Straight answers about your clients' data.

Check-ins, body measurements and progress photos can reveal health information. On top of the security measures below, health data has its own rules.

• Your call. You decide what health data to collect, and we process it on your behalf, only on your instructions.
• Consent first. Health data needs your client's explicit consent, given separately from accepting the terms. Training AI on it needs a second, separate consent, and your client can withdraw either at any time.
• Kept out of analytics. We exclude or mask health data before it reaches our analytics, session replay and monitoring tools. We don't sell it or use it for cross-context advertising.
• AI only with consent. We only send health data to a third-party AI provider with your client's explicit consent and a data processing agreement with that provider.
• Encrypted photos. We store progress photos on AWS in London with server-side encryption. You and the team members you give access can see them. Inside Kahunas, we limit access to staff who need it to run, secure or support the service.
• How long. We keep health data while the account is active and for 30 days after it closes, or until your client withdraws consent, whichever comes first. If you archive a client, we delete their data after 12 months unless you restore them.

We don't hold SOC 2 or ISO 27001 certification. It's on our security roadmap, and our infrastructure providers hold industry-standard certifications for their own services.

• Encryption. We encrypt everything in transit with TLS 1.2 or higher. At rest, the database uses AES-256, photos and files use server-side encryption, and the cache is encrypted too. Payments go through our payment providers, so we don't store card details.
• Separate databases. Each coaching business has its own dedicated database, separate from every other customer's. We refuse any request we can't match to an account.
• Sign-in and MFA. WorkOS runs sign-in, with single sign-on and multi-factor authentication. We offer MFA to every account but don't enforce it for all of them yet, so as a safeguard, only administrator accounts can delete data. Mandatory MFA is on our roadmap.
• Staff access. We grant access by role, limit it to what each role needs, review it regularly and remove it when someone leaves. Only authorised engineers can reach the production database. Our Coach Success team has scoped administrative access so they can help you, and support staff have no direct database or infrastructure access.
• Backups. We run continuous database backups with point-in-time recovery and keep version history on stored photos and files.
• Testing. We build security reviews into development and run regular vulnerability assessments. Independent external penetration testing is part of our ongoing security program.
• Breaches. If a breach affects your clients' data, we tell you without undue delay and within 48 hours of becoming aware, with the details we have, so you can meet your own reporting duties. For data we control, we notify the regulator where the law requires, within 72 hours where feasible.

We can't guarantee that any system, ours included, is completely secure.

These companies process data on our behalf to run Kahunas, each under a data processing agreement. We give you at least 30 days' notice before adding or replacing one. You can object on reasonable data protection grounds, and if we can't resolve it, you can cancel before the change takes effect.

Version 2.6Effective 5 October 2026Version history

Apps that you or your clients choose to connect, like Apple Health, Google Fit, Garmin, Whoop, YouTube or Vimeo, run under their own terms. You authorise them directly, so they aren't our sub-processors.

We store your clients' records, photos and files in London, UK. Chat, AI features and some supporting services run in other regions, and the Sub-processors section lists every provider's region. Kahunas FZE is registered in the UAE. Our DPA includes the Standard Contractual Clauses and the UK Addendum, which cover UK and EU client data sent to countries without an adequacy decision.

Your clients' data is yours to control, and we look after it for you. In GDPR terms, you're the controller and we're the processor. For your own account and billing details, we're the controller. We follow UK GDPR, EU GDPR and UAE data protection law, and we're registered with the UK Information Commissioner's Office.

• Never sold. We don't sell personal data, share it for cross-context advertising or set advertising cookies.
• Your part. As the controller, you decide why you collect client data. You're responsible for having a lawful basis, getting any consent you need and telling your clients how you use their data.
• Your clients' rights. Clients can ask to access, correct, delete, restrict or export their data, or object to how it's used. Kahunas gives you the tools to handle these requests yourself.
• When an account closes. We delete personal, coaching and health data within 30 days. We keep records that tax and financial law require for up to 7 years, limited to what the law needs. Ask us and we'll confirm the deletion in writing once it's done.
• Archived clients. If you archive a client, we delete their data 12 months later unless you restore them. We give you and your client 30 days' notice, and until then you can request an export, which we send only to the client.
• AI training. We only train AI on anonymised data that can't be traced back to a person, and health data needs separate consent before we use it. Anyone can opt out at any time.
• Asking about data. Clients: your coach controls your coaching data, so ask them first. You can also email compliance@kahunas.io, and we'll answer for the data we control and pass the rest to your coach. Coaches: email compliance@kahunas.io for privacy requests and support@kahunas.io for anything else.

If you think you've found a security vulnerability in Kahunas, email compliance@kahunas.io with the steps to reproduce it. Please don't access or change other people's data or disrupt the service, and give us reasonable time to fix the issue before sharing it publicly. We'll acknowledge your report within 5 business days.