Privacy Policy

We collect only the data we need to deliver and improve your wellness programme. Depending on how you interact with us, this may include:

• Identity and contact data, such as your name, work email address, phone number, employer and job function.
• Programme data, such as attendance and participation records, session bookings, tournament sign-ups, and the goals you set with your coach.
• Health and fitness data, such as height, weight, body composition, resting heart rate, activity levels, injury history, dietary preferences and restrictions, and similar measurements you choose to share.
• Nutrition data collected by our registered dietitians during consultations, including food diaries and dietary assessments.
• Mental wellbeing data, meaning information you share during counselling, assessment or therapy sessions with our clinical psychologists.
• Website and technical data, such as IP address, browser type, device type and pages visited, collected to keep the website secure and working correctly.
• Communications, meaning messages you send us through our contact form or by email.

We treat health data and mental wellbeing data as sensitive. We apply stricter access controls, stricter sharing rules and stricter retention rules to them, as described below.

• Directly from you, through assessments, consultations, forms, sessions and messages.
• From your employer, limited to onboarding information such as your name, work email and department, so we can enrol you in the correct programme.
• Automatically, meaning basic technical information collected by our website and platform for security and reliability.

Under the DPDP Act we process your personal data on the basis of your consent, or where processing is necessary for a legitimate use permitted by law. We use your data to:

• Design, deliver and adjust your individual wellness programme.
• Schedule sessions and tournaments, and communicate with you about them.
• Produce aggregated, de-identified reporting for your employer on programme participation and overall outcomes.
• Respond to your enquiries and provide support.
• Keep our website and platform secure, and comply with our legal obligations.

We do not sell your personal data. We do not use your personal data to make automated decisions that produce legal or similarly significant effects on you.

More generally, employers receive reporting only at an aggregated and de-identified level. Your employer can see:

• Overall participation and attendance rates across the organisation or a large team.
• Aggregate, anonymised trends across a group, reported only where the group is large enough that no individual can reasonably be identified.
• Programme delivery information, such as sessions run, tournaments held and formats offered.

Your employer does not receive:

• Any mental health or counselling information whatsoever.
• Your individual health measurements, assessment results or fitness data.
• Any dietary assessment, food diary or nutrition plan prepared for you.
• Notes from your one to one sessions with any of our professionals.
• Any report about you as an identified individual.

The only exceptions are where you give us your specific, informed and freely given consent to share something in particular, or where disclosure is strictly required by law or is necessary to prevent a serious and imminent risk to life or safety. Where such an exception applies, we will limit the disclosure to the minimum necessary and, wherever it is lawful and safe to do so, tell you about it.

We share personal data only with parties who need it to deliver the service to you, and only under written confidentiality and data protection obligations:

• Our own coaches, registered dietitians and clinical psychologists, on a strict need-to-know basis. Mental wellbeing records are accessible only to the clinical psychologist involved in your care.
• Service providers who host our platform, send our emails or provide secure storage, acting only on our instructions.
• Venue operators, where a name list is required to give your team access to a booked ground or court for a tournament. This is limited to names and nothing else.
• Legal, regulatory or government authorities, where we are required by law to disclose data.

EDIT ME: if any personal data is transferred outside India, for example if your website hosting, email or analytics provider stores data abroad, list those providers and the countries involved here, and confirm with your legal advisor that the transfer is permitted under the DPDP Act.

We take reasonable security safeguards to prevent personal data breaches, including:

• Encryption of data in transit and at rest.
• Role-based access controls, so staff can only reach the data their role requires.
• Separate, more tightly restricted storage for mental wellbeing records.
• Confidentiality agreements binding every member of our team and every professional we work with.
• Logging, periodic access reviews and a defined process for responding to any suspected breach.

If a personal data breach occurs, we will notify the Data Protection Board of India and each affected person in the manner and within the timelines required by the DPDP Act.

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires. Our retention periods are:

• EDIT ME: contact and enquiry data, for example 24 months from your last contact with us.
• EDIT ME: programme, participation and tournament records, for example for the duration of the programme plus 12 months.
• EDIT ME: health, fitness and dietary assessment data, for example for the duration of the programme plus 12 months.
• EDIT ME: mental wellbeing and clinical records. Confirm the retention period your clinical psychologists are required to observe under applicable professional and legal standards.
• EDIT ME: billing and statutory records, for example 8 years, as required by tax and company law.

When a retention period ends, we securely delete the data or irreversibly anonymise it so that it can no longer be linked to you.

Under the DPDP Act, as a Data Principal you have the right to:

• Access, meaning you can obtain a summary of the personal data we hold about you and how we process it.
• Correction, meaning you can have inaccurate or incomplete data corrected, completed or updated.
• Erasure, meaning you can ask us to delete your personal data where it is no longer needed for the purpose it was collected for, and where no law requires us to keep it.
• Withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing that already took place, and may mean we can no longer deliver parts of the programme.
• Grievance redressal, meaning you can raise a complaint with our Grievance Officer about how we have handled your data.
• Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
• Complain to the Board, meaning you can escalate an unresolved complaint to the Data Protection Board of India.

To exercise any of these rights, contact our Grievance Officer using the details on this page. We may need to verify your identity before we act on a request.

Our services are intended for adults in employment. We do not knowingly collect personal data from anyone under the age of 18. Where we ever process the data of a child, or of a person with a disability who has a lawful guardian, we will obtain verifiable consent from the parent or lawful guardian as required by the DPDP Act, and will not carry out tracking, behavioural monitoring or targeted advertising directed at them.

EDIT ME: describe your actual cookie and analytics use here. If you add a tool such as Google Analytics, Vercel Analytics or a chat widget, say what it collects, why, and how visitors can opt out. If this website sets no analytics or advertising cookies at all, say so plainly instead.

We may update this policy as our services or the law change. We will update the "last updated" date at the top of this page, and where the change is significant we will notify you directly.

For any question about this policy, or about how we handle your personal data, contact our Grievance Officer using the details listed on this page.