• Personal Information We may collect personal information that you voluntarily provide when you use the App, such as your name, email address, birthdate, gender, and fitness goals. We may also collect information about your physical activities, workout routines, and health data, including heart rate, calories burned, and sleep patterns.
• Device and Usage Information We automatically collect certain information about your device and usage when you use the App, including device type, operating system, unique device identifiers, IP address, and how you interact with the App. We may also collect data on the frequency and duration of your workouts.
• Location Information With your permission, we may collect information about your location through GPS, Wi-Fi, or other location-based services. You may disable location services at any time through your device settings.
• Apple Health and Health Connect Data With your permission, the App may connect to your Apple Health or Health Connect account to access your health data stored in these services. This may include information about your activities, heart rate, calories burned, sleep patterns, and other health-related data. You may revoke the App's access to your Apple Health or Health Connect data at any time through your device settings.

• To provide and improve the App and its features, including creating personalised workouts and recommendations for you.
• To communicate with you about the App, including updates, promotions, and customer support.
• To monitor and analyze usage and trends, for research purposes, and to improve our understanding of how users interact with the App.
• To enforce our terms of service, prevent fraud, and ensure the security of the App and our users' information.

• With your consent, such as when you choose to share your workout data with friends or fitness professionals.
• To our service providers, who help us provide and maintain the App and are contractually obligated to protect your information.
• As required by law or to comply with legal processes, such as subpoenas, court orders, or government requests.
• If we believe it is necessary to protect our rights, property, or the safety of our users or others.

Wellbayt is committed to ensuring the security and confidentiality of all user data, especially sensitive information such as health records, in accordance with applicable privacy laws and regulations. To this end, we implement the following data protection mechanisms:

• Encryption: Sensitive data transmitted through Wellbayt's services, including Health Connect, is encrypted using industry-standard encryption protocols to prevent unauthorised interception or access during transmission. Additionally, all stored sensitive data is encrypted at rest to safeguard against unauthorised access.
• End-to-End Encryption: Communication between users and the Wellbayt platform, as well as between different components of the system, is protected with end-to-end encryption. This ensures that data remains confidential and secure throughout its journey within the platform.
• Access Controls: Wellbayt employs robust access control measures to restrict access to sensitive data only to authorised personnel who require such access for legitimate purposes. User authentication mechanisms, including passwords and multi-factor authentication, are implemented to verify the identity of users accessing the platform.
• Key Management: Proper key management practices are implemented to securely generate, store, and manage encryption keys used to protect sensitive data. This includes regular rotation of keys and adherence to industry best practices for key storage and handling.
• Regular Security Audits: Wellbayt conducts regular security audits and assessments to identify and address potential vulnerabilities in our systems and infrastructure. These audits include penetration testing, vulnerability scanning, and code reviews to ensure the ongoing effectiveness of our security measures.

By employing these data protection mechanisms, Wellbayt aims to safeguard user data against unauthorised access, destruction, loss, alteration, or disclosure.