Privacy Policy.

This Privacy Policy describes how Elitesgen Academy ("Elitesgen", "we") collects, uses, shares, and protects personal information when you use Egen Active (the "Service"). It is written to align with the Nigerian Data Protection Regulation (NDPR) and the Nigeria Data Protection Act (NDPA).

If you do not agree with this Policy, do not use the Service.

Information you give us: name, email, phone number, date of birth, profile photo, emergency contact, city, activity interests, and (for organizations) employer details and member roster. When you book a facility, we collect the booking details. When you pay, we collect payment metadata; your full card number is handled by the payment processor, not by us.

Information collected automatically: device type, operating system, app version, IP address, approximate (city-level) location unless you grant precise permission, pages viewed, sessions completed, bookings made, timestamps, and error logs.

Information from partner facilities and organizations: check-in records when you tap in at a facility, session attendance, and, for organization-funded members, eligibility and role within the organization.

Information from Apple Health or Health Connect, only if you choose to connect it: your recent workouts, as described in section 3.

If you choose to connect Egen Active to Apple Health (on iPhone) or Health Connect (on Android), we read your workouts from it: the type of workout, when it started and ended, how long it lasted and, when there is one, the distance. We do not read any other health data, such as heart rate, steps, sleep, routes or medical records, and we never write anything to Apple Health or Health Connect.

Why we read it. So you can add a workout recorded by your watch or another fitness app to your Egen Active activity in one tap, instead of typing it in again. The app reads the last 7 days of workouts, only while it is open, and shows them to you as cards.

What we keep. Nothing is saved until you tap Add on a card. When you do, that workout becomes one of your activity logs and is stored with your Egen Active account like any log you type in, with the audience you choose (on an account under 18, a log stays private unless they share it with an official club at their gym, as section 11 explains). To avoid showing you the same workout twice, our servers briefly process the workouts your phone read (their type, times, distance and the name of the app that recorded them) to check them against the logs you already have. Workouts you do not add are not kept, apart from a record that you chose "Not this one" on a workout, so it does not come back.

What we never do. We never sell health data, never use it for advertising or marketing, and never share it with third parties. It is not sent to our analytics or crash reporting tools; they only count that the feature was used.

How to stop. In the app, go to Activity settings and tap Disconnect. On Android this also removes our access in Health Connect. On iPhone you can also turn off our access in Settings, then Health, then Data Access & Devices. Workouts you already added stay in your activity until you delete them, and you can delete any log, or your whole account, in the app.

We use personal information to:

• provide and operate the Service (accounts, bookings, payments, visits, community features);
• communicate with you (confirmations, reminders, service announcements, support replies);
• personalize recommendations (facilities, groups, events, activities);
• prevent fraud, abuse, and unauthorized access;
• measure and improve the Service (usage analytics, performance monitoring); and
• meet legal, tax, and accounting obligations.

We rely on one or more of the following bases under the NDPR and NDPA:

• Consent, for marketing communications, precise location, reading workouts from Apple Health or Health Connect, and similar optional features;
• Contract, to operate the Service you've signed up for (bookings, payments, visits);
• Legal obligation, to meet tax, accounting, and regulatory requirements; and
• Legitimate interest, for fraud prevention, service improvement, and safety.

We share personal information only with:

• Partner facilities, limited to what is needed for your booking or visit (your name, photo, membership status, check-in time);
• Your organization, if you access the Service through one; your usage data (visits, spend, bookings) is visible to your organization's authorized administrators;
• Service providers, including payment processors, email delivery, analytics, map tile providers, cloud hosting, fraud screening, and customer support tools, each under a data processing agreement that restricts their use of the data to the service they provide to us; and
• Legal and safety recipients, where required by law, court order, or to protect a person from harm.

We do not sell personal information.

You have the right to:

• access the personal information we hold about you;
• correct inaccurate or incomplete information;
• request deletion of your information, subject to legal retention requirements;
• object to specific processing and withdraw consent where processing relies on consent;
• receive a copy of your information in a portable format; and
• lodge a complaint with the Nigeria Data Protection Commission.

Staff accounts work differently. Accounts on Egen Active Team, the app used by staff at partner facilities, are created and closed by your facility administrator rather than by you, because access to a facility’s member records is granted by that facility. To have your staff account closed or your personal data deleted, ask your facility administrator, or email [email protected] from the address on your account and we will action it with them. Employment records your facility must keep by law are retained by that facility as your employer.

We keep personal information for as long as your account is active and for a reasonable period thereafter to meet legal, accounting, and safety obligations. Booking and payment records are retained for the period required under Nigerian tax and accounting rules. When we no longer need information, we delete or anonymize it.

We protect personal information with encryption in transit and at rest, role-based access controls, audit logging, and regular security reviews. No system is perfectly secure; if a breach occurs that meets the NDPR notification threshold, we will notify affected users and the supervisory authority in line with regulatory requirements.

We use first-party cookies and similar technologies to keep you signed in, remember your preferences, and measure usage. Our analytics provider (PostHog) processes de-identified event data to help us understand how the Service is used. We use Vercel Analytics and Speed Insights for performance measurement. You can disable analytics in your device or browser settings; doing so will not affect core Service functionality.

Under Nigerian law, a child is anyone under 18. You need to be 18 or older to create your own Egen Active account, which is why we ask for your date of birth when you sign up.

Some people under 18 do use Egen Active, but only through an account set up for them in one of two ways: by a parent or guardian, for example when they add their child to their family or give their child a sign-in of their own; or when the child is enrolled in an academy or school programme run by Elitesgen or one of our partners. A child under 13 only gets their own sign-in if a parent or guardian sets it up. Where an academy, school or facility partner enrolls a child, that organization is responsible for getting and recording a parent or guardian’s consent.

Extra protection for accounts under 18. We use the date of birth on the account to apply these protections automatically:

• the account is always private and does not appear in People search or suggestions, so other people cannot find it, follow it, or see its profile or activity;
• their activity logs are seen only by them, or by an official club at their gym if they choose to share there, and never appear in anyone else’s feed, in nearby activity, or behind a public share link. This includes workouts added from Apple Health or Health Connect (section 3);
• they cannot follow people, send direct messages, or create or join any club other than an official club at their gym; and
• photos they add are checked to a stricter standard, and anything that might be unsuitable is held back for our team to review.

A parent or guardian can ask to see, correct or delete their child’s information by emailing [email protected].

Some of our service providers are based outside Nigeria. Where personal information is transferred internationally, we rely on the safeguards permitted under the NDPR, typically standard contractual protections or an adequacy assessment, to ensure an equivalent standard of protection.

We may update this Policy to reflect changes to the Service, our practices, or legal requirements. If we make material changes, we will notify you through the app or by email before they take effect. The "Last revised" date at the top of this page shows the most recent update.