Health Data Policy

1 Purpose and Scope

This Health Data Policy ("Policy") explains how Kahunas FZE ("Kahunas", "we", "us", or "our") collects, uses, shares, secures, and retains health, fitness, and wellbeing data ("Health Data") processed through our websites, mobile and desktop applications, and services (collectively, the "Services").

Health Data is among the most sensitive categories of personal data. Where it identifies or relates to an identifiable individual, it may constitute "special category" personal data under the UK GDPR and EU GDPR, "sensitive personal data" under UAE Federal Decree-Law No. 45/2021, and comparable categories under other applicable laws. This Policy sets out the additional safeguards we apply to that data.

This Policy supplements, and should be read together with, the Kahunas Privacy Policy, the Business User Terms, the End User Terms & Conditions, and the Data Processing Addendum (DPA). Where this Policy and the Privacy Policy address the same subject, they are intended to be read consistently; the Privacy Policy remains the primary privacy notice for all personal data, and this Policy governs the specific handling of Health Data. In the event of an irreconcilable conflict regarding Health Data, this Policy prevails to the extent of that conflict.

This Policy applies to all individuals whose Health Data is processed through the Services, including end users (clients) and the coaches and businesses that use the Services to support them.

2 What We Mean by Health Data

For the purposes of this Policy, "Health Data" means information relating to an individual's health, fitness, activity, recovery, sleep, wellbeing, nutrition, physiology, or biometrics, and any scores, insights, or inferences derived from that information. Health Data includes both information you enter yourself and information synchronised from devices or third-party sources you connect.

Health Data does not include ordinary account or contact information (such as your name or email address), which is addressed in the Privacy Policy.

3 Our Role: Controller and Processor

Kahunas operates in different roles depending on the context of processing:

• Data Processor. When a coach or business ("Coach") uses the Services to manage their clients' Health Data — for example, check-in records, body measurements, coaching notes, and derived wellbeing scores — Kahunas acts as a data processor on behalf of the Coach, who is the data controller. This processing is governed by the Data Processing Addendum, which is incorporated into the Business User Terms.
• Data Controller. When Kahunas processes personal data for its own purposes — such as account administration, platform security, and aggregate product analytics — Kahunas acts as a data controller. As set out in Section 10, Kahunas does not use identifiable Health Data for its own analytics, and does not process Health Data as a controller except where strictly necessary to operate and secure the Services.

Coaches are responsible for establishing a lawful basis for their processing of client Health Data, providing appropriate privacy notices to their clients, and obtaining any consents required before Health Data is collected or uploaded through the Services.

4 Categories of Health Data We Process

With the appropriate lawful basis (see Section 6), the Services may process the following categories of Health Data. Not all categories apply to every user; what is processed depends on the forms a Coach uses, the features enabled, and the sources an individual chooses to connect.

• Body composition and measurements: weight, waist and other body measurements, BMI, body fat percentage, lean body mass, bone mass, and hydration.
• Physical activity: steps, active and stand minutes, exercise duration, calories burned, and workout records.
• Cardiovascular metrics: resting and walking heart rate, heart rate variability (HRV), blood pressure, and cardiovascular recovery indicators.
• Sleep: sleep duration and timing, and where available deep, REM, and light sleep phases and consistency.
• Nutrition: dietary intake, macronutrients, calories, hunger, and hydration.
• Biomarkers: blood glucose, SpO2, and skin temperature.
• Laboratory test results: lab reports you upload through a check-in (for example blood, urine, or hormone panels), and the test names, results, units, reference ranges, and lab flags read from them.
• Respiratory metrics: breathing rate and breaths per minute.
• Reproductive health: menstrual cycle data, where you choose to record it.
• Recovery and readiness indicators.
• Subjective wellbeing ratings: self-reported stress, energy, sleep quality, recovery, fatigue, digestion, mood, and similar check-in ratings.
• Free-text and contextual notes you or your Coach record alongside the above.
• Derived scores and insights generated from the above (see Section 7).

5 Sources of Health Data

Health Data reaches the Services from the following sources:

• Information you provide directly. The primary source of Health Data is information you enter yourself — through check-ins, daily habit logs, initial questionnaires, forms, and measurements you record in the Services.
• Devices and third-party health platforms you connect. Where you explicitly authorise a connection, Health Data may be synchronised from wearables and third-party health platforms, which may include Apple Health, Google Fit, Health Connect, and connected fitness devices and applications. We only access data you authorise, and you may revoke any connection at any time through your account or device settings.

We apply data minimisation: we process the Health Data needed to provide the Services and the features you use, and no more.

6 Legal Basis for Processing Health Data

Because Health Data is sensitive, we rely on a heightened legal basis for processing it:

• Explicit consent is the primary basis for processing Health Data. We capture explicit consent separately for (a) the processing of your Health Data and (b) any use of Health Data to train AI models, and we also seek explicit consent before synchronising Health Data from a connected device. Each consent is sought separately from general acceptance of our Terms, is granular and per-purpose, and can be withdrawn at any time.
• Where a Coach is the controller, the Coach is responsible for establishing the lawful basis for their processing and for obtaining any required explicit consent from their clients before Health Data is collected or uploaded.
• Contract performance, legitimate interests, legal obligation, and vital interests may additionally apply as described in the Privacy Policy — for example, security monitoring, or processing necessary to protect life in an emergency.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

7 Automated Health Scores and Insights

The Services generate automated scores and insights from Health Data to support coaching. These are calculated using automated methods, including exponential-moving-average smoothing over your check-in history and other statistical techniques. Depending on the features enabled and the data available, these may include:

• A wellbeing indicator (the "Aura Score") derived from self-reported ratings collected through check-ins and daily habit logs (such as stress, sleep, recovery, energy, fatigue, and digestion), expressed across stress, anxiety, mood, and wellbeing dimensions. A minimum number of qualifying submissions is required before the aggregate score is shown.
• Sleep, stress, anxiety, readiness, recovery, wellbeing, activity, nutrition, and performance indicators, where the underlying data is available.
• Cross-domain insights such as training volume and momentum, weight trends, check-in reliability, nutrition adherence, and habit completion.

These scores and insights are informational aids only. They are estimates, are not medical advice, diagnoses, or treatment recommendations, and may not accurately reflect your actual condition. Sensor-derived measurements synchronised from connected devices, such as heart rate, blood oxygen (SpO2), and step counts, are consumer-grade estimates and are not medical-grade readings. They are surfaced only where sufficient underlying data exists. You have the right to understand how a score is calculated, to access the underlying raw data, and to discuss any score with your Coach. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing; you may request human review of any automated output that affects you.

8 AI and Health Data

Where AI features are used within the Services:

• Health Data is not used to train AI models unless you have given separate, explicit consent specifically for that purpose. This consent is distinct from your consent to the processing of Health Data, and from your acceptance of our Terms.
• You may withdraw your AI-training consent at any time, through your account settings or by contacting compliance@kahunas.io. Withdrawal stops any further use of your Health Data for AI training. Because withdrawal cannot always reverse training already carried out, it does not affect the lawfulness of processing performed before you withdrew, but we will not use your Health Data in future training once you opt out.
• Where Health Data is used for AI training, we use only data that has been properly anonymised so that it can no longer be attributed to you.
• Health Data is not transmitted to third-party AI providers without explicit consent and a confirmed data processing agreement with the relevant provider. Any use of AI to process Health Data is subject to prior legal review.
• Where AI features are available, their outputs are informational and are not a substitute for professional judgement or medical advice, as described in the Terms.

9 How Your Health Data Is Shared

We share Health Data only as necessary to provide the Services:

• With your Coach and their authorised team. If you are a client, the Coach supporting you — and any team members or staff your Coach has authorised to assist with your coaching — can access the Health Data you choose to record or connect through the Services, in order to deliver coaching. Your Coach determines who on their team has access and is an independent controller of that data.
• With sub-processors that help us operate the Services, each under a data processing agreement and appropriate safeguards. Our current sub-processors are listed in the Kahunas Sub-Processor List and in the Privacy Policy.
• With authorities where required by law, and with successor entities in the event of a merger, acquisition, or business transfer, subject to this Policy.

We do not sell Health Data, and we do not use it for cross-contextual advertising.

Exclusion of Health Data from analytics and telemetry

Health Data is excluded from, or masked before reaching, our analytics, session-replay, and observability tooling:

• Product analytics are collected on a cookieless basis and exclude Health Data.
• Session replay masks sensitive content and does not capture request or response bodies.
• Operational observability applies telemetry-minimisation controls so that identifiers, subject content, and payloads — including Health Data — are dropped and not recorded in logs, traces, or metrics.

10 Consent, Preferences, and Control

We capture explicit, granular consent for the processing of your Health Data and, separately, for the use of your Health Data in AI training. You can give or withdraw each consent independently, at any time, and withdrawing one does not withdraw the other. You can exercise control over your Health Data in the following ways:

• Health-data consent. You may grant or withdraw consent to the processing of your Health Data at any time through your account settings or by contacting compliance@kahunas.io. Withdrawal stops the relevant future processing without affecting prior lawful processing.
• AI-training consent. You may grant or withdraw consent to the use of your Health Data for AI training at any time, independently of your other consents (see Section 8). Opting out does not affect your access to the Services.
• Connections. You choose whether to connect any device or third-party health platform, and you can disconnect at any time through your account or device settings. Disconnecting stops future synchronisation.
• Cookie and tracking preferences. You can manage non-essential cookies and trackers (functional, analytics, and session-replay categories) through our consent banner; essential cookies are always on.

Withdrawing any consent is as straightforward as giving it, and takes effect for future processing without affecting the lawfulness of processing carried out beforehand.

11 Your Rights Over Your Health Data

Subject to your jurisdiction, you have the following rights in relation to your Health Data. To exercise any right, contact compliance@kahunas.io. Where a Coach is the controller of your Health Data, we will refer or assist with your request as appropriate and the Coach remains responsible for responding.

We operate data-subject-request workflows to fulfil access, export, rectification, erasure, and restriction requests. Where a request involves shared communications, we provide your own data while protecting the privacy of other participants.

12 Security of Health Data

We apply the security measures described in the Privacy Policy to all personal data, and the following additional protections are particularly relevant to Health Data:

• Encryption of data in transit (TLS) and at rest.
• Tenant isolation: each customer account's data, including Health Data, is stored in its own database.
• Role-based access controls, with destructive operations restricted to administrator accounts.
• Masking and telemetry minimisation so that Health Data is excluded from analytics, session replay, and operational logging (see Section 9).
• Object versioning on stored media to support recovery, secure backups, and disaster-recovery procedures.
• Regular security reviews, staff training, and incident-response procedures.

No method of transmission or storage is completely secure, but we continuously monitor and improve our safeguards. In the event of a personal data breach affecting Health Data, we follow the breach-notification procedures set out in the Privacy Policy.

13 Retention of Health Data

We retain Health Data for the duration of your active account and thereafter for 30 days following account closure or offboarding, or until consent is withdrawn, whichever occurs first, unless a longer period is required by law or a shorter period is requested and permitted. Where a coach archives a client, the client's Health Data is deleted 12 months after the date of archiving, unless the coach restores the client before then. A client who was already archived when this version took effect is deleted 12 months after their original date of archiving, but no earlier than 90 days after the effective date of this version. Before then, a coach may request an export of the client's Health Data, which is sent only to the client. The coach and the client are notified 30 days before deletion. Derived scores and insights are retained no longer than the underlying Health Data. Backup copies are deleted in line with our disaster-recovery schedule and primary retention timelines. You may request earlier deletion where permitted by law by contacting compliance@kahunas.io.

14 International Transfers

Our infrastructure is hosted primarily in the United Kingdom, with certain sub-processors located in the United States, the European Union, and other jurisdictions as set out in the Sub-Processor List, and we serve users globally. Where Health Data is transferred internationally, we apply the safeguards described in the Privacy Policy, including Standard Contractual Clauses where an adequacy decision is unavailable, and compliance with UK GDPR, EU GDPR, and UAE Federal Decree-Law No. 45/2021.

15 Children

The Services are not directed to children under the age of 16 (or, where higher, the applicable age of digital consent in your jurisdiction), and we do not knowingly collect Health Data from children. If we become aware that we have collected Health Data from a child, we will delete it promptly.

16 Changes to This Policy

We may update this Policy to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated in accordance with the Privacy Policy (email, in-app notification, or website notice). The latest version is always the authoritative one.

17 Contact Us

For any questions about this Policy, your Health Data, or to exercise your rights:

This Health Data Policy is effective as of 6 October 2026.

Appendix A — Version History

The table below records material changes to the Kahunas Health Data Policy. Minor editorial corrections and formatting updates are not recorded. Users are notified of material changes in accordance with Section 16.

For questions regarding changes between versions, contact compliance@kahunas.io