Privacy Policy

Version 2026-07-11 · Last updated 11 July 2026

1. Who we are (Data Controller)

DARE, a company in formation in Dubai, United Arab Emirates — registered name, licence number and address will be published here upon incorporation. Contact for privacy matters: privacy@darehabits.com.

We operate from Dubai and our clients are primarily UAE residents, so our processing is governed first by the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL"). For clients residing in the European Union, the EU General Data Protection Regulation (GDPR) applies additionally to the processing of their data.

2. What data we process

• Identification and contact data: name, email address, phone number.
• Health-related data (sensitive data under the UAE PDPL; special category under art. 9 GDPR): weight, height, body-fat percentage, lean mass, training and nutrition logs, dietary restrictions and any medical conditions you choose to share with your coaches.
• Usage data: login timestamps and messages exchanged with your coaches inside the client portal.

3. Why and on what legal basis

• Providing the coaching service (plans, check-ins, messaging): performance of our contract with you (art. 4 UAE PDPL; art. 6.1.b GDPR).
• Health data: your explicit consent (required for sensitive data under the UAE PDPL, and under art. 9.2.a GDPR for EU residents), collected the first time you access the client portal. You can withdraw it at any time (see section 8).
• Service emails (welcome, password reset): performance of contract. We do not send marketing emails without separate consent.

4. Who processes your data for us

We use a small number of service providers (processors) under data-processing agreements:

• Railway — application and database hosting.
• Resend — transactional email delivery.
• OpenAI — assists coaches in drafting plans. Coach inputs may include your first name and plan targets; we do not send your medical history to OpenAI, and OpenAI does not use API data to train its models.

Some providers are located outside the UAE (mainly the United States). These transfers rely on each provider's contractual data-protection safeguards; for EU residents they are additionally covered by the European Commission's Standard Contractual Clauses or an equivalent GDPR safeguard.

We never sell your data and we never share it with third parties for advertising.

5. Progress photos and testimonials

We only publish "before & after" photos or testimonials with your prior, specific, written authorization, which you can refuse or withdraw at any time without affecting your coaching.

6. How long we keep it

Your data is kept while your coaching engagement is active. When it ends (or when you ask us to delete your account), your personal and health data is deleted within 30 days, except for the minimum data we must keep to comply with legal (tax/contract) obligations.

7. Security

• All traffic is encrypted in transit (HTTPS/TLS).
• Passwords are stored hashed (bcrypt) — we never see or store them in clear text.
• Access to your data is limited to your two coaches; other clients can never see your data.
• Sessions expire automatically after 30 minutes of inactivity.
• The database is backed up regularly to allow recovery from incidents.

8. Your rights

Under the UAE PDPL — and under the GDPR if you reside in the EU — you can exercise your rights of access, rectification, erasure, portability, restriction and objection, and withdraw your consent at any time, by writing to privacy@darehabits.com. We will respond within one month.

If you believe we have not handled your data properly, you may complain to the UAE Data Office (the PDPL supervisory authority). EU residents may also lodge a complaint with their national data-protection authority (in Spain, the AEPD — aepd.es).