This privacy notice is written in plain English so that you can easily understand how your personal data is used. If you have any questions, please email us at support@areela.com.
Who We Are
We are ME24 Limited, a company registered in England and Wales (company number 16701491). We are registered with the Information Commissioner’s Office (ICO) under registration number ZC069669. We operate the “Areela” platform at app.areela.com and the “Areela for Coach” mobile application. You can contact us at: support@areela.com.
Our Role and Your Coach’s Role
When you use the Areela platform, two organisations are responsible for your personal data:
Your Coach
Your coach (or their business) is the data controller for your coaching data. This means your coach decides why and how your coaching information is used. This includes your training programmes, workouts, exercises, AI coaching conversations, messages, check-ins, progress data, and feedback. Your coach has their own legal obligations to you under data protection law. ME24 Limited (Us) We are the data controller for your account data, the information needed to create and maintain your account, keep the platform running, and ensure security. We are also a data processor, meaning we process your coaching data on your coach’s behalf, following their instructions, to provide the platform services.
What Data We Collect About You
We collect and process the following types of personal data:
Category | Examples |
Identity data | Your name, username, and profile photograph |
Contact details | Email address, telephone number |
Date of birth | Used for age verification and coaching personalisation |
Gender | Used for coaching personalisation |
Country | Used for localisation and regulatory compliance |
Goals and lifestyle information | Fitness goals, activity levels, lifestyle preferences, daily routines |
Injury and medical history | Current and past injuries, physical limitations, conditions affecting exercise |
PAR-Q answers | Your responses to the Physical Activity Readiness Questionnaire, used to assess exercise safety |
Allergies and dietary information | Food allergies, dietary restrictions, nutritional preferences |
Medication | Current medications that may affect exercise or nutrition recommendations |
Blood type | If provided by you for your coaching profile |
Workout and exercise data | Exercises performed, sets, reps, weights, duration, completion status |
Nutrition and hydration data | Meals logged, calorie intake, macronutrients, water intake |
Journals and notes | Personal reflections, coaching notes, session feedback |
Progress photographs | Before/after and progress images you upload |
Body measurements | Weight, body fat percentage, circumference measurements, BMI |
Wearable device data | Activity data (steps, calories burned, distance), sleep data (duration, quality, stages), heart rate, blood oxygen (SpO2), blood glucose levels, body temperature, location data (if shared by your wearable device) |
Special Category (Health) Data
Some of the data listed above, such as injury history, PAR-Q answers, allergies, medication, blood type, and wearable health metrics, is classified as “special category data” (specifically, health data) under data protection law. This data receives additional protection. We process your health data based on your explicit consent (UK GDPR Article 9(2)(a)). When you first provide health information through the platform, you will be asked to give your explicit consent. You can withdraw your consent at any time by contacting us at support@areela.com or by using the settings within the app. Withdrawing consent does not affect the lawfulness of any processing that took place before you withdrew it.
How AI Uses Your Data
The Areela platform uses artificial intelligence (AI) to enhance your coaching experience. Here is how AI interacts with your data:
OpenAI (AI Coaching Features)
We use AI models provided by OpenAI OpCo, LLC to power coaching conversations, workout generation, check-in analysis, and other AI features. When you use AI-powered features, your data is processed by OpenAI OpCo, LLC in the United States. OpenAI acts as a data processor on our behalf.
a) Zero Data Retention is enabled for text-based AI interactions - your inputs and outputs are not stored beyond the immediate processing task.
b) c) Image and file inputs may be retained for automated safety screening.
OpenAI will not use your data to develop or improve its services unless explicitly agreed. The OpenAI Services Agreement provides that OpenAI will not use Customer Content to develop or improve the Services unless explicitly agreed. When you upload images or files (such as progress photos or food photos) that are processed using our AI features, they may be shared with OpenAI and may be retained for automated Safety Classification. This is separate from the Zero Data Retention arrangement for content submitted to eligible API endpoints.
ElevenLabs (Text-to-Speech)
We use ElevenLabs to convert AI-generated text replies into speech so you can listen to coaching responses. ElevenLabs receives only the text of the AI reply, it does not receive your personal data, health data, or conversation history. ElevenLabs retains data in accordance with its own privacy policy.
Your data is not used by OpenAI to train or improve its AI models under the Modified Retention Amendment and the OpenAI Enterprise Agreement.
Why We Use Your Data (Lawful Bases)
The law requires us to have a valid reason (“lawful basis”) for using your personal data:
Purpose | Lawful Basis |
|---|---|
Creating and managing your account | Contract: necessary to provide the service you signed up for |
Delivering coaching services through the platform | Contract: necessary to provide the service |
Processing health and special category data | Your explicit consent (Article 9(2)(a)) |
AI-powered coaching features | Contract: part of the service provided to you and your coach |
Platform security, error monitoring, and fraud prevention | Legitimate interests: keeping the platform safe and functional |
Sending service communications (e.g., password resets, account updates) | Contract: necessary for account management |
Analytics and product improvement | Legitimate interests: improving the platform for all users |
Compliance with legal obligations | Legal obligation: required by law (e.g., tax records) |
Wearable data integration | Your explicit consent |
Who We Share Your Data With
We use trusted service providers (“Sub-processors”) to help us run the Platform. Each provider is contractually required to protect your data and only use it for the purposes we specify. The complete approved Sub-processor list is maintained in Schedule 4 (Sub- processor List) of the Subscription Services Agreement and is reflected in the table below.
Provider | What They Do | Where They Are |
|---|---|---|
Laravel Cloud (Laravel Holdings, Inc.) | Application hosting, compute, database | EU West (London, United Kingdom) |
Amazon Web Services (AWS) | Cloud infrastructure (underlying Laravel Cloud) | EU West (London, United Kingdom) / United States |
OpenAI, LLC (also known as OpenAI OpCo, LLC) | Provision of AI-assisted features within the Platform | United States |
ElevenLabs, Inc. | Text-to-speech voice generation | United States |
Terra API, Inc. | Wearable device data integration | United States / United Kingdom |
FatSecret Pty Ltd | Food and nutrition database | Australia |
Stripe, Inc. | Payment processing | United States / Ireland |
RevenueCat, Inc. | In-app purchase management and subscription tracking | United States |
Apple Inc. | App Store distribution and IAP billing | United States |
Google LLC | Play Store distribution and Play Billing | United States |
Expo (650 Industries, Inc.) | Mobile app build and OTA update service | United States |
Postmark (ActiveCampaign, LLC) | Transactional email delivery | United States |
FontAwesome (Fonticons, Inc.) | Icon library (Pro licence) | United States |
Sentry (Functional Software, Inc.) | Error monitoring and performance tracking | United States |
Cloudflare, Inc. | CDN, DDoS protection, DNS | United States / Global |
Plausible Analytics (Plausible Insights OÜ) | Privacy-friendly web analytics | EU (Estonia) |
Crisp IM SAS | Live chat and customer support widget | EU (France) |
International Data Transfers
Some of the providers listed above are based in the United States. We do not send your data to China, Russia, India, or any country outside the UK, EEA, and United States.
When your data is transferred to the US, we use an applicable lawful transfer mechanism and supplementary safeguards such as encryption. Transfers to OpenAI in the US require a UK International Data Transfer Agreement (“UK IDTA”) and/or EU Standard Contractual Clauses (“EU SCCs”), as applicable. The Modified Retention Amendment does not itself establish an international transfer mechanism; the applicable OpenAI mechanism must be verified in the OpenAI Enterprise Agreement and/or OpenAI Data Processing Addendum. See the International Data Transfer Addenda (Document 9 of this suite) for the current transfer provisions and review notes.
For full details of the transfer mechanisms, supplementary measures, and contractual safeguards applicable to OpenAI, see the International Data Transfer Addenda (Document 9 of this suite) and, where applicable, the Data Processing Addendum at Schedule 2 of the Subscription Services Agreement.
OpenAI OpCo, LLC (United States): AI processing services. Transfer safeguard: EU Standard Contractual Clauses as amended by the UK Addendum.
HIPAA Disclaimer
The Areela Platform is a fitness and wellness platform. It is not intended for use in connection with medical treatment, clinical care, or any healthcare service regulated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The Areela Platform is not intended to create, receive, maintain, or transmit protected health information as defined under HIPAA. While the Platform processes health and fitness data (such as heart rate, sleep data, injuries, allergies, and medication information), this data is processed as special category data under UK GDPR Article 9, subject to the safeguards and lawful bases described in this Privacy Notice. If you are a HIPAA-covered entity or business associate and believe that HIPAA applies to your use of the Platform, you must stop using the Platform and contact us at support@areela.com.
How Long We Keep Your Data
What | How Long | What Happens After |
|---|---|---|
Your account information | As long as your account is active, plus 14 days after deletion | Permanently deleted |
AI conversations and summaries | As long as your account is active, or when you delete them | Permanently deleted |
Subscription and purchase records | As long as required by tax law | Retained without identifying you |
Support messages | As long as your account is active | Deleted with your account |
Security logs | As long as your account is active | Deleted with your account |
Health and activity data | As long as your account is active, or when you delete individual items | Permanently deleted |
Wearable data (raw) | Raw data redacted after 30 days, deleted after 90 days | Progressively deleted |
Wearable data (structured metrics) | As long as your account is active | Permanently deleted |
Backups | Short rolling period | Automatically overwritten |
Your Rights
You have the following rights over your personal data. You can exercise them at any time by emailing support@areela.com:
See your data: You can ask us to show you what personal data we hold about you.
Correct your data: If any of your data is wrong or incomplete, you can ask us to fix it.
Delete your data: You can ask us to delete your personal data. We will do so unless we are legally required to keep it.
Restrict how we use your data: You can ask us to limit what we do with your data in certain situations.
Move your data: You can ask us to provide your data in a format that lets you transfer it to another service.
Object to our use of your data: You can object to processing based on our legitimate interests.
Withdraw your consent: Where we rely on your consent (e.g., for health data), you can withdraw it at any time.
Right to Complain
If you are unhappy with how we handle your data, we encourage you to contact us first at support@areela.com so we can try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113
Supplemental Notice for California Residents (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”).
Categories of Personal Information Collected
We collect the following categories of personal information as defined by the CCPA: identifiers (name, email, phone number); personal information under Cal. Civ. Code § 1798.80(e) (name, address); internet or other electronic network activity information (usage data, device data); geolocation data (country, wearable location if shared); biometric information (wearable health metrics); professional or employment-related information (coaching qualifications, if applicable); health information; and inferences drawn from the above.
Your California Rights
a) Right to Know: You may request that we disclose what personal information we collect, use, disclose, and sell about you.
b) Right to Delete — You may request that we delete personal information we collected from you.
c) d) Right to Correct — You may request that we correct inaccurate personal information. Right to Opt-Out of Sale — You have the right to opt out of the sale of your personal information. We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising purposes. We will not discriminate against you for exercising any of your CCPA rights. To submit a request, email support@areela.com.
Supplemental Notice for EU/EEA Residents
If you are located in the European Union or European Economic Area, the EU General Data Protection Regulation (Regulation (EU) 2016/679) applies in addition to the UK GDPR. You have the same rights described in Section 10 above, and additionally:
a) You have the right to lodge a complaint with your local supervisory authority (not only the UK ICO). A list of EU supervisory authorities is available at edpb.europa.eu.
b) International transfers from the EEA are governed by EU Standard Contractual Clauses (SCCs) as approved by the European Commission under Implementing Decision (EU) 2021/914.
c) You have the right not to be subject to automated decision-making, including profiling, which produces legal effects or similarly significantly affects you. The AI features on the platform are assistive in nature and do not make automated decisions with legal or similarly significant effects.
Supplemental Notice for Australian Residents
If you are located in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to the handling of your personal information. In addition to the rights described above:
a) b) c) d) You may request access to, and correction of, your personal information at any time. If you believe we have breached the APPs, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. We will take reasonable steps to ensure that personal information transferred overseas is handled in accordance with the APPs. Sensitive information (including health information) is collected only with your consent and for the purposes disclosed in this notice.
Other International Provisions
New Zealand: Privacy Act 2020
If you are located in New Zealand, you have rights under the Privacy Act 2020 and Information Privacy Principles. You may lodge a complaint with the Office of the Privacy Commissioner at privacy.org.nz.
Canada: PIPEDA
If you are located in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies. You have the right to access and correct your personal information, and to withdraw consent. Complaints may be filed with the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Singapore: PDPA
If you are located in Singapore, the Personal Data Protection Act 2012 (PDPA) applies. You have the right to access, correct, and request deletion of your personal data. Complaints may be filed with the Personal Data Protection Commission at pdpc.gov.sg.
Japan: APPI
If you are located in Japan, the Act on the Protection of Personal Information (APPI) applies. You have the right to request disclosure, correction, cessation of use, and deletion of your personal information. Complaints may be filed with the Personal Information Protection Commission at ppc.go.jp.
Changes to This Privacy Notice
We may update this Privacy Notice from time to time. The most current version will always be available at areela.com/legal. Where we make material changes, we will provide at least 30 days’ advance notice by: (a) displaying a prominent notice on the Platform; (b) sending an email to the address associated with your account; or (c) both. Material changes include changes that affect: your rights and obligations; how your personal data is processed; the scope of services or features available to you; or any other matter that could reasonably be expected to affect your use of the Platform. Your continued use of the Platform after changes are posted constitutes acceptance of the updated Privacy Notice.