Privacy policy.

1Introduction

1.1 Thrive App LLC ("Thrive", "we", "us", "our") operates a platform that connects people with independent fitness, nutrition and wellbeing professionals, and gives those professionals tools to manage their practice.

1.2 This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to everyone who uses Thrive, whether as a User (someone seeking guidance) or an Expert (a professional delivering services). Where something applies only to one group, we say so.

1.3 We are the controller of the personal data described in this Policy. Our primary regulatory framework is UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations. Where you are in the European Economic Area or the United Kingdom, we also apply the standards of the GDPR and UK GDPR to your data.

1.4 Independent Experts are separate controllers. When you engage an Expert, that Expert receives your data and decides how to use it for the purpose of delivering their services. In respect of that use, the Expert is an independent controller with their own legal obligations. See Section 9.

1.5 If you do not agree with this Policy, please do not use Thrive.

2The data we collect

2.1 Data you give us

All users

Users specifically

Experts specifically

2.2 Data we collect automatically

2.3 Data from third parties

2.4 Data minimisation

We request only the data needed to operate the features you use. Where a feature is optional, so is the data behind it. Declining an optional permission does not prevent you from using the rest of the app.

3Sensitive personal data

3.1 Health and fitness data is sensitive personal data under the PDPL and special category data under the GDPR. This includes your measurements, conditions, injuries, medications, dietary restrictions, pregnancy status, progress photos and wearable metrics.

3.2 We process sensitive data on the basis of your explicit consent, which you give when you enter it, connect a health platform, complete a health questionnaire or share it with an Expert. You may withdraw consent at any time (see Section 13), although some features will stop working without it.

3.3 We never use health data for advertising, and we never sell it. We do not disclose it to data brokers, advertising networks or analytics providers, and we do not use it for any form of use-based data mining beyond providing and improving the health, fitness and wellbeing features you have asked for.

3.4 Progress photos, body images and identity documents are stored with restricted access and are visible only to you, to Experts you have shared them with, and to a limited number of authorised Thrive personnel where necessary for support, safety or verification.

4Health Platform integrations

This Section sets out the specific commitments we make in respect of data received from Apple Health (HealthKit), Android Health Connect and connected wearable devices.

4.1 Connection is always your choice. No health platform is connected unless you explicitly authorise it, and you choose which data types to share. You can review or revoke that authorisation at any time in your device settings or in the Thrive app.

4.2 We read only what you authorise. We request the narrowest set of data types needed for the features you have enabled, such as steps, workouts, active energy, heart rate, sleep and recovery metrics.

4.3 What we will never do with health platform data. We will not:

(a) use it for advertising, marketing, remarketing or any similar service;

(b) sell it, or disclose it to data brokers, advertising networks or information resellers;

(c) use it for use-based data mining unrelated to your health, fitness or wellbeing;

(d) disclose it to any third party without your separate consent, except where required by law;

(e) store Apple HealthKit data in iCloud, or write false or fabricated data back to any health platform.

4.4 Health research. We do not use your health platform data for research. Should that ever change, we would seek your separate, informed and revocable consent first, and would obtain approval from an independent ethics review board before doing so.

4.5 Revoking access. If you disconnect a health platform, we stop receiving new data immediately. Data already received is retained in accordance with Section 12 unless you ask us to delete it, which you can do at any time.

4.6 Data sharing with your Expert. Health platform data is shared with an Expert only where you choose to share it with that Expert. Disconnecting an integration does not retrieve data an Expert has already seen.

5Device permissions

We ask for a device permission only at the point a feature needs it, and we explain why at the time. You may decline any of these, and you may change your mind later in your device settings.

6How and why we use your data

6.1 Where we rely on legitimate interests, we have assessed that our interest does not override your rights and freedoms. You may object at any time (Section 13).

6.2 We do not sell your personal data.

6.3 We will not use your data for a materially different purpose without telling you first and, where the law requires it, obtaining your consent.

7Automated processing

7.1 We use automated processing to sort search results, recommend Experts and content, calculate estimated metrics such as calories burned, detect fraudulent or abusive behaviour, and flag content for review.

7.2 We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, without human involvement. Where an automated system flags an account for suspension, removal or payout hold, a person reviews the decision before it is finalised, and you may contest it by contacting ask@mythrive.ae.

8What other people can see

Publicly visible or visible to all Platform users

• Expert profiles: name, photo, bio, disciplines, qualifications claimed, pricing, availability, ratings and reviews

• User display name and profile photo, where you interact publicly, leave a review, or appear in shared features

Visible to an Expert you engage

• Your name, profile photo and contact preferences

• Health questionnaire responses, goals, measurements, conditions and limitations you disclose

• Workout and nutrition logs, adherence and progress data you share with them

• Session history, bookings, cancellations and messages with them

• Progress photos only where you choose to share them

Visible to a User who engages an Expert

• The Expert's profile, credentials as listed, availability and pricing

• Programmes, plans, messages and content the Expert issues to them

Never shared between Users and Experts by us

• Payment card details, bank or payout details

• Home address, unless you provide it for a session

• Identity documents

• Data about any other client or user

8.1 You control much of this through your privacy settings. Once you have shared data with an Expert, that Expert holds it as an independent controller and you may need to contact them directly to have it deleted from their own records.

9Sharing your data

We share personal data only as described below.

9.1 With Experts and Users, as set out in Section 8, to enable the service you have requested.

9.2 With service providers acting on our instructions, under contract and only for the purposes we specify:

9.3 Equivalent protection. Every third party with access to personal data through Thrive is bound by contract to provide protection at least equivalent to the standards in this Policy, to process data only on our documented instructions and only for the purpose we specify, to apply appropriate security measures, and to delete or return the data when the engagement ends. They may not use your data for their own purposes.

9.4 With app stores, for subscription and purchase management.

9.5 With professional advisers, including lawyers, accountants, auditors and insurers, where necessary.

9.6 With authorities and third parties, where we believe in good faith that disclosure is required to comply with a law, court order, regulator or lawful request; to enforce our Terms; to investigate suspected fraud, harassment or misconduct; or to protect the rights, property or safety of Thrive, our users or the public. In an emergency involving risk to life we may disclose to emergency services.

9.7 In a corporate transaction, such as a merger, acquisition, financing or sale of assets, in which case we will require the recipient to honour this Policy or will notify you of any material change.

9.8 In aggregated or de-identified form, which cannot reasonably be used to identify you, for research, benchmarking, reporting and marketing.

9.9 We do not share health data with advertisers, data brokers or advertising networks in any circumstances.

10Advertising identifiers and tracking

10.1 In the Thrive app, we do not track you across other companies' apps and websites. The app does not link your data with data from third-party apps or sites for advertising or measurement purposes. We never sell your data or share it with data brokers, and your health, fitness and nutrition data is never used for advertising.

On our website (mythrive.ae), and only if you accept marketing cookies, we use advertising tools such as the Meta Pixel to measure our campaigns and to show Thrive ads to people who have visited our website. These tools never receive your health, fitness or nutrition data. You can withdraw consent at any time through the cookie banner or your browser settings.

10.2 On iOS, if we ever introduce any activity that Apple defines as tracking, we will first request your permission through the App Tracking Transparency prompt. If you decline, we will not track you, and the app will continue to work normally. You can review your choice at any time under Settings, Privacy and Security, Tracking.

10.3 On Android, the advertising identifier is used only for the limited purposes you have consented to, such as measuring the performance of a campaign that brought you to Thrive. We do not combine the advertising identifier with health data or with any other persistent identifier for advertising purposes. You can reset or delete the advertising identifier in your Android settings, and we honour that choice.

10.4 Analytics are used to understand how features perform and to fix defects. Analytics data is not used to build an advertising profile of you.

10.5 Children. We do not use advertising identifiers, ad personalisation or tracking of any kind in relation to anyone we know or believe to be a minor.

11International transfers

11.1 Thrive operates from the UAE. Some of our service providers process data outside the UAE, including in the European Union, United Kingdom, United States and other locations.

11.2 Under the PDPL we transfer personal data outside the UAE only where: the destination has been recognised as providing an adequate level of protection; or appropriate safeguards are in place, including contractual clauses obliging the recipient to protect the data to a standard equivalent to UAE law; or a permitted exception applies, such as your explicit consent or necessity for the performance of a contract with you.

11.3 You may request details of the safeguards applied by contacting ask@mythrive.ae.

12How long we keep data

12.1 We may retain data for longer where required by law, or where necessary to establish, exercise or defend a legal claim.

12.2 Deletion of your account does not delete data that an Expert has independently recorded in their own systems or is required to retain under their professional obligations.

13Your rights

13.1 Subject to applicable law, you have the right to:

• be informed about how we process your data;

• access the personal data we hold about you and receive a copy;

• correct data that is inaccurate or incomplete;

• request deletion of your data, where there is no overriding legal basis for us to keep it;

• restrict or object to processing, including processing based on legitimate interests;

• withdraw consent at any time, including consent to process health data or to receive marketing, without affecting the lawfulness of processing carried out before withdrawal;

• receive your data in a portable format and, where technically feasible, have it transmitted to another controller;

• object to automated decision-making and request human review;

• complain to us and to the relevant supervisory authority.

13.2 How to exercise your rights. Use the privacy controls in the app, or write to ask@mythrive.ae. We will respond within 30 days, and will tell you if we need a reasonable extension. We may ask you to verify your identity before acting.

13.3 We may decline a request where an exemption applies, for example where compliance would reveal another person's data, prejudice an investigation, or conflict with a legal retention obligation. We will explain our reasons.

13.4 Requests are handled free of charge, unless manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable fee.

13.5 Complaints. If you are not satisfied with our response you may complain to the UAE Data Office. If you are in the EEA or UK you may complain to your local data protection authority.

14Deleting your account and your data

14.1 You can delete your account from inside the app at any time. From the Home tab, tap your profile picture at the top right, then tap Delete Account at the bottom of your profile page and confirm. The option is available to every account holder, User and Expert alike, and does not require you to contact support, send an email or explain why.

14.2 If you no longer have the app, visit www.mythrive.ae/delete-account and send us a deletion request by email from there. You don't need to reinstall the app.

14.3 Partial deletion. You do not have to delete everything. Within the app you can separately delete individual progress photos, logged workouts, logged meals, messages and health platform data, while keeping your account.

14.4 What happens when you delete your account. We immediately deactivate your account and stop all processing other than what is described below. Your profile is removed from the Platform, any active subscription is cancelled at the end of its current period, unredeemed Points are forfeited, and your personal data is deleted or irreversibly anonymised within 90 days.

14.5 What we keep, and why. A limited set of data is retained after deletion where the law requires it or where we need it to defend a legal claim. This is set out in Section 12, and covers transaction and tax records, booking records, and safety and enforcement records. This data is placed beyond ordinary operational use and is retained only for the stated period.

14.6 What we cannot delete for you. Data an Expert has independently recorded in their own systems, messages you sent to another person, and reviews you posted publicly may persist. Where a review remains, we can disassociate it from your name on request. For an Expert's own records, contact that Expert directly.

14.7 Deletion is permanent and cannot be reversed. You will be asked to confirm before it proceeds.

14.8 If you cannot access your account, write to ask@mythrive.ae and we will verify your identity and action the deletion for you.

15Cookies and similar technologies

15.1 Our website and app use cookies, SDKs, pixels and local storage to keep you signed in, remember preferences, secure the service, measure performance and, where you consent, measure marketing.

15.2 Categories used:

• Strictly necessary — authentication, security, load balancing. These cannot be switched off.

• Functional — language, saved preferences, session continuity.

• Analytics — how features are used, where errors occur.

• Marketing — measuring campaigns and attribution, and showing Thrive ads to people who have visited our website. Used only with your consent.

15.3 You can manage non-essential cookies through our cookie banner or your browser settings, and can limit mobile tracking through your device's advertising and tracking settings.

16Marketing and notifications

16.1 Service messages (booking confirmations, payment receipts, security alerts, policy changes) are part of the service and cannot be opted out of while your account is active.

16.2 Marketing messages are sent only with your consent. You may unsubscribe at any time using the link in any email, by adjusting your in-app notification settings, or by contacting us.

16.3 Push notifications, including reminders, streaks, milestones and Rewards Hub updates, can be controlled in the app and in your device settings.

16.4 We do not use push notifications for advertising, promotion or direct marketing unless you have opted in to receive them.

17Security

17.1 We use technical and organisational measures appropriate to the risk, including encryption of all data in transit using industry-standard transport layer security, encryption of data at rest, hashed password storage, access controls on a need-to-know basis, logging and monitoring, secure development practices, vendor due diligence, and staff confidentiality obligations.

17.2 We do not store full payment card details. Card data is handled by our PCI-DSS compliant payment processor.

17.3 No system is completely secure. You are responsible for keeping your password confidential, using a unique password, enabling any available additional authentication, and notifying us immediately at ask@mythrive.ae if you suspect unauthorised access.

17.4 Breach notification. Where a personal data breach is likely to prejudice your privacy, confidentiality, security or rights, we will notify the UAE Data Office and, where required, affected individuals, without undue delay and in accordance with the PDPL.

18Children and family safety

18.1 Thrive is not directed to children. It is not designed for, marketed to, or intended to appeal to children, and we do not knowingly collect personal data from anyone under 16.

18.2 Where a person aged 16 to 18 uses the Platform, the account must be created and supervised by a parent or legal guardian who provides verifiable consent and accepts the Terms on their behalf.

18.3 We do not serve advertising, use advertising identifiers, or personalise content using tracking for anyone we know or believe to be a minor.

18.4 If you believe a child has provided us with personal data, contact ask@mythrive.ae and we will investigate and delete it promptly.

18.5 Experts working with minors have additional obligations under the Expert Terms, including obtaining guardian consent, ensuring an appropriate chaperone is present, and never communicating privately with a minor outside monitored Platform channels.

19Third-party links and integrations

19.1 The Platform may link to or integrate with third-party sites, apps, devices and services. This Policy does not apply to them.

19.2 Before connecting a wearable, health platform, calendar or social account, review that provider's own privacy policy. You may disconnect an integration at any time through the Platform or your device settings, which stops future data flow but does not by itself delete data already received. To delete data already received, see Section 14.

20Data disclosure summary

This Section summarises our practices in the form used by the Apple App Store privacy labels and the Google Play Data safety section. It is a summary of the detail set out above, and does not replace it.

Data linked to you

Data used to track you across other companies' apps and websites: none.

Data sold: none.

Data shared with data brokers or advertising networks: none.

Encrypted in transit: yes, all data.

Deletion: you can request deletion of your data, and you can delete your account in the app or at www.mythrive.ae/delete-account. See Section 14.

Health data: never used for advertising, never sold, never shared with data brokers. See Sections 3 and 4.

21Changes to this policy

21.1 We may update this Policy to reflect changes in our services, technology, or legal obligations.

21.2 Where changes are material we will notify you through the Platform or by email before they take effect, and where required by law we will seek your fresh consent.

21.3 The "last updated" date at the top of this Policy shows when it was last revised. Earlier versions are available on request.

22Contact us

Thrive App LLC

Trade Licence No. 2427891.01

Sharjah Media City, Sharjah, United Arab Emirates

Please use these addresses for all privacy matters, including exercising your data rights, requesting deletion, withdrawing consent, reporting a security incident, reporting a safety or harassment concern, and any other question about this Policy.

Supervisory authority: UAE Data Office (Federal Authority for Data Office). If you are not satisfied with our response you may lodge a complaint with the UAE Data Office through its published channels. If you are in the EEA or the UK, you may complain to your local data protection authority.

23Language

This Policy may be published in English and Arabic. In the event of any inconsistency, the Arabic version prevails for the purposes of interpretation before the UAE courts.

This Privacy Policy should be read together with the Thrive Terms and Conditions of Use (Users) and the Thrive Expert Terms and Conditions (Experts).