Your information. Clearly governed.

Corrective draft and approval boundary

This version corrects omissions in the earlier notice. Qualified legal and privacy reviewers must confirm the applicable processing grounds, special personal information conditions, recipient arrangements, retention and market-specific disclosures before approval and publication. This draft does not itself establish those approvals or consent. ¶

Account deletion and other privacy-rights requests remain available while this draft is under review. Previously confirmed requests remain eligible for fulfilment; a notice update does not cancel them. The earlier version remains available for historical reference, not as evidence that these corrections have been approved. ¶

Who is responsible and who this policy covers

FLEXa is developed and provided by The Sovereign Series (Pty) Limited, the responsible party for the processing described in this policy unless an approved market annex identifies a different local responsible party. Privacy questions and rights requests can be sent to hello@sovereignseries.africa. ¶

This policy covers prospective and registered members, tenant and gym applicants, gym operators, authorised platform users, support contacts, and people whose information is included in a lawful access, payment, verification, security or audit record. Market-specific annexes may add mandatory local disclosures without reducing applicable rights. ¶

Where information comes from and whether it is required

Most information comes directly from you when you register, update a profile, upload a document, create a purchase, request access, contact support or request deletion. FLEXa also receives technical and security information from your browser or device; access and branch information from participating gyms; and status, reference or verification results from payment, identity-verification and communications providers. ¶

Fields marked as required are needed for the selected account or feature. Optional profile images, precise location, voice or video calls, HEALBE health submissions and health-sharing preferences can be declined. Contacts are entered by the member; FLEXa does not import the device address book. The current service does not require access to device call logs, SMS content, installed-app inventory or background location. Microphone access is requested for a member-initiated voice or video call, and camera access is requested for video calling or scanning. ¶

Why FLEXa processes information

FLEXa processes information to take steps you request and perform its service contract; comply with accounting, tax, consumer, identity, security and other legal obligations; protect the legitimate interests of members, gyms, FLEXa and the public; and obtain consent where the law or a device permission requires it. ¶

Operational purposes include account creation and security, eligibility and identity checks, gym discovery, quote calculation, purchase fulfilment, access-code issuance and validation, operator settlement, refunds, fraud and abuse prevention, support, service reliability, legal claims and attributable audit records. FLEXa does not sell personal or sensitive information and does not use it for third-party advertising. ¶

Location, camera, microphone, biometrics and notifications

Approximate location may be inferred from an internet address to show relevant markets or nearby gyms. Precise foreground location is requested only when you use a feature that needs it, such as distance, geofence or gym-entry validation. The current app does not request background location. ¶

Camera frames used to scan a gym QR code are processed for the scan and are not uploaded or retained as footage. A profile image or identity-document image that you deliberately capture or select is uploaded and handled as account or verification information. ¶

Configured member voice and video calling uses the microphone, and video also uses the camera, only after you join or accept a call and grant permission. Calls can use the portal or the foreground in-app call surface. The native app stops capture when you leave that surface or put the app in the background; it does not implement phone-equivalent background calling. Call participants receive the selected live audio or video, and connection setup processes call and network metadata. A member can decline a call or deny permission; camera permission for scanning is separate from consent to a call. ¶

A biometric sign-in prompt is performed by the device operating system. FLEXa receives the success or failure result and does not receive or store a fingerprint, face template or other biometric template. ¶

If the service is configured and you opt in, native message and call alerts use Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM). FLEXa binds a protected device delivery identifier to your authenticated session and notification choices. Providers receive that identifier and generic event references, not the chat body or sender name. Notification permission alone does not make delivery available or guaranteed, and a call alert does not automatically answer a call. This is ordinary notification delivery, not Apple VoIP push or a system background-call service. ¶

Pricing, eligibility and automated rules

FLEXa uses documented rules to derive the current gym demand band and quote, revalidate a purchase, assess account or market eligibility, detect security risk, and decide whether an access credential can be issued or redeemed. These rules can use branch, time, market, account, entitlement, device and foreground-location evidence. ¶

Material outcomes retain a status or reason code for audit and support. You may contact FLEXa to question an outcome or request human review where applicable. FLEXa does not use these rules to make credit, insurance or employment decisions. ¶

Cookies, app storage and internal analytics

The website uses essential authentication and antiforgery cookies, browser local storage for its installation identifier, and service-worker Cache Storage for the application shell. The mobile app keeps protected session material in operating-system secure storage, an installation identifier in Preferences and secure storage, and an application-private SQLite cache containing limited venue, visit, credential, purchase-reference and screen-state data. ¶

Logging out revokes the active server session and removes authenticated browser or app session material and user-scoped cached screen data. A non-secret installation identifier and the public application shell may remain so FLEXa can recognise an installation and start safely; uninstalling the app or clearing site or app storage removes that local copy. Server-side deletion cannot remotely erase a device that is offline. FLEXa creates internal service, security, purchase, access and audit events to operate the platform, investigate failures and measure service performance. The current app does not request the Android advertising identifier and does not use third-party advertising cookies or an advertising analytics SDK. ¶

When information is disclosed

Information is disclosed only as needed to authorised FLEXa personnel and affiliates, participating gym operators, configured payment and settlement providers, identity-verification providers, BUA Speak acting as the member-chat processor, cloud and security providers, communications providers, mapping and approximate-location providers, professional advisers, and public authorities or courts where lawfully required. ¶

Optional health summaries are addressed to the member. When urgent alerts and the relevant sharing choice are enabled, alerts may also be sent to the member-entered doctor or trainer email addresses, or to active Global Administrators when that distinct sharing choice is enabled. These are health disclosures, not ordinary operational access or proof that a recipient is a verified clinician. Member-chat call participants receive the media selected for the call. ¶

The recipient table below describes the current integration categories and the information involved. A provider acting for FLEXa may process information only for the contracted service and applicable legal duties; an independently responsible recipient processes information under its own legal obligations and notice. ¶

International processing

Cloud, communications, verification, mapping or payment providers may process information in countries other than the country where it was collected. FLEXa must assess the destination, recipient and safeguard before enabling a provider or market flow. ¶

Where applicable law requires it, FLEXa relies on an approved adequacy basis, binding agreement, consent or another lawful transfer mechanism. Contact FLEXa for information about safeguards relevant to a specific transfer. ¶

How information is protected

FLEXa uses HTTPS in transit, role-based authorisation, multi-factor authentication, device-bound sessions, protected credentials, restricted administrative access, append-only audit controls, idempotency and session revocation. Member-chat messages are sent to BUA Speak as authenticated AES-256-GCM encrypted envelopes under the configured processor integration; selected linked documents and notification content are protected by the application. The mobile SQLite cache is application-private but is not represented as independently encrypted by FLEXa. ¶

No system can eliminate every risk. FLEXa investigates suspected incidents and will notify affected people and regulators when required by applicable law. Do not send passwords, raw payment credentials, one-time codes or identity-document images by ordinary support email. ¶

Your choices, rights and complaints

Subject to applicable law, you may request confirmation and access, correction or deletion; object to or ask for restriction of certain processing; withdraw consent without affecting earlier lawful processing; request portability where available; and complain about how information is handled. FLEXa may verify identity and may refuse or limit a request where the law requires or permits it. ¶

Send a rights request to hello@sovereignseries.africa. South African data subjects may also lodge a POPIA complaint with the Information Regulator. Details are available at https://inforegulator.org.za/contact-us/. ¶

Age and children's information

FLEXa member accounts are intended for adults aged 18 or older. Where enabled, verified date-of-birth evidence or an adult-eligibility decision is processed through the protected eligibility boundary and is not placed in ordinary session claims or public analytics. FLEXa does not knowingly offer a member account to a child. ¶

If you believe a child has supplied information contrary to this restriction, contact hello@sovereignseries.africa so FLEXa can investigate and take the action required by law. ¶

Account deletion

An authenticated member can request deletion after identity re-verification. The public web route is available to a low-privilege consumer account that cannot sign in and proves control of its registered email address; operator, administrator and multi-role accounts require authenticated handling or assisted review because their records can affect a gym tenant, staff or regulated evidence. ¶

Once a request is confirmed, FLEXa disables the account, revokes active sessions and queues manual privacy-operator fulfilment. For every affected member-chat binding, fulfilment first instructs BUA Speak to remove the participant copy and irreversibly anonymise that member's sender and encrypted-message processor copies. Only after BUA confirms the idempotent erasure does FLEXa pseudonymise the core identity profile, remove local member-chat participant and authored-message rows, remove authentication roles, claims, logins and tokens, and remove the current profile image. A failed or cancelled processor request leaves fulfilment incomplete and available for safe retry. Until every required processor and local step succeeds, disabling or pseudonymising the active profile does not yet constitute erasure of every associated record. Completed fulfilment does not erase lawfully retained records or every device-local copy. ¶

Successful fulfilment also removes the member's stored HEALBE samples, member-entered emergency contacts, health-notification preferences, health-delivery tracking rows, native push registrations and native push-delivery tracking. Disabling the account or withdrawing a notification preference alone is not deletion of those records. Health content may remain in inbox, protected notification-outbox and audit records under the existing restricted retained-record boundary. Messages already delivered to a recipient and offline device copies cannot be remotely recalled by account deletion; applicable retained-record and processor boundaries still apply. An alert already accepted by a push provider cannot be recalled by signing out or deleting the account; opening it still requires current authorization. ¶

Linked verification documents, agreement evidence, support and inbox records, referrals, protected notification content, adult-eligibility evidence, finance, access-control, security and audit records may retain an opaque user key or other identifying evidence. The retention register assigns each retained category a purpose, lawful basis, access restriction and disposal rule; records without a lawful retention need must be erased or irreversibly de-identified. ¶

Retention

Active profile information is kept while the account is active and for the limited period needed to complete closure, protect the service or resolve a request. One-time credentials, confirmation links and temporary security material expire on their configured short-lived schedules. Incomplete gym applications are deleted after the configured abandonment period, currently 10 days after the latest save; identity-capture links expire after 48 hours, but expiry of a link does not by itself prove erasure of its stored record or content. ¶

The controlled retention register records the trigger, period, lawful basis, access restriction, disposal method and backup treatment for financial, payment, contract, identity, eligibility, access, fraud, dispute, support, communications, device and audit records. No unspecified category is treated as retained indefinitely or erased automatically. Append-only evidence is preserved only while a lawful retention need applies and is deleted or irreversibly de-identified when that need ends. ¶

Changes to this policy

FLEXa retains versioned notices. This corrective version is a review draft; approval, any effective date, and communication of material changes through appropriate channels are separate publication steps. A draft date must not be treated as an approval or effective date. ¶

A market annex may identify additional local rights, responsible parties, providers or retention duties. The current public version and its available versions are exposed through the FLEXa privacy-notice endpoint. ¶

Optional HEALBE information, contacts and health alerts

When you submit HEALBE device or portal samples through the optional health integration, FLEXa stores the source sample reference, measurement and receipt times, and supplied heart rate, steps, calorie intake and expenditure, hydration, stress, sleep, wear duration and weight values. It derives member health summaries from those samples. Listing this integration does not mean every device or provider connection is enabled. ¶

You may enter emergency-contact names, relationship types, email addresses and telephone numbers. Obtain the person's permission to supply their details and tell them how you intend to use them. Daily summaries, urgent alerts and sharing with a doctor, trainer or active Global Administrators have separate member choices; sharing is not implied by an account or chat invitation. Changing a sharing preference stops future use of that choice but does not recall information already sent. ¶

Wearable values and automated extreme-heart-rate rules can be wrong. Summaries and alerts are not diagnosis, medical advice, continuous monitoring or an emergency-response service. Seek appropriate medical assistance instead of relying on an app alert. The lawful basis and applicable special-personal-information conditions for each health and third-party-contact flow, provider arrangements and category-specific retention schedule require qualified review; this draft does not claim those decisions have been made. ¶

Data categories and controls

The categories below describe the current web and mobile implementation. A feature that is not enabled in a user's market does not collect its feature-specific information merely because it is listed here. ¶

Recipients and service providers

Provider availability and legal role can differ by market. FLEXa must approve the provider and relevant safeguards before enabling the integration. ¶

Records retained after deletion

Deleting an account removes the active profile and authentication material. It does not rewrite evidence that FLEXa must preserve for a lawful, security, accounting or dispute-resolution purpose. ¶

Governance registers and linked evidence

The effective policy is supported by controlled corporate, provider, transfer, retention and market records. Those records are maintained by accountable owners and are not silently inferred from application code. ¶

Privacy, complaint and provider links

These links make the current controls, public authorities and external-provider notices directly reachable. A provider's public policy does not replace FLEXa's required contract, role assessment or transfer approval. ¶