Kahunas Privacy Policy — Version 3.9

Version 3.9 · Effective Date 6 October 2026

Previous Version 5 October 2026 (v3.8) · Status Live

Governing Law United Arab Emirates · Jurisdiction Dubai Courts

Registered Office Kahunas FZE, Coworking Business Centre, Sharjah Publishing City Free Zone, Sharjah, UAE

Contact compliance@kahunas.io

1 Introduction

This Privacy Policy ("Policy") explains how Kahunas FZE ("Kahunas", "we", "us", or "our") collects, uses, shares, and protects personal information through our websites, mobile and desktop applications, and services (collectively, the "Services"). Kahunas is incorporated in the United Arab Emirates, with its registered office at Coworking Business Centre, Sharjah Publishing City Free Zone, Sharjah, UAE.

We serve users globally. While our infrastructure is hosted primarily in the United Kingdom, with certain sub-processors located in the United States and other jurisdictions, this Policy applies to all users regardless of location. This Policy is incorporated into the Kahunas Business User Terms by reference and should be read together with them.

2 Scope and Application

This Policy applies to all individuals who interact with our Services, including coaches, clients, and site visitors. Our Services are not directed at children under 16. By accessing or using the Services, you acknowledge the practices described in this Policy.

3 Our Role: Controller and Processor

Kahunas operates under different roles depending on context:

• Data Controller: When we collect and process personal data for our own purposes — including account management, platform analytics, product improvement, and marketing communications — Kahunas acts as the data controller.
• Data Processor: When coaches use our platform to manage their clients' personal data (fitness records, coaching notes, communications), Kahunas acts as a data processor on behalf of the coach, who is the data controller. We maintain Data Processing Agreements (DPAs) for this purpose.

Coaches are responsible for ensuring they have appropriate legal grounds and disclosures in place when using our platform with their clients. We provide DPA templates and guidance to support compliance.

4 Information We Collect

A. Automatically Collected Data

• Log data (IP address, browser type, pages visited, time spent)
• Device data (operating system, device model, identifiers)
• Usage behaviour and in-app interactions
• Cookies, pixels, and analytics data

B. Information You Provide

• Contact details (name, email address, phone number)
• Profile data (username, photo, preferences)
• Payment information (processed via Stripe or PayPal — we do not store card data)
• Support messages and communications
• Uploaded files (images, audio, documents)
• Chat messages between coaches and clients, and posts/comments/reactions within Communities you join (via GetStream)
• Video content preferences (YouTube, Vimeo integrations)

5 Special Category Health and Fitness Data

With your explicit consent, we may collect the following health and fitness data:

• Cardiovascular metrics: heart rate, VO2 max, blood pressure (systolic and diastolic)
• Physical activity: steps, calories burned, workout records, active minutes
• Body composition: weight, BMI, body fat percentage, lean body mass, bone mass, hydration
• Sleep data: duration, deep sleep, REM, light sleep phases, consistency
• Nutrition: dietary intake, macros, hydration levels
• Biomarkers: blood glucose, SpO2 (blood oxygen saturation), skin temperature
• Laboratory test results: lab reports you upload (for example blood, urine, or hormone panels) and the results, reference ranges, and lab flags read from them
• Heart Rate Variability (HRV) and cardiovascular recovery metrics
• Respiratory metrics: breathing rate, breaths per minute
• Physical recovery and readiness indicators
• Reproductive health: menstrual cycle data, where you choose to record it

Consent for health data may be granted or withdrawn at any time per category. Withdrawal of consent does not affect the lawfulness of prior processing.

6 Data from Third-Party Sources

With your explicit permission, we may receive data from:

• Health platforms: Apple Health, Google Fit, Health Connect SDK (Android)
• Video platforms: YouTube, Vimeo (viewing preferences, workout video interactions)
• Fitness tracking devices and connected wearables
• Other health and fitness applications you choose to connect

We only access third-party data you explicitly authorise. You may revoke these connections at any time via your account settings. We adhere to data minimisation principles.

7 How We Use Your Information

We use personal data to:

• Provide, operate, and improve our Services
• Create and manage user accounts
• Process payments via Stripe or PayPal
• Respond to support enquiries
• Send administrative, transactional, and service communications via SendGrid
• Deliver personalised coaching content and recommendations
• Facilitate secure communication between coaches and clients
• Sync health and fitness data from connected apps and devices
• Conduct product analytics and platform optimisation
• Ensure legal compliance and platform security
• Conduct marketing communications (with opt-out available)
• Generate automated health scores (Sleep, Stress, Anxiety, Readiness, Wellbeing) using a 0–100 algorithmic scale based on established health metrics
• Enhance our AI features and services, including improving coaching recommendations and insights
• Train AI models using properly anonymised data (health data requires explicit consent; see Section 11)

8 Legal Bases for Processing

Under UK GDPR, EU GDPR, and other applicable laws, our processing is based on:

9 Sharing Your Information

We may share your data with:

• Your assigned coach, and any authorised team members or staff at your coach's business whom your coach has given access to your account, for the purpose of delivering coaching services (if you are a client on our platform)
• Other members of a Community you choose to join, limited to the posts, comments, and reactions you share within that Community (where this feature is enabled for your account)
• Essential service providers under strict Data Processing Agreements (see Section 10)
• Legal or regulatory authorities, where required by law
• Successor entities in the event of a merger, acquisition, or business transfer
• Third-party integrations you explicitly authorise

We do not sell personal data. We do not share personal data for cross-contextual advertising.

10 Sub-Processors

We use the following third-party sub-processors. Each operates under a data processing agreement and meets our data protection standards. We maintain a current sub-processor register and will notify affected customers of material changes. The authoritative register is the Kahunas Sub-Processor List (currently Version 2.6, effective 5 October 2026); where this table and that list differ, the Sub-Processor List governs.

AI Providers and Health Data

AI providers (Google, DeepSeek models served by Baseten, and OpenAI) process user inputs to generate product responses, and Cartesia converts AI agent results into optional voice recaps. Health data is not passed to AI providers without explicit consent and a confirmed data processing agreement with the relevant provider (see the Health Data Policy, Section 8).

11 AI Training and Automated Processing

AI Training.

We use AI and machine learning to enhance our Services, including improving coaching recommendations, personalising user experiences, and developing new features. For AI training purposes:

• We use only properly anonymised data that cannot be re-identified
• Health and special category data requires explicit, separate consent before use in AI training
• You may opt out of AI training at any time via account settings or by contacting compliance@kahunas.io
• Opting out of AI training does not affect your access to our Services
• We maintain records of AI training activities and data categories used

Your Rights Regarding Automated Processing.

We do not make decisions with legal or significant effects on you based solely on automated processing. Where automated systems are used for personalisation or recommendations, you may request human review, understand the logic applied, and contest or request reconsideration of any output.

12 Automated Health Scores

We use automated algorithms to generate numerical health scores (0–100 scale) from your health data:

• Sleep Score: Based on sleep duration, deep sleep phases, and REM sleep quality
• Stress Score: Derived from heart rate variability, resting heart rate, and blood pressure
• Anxiety Score: Combination of stress indicators and sleep quality metrics
• Readiness Score: Sleep quality, HRV, and activity levels for training preparation
• Wellbeing Score: Daily steps, sleep patterns, and cardiovascular health indicators

These scores are informational aids to support coaching. They do not constitute medical diagnoses or treatment decisions. You have the right to understand how scores are calculated, access the underlying raw data, discuss interpretations with your coach, and opt out of automated scoring while retaining access to raw health data.

13 Your Data Protection Rights

Depending on your jurisdiction, you have the following rights. To exercise any right, contact us at compliance@kahunas.io.

Chat History and Shared Communications.

When processing data access requests that include chat history, we provide your complete messages and conversation metadata while redacting other participants' messages to protect their privacy rights.

14 Data Retention

The periods above are maximum retention periods. Following account closure or offboarding, personal, coaching and health data is deleted within 30 days. If a coach archives a client, the client's personal, coaching and health data is deleted 12 months after the date of archiving, unless the coach restores the client before then. A client who was already archived when this version took effect is deleted 12 months after their original date of archiving, but no earlier than 90 days after the effective date of this version. Before the 12 months end, a coach may request an export of the client's data; the export is sent only to the client. We notify the coach and the client 30 days before an archived client's data is deleted. Records required for financial and tax compliance may be retained for up to 7 years, with personal data limited to what is necessary for the relevant legal, accounting or regulatory purpose. A minimal internal record evidencing that deletion took place is retained for 6 years. Operational deletion timelines are set out in the Kahunas Data Retention Policy.

You may request earlier deletion where permitted by law. Requests are handled via compliance@kahunas.io.

15 International Data Transfers

Our infrastructure is hosted primarily in the United Kingdom, and certain sub-processors are located in the United States, the European Union, and other jurisdictions, as set out in the Sub-Processor List. We serve users globally and transfer data internationally where necessary to provide our Services. We ensure adequate protection through the following mechanisms:

16 Data Security

We implement the following security measures:

• Encryption of all data in transit (TLS) and at rest using industry-standard protocols
• Role-based access controls — CS and engineering access is segregated
• Destructive operations (including data deletion) are restricted to administrator accounts only
• Multi-factor authentication (MFA) available via WorkOS — offered to all users to set up during account onboarding, and recommended for all staff accounts
• Object versioning enabled on stored media to support recovery
• Regular security reviews and vulnerability assessments
• Staff training on data handling and security responsibilities
• Secure backup procedures and disaster recovery protocols
• Incident response procedures (see Section 18)

While we implement robust security measures, no method of transmission or storage is 100% secure. We continuously monitor and improve our security posture.

17 Cookies and Tracking

We use cookies and similar technologies as described in the Kahunas Cookie Policy, which is the authoritative statement of the technologies in use, the purposes for which they are used, and the choices available to you. The Services do not set marketing or advertising cookies. Disabling strictly necessary cookies may affect platform functionality.

18 Data Breach Notification

In the event of a personal data breach, we will:

• Notify the competent supervisory authorities where required by applicable law, in particular where the breach is likely to result in a risk to individuals' rights and freedoms, without undue delay and, where feasible, within 72 hours of becoming aware (UK ICO, relevant EU authorities, or other applicable regulators)
• Notify affected users without undue delay where there is a high risk to their rights and freedoms
• Investigate all incidents thoroughly, document findings, and implement remediation
• Maintain records of all breaches and actions taken

19 Children's Privacy

Our Services are not directed to children under the age of 16 (or the applicable age of digital consent, where higher, in your jurisdiction). Health Data is additionally subject to the minimum age set out in the Health Data Policy. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it within 30 days. If you believe a child has provided us with personal data, please contact compliance@kahunas.io.

20 California Residents (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including:

• Right to know what personal information we collect, use, disclose, or sell
• Right to delete your personal data (subject to certain exceptions)
• Right to opt out of the sale of personal data (note: we do not sell personal data)
• Right to correct inaccurate personal data
• Right to non-discrimination for exercising your CCPA rights

To make a CCPA request, contact compliance@kahunas.io with sufficient information to verify your identity.

21 UK Residents (UK GDPR)

If you are a UK resident, you have rights under UK GDPR including access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making (see Section 13). If you are dissatisfied with our response to any privacy concern, you may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. You may also raise your concern with us first at compliance@kahunas.io; we will acknowledge your complaint within 30 days and keep you informed of its progress.

22 UAE Data Protection

Kahunas FZE is incorporated in the United Arab Emirates and processes personal data in compliance with UAE Federal Decree-Law No. 45/2021 on the Protection of Personal Data. Where required, appropriate safeguards are applied to cross-border transfers of personal data originating in the UAE.

23 Changes to This Policy

We may update this Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated via:

• Email notification to registered users
• In-app notifications
• Prominent notice on our website

The latest version is always available at https://kahunas.io/privacy. Continued use of our Services after changes become effective constitutes acceptance of the updated Policy.

24 Contact Us

For any questions about this Privacy Policy, your data rights, or our privacy practices:

This Privacy Policy is effective as of 6 October 2026. It supersedes all prior versions.

Appendix A — Version History

The table below records the published versions of the Kahunas Privacy Policy. Minor editorial corrections and formatting updates are not recorded. Users are notified of material changes in accordance with Section 23.

For questions regarding changes between versions, contact compliance@kahunas.io