Who We Are
This Privacy Notice is issued by ME24 Limited (“we”, “us”, “our”, or “ME24 Limited”), a company registered in England and Wales under company number 16701491, with ICO registration number ZC069669. We operate the “Areela” platform, accessible at app.areela.com, together with the companion mobile application “Areela for Coach” (collectively, the “Platform”). You can contact us at any time by emailing support@areela.com. This Privacy Notice explains how we collect, use, store, and share your personal data when you register for and use the Platform as a trainer, coach, or business user (“Trainer User” or “you”). It is provided in accordance with Articles 13 and 14 of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. Corporate processing by ME24 Limited, including employee, supplier, recruitment and website processing, is described in the Privacy Policy: ME24 Limited (Corporate) (Document 1A of this suite).
Our Role: Controller and Processor
ME24 Limited acts in a dual capacity in relation to personal data processed through the Platform:
ME24 Limited as Controller
We are the data controller for the following categories of processing activities relating to your use of the Platform:
a) Account administration and management
b) Billing, invoicing, and subscription management
c) Platform security and integrity
d) Analytics and product improvement
e) Operation and error logging
f) First-party communications (service updates, support)
ME24 Limited as Processor
We act as a data processor on your behalf (you being the controller) for personal data relating to your clients that you input into or generate through the Platform, including but not limited to:
a) AI conversations and AI-generated coaching content
b) Training programmes, workouts, and exercises
c) Messages exchanged between you and your clients via the Platform
d) Client check-ins, feedback, and progress data
The processing of client data by ME24 Limited on your behalf is governed by the Data Processing Addendum at Schedule 2 of the Subscription Services Agreement between you and ME24 Limited.
Categories of Personal Data We Collect
We collect and process the following categories of personal data about you:
Category | Examples |
Identity data | Full name, username, profile photograph |
Contact data | Email address, telephone number |
Business information | Business name, business type, qualifications, certifications, coaching specialisations |
Payment data | Billing address, payment card details (processed and stored by Stripe; we do not store full card numbers), transaction history, subscription tier |
Platform usage data | Login timestamps, feature usage, session duration, pages visited, actions taken within the Platform |
AI interaction logs | Queries submitted to AI features, AI-generated responses, AI conversation metadata |
Support correspondence | Emails, in-app support messages, and any attachments you send to our support team |
Device and technical data | IP address, browser type and version, operating system, device identifiers, time zone, language preferences, mobile device information |
Lawful Bases for Processing
We rely on the following lawful bases under Article 6(1) of the UK GDPR:
Purpose | Lawful Basis | Details |
Providing and administering the Platform, managing your account, processing subscriptions and payments | Contract - Article 6(1)(b) | Processing is necessary for the performance of the Subscription Services Agreement between you and ME24 Limited. |
Platform security, fraud prevention, error monitoring, analytics, and product improvement | Legitimate Interests - Article 6(1)(f) | We have a legitimate interest in maintaining the security and integrity of the Platform, understanding how the Platform is used, and improving our services. We have conducted a balancing test and determined that these interests are not overridden by your rights and freedoms. |
Compliance with tax, accounting, and regulatory obligations; responding to lawful requests from public authorities | Legal Obligation - Article 6(1)(c) | Processing is necessary for compliance with legal obligations to which ME24 Limited is subject, including UK tax and accounting legislation. |
How We Collect Your Data
We collect personal data from the following sources:
Directly from you
When you register for an account, complete your profile, subscribe to a plan, contact our support team, or otherwise interact with the Platform.
Automatically via the Platform
When you access and use the Platform, we automatically collect device and technical data, usage data, and AI interaction logs through our systems and third-party monitoring tools.
From Stripe
Our payment processor, Stripe, provides us with transaction confirmations, subscription status updates, and limited billing information necessary to manage your account.
Recipients of Your Personal Data
We share your personal data with the following categories of recipients and sub-processors. Each sub-processor is contractually bound to process personal data only in accordance with our instructions and to implement appropriate technical and organisational measures to protect your data.
The complete list of approved Sub-processors is maintained in Schedule 4 of the Subscription Services Agreement and is updated in accordance with the change notification mechanism set out in the Data Processing Addendum (Schedule 2 of the Subscription Services Agreement).
Use of Coach Information in Marketing
ME24 Limited may wish to use your name, brand, business name, logo, testimonials, and aggregated performance statistics in its marketing and promotional materials (including on the areela.com website, social media channels, case studies, press materials, and advertising). We will only use your information for marketing purposes if you have provided express written opt-in consent (“Marketing Consent”). Marketing Consent is: (a) separate from your acceptance of the Subscription Services Agreement and other Platform terms; (b) voluntary - you are not required to provide Marketing Consent to use the Platform; (c) specific - we will tell you how your information will be used before asking for your consent; and (d) withdrawable - you can withdraw Marketing Consent at any time by contacting us at support@areela.com. If you withdraw Marketing Consent, we will cease using your information in new marketing materials within 30 days of receiving your withdrawal notice. Materials already published before the withdrawal date may remain in circulation for a reasonable period. Lawful basis: Where Marketing Consent involves the processing of personal data, the lawful basis for processing is consent under UK GDPR Article 6(1)(a). Where testimonials include health or fitness information, the additional lawful basis for processing special category data is explicit consent under UK GDPR Article 9(2)(a).
AI Processing and OpenAI
When you use AI-powered features, your data is processed by OpenAI OpCo, LLC in the United States. OpenAI acts as a data processor on our behalf. ZDR is enabled for eligible text-based AI interactions, so covered inputs and outputs are not logged for abuse monitoring or human review and are not retained beyond the immediate processing task. Image and file inputs may be retained for automated Safety Classification.
OpenAI does not use user data to develop or improve its AI models under the Modified Retention Amendment and the OpenAI Enterprise Agreement. AI processing is performed by OpenAI OpCo, LLC in the United States.
ZDR does not apply to image or file inputs. Images and files transmitted to OpenAI may be retained for automated Safety Classification. Safety Classifiers consist of metadata only, including classifier types, dates, counts and confidence scores, and do not contain user content.
Sub-Processor | Service | Location |
Laravel Cloud (Laravel Holdings, Inc.) | Application hosting, compute, database | EU West (London, United Kingdom) |
Amazon Web Services (AWS) | Cloud infrastructure (underlying Laravel Cloud) | EU West (London, United Kingdom) / United States |
OpenAI, LLC (also known as OpenAI OpCo, LLC) | Provision of AI-assisted features within the Platform | United States |
ElevenLabs, Inc. | Text-to-speech voice generation | United States |
Terra API, Inc. | Wearable device data integration | United States / United Kingdom |
FatSecret Pty Ltd | Food and nutrition database | Australia |
Stripe, Inc. | Payment processing | United States / Ireland |
RevenueCat, Inc. | In-app purchase management and subscription tracking | United States |
Apple Inc. | App Store distribution and IAP billing | United States |
Google LLC | Play Store distribution and Play Billing | United States |
Expo (650 Industries, Inc.) | Mobile app build and OTA update service | United States |
Postmark (ActiveCampaign, LLC) | Transactional email delivery | United States |
FontAwesome (Fonticons, Inc.) | Icon library (Pro licence) | United States |
Sentry (Functional Software, Inc.) | Error monitoring and performance tracking | United States |
Cloudflare, Inc. | CDN, DDoS protection, DNS | United States / Global |
Plausible Analytics (Plausible Insights OUE) | Privacy-friendly web analytics | EU (Estonia) |
Crisp IM SAS | Live chat and customer support widget | EU (France) |
International Data Transfers
Some of our sub-processors are located in the United States. We do not transfer personal data to China, Russia, India, or any other jurisdiction outside the UK and EEA other than the United States. Where personal data is transferred to the United States, we rely on an applicable lawful transfer mechanism and appropriate supplementary measures, including encryption in transit and at rest and contractual protections. Transfers to OpenAI in the United States require a UK International Data Transfer Agreement (“UK IDTA”) and/or EU Standard Contractual Clauses (“EU SCCs”), as applicable. The Modified Retention Amendment does not itself establish an international transfer mechanism; the applicable OpenAI mechanism must be verified in the OpenAI Enterprise Agreement and/or OpenAI Data Processing Addendum. See the International Data Transfer Addenda (Document 9 of this suite) for the current transfer provisions and review notes. OpenAI OpCo, LLC (United States) - AI processing services. Transfer safeguard: EU Standard Contractual Clauses as amended by the UK Addendum.
HIPAA Disclaimer
The Areela Platform is a fitness and wellness platform. It is not intended for use in connection with medical treatment, clinical care, or any healthcare service regulated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The Areela Platform is not intended to create, receive, maintain, or transmit protected health information as defined under HIPAA. While the Platform processes health and fitness data (such as heart rate, sleep data, injuries, allergies, and medication information), this data is processed as special category data under UK GDPR Article 9, subject to the safeguards and lawful bases described in this Privacy Notice. If you are a HIPAA-covered entity or business associate and believe that HIPAA applies to your use of the Platform, you must stop using the Platform and contact us at support@areela.com.
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following retention periods apply:
Data Category | Retention Period | Post-Deletion Treatment |
Account information | Account lifetime + 14-day grace period following account deletion | Permanently erased |
AI conversation data and summaries | Account lifetime, or earlier upon your deletion request | Permanently erased |
Subscription and purchase records | Account lifetime; after account deletion, retained without user-identifying information per applicable tax and accounting law | De-identified retention per legal obligation |
Support correspondence | Account lifetime | Erased upon account deletion |
Security and operation logs | Account lifetime | Erased upon account deletion; anonymised data may be retained for analytical purposes |
Backups | Short rolling period | Overwritten on rotation; not restored except for disaster recovery purposes |
Your Rights
Under the UK GDPR, you have the following rights in relation to your personal data:
a) Right of access: You have the right to request a copy of the personal data we hold about you (a “subject access request”).
b) Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
c) Right to erasure: You have the right to request that we delete your personal data, subject to applicable legal retention requirements.
d) Right to restriction of processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
e) Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
f) Right to object: You have the right to object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
g) Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To exercise any of these rights, please contact us at support@areela.com. We will respond to your request within one month, or inform you if an extension is required.
Complaints
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113
We would appreciate the opportunity to address your concerns before you contact the ICO.
Changes to This Privacy Notice
We may update this Privacy Notice from time to time. The most current version will always be available at areela.com/legal. Where we make material changes, we will provide at least 30 days’ advance notice by: (a) displaying a prominent notice on the Platform; (b) sending an email to the address associated with your account; or (c) both. Material changes include changes that affect: your rights and obligations; how your personal data is processed; the scope of services or features available to you; or any other matter that could reasonably be expected to affect your use of the Platform. Your continued use of the Platform after changes are posted constitutes acceptance of the updated Privacy Notice.