1. Summary
We collect only what is needed to provide the service. Your health information is visible to the trainers you subscribe to or have subscribed to. Medical conditions and medications are encrypted, and InBody report photos are read by a service provider to extract your values. We do not sell personal data. You can download a copy of your data or delete your account in Settings at any time.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | email address, password (stored only as a one-way hash), name, photo, language, time zone, gender, date of birth, optional contact phone number | you |
| Sign-in | email verification status, sign-in attempts (to lock an account after repeated wrong passwords), optional Apple or Google account identifier, device name, IP address, app version | you, your device |
| Trainer profile | headline, bio, disciplines, certification documents, gym, service area, payout IBAN | trainer |
| Bookings and payments | orders, subscriptions, sessions, check-in time and location, payment status and method type (never the card number) | you, Moyasar |
| Health (sensitive) | screening answers, injuries, conditions, medications, InBody measurements and report photos, workout and meal logs | trainee |
| Communication | chat messages, voice notes, photos and videos, complaint messages | you |
| Matching | questionnaire answers (goals, preferences, search radius) | trainee |
| Technical | crash reports and request logs (email addresses and phone numbers masked; passwords, links and tokens are never logged) | your device, our servers |
3. Why we use it
- To provide the service you request: accounts, bookings, payments, programs and chat.
- With your explicit consent for health data. You give it in the health questionnaire and can withdraw it at any time in Settings; trainers then no longer see your health data. Withdrawing it may prevent in-person training.
- To meet legal obligations: accounting, tax and VAT, and fraud prevention.
- For legitimate interests: security, abuse prevention and improving the service through aggregated statistics.
4. Who can see your data
- Your trainer sees your profile, bookings and messages. Your health questionnaire and InBody results are visible only while you have an active or past subscription with that trainer.
- Modarebek staff, on a need-to-know basis and only through role-scoped admin access (verification, finance, support, content). Every sensitive admin action is recorded in an audit log.
- Service providers that process data for us: Moyasar (payments, Saudi Arabia), an email delivery provider (verification, password-reset and security emails), Expo, Google Firebase Cloud Messaging and Apple Push Notification service (notifications), our cloud hosting and storage provider, OpenAI (reading InBody report photos) and Sentry (crash reports). Some of these providers process data outside the Kingdom; we only transfer data where the Personal Data Protection Law allows it.
- Authorities, when the law requires it.
5. Security
Data is encrypted in transit (TLS). Medical free text, medications, IBANs and two-factor secrets are also encrypted at the application level (AES-256-GCM with rotating keys). Files are private by default and are shared through short-lived links. Access is logged.
6. How long we keep data
- Account data is kept until you delete your account and is erased 30 days after the request.
- Data export archives are kept for 7 days.
- Records of orders, payments, refunds and payouts are kept for the period accounting and tax law requires, with your name removed from them.
- Health questionnaires and InBody scans are kept until you delete the scan or your account.
7. Your rights
You can access your data, correct it, delete it, receive a copy (Settings, then Download my data) and withdraw your consent. You can also complain to the Saudi Data and AI Authority (SDAIA). For any request you cannot complete in the app, contact legal@modarebek.com.
8. Children
The service is not intended for anyone under 18.
9. Cookies
The website uses only strictly necessary cookies. The Cookie Policy lists them.
10. Changes and contact
We will notify you in the app about material changes to this policy. Contact: legal@modarebek.com, [to be confirmed].