Privacy policy
Imara is built around one rule: your training data is yours. This policy explains what we collect, why, who sees it, how long we keep it and what you can do about it.
The short version
- We never sell your data, and it's never used for advertising.
- Apple Health data is used only for your training. Your Health history stays on your iPhone unless you choose to sync it.
- Your coach sees only what you choose to share.
- Imara staff can view your data only with a stated reason, for a limited time, and every view is logged.
- You can export your data or delete your account at any time.
Who we are
Imara is made by Terrigence Labs TODO: registered legal name, company number and registered address, the data controller for your personal data. We are registered with the Office of the Data Protection Commissioner of Kenya TODO: ODPC certificate number. Our data protection contact is privacy@terrigencelabs.com TODO: name the Data Protection Officer.
What we collect
| Data | What it includes |
|---|---|
| Account | Your name, phone number or email, or your Sign in with Apple identity, and sign-in records. |
| Profile | Goals, experience, home equipment, age, weight, height and photo, if you add them. |
| Training | Workouts, sets, weights, warm-ups, notes and how much effort a session took. |
| Health | Apple Health data you allow: steps, heart rate, resting heart rate, HRV, sleep, energy, workouts, weight, body fat and waist. You choose each type in the Health app. Our servers keep workout summaries, and your Health history only if you turn on Health history sync. |
| Wellness | Wellness and weekly check-ins, including progress photos. |
| Coaching | Requests to coaches, the health questions you answer (PAR-Q), your typed name and signature on agreements, and chat with your coach: text, voice notes, photos and videos. |
| Payments | Your M-Pesa number, amounts, confirmation codes and dates. Card details are handled by our card provider. Imara never sees or stores your M-Pesa PIN or full card number. |
| Location | My gym's position, to notice when you arrive. Your exact location is used only when you search nearby or save where you stand. |
| Activity in the community | Shop orders, gym check-ins, places and food spots you suggest or rate, posts and comments. |
| Device | Push notification tokens and basic technical logs, including IP addresses, for security and to keep the service running. |
Health history sync
Health history sync is optional and off by default. If you turn it on, the daily summaries, workouts, weigh-ins, HRV readings and activity rings Imara reads from Apple Health are stored on our servers, so they follow your account to a new phone. It needs its own consent. You can turn it off at any time, which stops new uploads, and you can delete what's stored.
What stays on your iPhone
These are never uploaded to our servers: run routes, the day timeline, Home and Work places, your Apple Watch battery level and the private log. Your Health history also stays on your iPhone unless you turn on Health history sync.
The private log
The private log is an optional record of sexual activity. It's off until you turn it on and agree to its own consent screen. It stays only on your iPhone, in an encrypted file left out of backups, and in Apple Health for entries you choose to save there. It opens only with Face ID, Touch ID or your passcode. It's never sent to our servers, your coach, gym buddies, chat or the community, and it's left out of Export my data unless you tick it.
Why we use your data, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Run your plan, log your training and show your progress | Performing our contract with you |
| Use health data, including check-ins and PAR-Q answers | Your explicit consent, which you can withdraw |
| Store your Health history on our servers | Your explicit consent, in Health history sync |
| Share your data with your coach | Your consent, set in Profile › Share with my coach |
| Store and process data outside Kenya | Your consent, with the safeguards described below |
| Take payments, keep receipts and pay coaches | Performing our contract, and legal duties on tax and accounting |
| Keep the service secure and prevent fraud | Our legitimate interests |
| Marketing messages | Only if you opt in |
Health data is sensitive personal data. HealthKit data is used only for your training and health management. It's never used for advertising, marketing or data mining, and it's never sold or stored in iCloud by Imara.
Who sees your data
- You. You can see and export what we hold.
- Your coach sees only what you share and what you send them. Habits and life load aren't shared unless you turn sharing on.
- Sellers and gyms see the orders you place with them and your check-ins with them.
- Imara staff can view your data only to help you, after giving a reason, for a limited time. Each view is logged. Health and message data need a senior role.
We use these service providers, under contract, and they may only use your data to provide their service to us:
| Provider | What for | Where |
|---|---|---|
| Microsoft Azure | Servers, database, media and backups | South Africa |
| Cloudflare | Network security and delivery. Traffic is decrypted at Cloudflare's edge to inspect it and pass it on | Global network |
| Safaricom (M-Pesa) | Mobile money payments | Kenya |
| TODO: confirm card provider | Card payments | TODO |
| Apple | Sign in with Apple, App Store purchases and push notifications | United States and other countries |
| Africa's Talking | SMS sign-in codes | Kenya |
| Amazon Web Services | Email delivery | European Union |
We may also disclose data when the law requires it. We don't sell or rent personal data.
Data stored outside Kenya
Your data is stored in South Africa, and some providers above operate in other countries. We ask for your consent to this during sign-up and rely on our providers' data protection agreements and standard contractual clauses as safeguards.
How long we keep data
| Data | How long |
|---|---|
| Your account and training data | Until you delete your account, then erased after 14 days |
| Synced Health history | Until you delete it or your account, then erased after 14 days |
| Payment records | 5 years for tax law, without the link to you once your account is erased |
| Sign-in codes | 24 hours |
| Sign-in sessions | 30 days after they expire or are revoked |
| Notifications sent | 30 days |
| Payment provider messages | Content removed after 2 years |
| Security and staff access logs | 2 years |
| Data export files | Deleted after 7 days |
| Encrypted backups | Daily backups 35 days, monthly backups 12 months. We don't restore deleted accounts from backups |
Your rights
Under the Data Protection Act, 2019, you have the right to:
- Be told how your data is used.
- Get a copy of your data: use Export my data in the app or your web account.
- Correct your data: edit your profile, plans and check-ins at any time.
- Delete your data: see how to delete your account.
- Object to a use of your data, or withdraw consent at any time, such as coach sharing or Apple Health access. Withdrawing doesn't affect what we did before.
To use any of these rights, email privacy@terrigencelabs.com. If you're unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner in Kenya.
Security
Connections use HTTPS, disks and backups are encrypted, and the most sensitive fields have their own encryption. The database itself limits who can read each row. Staff tools need two-step sign-in. If a breach is likely to harm you, we'll notify the Data Commissioner within 72 hours and tell you without undue delay.
Children
Imara isn't directed at children. If you're under 18, use Imara only with a parent's or guardian's consent.
Changes to this policy
We'll show the new date at the top and tell you in the app about important changes.