner or your browser settings.

11International Data Transfers

Your data may be processed outside the country where you live. Where that happens we rely on adequacy decisions or Standard Contractual Clauses, and we comply with UK GDPR, EU GDPR, UAE and applicable US requirements.

12Data Security

We use encryption in transit and at rest, access controls, regular audits, staff training, secure backups, and documented incident response procedures.

No system can be guaranteed completely secure, and we do not claim otherwise.

13Automated Decision-Making, Profiling & AI Processing

We do not make decisions with legal or similarly significant effects using automated processing alone. You can request human review of any automated output, ask us to explain the logic involved, and opt out of your data being used for AI training.

14California Residents (CCPA Addendum)

If you live in California you have the right to know what we collect, to request deletion, to opt out of the sale of personal information, to correct inaccurate data, and not to be discriminated against for exercising those rights.

Kahunas does not sell personal information as that term is defined by the CCPA.

15UK Residents (UK GDPR Rights)

If you live in the UK you have rights of access, rectification, erasure, restriction, portability and objection.

If you are not satisfied with how we have handled your request, you can complain to the Information Commissioner's Office at ico.org.uk.

16Data Breach Notification

Where a breach is likely to result in a risk to your rights and freedoms, we notify the relevant supervisory authority within 72 hours. Where the risk is high, we notify affected users without undue delay.

17Changes to This Policy

We communicate updates by email, in-app notification, or a notice on the website. Continued use of the service after an update constitutes acceptance of the revised policy.

18Contact Us

For any privacy question, email support@kahunas.io or write to Kahunas FZE, Sharjah, United Arab Emirates.

Still not sure?

Email support@kahunas.io and a person will answer. For data requests, say what you want and we will confirm the next step.

Your data, explained.