Privacy Policy

MYND (“we”, “us”) is a personal-training application operated by Moamal Rassan (trading as MYND), the data controller responsible for your personal data. This policy explains what personal data we collect, why we collect it, who we share it with, and the choices you have. Questions can be sent to privacy@themynd.org.

Information we collect

• Account details — your name and email address, used to sign you in.
• Training data — workouts, exercises, sets, and session feedback you log.
• Check-ins — your weekly answers and any optional progress photos you upload.
• Bookings — session dates, times, and calendar status.
• Messages — conversations between you and your coach.
• Financial information — only if you choose to connect a bank account so your coach can view transaction data. This feature is not yet available; when it launches it will use Akahu, a New Zealand open-banking provider. We do not see or store your online-banking login credentials.
• Technical data — device and diagnostic information and error logs used to keep the app reliable and secure.

How we use your data

We use your data only to provide the coaching service: to show your program and progress to you and your assigned coach, schedule sessions, enable messaging, and maintain the security and reliability of the app. We do not sell your data, and we do not use it for advertising.

Who can see your data

Your training data, check-ins, bookings, and messages are visible only to you and your assigned coach. Access is enforced at the database level (row-level security), not merely hidden in the interface. Your data is never public.

Service providers

We use trusted providers to run the service. They process data only on our instructions:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Resend — transactional email (e.g. invites, password resets).
• Google Calendar — session booking and calendar sync (only if you connect it).
• Akahu — secure bank-account connection for financial features (only if and when you connect a bank account; not yet enabled).
• Sentry — error monitoring and diagnostics.

Some of these providers store or process data on servers outside New Zealand. Where that happens, we take reasonable steps to ensure your data receives comparable protection to that required under New Zealand law.

Data retention & deletion

We keep your data for as long as your account is active. You can request a copy of your data or request deletion of your account and associated data at any time from within the app (Profile → Privacy & your data), or by emailing privacy@themynd.org. Deletion requests are actioned within 30 days, except where we must retain limited records to meet legal obligations.

How we protect your data

Data is encrypted in transit. Access to private coaching data is restricted to the client and their assigned coach using database-level access controls. We limit administrative access and use service providers that support appropriate security safeguards.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact privacy@themynd.org.

Governing law & complaints

MYND is operated from New Zealand, and we handle personal data in accordance with the New Zealand Privacy Act 2020. If you believe we have mishandled your personal data, please contact us first at privacy@themynd.org so we can put it right. If you are not satisfied with our response, you may raise a complaint with the Office of the Privacy Commissioner (privacy.org.nz).

Children

MYND is intended for adults and is not directed to people under 18. We do not knowingly collect children's data.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated in the app or by email. The “last updated” date above reflects the current version.