This subscription services agreement (the “Agreement”) is made between (1) the named entity or individual entering into this Agreement through registration (“Customer”, “you”, “your”), and (2) ME24 Limited trading as Areela (“Provider”, “us”, “our”), a limited company registered in England and Wales with company number 16701491 and having its registered office at Springfield House, Springfield Road, Horsham, England, RH12 2RG. This Agreement is effective between the Customer and the Provider as of the date of Customer’s acceptance of this Agreement (“Effective Date”) through the click-button contract acceptance mechanism (the “Click to Accept Button”) on the Provider’s website at https://www.areela.com.
RECITALS
A) The Provider has developed and operates the “Areela” fitness coaching platform (the “Platform”), an online software-as-a-service solution accessible at app.areela.com and via the “Areela for Coach” mobile application, which enables fitness professionals (“Coaches”) to deliver coaching services to their end-user clients (“Contacts”).
B) The Customer is a fitness coaching professional or business that wishes to subscribe to the Platform to manage and deliver coaching programmes, nutrition plans, and related services to the Customer’s Contacts.
C) The Provider and the Customer wish to enter into this Agreement to set out the terms on which the Provider shall make the Platform and associated Services available to the Customer.
D) The Parties acknowledge that in the course of providing the Services, the Provider will process Personal Data on behalf of the Customer as a Processor, and this Agreement incorporates a Data Processing Addendum at Schedule 2 to regulate that processing.
E) The Customer agrees to enter into this Agreement on the terms and conditions set out below by accepting this Agreement through the Provider’s online registration and subscription process.
IT IS AGREED as follows:
1. DEFINITIONS AND INTERPRETATION
1.1 In this Agreement, unless the context otherwise requires, the following terms shall have the meanings set out below:
Definitions
a) “AI Features” means the artificial intelligence and machine learning features made available through the Platform, including but not limited to AI-powered programme generation, nutrition plan suggestions, automated check-in analysis, AI-generated coaching insights, and text-to-speech functionality, as further described in Clause 11 and Schedule 1.
b) “Authorised Users” means those employees, agents, and independent contractors of the Customer who are authorised by the Customer to use the Platform, as further specified in the Order Form.
c) “Business Day” means a day other than a Saturday, Sunday, or public holiday in England and Wales.
d) “Confidential Information” means all information (whether written, oral, or in electronic form) disclosed by one Party to the other Party that is designated as confidential or that reasonably ought to be considered confidential given the nature of the information and the circumstances of disclosure, including but not limited to: business plans, financial information, customer lists, technical data, source code, algorithms, trade secrets, marketing strategies, and the terms of this Agreement.
e) “Contact” means an end-user client of the Customer who accesses and uses the Platform through the Customer’s subscription, including via the “Areela for Coach” mobile application. Contacts are not direct customers of the Provider.
f) “Contact Data” means any Personal Data and other information relating to Contacts that is uploaded to, generated by, or processed through the Platform, including health and fitness data, nutrition information, progress photographs, wearable device data, biometric data, and any other data described in Schedule 2 (Data Processing Addendum).
g) “Controller” has the meaning given to it in the UK GDPR.
h) “Customer Data” means all data, information, content, and materials (including Personal Data) uploaded to, generated by, stored on, or processed through the Platform by or on behalf of the Customer or its Authorised Users, including Contact Data, coaching programmes, templates, media files, and business records, but excluding any de-identified or aggregated data derived therefrom.
i) “Data Protection Laws” means all applicable data protection and privacy legislation in force from time to time, including: a) the UK GDPR; b) the Data Protection Act 2018; c) the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426); and d) to the extent applicable, the General Data Protection Regulation (EU) 2016/679 (“EU GDPR”), the California Consumer Privacy Act of 2018 (as amended by the CPRA), and any other data protection laws of any jurisdiction in which the Services are used, in each case as amended, re-enacted, or replaced from time to time.
j) “Documentation” means the user guides, help centre articles, onboarding materials, API documentation, and other documentation made available by the Provider to the Customer from time to time in connection with the Platform, whether online or in printed form.
k) “Effective Date” means the date on which the Customer accepts this Agreement through the Click to Accept Button on the Provider’s website.
l) “Fees” means the subscription fees, add-on fees, and any other charges payable by the Customer for the Services as set out in the Order Form and Clause 3.
m) “Force Majeure Event” means any event beyond the reasonable control of a Party, including but not limited to acts of God, fire, flood, earthquake, epidemic, pandemic, war, terrorism, riots, civil disorder, rebellion, strikes, lock-outs, industrial action, governmental action, sanctions, embargoes, power failure, internet or telecommunications failure, cyberattack, or failure of third-party hosting or cloud infrastructure providers.
n) “IDTA” means the International Data Transfer Agreement issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as may be amended or replaced from time to time.
o) “Initial Term” means the initial subscription period specified in the Order Form, being either thirty (30) days (for monthly subscriptions) or one (1) year (for annual subscriptions).
p) “Intellectual Property Rights” or “IPR” means all patents, rights to inventions, utility models, copyright and neighbouring rights, moral rights, trade marks and service marks, business names and domain names, rights in get-up and trade dress, goodwill and the right to sue for passing off, rights in designs, database rights, rights to use and protect the confidentiality of confidential information (including know-how and trade secrets), and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted, renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world.
q) “Open-Source Software” or “OSS” means software that is distributed under a licence approved by the Open Source Initiative (www.opensource.org) or that is otherwise made freely available under terms that permit use, modification, and redistribution, including but not limited to the MIT Licence, Apache Licence 2.0, GNU General Public Licence, and BSD Licences.
r) “Order Form” means the online registration and subscription form completed and submitted by the Customer through the Provider’s website at www.areela.com as part of the Customer’s subscription to the Services, which sets out or records the Customer’s selected subscription plan and any other applicable subscription details, and which forms part of and is subject to this Agreement.
s) “Personal Data” has the meaning given to it in the UK GDPR.
t) “Platform” means the Provider’s “Areela” fitness coaching software-as-a- service platform, accessible at app.areela.com (the web application) and via the “Areela for Coach” mobile application available on iOS and Android, together with all updates, upgrades, modifications, and new features made available by the Provider from time to time during the Subscription Term.
u) “Processing” has the meaning given to it in the UK GDPR, and “Process”, “Processes”, and “Processed” shall be construed accordingly.
v) “Processor” has the meaning given to it in the UK GDPR.
w) “Renewal Term” means each successive period of the same duration as the Initial Term for which this Agreement is renewed in accordance with Clause 4.
x) “Services” means the subscription services provided by the Provider to the Customer under this Agreement, comprising access to and use of the Platform, the AI Features, hosting, maintenance, support, and any other services described in Schedule 1 (Service Description) and the applicable Order Form.
y) “Sub-processor” means any third party appointed by or on behalf of the Provider to Process Personal Data on behalf of the Customer in connection with this Agreement, as listed in Schedule 4.
z) “Subscription Term” means the Initial Term together with any Renewal Terms. (aa) “UK GDPR” means the retained EU law version of the General Data Protection Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union(Withdrawal) Act 2018 (as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019).
1.2 In this Agreement, unless the context otherwise requires:
a) references to Clauses and Schedules are to clauses of, and schedules to, this Agreement;
b) references to a Party include that Party’s personal representatives, successors, and permitted assigns;
c) references to a statute or statutory provision include any subordinate legislation made under it and any modification, re-enactment, or replacement of it from time to time;
d) words in the singular include the plural and vice versa, and words importing one gender include all genders;
e) a reference to “writing” or “written” includes email but not fax;
f) headings are for convenience only and shall not affect the interpretation of this Agreement;
g) the Schedules form part of this Agreement and shall have effect as if set out in full in the body of this Agreement, and any reference to this Agreement includes the Schedules; and
h) where there is any conflict or inconsistency between the terms of the body of this Agreement and a Schedule, the body of this Agreement shall prevail unless the Schedule expressly states otherwise.
2. SERVICE DESCRIPTION
2.1 The Provider shall, during the Subscription Term and subject to the terms of this Agreement, provide the Services to the Customer and make the Platform available to the Customer and its Authorised Users in accordance with the service description set out in Schedule 1 (Service Description) and the applicable Order Form.
2.2 The Platform comprises:
a) the web application accessible at app.areela.com (the “Web App”);
b) the “Areela for Coach” mobile application available for download on Apple iOS and Google Android (the “Mobile App”); and
c) such additional interfaces, APIs, integrations, and features as the Provider may make available from time to time.
2.3 The Platform is hosted on Laravel Cloud in the eu-west-1 (London, United Kingdom) region.
2.4 The Platform provides the following core features, as more particularly described in Schedule 1:
a) coach and contact management (client profiles, onboarding, questionnaires);
b) programme and workout builder (exercise library, templates, scheduling);
c) nutrition planning and food diary (integration with FatSecret API);
d) wearable device integration (via Terra API: Apple Health, Fitbit, Garmin, WHOOP, Oura, and others);e) AI-powered features including programme generation, nutrition suggestions, check-in analysis, and coaching insights (powered by OpenAI, LLC (also known as OpenAI OpCo, LLC));
f) text-to-speech functionality (powered by ElevenLabs);
g) progress tracking (measurements, progress photographs, check-ins, habit tracking);
h) in-app messaging and communication tools;
i) billing and payment management (via Stripe and in-app purchase through RevenueCat);
j) document and media storage;
k) reporting and analytics dashboards; and
l) such other features as described in the Documentation or as the Provider may introduce from time to time.
2.5 Authentication and access to the Platform is provided via email-based one-time passcode (OTP) and, on supported mobile devices, biometric authentication (Face ID / fingerprint). The Provider does not operate a traditional username/password system.
2.6 Subject to the Customer’s compliance with this Agreement and payment of the Fees, the Provider grants to the Customer a non-exclusive, non-transferable, non- sublicensable licence during the Subscription Term to:
a) access and use the Platform via the Web App and the Mobile App;
b) permit its Authorised Users to access and use the Platform in accordance with this Agreement;
c) permit its Contacts to access and use those features of the Platform that are designated for Contact use; and
d) use the Documentation in connection with the Customer’s permitted use of the Platform.
2.7 The Customer shall not, and shall ensure that its Authorised Users and Contacts do not:
a) access, store, distribute, or transmit any material through the Platform that is unlawful, harmful, threatening, defamatory, obscene, infringing, harassing, or racially or ethnically offensive, or that facilitates illegal activity, depicts sexually explicit images, promotes unlawful violence, or is discriminatory;
b) use the Platform in any manner that is or may be harmful to minors;
c) use the Platform to provide medical advice, diagnosis, or treatment, or hold itself out as providing medical services through the Platform;
d) reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, know-how, or algorithms of the Platform, except to the extent that such restriction is prohibited by applicable law;
e) modify, translate, adapt, or create derivative works based on the Platform or the Documentation;
f) licence, sell, rent, lease, transfer, assign, distribute, display, disclose, or otherwise make the Platform available to any third party except as expressly permitted under this Agreement;
g) use the Platform to develop a competing product or service;h) attempt to gain unauthorised access to, or disrupt the integrity or performance of, the Platform or any data contained therein;
i) introduce any virus, Trojan horse, worm, logic bomb, or other material that is malicious or technologically harmful;
j) scrape, data-mine, or use automated means to access the Platform other than through the Provider’s published APIs; or
k) use the Platform in breach of any applicable law or regulation.
2.8 EU AI Act Provisions. The Customer acknowledges that certain AI Features of the Platform may constitute an “AI system” within the meaning of the EU AI Act (Regulation (EU) 2024/1689). The Provider shall:
a) clearly label AI-generated content with the statement: “Areela is beta AI and can make mistakes”;
b) provide transparency information about the AI Features in the Documentation, including their purpose, capabilities, and known limitations;
c) maintain appropriate technical and organisational measures to ensure that the AI Features operate in a manner that is consistent with their intended purpose; and
d) cooperate with the Customer in fulfilling any deployer obligations that may apply under the EU AI Act.
2.9 White-Label and Signature Range. The Provider offers optional white-label branding and “Signature” range customisation features as add-on services. Such add-on services shall be subject to separate pricing as set out in the Order Form and/or the Provider’s then-current price list and shall be governed by the terms of this Agreement.
2.10 Marketing Communications.
a) The Customer shall ensure that any marketing consent it collects for ME24 Limited is specific, informed, unambiguous, freely given, and separate from acceptance of this Agreement or use of the Services.
b) ME24 Limited shall maintain records of each marketing consent, including the identity of the consenting person, date and time, method, wording, scope, and any withdrawal or opt-out.
c) Every marketing communication shall include a clear, easy-to-use, and free opt-out mechanism. ME24 Limited shall act on an opt-out without undue delay and shall not send further marketing communications to that recipient except as permitted by applicable law.
2.11 Testimonial and Brand Marketing Consent.
a) ME24 Limited shall not use any Coach’s testimonials, brand, business name, imagery, likeness, logos, or aggregated performance statistics in its marketing, promotional, or case study materials (including on the areela.com website, social media, press materials, and partner communications) without first obtaining the Coach’s express, informed, written consent (“Marketing Consent”).
b) Marketing Consent shall be: i) freely given, specific, informed, and unambiguous (in accordance with UK GDPR Article 7 where the material includes personal data); (ii) obtained via a clear, affirmative opt-in mechanism separate from the acceptance of this Agreement (i.e., not bundled with the general terms of service); (iii) recorded and retained by ME24 Limited for the duration of its use plus six (6) years; and (iv) withdrawable at any time by the Coach upon written notice to support@areela.com, after which ME24 Limited shall cease using the relevant materials within thirty (30) days of receiving the withdrawal notice.
c) Use of testimonials must comply with the Advertising Standards Authority CAP Code and the Competition and Markets Authority guidance on endorsements and reviews.
3. FEES AND PAYMENT
3.1 The Customer shall pay the Fees to the Provider in accordance with this Clause 3 and the Order Form. Fees are stated exclusive of value added tax (“VAT”), which shall be added at the prevailing rate where applicable and payable by the Customer in addition to the Fees.
3.2 Billing and Payment Terms:
a) Fees shall be invoiced and collected on a monthly or annual basis, as selected by the Customer in the Order Form.
b) Monthly subscriptions shall be billed in advance on each monthly anniversary of the Effective Date.
c) Annual subscriptions shall be billed in advance on the Effective Date and on each annual anniversary thereafter.
d) Add-on services (including white-label branding, Signature range features, and paid support services) shall be billed as set out in the Order Form.
3.3 Payment Processing. Fees are collected via:
a) Stripe, for web-based subscriptions and direct payments;
b) Apple In-App Purchase (IAP) and/or Google Play Billing, for subscriptions initiated through the Mobile App, managed via RevenueCat; and
c) such other payment methods as the Provider may make available from time to time. The Customer acknowledges that where Fees are collected via Apple IAP or Google Play Billing, the applicable app store terms, commission rates, and refund policies of Apple Inc. or Google LLC (as applicable) shall apply in addition to the terms of this Agreement.
3.4 Fee Changes. The Provider may increase the Fees at any time by giving the Customer not less than thirty (30) days’ prior written notice. Any increase shall take effect at the start of the next billing period following expiry of the notice period. If the Customer does not agree to any increase, the Customer may terminate this Agreement by giving written notice to the Provider before the increase takes effect, and in such case the termination shall be effective at the end of the then-current billing period.
3.5 Failed Payments and Suspension.
a) If any payment of Fees fails on the first attempt (whether due to an expired card, insufficient funds, or any other reason), the Provider reserves the right to immediately suspend access to the Platform for the Customer and all associated Contacts.
b) Following suspension under Clause 3.5a), the Provider shall use commercially reasonable efforts to collect the outstanding Fees for a period of thirty (30) days (the “Collection Period”). The Provider may re-attempt payment and/or request updated payment information during the Collection Period.
c) If the outstanding Fees remain unpaid at the end of the Collection Period, the Provider may terminate this Agreement immediately by giving written notice tothe Customer, and the provisions of Clause 4 (Term and Termination) shall apply.
d) During any period of suspension, the Customer’s data shall be retained in accordance with the retention schedule set out in Schedule 5 but shall not be accessible to the Customer or its Contacts.
3.6 Refunds.
a) Refund requests shall be handled in accordance with ME24 Limited’s Refund and Cancellation Policy, as published at areela.com/legal/subscription-services-agreement and as updated from time to time. For purchases made through an App Store, the applicable App Store refund rules in Clause 12.3 also apply.
b) Except where required by law or expressly stated in the Refund and Cancellation Policy, no refunds shall be available for any partial billing period following termination by the Customer.
c) For subscriptions purchased through Apple IAP or Google Play Billing, refund requests must be directed to the applicable app store in accordance with their respective refund policies. The Provider has no obligation to process refunds for app-store-billed subscriptions.
3.7 Discounts and Promotional Pricing. Any discounts, promotional pricing, or free trial periods offered by the Provider shall be subject to the specific terms communicated to the Customer at the time of the offer. Unless otherwise stated, discounts apply only to the Initial Term and the standard Fees shall apply upon renewal.
4. TERM AND TERMINATION
4.1 This Agreement shall commence on the Effective Date and shall continue for the Initial Term, unless terminated earlier in accordance with this Clause 4.
4.2 Minimum Terms. The minimum Subscription Term is:
a) thirty (30) days for monthly subscriptions; or
b) one (1) year for annual subscriptions, as selected by the Customer in the Order Form.
4.3 Auto-Renewal. Unless either Party gives the other written notice of non-renewal at least thirty (30) days before the end of the then-current Initial Term or Renewal Term (as applicable), this Agreement shall automatically renew for successive Renewal Terms of the same duration as the Initial Term, subject to the Fees then in effect.
4.4 Termination for Convenience. Either Party may terminate this Agreement:
a) by giving not less than three (3) days’ written notice to the other Party for monthly subscriptions; or
b) by giving not less than thirty (30) days’ written notice for annual subscriptions.
4.5 Termination for Cause. Either Party may terminate this Agreement immediately by giving written notice to the other Party if:
a) the other Party commits a material breach of this Agreement and, in the case of a breach capable of remedy, fails to remedy such breach within thirty (30) days of receiving written notice specifying the breach and requiring its remedy;
b) the other Party becomes insolvent, enters into administration, receivership, or liquidation, makes a voluntary arrangement with its creditors, has a receiver or administrative receiver appointed over any of its assets, ceases or threatens tocease to carry on business, or is subject to any analogous event or proceeding in any jurisdiction;
c) a Force Majeure Event affecting the other Party continues for a period of sixty (60) days or more; or
d) in the case of the Provider terminating, the Customer fails to pay any undisputed Fees when due and such failure continues for a period of thirty (30) days following the end of the Collection Period referred to in Clause 3.5.
4.6 Suspension. The Provider may suspend access to all or part of the Platform immediately without prior notice if:
a) the Provider reasonably believes that the Customer or any of its Authorised Users or Contacts has breached the acceptable use provisions of Clause 2.7;
b) the Provider is required to do so by a court order, regulatory authority, or law enforcement agency;
c) the Provider reasonably determines that continued access poses a security risk to the Platform or to other users of the Platform; or
d) payment of Fees has failed in accordance with Clause 3.5.
4.7 Consequences of Termination.
a) Upon termination or expiry of this Agreement for any reason, the Customer’s right to access and use the Platform shall cease immediately, subject to the grace period in Clause 4.7b).
b) The Provider shall provide the Customer with a fourteen (14) day grace period following the effective date of termination during which the Customer may continue to access the Platform in read-only mode for the sole purpose of exporting Customer Data in accordance with Clause 9.
c) Following expiry of the grace period in Clause 4.7b), the Provider shall delete or return the Customer Data in accordance with the retention and deletion schedule set out in Schedule 5 and Clause 9, save to the extent that the Provider is required by applicable law to retain any data, in which case the Provider shall isolate and protect such data and limit any further processing to that required by law.
d) The Provider shall retain financial records, invoices, and subscription records relating to the Customer for a period of seven (7) years following termination in accordance with applicable accounting and tax legislation.
e) Termination of this Agreement shall not affect any rights, remedies, obligations, or liabilities of the Parties that have accrued up to the date of termination, including the right to claim damages in respect of any breach of this Agreement which existed at or before the date of termination.
f) The following provisions shall survive termination or expiry of this Agreement: Clause 1 (Definitions and Interpretation), Clause 3 (Fees and Payment) to the extent of any outstanding payments, Clause 6 (Intellectual Property), Clause 7 (Data Protection), Clause 8 (Security), Clause 9 (Data Export and Offboarding), Clause 10 (Warranties and Liability), Clause 14 (Governing Law), and Clause 15 (General Provisions).
5. SERVICE LEVELS AND SUPPORT
5.1 Availability Target. The Provider shall use commercially reasonable efforts to make the Platform available with a target uptime of 99.9% measured on a calendar-month basis, excluding Scheduled Maintenance. The detailed service level terms are set out in Schedule 3 (Service Level Agreement).
5.2 Scheduled Maintenance. The Provider reserves the right to perform scheduled and unscheduled maintenance on the Platform at its discretion. The Provider shall use reasonable efforts to provide advance notice of any planned maintenance via the Platform’s status page or by email to the Customer’s registered email address, but shall not be liable for any downtime arising from maintenance activities.
5.3 Support Services. The Provider shall provide support to the Customer on a best-effort basis as follows:
a) Coach Support (for the Customer and its Authorised Users):
• Available Monday to Friday, 9:00 am to 8:00 pm United Kingdom time, excluding UK public holidays;
• Channels: knowledge base (help centre), WhatsApp messaging, email (support@areela.com), and live chat;
• One-to-one onboarding demonstrations available upon request; and
• Response times as set out in Schedule 3.
b) Contact Support (for Contacts of the Customer):
• Access to the Provider’s Help Centre (self-service knowledge base) only;
• No direct support from the Provider to Contacts; and
• Contacts requiring assistance beyond the Help Centre should direct enquiries to their Coach (the Customer or its Authorised User).
5.4 Paid Support Services. The Provider may offer additional paid support services from time to time, including priority support, dedicated account management, and custom training. Such services shall be specified in the Order Form and charged at the rates set out therein.
5.5 Exclusions. The Provider shall have no obligation to provide support in respect of:
a) issues arising from the Customer’s misuse of the Platform or failure to comply with the Documentation;
b) issues arising from third-party software, hardware, or services not provided by the Provider;
c) issues arising from modifications to the Platform not authorised by the Provider; or
d) issues caused by the Customer’s network, equipment, or internet connectivity.
6. INTELLECTUAL PROPERTY
6.1 Provider IP. The Customer acknowledges and agrees that the Provider and/or its licensors own all Intellectual Property Rights in and to the Platform, the Documentation, the AI Features, and all improvements, modifications, enhancements, and derivative works thereof. Nothing in this Agreement shall operate to transfer or assign any Intellectual Property Rights from the Provider to the Customer, except for the limited licence granted in Clause 2.6.
6.2 Third-Party Components. The Platform incorporates and/or integrates with the following third-party components and services:a) Terra API - wearable device data integration;
b) FatSecret API - food and nutrition database;
c) OpenAI, LLC (also known as OpenAI OpCo, LLC) - AI-powered content generation, programme suggestions, and coaching insights;
d) ElevenLabs - text-to-speech and voice generation;
e) Expo (React Native) - mobile application framework;
f) FontAwesome Pro - icon library; and
g) such other third-party components as the Provider may incorporate from time to time. The Customer’s use of such third-party components is subject to the applicable third-party licence terms, which the Provider shall make available upon request. The Provider shall maintain a software bill of materials (SBOM) identifying material third-party components and their applicable licence terms, and shall make such SBOM available to the Customer upon reasonable written request.
6.3 Open-Source Software. The Platform may incorporate Open-Source Software components. The Provider shall ensure that its use of OSS does not impose obligations on the Customer that are inconsistent with the terms of this Agreement. A list of material OSS components and their licences is available as part of the SBOM referred to in Clause 6.2.
6.4 Customer Content. The Customer retains all Intellectual Property Rights in and to:
a) all coaching programmes, workout templates, nutrition plans, and other content created by the Customer or its Authorised Users using the Platform;
b) all media files (including photographs, videos, and images) uploaded to the Platform by the Customer, its Authorised Users, or its Contacts;
c) all Customer Data; and
d) any trade marks, logos, and branding elements uploaded or used by the Customer on the Platform.
6.5 Licence to Provider. The Customer grants to the Provider a non-exclusive, perpetual, worldwide, royalty-free licence during the Subscription Term to use, reproduce, modify, display, and distribute the Customer Data solely to the extent necessary to provide the Services and perform the Provider’s obligations under this Agreement. This licence shall terminate upon expiry or termination of this Agreement, subject to the retention provisions in Schedule 5.
6.6 De-identified Data. The Provider may create de-identified, anonymised, and/or aggregated data derived from the Customer Data (“De-identified Data”), provided that such data does not identify and cannot reasonably be used to identify the Customer, any Authorised User, or any Contact. The Provider may use De-identified Data for:
a) improving and enhancing the Platform and the Services;
b) developing new features and products;
c) generating industry benchmarks and analytics; and
d) research and statistical purposes, provided that the Provider shall comply with all applicable Data Protection Laws in the creation and use of De-identified Data and shall not attempt to re-identify any De-identified Data.6.7 OpenAI Zero Data Retention. The Provider confirms that the Modified Retention Amendment between ME24 Limited (T/A Areela) and OpenAI OpCo, LLC dated 6 September 2026 is effective for the approved Org ID and correctly configured Projects. The Provider shall use Zero Data Retention (“ZDR”) for eligible API endpoints. For eligible endpoints, Customer Content is not logged for abuse monitoring or human review, is not retained beyond immediate processing, and is not used by OpenAI to train its models. OpenAI processing is performed through a United States processing location. ZDR does not apply to image or file Inputs, which may be retained by OpenAI for Safety Classification. If OpenAI suspends or revokes Modified Retention or ZDR, Clause 11.11 shall apply.
6.8 The Provider shall ensure that it transmits data to OpenAI only through API endpoints specified by OpenAI as eligible for ZDR at https://platform.openai.com/docs/guides/your-data and only through the approved Org ID and correctly configured Projects for which Modified Retention has been activated.
7. DATA PROTECTION
7.1 The Parties acknowledge that for the purposes of Data Protection Laws, in respect of the processing of Personal Data in connection with this Agreement:
a) the Customer is the Controller;
b) the Provider is the Processor;
c) the Contact is the data subject; and
d) the subject matter, duration, nature, and purpose of processing, the types of Personal Data, and the categories of data subjects are as set out in Schedule 2 (Data Processing Addendum).
7.2 The Parties agree that Schedule 2 (Data Processing Addendum) sets out the full terms governing the processing of Personal Data by the Provider on behalf of the Customer and forms an integral part of this Agreement.
7.3 Without prejudice to the generality of Schedule 2, the Provider shall:
a) process Personal Data only on the documented instructions of the Customer (which, for the avoidance of doubt, include the instructions set out in this Agreement and Schedule 2), unless required to do so by applicable law, in which case the Provider shall (to the extent permitted by law) inform the Customer of that legal requirement before processing;
b) ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
c) implement and maintain the technical and organisational security measures set out in Clause 8 and Schedule 2;
d) not engage another Processor (Sub-processor) without the prior specific or general written authorisation of the Customer, and in the case of general written authorisation, inform the Customer of any intended changes concerning the addition or replacement of Sub-processors, giving the Customer the opportunity to object to such changes in accordance with Schedule 2;
e) take into account the nature of the processing and assist the Customer by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer’s obligation to respond to requests for exercising the data subject’s rights under Data Protection Laws;f) assist the Customer in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the UK GDPR, taking into account the nature of processing and the information available to the Provider;
g) at the choice of the Customer, delete or return all Personal Data to the Customer after the end of the provision of Services and delete existing copies unless applicable law requires storage of the Personal Data, subject to the provisions of Clause 9 and Schedule 5;
h) make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the UK GDPR and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer; and
i) immediately inform the Customer if, in the Provider’s opinion, an instruction from the Customer infringes Data Protection Laws.
7.4 International Transfers. The Provider shall not transfer Personal Data to any country outside the United Kingdom unless the transfer is permitted under this Clause 7.4 and Schedule 2 (Data Processing Addendum). The Parties acknowledge that the Platform’s primary hosting region is eu-west-1 (London, United Kingdom), while OpenAI processing is performed through a United States processing location with the UK Data Residency/Processing Region enabled under the Modified Retention Amendment:
a) the transfer is to the United States of America in connection with OpenAI, LLC (also known as OpenAI OpCo, LLC) or another Sub-processor listed in Schedule 4 (Sub-processor List), and such transfer is made subject to the UK IDTA and, where EEA data subjects’ Personal Data is processed, the EU SCCs;
b) the transfer is to a country that has been designated as providing an adequate level of data protection by the UK Secretary of State under section 17A of the Data Protection Act 2018; or
c) for transfers to OpenAI, LLC (also known as OpenAI OpCo, LLC) in the United States, the Provider shall ensure that the OpenAI DPA or a standalone addendum includes the UK IDTA for UK Personal Data and the EU SCCs for Personal Data of EEA data subjects, in each case under the Data Protection Act 2018 and Regulation (EU) 2016/679, respectively;
d) the Customer has provided its prior written consent to the transfer and appropriate safeguards are in place.
7.5 Lawful Basis and Consent Records. The Customer is responsible for:
a) determining the lawful basis for each processing activity undertaken using the Platform;
b) obtaining and recording all necessary consents from Contacts where consent is relied upon as the lawful basis;
c) providing appropriate privacy notices to Contacts; and
d) maintaining records of processing activities as required by Article 30 of the UK GDPR. The Provider shall provide reasonable assistance to the Customer in maintaining consent records and processing activity records through the functionality of the Platform.
7.6 Data Protection Impact Assessment. Where a type of processing using the Platform is likely to result in a high risk to the rights and freedoms of data subjects, the Providershall provide reasonable assistance to the Customer in carrying out a data protection impact assessment (“DPIA”) and, where necessary, prior consultation with the relevant supervisory authority, taking into account the nature of the processing and the information available to the Provider.
7.7 Personal Data Breach Notification. The Provider shall:
a) notify the Customer without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data Breach affecting Customer Data;
b) provide the Customer with sufficient information to allow the Customer to meet its obligations to report the breach to the relevant supervisory authority under Article 33 of the UK GDPR and/or to affected data subjects under Article 34 of the UK GDPR; and
c) cooperate with the Customer and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of any Personal Data Breach.
7.8 Companion Documents and Cross-References. The Acceptable Use Policy as published at areela.com/legal/acceptable-use-policy and as updated from time to time, the AI Transparency and Use Policy as published at areela.com/legal/ai-transparency-and-use-policy and as updated from time to time, the Privacy Notices as published at areela.com/legal/privacy-policy-me24-limited-corporate and as updated from time to time, the Security Policy as published at areela.com/legal/security-and-incident-response-policy-customer-summary and as updated from time to time, and the Data Retention Policy as published at areela.com/legal/data-retention-policy and as updated from time to time are companion documents to the Agreement and this DPA. They shall be read consistently with the Agreement, this DPA, Schedule 4, and Schedule 5; in the event of conflict, the Agreement and this DPA prevail.
8. SECURITY
8.1 Technical and Organisational Measures. The Provider shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing Personal Data, having regard to the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. Such measures shall include, as a minimum:
a) encryption of Personal Data in transit using TLS 1.2 or higher;
b) encryption of Personal Data at rest using AES-256 or equivalent;
c) authentication via email-based one-time passcode (OTP) and biometric authentication (where supported by the end-user device);
d) encrypted backups with appropriate access controls;
e) logical separation of Customer Data from the data of other customers of the Provider;
f) role-based access controls for Provider personnel with access to Customer Data;
g) regular vulnerability scanning and security monitoring;
h) employee security training and confidentiality obligations; and
i) business continuity and disaster recovery arrangements.
8.2 Certifications and Audits.
a) The Provider shall use commercially reasonable efforts to obtain SOC 2 Type II certification within twelve (12) months of the Effective Date and shall maintain such certification (or an equivalent standard) thereafter.
b) The Provider shall commission an independent penetration test of the Platform at least once per calendar year and shall provide the Customer with an executive summary of the results upon reasonable written request.
c) The Provider shall maintain and make available upon request a summary of its information security policies, including access management, incident management, change management, and data classification policies.
8.3 Incident Response. The Provider shall maintain an incident response plan and shall:
a) classify security incidents by severity;
b) assign appropriate resources to investigate, contain, and remediate incidents;
c) notify the Customer of any security incident that affects or is reasonably likely to affect Customer Data in accordance with the timelines set out in Clause 7.7;
d) conduct a post-incident review and implement appropriate remedial measures.
8.4 GDPR Compliance. The security measures described in this Clause 8 are intended to fulfil the Provider’s obligations under Article 32 of the UK GDPR (security of processing). The Provider shall cooperate with the Customer in respect of any notifications required under Articles 33 (notification of a personal data breach to the supervisory authority) and 34 (communication of a personal data breach to the data subject) of the UK GDPR.
9. DATA EXPORT AND OFFBOARDING
9.1 Data Export Right. During the Subscription Term and for a period of fourteen (14) days following termination or expiry of this Agreement (the “Export Window”), the Customer shall have the right to export Customer Data from the Platform in accordance with this Clause 9.
9.2 Export Formats. The Provider shall make Customer Data available for export in the following formats:
a) structured data (client profiles, programmes, nutrition plans, measurements, check-ins) in CSV and/or JSON format;
b) media files (photographs, videos, documents) in their original uploaded format;
c) progress photographs in their original resolution and format; and
d) such other formats as the Provider may support from time to time.
9.3 Specific Data Categories. The following specific provisions apply to the export and retention of particular data categories:
a) Raw Wearable Data: Raw data received from wearable devices via the Terra API integration is processed in real time and is not stored by the Provider beyond the period necessary to display it in the Platform. The Customer acknowledges that raw wearable data may not be available for export and should be obtained from the relevant wearable device manufacturer or platform.
b) AI Conversations: Transcripts retained by the Provider are retained for the duration of the Subscription Term and may be exported during the Export Window, subject to Schedule 5. OpenAI processing under eligible ZDRendpoints is not retained beyond immediate processing; image and file Inputs are outside ZDR and may be retained for Safety Classification. The Provider shall not retain AI conversation data beyond the periods specified in Schedule 5.
c) Subscription and Billing Records: Financial records, invoices, and payment history shall be retained for seven (7) years following termination in accordance with applicable accounting and tax legislation and are not subject to deletion requests.
d) De-identified Deletion Records: Where Customer Data is deleted, the Provider may retain de-identified records of the deletion event (including a deletion timestamp and anonymised identifier) for audit and compliance purposes.
9.4 Subject to Clause 7.3, Schedule 5 (Data Retention Schedule), and the Data Retention Policy as published at areela.com/legal/data-retention-policy and as updated from time to time:
a) the Provider shall, following expiry of the Export Window and upon written request from the Customer, delete all Customer Data from the Provider’s live systems within thirty (30) days;
b) Customer Data in encrypted backups shall be purged in accordance with the backup rotation schedule, and in any event within ninety (90) days of the deletion of the corresponding live data; and
c) the Provider shall provide written confirmation of deletion to the Customer upon request.
9.5 Offboarding Assistance. Upon termination or expiry, the Provider shall provide reasonable assistance to the Customer in transitioning to an alternative service provider, including:
a) making Customer Data available for export in the formats described in Clause 9.2;
b) responding to reasonable queries regarding the format and structure of exported data; and
c) where agreed in the Order Form, providing paid transition assistance services at the Provider’s then-current rates.
10. WARRANTIES AND LIABILITY
10.1 Provider Warranties. The Provider warrants that:
a) it has the legal right and authority to enter into this Agreement and to perform its obligations hereunder;
b) the Platform will perform materially in accordance with the Documentation during the Subscription Term;
c) the Services will be provided with reasonable care and skill;
d) the Platform will not, at the time of provision, infringe the Intellectual Property Rights of any third party (subject to Clause 10.3); and
e) it will comply with all applicable laws and regulations in the performance of its obligations under this Agreement, including Data Protection Laws.
10.2 Customer Warranties. The Customer warrants that:a) it has the legal right and authority to enter into this Agreement and to perform its obligations hereunder;
b) it will use the Platform in accordance with this Agreement, the Documentation, and all applicable laws and regulations;
c) it has obtained all necessary consents, permissions, and authorisations from Contacts to enable the Provider to process Contact Data in accordance with this Agreement and Schedule 2; and
d) all Customer Data provided to the Provider is accurate, complete, and not misleading, and does not infringe the Intellectual Property Rights or other rights of any third party.
10.3 IP Indemnity.
a) The Provider shall defend, indemnify, and hold harmless the Customer and its directors, officers, employees, and agents from and against any losses, damages, costs, and expenses (including reasonable legal fees) arising out of or in connection with any claim brought by a third party alleging that the Customer’s use of the Platform in accordance with this Agreement infringes the Intellectual Property Rights of that third party (an “IP Claim”).
b) The Provider’s obligations under Clause 10.3a) shall not apply to the extent that the IP Claim arises from: i) the Customer’s modification of the Platform;
(ii) the Customer’s use of the Platform in combination with any product, service, or equipment not provided or approved by the Provider; (iii) the Customer’s use of the Platform other than in accordance with this Agreement and the Documentation; or (iv) the Customer Data.
c) If the Platform becomes, or in the Provider’s reasonable opinion is likely to become, the subject of an IP Claim, the Provider may at its option and expense:
i) procure for the Customer the right to continue using the Platform; (ii) modify the Platform so that it is no longer infringing, provided that such modification does not materially reduce the functionality of the Platform; or (iii) if neither i) nor (ii) is commercially practicable, terminate this Agreement upon thirty (30) days’ written notice and refund to the Customer a pro rata portion of any pre- paid Fees for the remainder of the then-current Subscription Term.
10.4 Exclusion of Implied Warranties. Except as expressly set out in this Agreement:
a) all warranties, conditions, terms, representations, and undertakings, whether express or implied, statutory or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, satisfactory quality, and non- infringement, are hereby excluded to the fullest extent permitted by applicable law; and
b) the Provider does not warrant that the Platform will be uninterrupted, error-free, or free of viruses or other harmful components, or that defects will be corrected.
10.5 Limitation of Liability.
a) Subject to Clauses 10.5c) and 10.5d), the Provider’s total aggregate liability to the Customer under or in connection with this Agreement (whether in contract, tort (including negligence), breach of statutory duty, or otherwise) shall not exceed an amount equal to the total Fees paid and payable by the Customer in the twelve (12) month period immediately preceding the date on which the claim arose.
b) Subject to Clauses 10.5c) and 10.5d), the Customer’s total aggregate liability to the Provider under or in connection with this Agreement (whether in contract, tort (including negligence), breach of statutory duty, or otherwise) shall notexceed an amount equal to the total Fees paid and payable by the Customer in the twelve (12) month period immediately preceding the date on which the claim arose.
c) Nothing in this Agreement shall exclude or limit either Party’s liability for:
i) death or personal injury caused by that Party’s negligence;
(ii) fraud or fraudulent misrepresentation;
(iii) wilful default or wilful misconduct; or
(iv) any liability which cannot be excluded or limited by applicable law.
d) Subject to Clause 10.5c), neither Party shall be liable to the other Party under or in connection with this Agreement for any:
i) loss of profits;
(ii) loss of revenue;
(iii) loss of business or contracts;
(iv) loss of anticipated savings;
v) loss of or damage to goodwill;
(vi) loss of or corruption to data (other than as a direct result of a breach of the Provider’s obligations under Clauses 7 or 8); or
(vii) any indirect, special, incidental, consequential, or punitive damages, in each case whether arising in contract, tort (including negligence), breach of statutory duty, or otherwise, and whether or not such loss or damage was foreseeable or the Party had been advised of the possibility of such loss or damage.
10.6 Mitigation. Each Party shall take all reasonable steps to mitigate any loss or damage suffered by it in connection with any claim under this Agreement.
10.7 No Liability for Third-Party Services. The Provider shall have no liability for any loss or damage arising from the Customer’s use of third-party services that integrate with the Platform (including, without limitation, Terra, FatSecret, Apple Health, Fitbit, Garmin, WHOOP, Oura, Stripe, and any app store), and the Customer’s use of such services is at the Customer’s own risk and subject to the applicable third-party terms.
11. AI FEATURES
11.1 Description of AI Features. The Platform incorporates AI Features and other technologies. The AI Features include, without limitation:
a) AI-powered programme generation and exercise suggestions;
b) AI-assisted nutrition plan creation and food logging analysis;
c) automated check-in analysis and progress insights;
d) AI-generated coaching recommendations and conversation summaries;
e) natural language chat interface for coaches and contacts;
f) text-to-speech audio generation; and
g) such other AI-powered features as the Provider may introduce from time to time.
11.2 Limitations and Disclaimers.
a) The AI Features are beta features and are labelled with the notice: “Areela is beta AI and can make mistakes”. AI-generated content may be inaccurate, incomplete, or inappropriate and must be reviewed by a qualified human professional before it is relied upon or communicated to Contacts, with the specific human oversight requirements for critical health-related suggestions in Clause 11.5.
b) The AI Features, including any fitness, nutrition, health-related plans, scores, nudges, insights, or recommendations, do not constitute and shall not be construed as medical advice, diagnosis, treatment, or any other healthcare service. The Customer shall not use or permit the AI Features to replace professional medical advice.
c) The Provider makes no representation or warranty as to the accuracy, reliability, completeness, or fitness for purpose of any content generated by the AI Features.
d) The Customer is solely responsible for reviewing, validating, and approving any AI-generated content before it is used in connection with coaching services provided to Contacts.
11.3 Reasoning and Transparency. The Provider shall provide transparent information about the AI Features, including:
a) a description of the purpose and intended use of each AI Feature in the Documentation;
b) clear labelling of all AI-generated content within the Platform;
c) information about the AI models and technologies used (at a level sufficient for the Customer to understand the general nature of the processing); and
d) known limitations, potential biases, and risks associated with the AI Features.
11.4 Guardrails. The Provider shall implement and maintain appropriate guardrails to:
a) prevent the AI Features from generating harmful, misleading, or dangerous content;
b) detect and filter inappropriate content inputs and outputs;
c) limit the AI Features to their intended domain of fitness and nutrition coaching; and
d) ensure that the AI Features do not generate content that could reasonably be construed as medical advice.
11.5 Human Oversight. The Parties acknowledge that the Provider does not provide human-in-the-loop review for general AI processing, but critical health-related suggestions must be subject to human oversight as set out below:
a) General AI-generated outputs may be delivered directly to the requesting user without prior review by the Provider. The Provider shall configure critical health- related suggestions to be flagged for review by a qualified human Coach before they are communicated to or relied upon by a Contact, to the extent technically practicable.
b) the Customer (and its Authorised Users in their capacity as Coaches) assumes the role of human oversight for all AI-generated content before it is communicated to or relied upon by Contacts; andc) the Provider retains the ability to monitor, audit, and adjust the AI Features and their guardrails at any time.
11.6 Data Usage for AI.
a) The Provider confirms that, pursuant to the Modified Retention Amendment, OpenAI will not use Platform data submitted as Customer Content to develop or improve its models. For eligible API endpoints, ZDR means that Customer Content is not logged for abuse monitoring or human review and is not retained beyond the immediate processing task. Image and file Inputs are excluded from ZDR and may be retained by OpenAI for automated Safety Classification.
b) OpenAI natural language processing is performed through a United States processing location. The Provider shall use the Modified Retention/ZDR arrangement described in Clause 6.7 and comply with the eligible endpoint, approved Org ID, Project configuration, and customer use requirements described in Clause 11.8. Any suspension or revocation of Modified Retention or ZDR shall be handled under Clause 11.11.
c) ElevenLabs text-to-speech processing is performed using the Provider’s API key and receives AI-generated reply text only. ElevenLabs retains data under its own privacy policy and terms; the Provider shall not represent that ElevenLabs retains no data beyond the time necessary to generate the audio output.
d) The Provider warrants that it shall comply with all applicable requirements of the OpenAI Usage Policies (as amended from time to time) in its use of AI Features within the Platform, including without limitation the prohibition on automation of high-stakes decisions in medical and other sensitive areas without appropriate human review.
11.7 EU AI Act Deployer Obligations. To the extent that the AI Features constitute an “AI system” within the meaning of the EU AI Act:
a) the Customer, as a deployer of the AI system, shall comply with its obligations under the EU AI Act, including ensuring appropriate human oversight and informing Contacts that they are interacting with AI-generated content;
b) the Provider shall cooperate with the Customer and provide such information and assistance as is reasonably necessary for the Customer to fulfil its deployer obligations; and
c) the Provider shall, upon request, provide the Customer with documentation regarding the AI Features sufficient to enable the Customer to conduct a conformity assessment or fundamental rights impact assessment, if required.
11.8 OpenAI Modified Retention Customer Use Requirements.
In using Modified Retention Services, the Provider shall:
a) restrict any AI chat or conversation feature by topic or ground responses in trusted documents or files, and shall not provide general-purpose unrestricted chat; the Provider’s guardrails shall deflect off-topic questions and redirect users toward health, fitness, and the relevant programme;
b) ensure that all Contacts and Authorised Users who generate natural language input for OpenAI are authenticated using email OTP verification and biometric scanning, where supported by the device;
c) implement moderation using OpenAI’s ModAPI or alternative moderation tooling; the Provider’s guardrails shall review generated and refusal text for inappropriate content and rewrite it before display;
d) notify OpenAI and discuss in good faith if the Provider detects notable spikes in high-severity abuse;
e) not use Modified Retention Services to: i) provide unrestricted general- purpose chat; (ii) provide unauthenticated access to Contacts or other external users who are not the Provider’s employees, agents, or contractors; (iii) generate code that can be deployed without human review; (iv) convert one programming language to another; v) generate doc strings for functions; (vi) convert natural language to SQL; or (vii) operate as a Routing Platform.
11.9 Image and File Inputs. Modified Retention and ZDR do not apply to image or file Inputs, including progress photographs uploaded by Contacts. Images and files transmitted to OpenAI may be retained by OpenAI as part of Safety Classification as specified at https://platform.openai.com/docs/guides/your-data. Where external users may upload image Inputs, the Provider shall limit them to low-risk and/or topical documents and impose appropriate technical or contractual limits on image and file uploads transmitted to OpenAI. The Provider shall describe this exception in the Privacy Notices as published at areela.com/legal/privacy-policy-me24-limited-corporate and as updated from time to time and the AI Transparency and Use Policy as published at areela.com/legal/ai-transparency-and-use-policy and as updated from time to time, and shall provide appropriate transparency notices to affected users.
11.10 Third-Party Policy Version Control. ME24 Limited shall maintain a dated record of the current version and URL of every hyperlinked third-party policy that governs or affects the Services or the processing, retention, transfer, or use of Customer Data, including OpenAI’s Data Processing Addendum, Usage Policies, Business Terms, and your Data documentation and the policies of each Sub-processor. ME24 Limited shall review those policies at least quarterly and shall notify the Customer and affected Coaches within thirty (30) days after becoming aware of any material change affecting data processing, retention, international transfers, or AI use.
11.11 OpenAI Modified Retention Suspension or Revocation. If OpenAI suspends or revokes Modified Retention or ZDR, or if the Provider becomes aware that Customer Content is being retained or logged by OpenAI in a manner inconsistent with ZDR (a “Non-ZDR Event”), the following provisions apply:
a) ME24 Limited shall notify the Customer and affected Coaches in writing within forty-eight (48) hours after becoming aware of the suspension, revocation, retention, or logging, identifying the affected AI Features, data categories, and expected duration.
b) ME24 Limited shall take reasonable steps to mitigate the Non-ZDR Event, including suspending the affected AI Features, preventing further transmission of affected Customer Data, or switching to an alternative provider or non-AI workflow.
c) ME24 Limited shall not be liable for OpenAI’s unilateral suspension, revocation, retention, or logging actions, except to the extent caused by ME24 Limited’s breach of this Agreement. ME24 Limited shall nevertheless use reasonable endeavours to restore ZDR or Modified Retention or provide an alternative provider or functionality.
d) The Customer and each affected Coach may suspend use of the affected AI Features during any period in which ZDR or Modified Retention is not in effect, without being in breach of this Agreement, incurring a penalty, or losing access to non-AI Services.
e) ME24 Limited shall maintain a continuity and exit plan for a Non-ZDR Event, including continued access to non-AI Services, export of Customer Data and AI conversation transcripts, disabling affected endpoints, and migration to an alternative provider or non-AI workflow.
f) Before resuming affected AI processing, ME24 Limited shall confirm the applicable retention position, update Schedule 4, Schedule 5, and the Privacy Notices and AI Transparency and Use Policy as published at areela.com/legal/privacy-policy-me24-limited-corporate and areela.com/legal/ai-transparency-and-use-policy and as updated from time to time, and ensure that the applicable transfer safeguard and customer notices are in place.
g) If a Non-ZDR Event continues for a period of thirty (30) or more continuous days, the Customer may terminate this Agreement (or, at its election, only the AI Features portion of the Services) by giving written notice to ME24 Limited, such termination to take effect immediately upon receipt. Upon any such termination: i) no early-termination fee or penalty shall apply; and (ii) the provisions of Clause 4.7 (Consequences of Termination) shall apply.
12. APP STORE PROVISIONS
12.1 The Customer acknowledges that the Mobile App is distributed through the Apple App Store and the Google Play Store (each an “App Store”) and that the Customer’s and Contacts’ use of the Mobile App is subject to:
a) this Agreement;
b) the applicable App Store terms of service and usage rules; and
c) any additional terms required by the applicable App Store operator.
12.2 In-App Purchase Billing. Where the Customer or a Contact subscribes to the Services or purchases add-ons through an App Store’s in-app purchase mechanism:
a) billing and payment processing shall be handled by the applicable App Store operator (Apple Inc. or Google LLC);
b) the applicable App Store’s payment terms, including commission rates and billing practices, shall apply;
c) the Provider uses RevenueCat to manage and reconcile in-app purchase subscriptions across platforms; and
d) the Customer acknowledges that the Provider has no control over the App Store’s billing practices and the Provider shall not be liable for any billing errors, overcharges, or payment processing failures caused by the App Store operator.
12.3 App Store Refunds. For subscriptions and purchases made through an App Store:
a) refund requests must be directed to the applicable App Store operator in accordance with its refund policy;
b) the Provider has no obligation to process refunds for App Store purchases and has limited ability to do so;
c) the Provider shall, where reasonably practicable, provide information to assist the Customer in seeking a refund from the App Store operator; and
d) any refund granted by an App Store operator shall be subject to that operator’s terms and policies.
12.4 App Store Terms. To the extent required by the applicable App Store operator, the Customer acknowledges and agrees that:
a) the App Store operator is not a party to this Agreement and has no obligations or liability under this Agreement;
b) the Provider, not the App Store operator, is solely responsible for the Mobile App and the content and services provided through it;c) the App Store operator has no obligation to furnish any maintenance or support services with respect to the Mobile App;
d) in the event of any failure of the Mobile App to conform to any applicable warranty, the Customer may notify the App Store operator, and the App Store operator may refund the purchase price (if any) to the Customer, but to the maximum extent permitted by law the App Store operator has no other warranty obligation with respect to the Mobile App; and
e) the App Store operator and its subsidiaries are third-party beneficiaries of this Clause 12, and upon acceptance of this Agreement, the App Store operator will have the right to enforce this Clause 12 against the Customer as a third- party beneficiary.
13. INTERNATIONAL PRIVACY PROVISIONS
13.1 This Clause 13 sets out supplemental provisions that apply to the extent that Personal Data processed under this Agreement is subject to the data protection laws of the jurisdictions set out below. These provisions are in addition to, and do not derogate from, the data protection obligations set out in Clause 7 and Schedule 2.
13.2 United States - CCPA/CPRA Supplemental Provisions. To the extent that the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the “CCPA”), applies to the processing of Personal Data under this Agreement:
a) the Provider is a “Service Provider” (as defined in the CCPA) with respect to Personal Data it processes on behalf of the Customer;
b) the Provider shall not sell or share (as those terms are defined in the CCPA) any Personal Data received from the Customer;
c) the Provider shall not retain, use, or disclose Personal Data for any purpose other than the business purposes specified in this Agreement, and shall not retain, use, or disclose Personal Data outside of the direct business relationship between the Provider and the Customer;
d) the Provider shall not combine Personal Data received from the Customer with Personal Data received from other sources except as permitted by the CCPA;
e) the Provider grants the Customer the right to take reasonable and appropriate steps to ensure that the Provider uses Personal Data in a manner consistent with the Customer’s obligations under the CCPA; and
f) the Provider shall notify the Customer if it determines that it can no longer meet its obligations under the CCPA and, in such event, the Customer shall have the right to take reasonable and appropriate steps to stop and remediate any unauthorised use of Personal Data.
13.3 HIPAA Exclusion. The Platform and Services expressly exclude any use subject to the United States Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”). The Platform is not intended for use by a covered entity or business associate as defined under HIPAA, and the Provider does not provide a HIPAA business associate agreement. The Platform does not create, receive, maintain, or transmit protected health information (“PHI”) as defined under HIPAA. The Customer shall not submit PHI to, or use the Platform for, any HIPAA- covered activity. The Provider makes no representation or warranty regarding HIPAAcompliance and shall have no liability arising from any prohibited use. If any HIPAA- adjacent use is anticipated, the Customer should first engage qualified US health law counsel.
13.4 European Union / European Economic Area. To the extent that the EU GDPR applies to the processing of Personal Data under this Agreement:
a) references in Clause 7 and Schedule 2 to the UK GDPR shall be read as including corresponding references to the EU GDPR;
b) the Parties shall enter into the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) to the extent required for transfers of Personal Data from the EU/EEA to a country not subject to an adequacy decision; and
c) the Provider shall appoint an EU representative under Article 27 of the EU GDPR if required.
13.5 Australia. To the extent that the Privacy Act 1988 (Cth) (the “Australian Privacy Act”) applies to the processing of Personal Data under this Agreement:
a) the Provider shall comply with the Australian Privacy Principles (APPs) to the extent applicable to its role as a service provider;
b) the Provider shall take reasonable steps to ensure that any disclosure of Personal Data outside Australia is made in compliance with APP 8; and
c) the Provider shall notify the Customer of any eligible data breach (as defined in the Notifiable Data Breaches scheme under Part IIIC of the Australian Privacy Act) within the timeframes specified in Clause 7.7.
13.6 New Zealand. To the extent that the Privacy Act 2020 (NZ) applies to the processing of Personal Data under this Agreement, the Provider shall comply with the Information Privacy Principles set out in that Act to the extent applicable to its role as a service provider.
13.7 Canada. To the extent that the Personal Information Protection and Electronic Documents Act (“PIPEDA”) or substantially similar provincial legislation applies to the processing of Personal Data under this Agreement:
a) the Provider shall process Personal Data only for the purposes identified in this Agreement;
b) the Provider shall implement safeguards appropriate to the sensitivity of the Personal Data; and
c) the Provider shall, upon request, provide the Customer with information regarding the Provider’s policies and practices for the management of Personal Data, including the name and contact details of a person accountable for the Provider’s compliance.
13.8 Singapore. To the extent that the Personal Data Protection Act 2012 (“PDPA”) of Singapore applies to the processing of Personal Data under this Agreement, the Provider shall comply with its obligations under the PDPA, including the obligation to make reasonable security arrangements to protect Personal Data and the obligation to notify the Personal Data Protection Commission and affected individuals in the event of a data breach in accordance with Part VIA of the PDPA.
13.9 Japan. To the extent that the Act on the Protection of Personal Information (“APPI”) of Japan applies to the processing of Personal Data under this Agreement, the Provider shall comply with its obligations under the APPI, including obtaining appropriate consents for cross-border transfers and implementing appropriate measures for the safe management of Personal Data.
14. GOVERNING LAW AND DISPUTE RESOLUTION
14.1 This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the law of England and Wales.
14.2 Each Party irrevocably agrees that, where the Customer is acting in the course of a business, the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Agreement or its subject matter or formation (including non-contractual disputes or claims.
14.3 Notices.
a) Any notice required or permitted to be given under this Agreement shall be in writing and shall be delivered by email, by hand, or by first-class post (or equivalent).
b) Notices to the Provider shall be sent to: support@areela.com. In the event that no response is received within five (5) Business Days, the Customer may escalate the notice to the directors of ME24 Limited at the Provider’s registered office address.
c) Notices to the Customer shall be sent to the email address provided in the Order Form.
d) A notice shall be deemed received: i) if delivered by email, at the time of transmission (provided no bounce-back or error notification is received); (ii) if delivered by hand, at the time of delivery; or (iii) if sent by first-class post, on the second Business Day after posting.
14.4 Company Details. Provider: ME24 Limited, Company No. 16701491, ICO Registration No. ZC069669 Registered Office: Springfield House, Springfield Road, Horsham, England, RH12 2RG
Email: support@areela.com
15. GENERAL PROVISIONS
15.1 Entire Agreement. This Agreement (including the Schedules and any Order Form) constitutes the entire agreement between the Parties and supersedes all prior negotiations, representations, warranties, undertakings, and agreements (whether written or oral) between the Parties relating to its subject matter.
15.2 Variation and Service Changes. No variation of this Agreement shall be effective unless it is in writing and signed by (or on behalf of) each of the Parties. The Provider may update this Agreement and may modify, deprecate, or discontinue aspects of the Services, provided that: a) the Provider gives the Customer at least thirty (30) days’ prior written notice of any material change to the Services and at least ninety (90) days’ prior written notice of any change affecting the core functionality of the Services; b) no change reduces the Services below the functionality, features, and level of performance reasonably expected by the Customer at the time of subscription; and c) if the Customer does not accept a material change, the Customer may terminate this Agreement without penalty by giving written notice before the change takes effect, withtermination effective on the change date and a pro rata refund of any prepaid Fees for the period after termination. Continued use after the applicable notice period constitutes acceptance of the updated terms only where the Customer has not exercised that termination right.
15.3 Waiver. No failure or delay by a Party to exercise any right or remedy provided under this Agreement or by law shall constitute a waiver of that or any other right or remedy, nor shall it prevent or restrict the further exercise of that or any other right or remedy. No single or partial exercise of such right or remedy shall prevent or restrict the further exercise of that or any other right or remedy.
15.4 Severability. If any provision or part-provision of this Agreement is or becomes invalid, illegal, or unenforceable, it shall be deemed deleted, but that shall not affect the validity and enforceability of the rest of this Agreement. If any provision or part-provision of this Agreement is deemed deleted under this Clause 15.4, the Parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
15.5 Third-Party Rights. Except as expressly provided in Clause 12 (App Store Provisions), a person who is not a Party to this Agreement shall not have any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.
15.6 Assignment.
a) The Customer shall not assign, transfer, mortgage, charge, subcontract, declare a trust over, or deal in any other manner with any of its rights or obligations under this Agreement without the prior written consent of the Provider (such consent not to be unreasonably withheld or delayed).
b) The Provider may assign, transfer, or subcontract its rights and obligations under this Agreement without the Customer’s consent, provided that the Provider gives the Customer not less than thirty (30) days’ prior written notice and the assignee or transferee agrees to be bound by the terms of this Agreement.
15.7 Confidentiality.
a) Each Party (the “Receiving Party”) shall keep confidential all Confidential Information of the other Party (the “Disclosing Party”) and shall not use or disclose the Disclosing Party’s Confidential Information except: i) to the extent necessary to perform its obligations under this Agreement; (ii) to its employees, officers, contractors, advisers, and (in the case of the Provider) Sub-processors who need to know such information for the purposes of this Agreement and who are bound by obligations of confidentiality no less onerous than those set out in this Clause 15.7; or (iii) as required by law, regulation, court order, or any governmental or regulatory authority.
b) The obligations of confidentiality in this Clause 15.7 shall not apply to information that: i) is or becomes publicly available other than through a breach of this Agreement; (ii) was already known to the Receiving Party before disclosure by the Disclosing Party; (iii) is received from a third party who is not under an obligation of confidentiality; or (iv) is independently developed by the Receiving Party without reference to the Disclosing Party’s Confidential Information.
c) The obligations of confidentiality in this Clause 15.7 shall continue for a period of three (3) years after the termination or expiry of this Agreement.
15.8 Force Majeure. Neither Party shall be in breach of this Agreement or otherwise liable to the other Party for any failure or delay in performing its obligations under thisAgreement (other than an obligation to pay Fees) to the extent that such failure or delay is caused by a Force Majeure Event. A Party whose performance is affected by a Force Majeure Event shall: a) promptly notify the other Party of the Force Majeure Event and its expected duration; b) use all reasonable endeavours to mitigate the effect of the Force Majeure Event; and c) resume performance of its obligations as soon as reasonably practicable after the Force Majeure Event ceases. If the Force Majeure Event continues for a period of sixty (60) days or more, either Party may terminate this Agreement by giving thirty (30) days’ written notice to the other Party.
15.9 This Agreement does not require signature by either Party. The Customer accepts this Agreement by clicking the Click to Accept Button as part of the Provider’s online registration and subscription process. By clicking the Click to Accept Button, the Customer confirms that it has read and agrees to be bound by this Agreement. Where the Customer is an entity and the individual clicking the Click to Accept Button does so on its behalf, that individual confirms that they are authorised to enter into this Agreement on behalf of and bind the Customer. This Agreement is formed and becomes binding on the Customer and the Provider when the Customer clicks the Click to Accept Button, and that date shall be the Effective Date.
SCHEDULE 1: SERVICE DESCRIPTION
1. OVERVIEW
1.1 The “Areela” fitness coaching platform (the “Platform”) is a software-as-a-service solution designed for fitness coaching professionals. The Platform enables Coaches to manage client relationships, design and deliver training and nutrition programmes, track progress, and communicate with their Contacts through a unified digital environment.
2. PLATFORM COMPONENTS
2.1 Web Application. The Platform’s web application is accessible at app.areela.com and provides the primary interface for Coaches to manage their coaching business, including client management, programme design, nutrition planning, analytics, and billing.
2.2 Mobile Application. The “Areela for Coach” mobile application is available on Apple iOS and Google Android and provides Contacts with access to their assigned programmes, nutrition plans, progress tracking, messaging, and AI features. Coaches may also access certain management features via the mobile app.
3. CORE FEATURES
3.1 Coach and Contact Management:
a) Client profiles and onboarding questionnaires
b) Contact tagging and segmentation
c) Client status management (active, paused, archived)
d) Multi-coach support (where applicable per subscription tier)
3.2 Programme and Workout Builder:
a) Exercise library with video demonstrations
b) Custom programme templates
c) Workout scheduling and periodisation
d) Progressive overload tracking
e) AI-powered programme generation
3.3 Nutrition Planning:
a) Macro and calorie target setting
b) Food diary and meal logging (FatSecret integration)
c) AI-assisted nutrition plan creation
d) Recipe database
3.4 Wearable Device Integration:
a) Integration with wearable devices via Terra API
b) Supported devices: Apple Health, Fitbit, Garmin, WHOOP, Oura, and others as supported by Terra
c) Real-time syncing of activity, sleep, heart rate, and other biometric data
3.5 Progress Tracking:
a) Body measurements and weight tracking
b) Progress photographs with comparison tools
c) Check-in forms and automated analysis
d) Habit tracking
e) AI-generated progress insights
3.6 Communication:
a) In-app messaging between Coach and Contact
b) Push notifications
c) AI chat interface
3.7 Billing and Payments:
a) Stripe integration for web payments
b) Apple IAP and Google Play Billing via RevenueCat
c) Subscription management and invoicing
3.8 Reporting and Analytics:
a) Coach dashboard with key metrics
b) Client progress reports
c) Revenue and subscription analytics
4. AUTHENTICATION
4.1 Email-based one-time passcode (OTP) authentication.
4.2 Biometric authentication (Face ID / fingerprint) on supported mobile devices.
4.3 No traditional username/password login.
5. INTEGRATIONS
5.1 Terra API (wearable device data)
5.2 FatSecret API (food and nutrition database)
5.3 OpenAI, LLC (also known as OpenAI OpCo, LLC) (AI features)
5.4 ElevenLabs (text-to-speech; https://elevenlabs.io/privacy-policy, section 6.4)
5.5 Stripe (payment processing)
5.6 RevenueCat (in-app purchase management)
5.7 Apple App Store and Google Play Store (distribution)
6. ADD-ON SERVICES
6.1 White-label branding customisation.
6.2 “Signature” range premium customisation features.
6.3 Paid priority support and dedicated account management.
6.4 Custom onboarding and training sessions.
SCHEDULE 2: DATA PROCESSING ADDENDUM
1. SCOPE AND APPLICATION
1.1 This Data Processing Addendum (“DPA”) forms part of the Agreement and sets out the terms on which the Provider (as Processor) shall process Personal Data on behalf of the Customer (as Controller) in connection with the Services. The companion documents and cross-references described in Clause 7.8 of the Agreement apply to this DPA and shall be read consistently with it.
1.2 This DPA supplements and is subject to the terms of the Agreement. In the event of any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of the conflict in relation to data processing matters.
1.3 Capitalised terms used in this DPA but not defined herein shall have the meanings given to them in the Agreement.
2. DETAILS OF PROCESSING
2.1 Subject Matter and Duration: The processing of Personal Data by the Provider in connection with the provision of the Services for the duration of the Subscription Term, plus any post-termination retention period specified in Schedule 5.
2.2 Nature and Purpose of Processing: The Provider processes Personal Data for the purpose of providing the Services, including hosting and making the Platform available, processing user interactions, generating AI-powered content, facilitating communications, processing payments, and providing support.
2.3 Types of Personal Data Processed:
a) Identity data: name, email address, date of birth, gender, profile photographs
b) Contact data: email address, phone number
c) Health and fitness data: height, weight, body measurements, body fat percentage, medical conditions and injuries (as disclosed by Contacts), fitness goals and experience level
d) Nutrition data: dietary preferences, allergies, food diary entries, calorie and macro intake
e) Biometric data: heart rate, sleep data, step count, activity data, HRV, SpO2, and other metrics from wearable devices
f) Progress data: progress photographs, check-in responses, habit tracking data, workout logs
g) Communication data: in-app messages, AI chat transcripts
h) Financial data: payment card details (tokenised via Stripe), subscription history, invoices
i) Technical data: device type, operating system, IP address, app version, usage analytics
j) AI interaction data: prompts, outputs, and conversation history with AI Features
2.4 Categories of Data Subjects:
a) Customers (Coaches): business users who subscribe to the Platform
b) Contacts (Clients): end-user individuals who use the Platform through their Coach’s subscription
c) Authorised Users: employees and agents of the Customer
3. PROCESSING INSTRUCTIONS
3.1 The Customer instructs the Provider to process Personal Data as necessary to provide the Services in accordance with the Agreement, including:
a) hosting and storing Customer Data on the Platform;b) processing user authentication and access management;
c) facilitating the creation and delivery of coaching programmes, nutrition plans, and related content;
d) processing wearable device data received via the Terra API;
e) transmitting prompts and receiving responses from OpenAI for AI Features;
f) generating text-to-speech audio via ElevenLabs;
g) processing payments and managing subscriptions;
h) sending notifications and facilitating in-app communications;
i) generating analytics and reports;
j) providing support services; and
k) any other processing reasonably necessary to perform the Provider’s obligations under the Agreement.
4. SECURITY MEASURES
4.1 The Provider shall implement and maintain the technical and organisational measures described in Clause 8 of the Agreement, including as a minimum:
a) TLS 1.2+ encryption in transit
b) AES-256 encryption at rest
c) OTP and biometric authentication
d) Encrypted backups
e) Logical data separation in multi-tenant environment
f) Role-based access controls
g) Security monitoring and vulnerability scanning
h) Employee security training and confidentiality obligations
i) Business continuity and disaster recovery arrangements
5. SUB-PROCESSORS
5.1 The Customer provides general written authorisation for the Provider to engage the Sub-processors listed in Schedule 4 (Sub-processor List).
5.2 The Provider shall:
a) notify the Customer by email of any intended addition or replacement of a Sub- processor at least thirty (30) days before the change takes effect;
b) provide the Customer with the opportunity to object to any such change on reasonable grounds related to data protection; and
c) if the Customer objects and the Provider cannot reasonably accommodate the objection, either Party may terminate this Agreement upon thirty (30) days’ written notice.
5.3 Where any Sub-processor’s terms are incorporated by reference to a URL, the Provider shall: i) maintain a dated record of the version of such terms in effect at the date of this Agreement; (ii) monitor such terms for material changes at least quarterly; and (iii) notify the Customer within thirty (30) days of becoming aware of any material change that adversely affects the processing of Customer Data. If a material adverse change occurs, the Customer may object in accordance with the Sub-processor objection procedure set out in this Schedule.
6. INTERNATIONAL TRANSFERS
6.1 Personal Data may be transferred to the United States of America in connection with the Sub-processors identified in Schedule 4. OpenAI, LLC (also known as OpenAI OpCo, LLC) is the OpenAI Sub-processor for the AI Features and processes data through a United States processing location. The Modified Retention Amendment addresses retention and logging only and does not itself provide an international transfer mechanism.
6.2 All transfers of Personal Data outside the United Kingdom, including transfers to OpenAI in the United States, shall be made subject to an appropriate transfer mechanism under Schedule 2 before the relevant processing begins.
a) For UK Personal Data, the transfer mechanism shall be the UK International Data Transfer Agreement (“UK IDTA”) or, where appropriate, the EU Standard Contractual Clauses (“EU SCCs”) as supplemented by the UK Addendum, in each case as required by the UK GDPR and the Data Protection Act 2018.
b) For Personal Data of EEA data subjects, the EU SCCs shall apply where required under Regulation (EU) 2016/679, unless the transfer is covered by an adequacy decision.
6.3 The applicable transfer mechanism for OpenAI shall be identified in the OpenAI Enterprise Agreement or OpenAI DPA before the relevant Personal Data is transferred. If those documents do not include adequate UK IDTA, UK Addendum, or EU SCC provisions, the Provider shall execute the appropriate standalone addendum with OpenAI before the transfer.
6.4 Where the Provider engages an AI service provider as a Sub-processor that processes Customer Data outside the United Kingdom, the Provider shall ensure that the applicable transfer safeguard is documented before processing begins and is reflected in the relevant DPA, Schedule 4, the Privacy Notices as published at areela.com/legal/privacy-policy and as updated from time to time, and any applicable transfer addendum.
7. LAWFUL BASES
7.1 The Customer is responsible for determining the lawful basis for each processing activity. The primary lawful bases anticipated by the Parties are: • Legitimate interests (Article 6(1)f) UK GDPR): for general platform operation and analytics • Performance of a contract (Article 6(1)b) UK GDPR): for processing necessary to deliver coaching services to Contacts • Consent (Article 6(1)a) UK GDPR): for processing of special category health data under Article 9(2)a), progress photographs, and electronic marketing communications, which shall be subject to prior opt-in consent and withdrawal or opt- out mechanisms under PECR and the UK GDPR • Legal obligation (Article 6(1)c) UK GDPR): for tax and accounting records
8. CONSENT RECORDS
8.1 The Platform provides functionality for the Customer to record and manage consent from Contacts, including:
a) Consent capture during onboarding questionnaires
b) Consent audit trail (timestamp, content of consent, identity of consenting individual)
c) Consent withdrawal mechanism
8.2 The Customer is responsible for ensuring that consent is obtained in a manner that is compliant with Data Protection Laws, including ensuring that consent is freely given, specific, informed, and unambiguous.
9. RETENTION AND DELETION
9.1 Personal Data shall be retained and deleted in accordance with the retention schedule set out in Schedule 5 (Data Retention Schedule), which is mirrored in the Data Retention Policy as published at areela.com/legal/data-retention-policy and as updated from time to time.
9.2 Upon termination or expiry of the Agreement, and following the Export Window described in Clause 9, the Provider shall:
a) delete all Personal Data from live systems within thirty (30) days of receipt of written instruction from the Customer;
b) purge Personal Data from encrypted backups within ninety (90) days of deletion from live systems; and
c) retain financial and subscription records for seven (7) years in accordance with applicable tax and accounting legislation.
10. DATA SUBJECT RIGHTS
10.1 The Provider shall provide reasonable assistance to the Customer in responding to requests from data subjects to exercise their rights under Data Protection Laws, including:
a) Right of access (Article 15 UK GDPR)
b) Right to rectification (Article 16 UK GDPR)
c) Right to erasure (Article 17 UK GDPR)
d) Right to restriction of processing (Article 18 UK GDPR)
e) Right to data portability (Article 20 UK GDPR)
f) Right to object (Article 21 UK GDPR)
g) Rights related to automated decision-making (Article 22 UK GDPR)
10.2 The Provider shall promptly notify the Customer if it receives a data subject access request or other rights request directly from a Contact, and shall not respond to such request directly unless instructed to do so by the Customer or required to do so by applicable law.
11. AUDIT RIGHTS
11.1 The Provider shall make available to the Customer all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer, subject to:
a) the Customer giving the Provider not less than thirty (30) days’ prior written notice of any audit;
b) audits being conducted during normal business hours and in a manner that minimises disruption to the Provider’s operations;
c) the Customer (or its auditor) entering into appropriate confidentiality undertakings; and
d) the Customer bearing the costs of any audit.
12. [Not Used]
12. BREACH NOTIFICATION
12.1 In the event of a Personal Data Breach, the Provider shall:
a) notify the Customer without undue delay (and in any event within 48 hours of becoming aware of the breach);
b) provide the following information (to the extent available):
i. the nature of the breach, including the categories and approximate number of data subjects and Personal Data records affected;
ii. the likely consequences of the breach;
iii. the measures taken or proposed to be taken to address the breach and mitigate its effects; and
iv. the name and contact details of the Provider’s data protection contact;
c) cooperate with the Customer in investigating and remediating the breach; and
d) not make any public disclosure regarding the breach without the Customer’s prior written consent, unless required by law.
SCHEDULE 3: SERVICE LEVEL AGREEMENT
1. AVAILABILITY TARGET
1.1 The Provider shall use reasonable efforts to maintain Platform availability of 99.9% measured on a calendar-month basis (the “Availability Target”).
1.2 Availability is calculated as: ((Total Minutes in Month - Downtime Minutes) / Total Minutes in Month) x 100%.
1.3 The following periods are excluded from the availability calculation:
a) Scheduled Maintenance (as defined below);
b) downtime caused by factors outside the Provider’s reasonable control, including Force Majeure Events, internet or DNS disruptions, and failures of third-party hosting infrastructure; and
c) downtime caused by the Customer’s equipment, software, or network.
2. SCHEDULED MAINTENANCE
2.1 The Provider reserves the right to perform scheduled maintenance at its discretion.
2.2 The Provider shall use reasonable efforts to:
a) perform scheduled maintenance during off-peak hours (between 00:00 and 06:00 UK time where practicable);
b) provide at least 24 hours’ advance notice of planned maintenance via the Platform’s status page and/or email; and
c) minimise the duration and impact of maintenance windows.
3. EMERGENCY MAINTENANCE
3.1 The Provider may perform emergency maintenance without prior notice where necessary to address critical security vulnerabilities, data integrity issues, or imminent service failures.
4. SUPPORT RESPONSE TIMES
4.1 The Provider shall use best efforts to respond to support requests within the following timeframes:
Priority | Description | Target Response Time | Target Resolution Time |
|---|---|---|---|
P1: Critical | Platform entirely unavailable or severe data loss | 1 hour | 4 hours |
P2: High | Major feature unavailable, no workaround | 4 hours | 1 Business Day |
P3: Medium | Feature degraded, workaround available | 1 Business Day | 5 Business Days |
P4: Low | Minor issue, cosmetic defect, feature request | 2 Business Days | Best effort |
4.2 Response times are measured during coach support hours: Monday to Friday, 9:00 am to 8:00 pm UK time, excluding UK public holidays.
5. SUPPORT CHANNELS
5.1 Coach support is available through the following channels:
a) Knowledge base / Help Centre (self-service, available 24/7)
b) WhatsApp messaging
c) Email: support@areela.com
d) Live chat (during support hours)
e) One-to-one onboarding demonstrations (by appointment)
5.2 Contact support is limited to the Help Centre (self-service only).
6. REMEDIES
6.1 The availability target set out in this Schedule is a target, not a guarantee. The Provider shall not be liable for any failure to meet the availability target, but shall use commercially reasonable efforts to restore service as quickly as practicable in the event of any unplanned downtime.
6.2 The Provider does not currently offer service level credits. The Provider may, at its discretion, introduce a service credit scheme in the future by amendment to this Schedule.
SCHEDULE 4: SUB-PROCESSOR LIST
7. APPROVED SUB-PROCESSORS
7.1 The following Sub-processors are approved by the Customer as at the date of this Agreement:
No. | Sub-processor | Activity | Processing Territory | Data Categories | Safeguards | Trust / Privacy URL |
|---|---|---|---|---|---|---|
1 | Laravel Cloud (Laravel Holdings, Inc.) | Application hosting, compute, database | eu-west-1 (London, United Kingdom) | Customer Data as necessary for application hosting | Laravel Cloud privacy and security safeguards | laravel.com/trust |
2 | Amazon Web Services (AWS) | Cloud infrastructure (underlying Laravel Cloud) | eu-west-1 (London, United Kingdom) / USA | Customer Data as necessary for cloud infrastructure | AWS privacy and security safeguards | aws.amazon.com/compliance/data-privacy |
3 | OpenAI, LLC (also known as OpenAI OpCo, LLC) | Provision of AI-assisted features within the Platform | United States | API inputs and outputs for AI-generated fitness plans, meal plans, and recommendations | Modified Retention Amendment dated 6 September 2026; ZDR applies to eligible API endpoints, so Customer Content is not logged for abuse monitoring or human review and is not retained beyond immediate processing; image and file Inputs are outside ZDR and may be retained for Safety Classification; transfer safeguards are set out in Schedule 2, Clause 13. | https://openai.com/policies/data-processing-addendum/; https://openai.com/policies/usage-policies/; https://openai.com/policies/business-terms/; https://platform.openai.com/docs/guides/your-data |
4 | ElevenLabs, Inc. | Text-to-speech voice generation | USA | AI-generated reply text only | ElevenLabs privacy policy and terms | https://elevenlabs.io/privacy-policy; ElevenLabs terms of use |
5 | Terra API, Inc. | Wearable device data integration | USA / UK | Wearable, activity, health, and nutrition data | Terra privacy and security safeguards | tryterra.co/privacy-policy |
6 | FatSecret Pty Ltd | Food and nutrition database | Australia | Nutrition and food data | FatSecret privacy and security safeguards | fatsecret.com/privacy-policy |
7 | Stripe, Inc. | Payment processing | USA / Ireland | Payment and billing data | Stripe privacy and security safeguards | stripe.com/privacy |
8 | RevenueCat, Inc. | In-app purchase management and subscription tracking | USA | Subscription and purchase metadata | RevenueCat privacy and security safeguards | revenuecat.com/privacy |
9 | Apple Inc. | App Store distribution and IAP billing | USA | App Store account and billing data | Apple privacy and security safeguards | apple.com/legal/privacy |
10 | Google LLC | Play Store distribution and Play Billing | USA | Play Store account and billing data | Google privacy and security safeguards | policies.google.com/privacy |
11 | Expo (650 Industries, Inc.) | Mobile app build and OTA update service | USA | Device and technical data | Expo privacy and security safeguards | expo.dev/privacy |
12 | Postmark (ActiveCampaign, LLC) | Transactional email delivery | USA | Contact and notification data | Postmark privacy and security safeguards | postmarkapp.com/privacy-policy |
13 | FontAwesome (Fonticons, Inc.) | Icon library (Pro licence) | USA | No Customer Data | FontAwesome licence terms | fontawesome.com/privacy |
14 | Sentry (Functional Software, Inc.) | Error monitoring and performance tracking | USA | Technical data, logs, and error reports | Sentry privacy and security safeguards | sentry.io/privacy |
15 | Cloudflare, Inc. | CDN, DDoS protection, DNS | USA / Global | Network and technical data | Cloudflare privacy and security safeguards | cloudflare.com/privacypolicy |
16 | Plausible Analytics (Plausible Insights OUE) | Privacy-friendly web analytics | EU (Estonia) | Usage analytics and technical data | Plausible privacy and security safeguards | plausible.io/privacy |
17 | Crisp IM SAS | Live chat and customer support widget | EU (France) | Support and communication data | Crisp privacy and security safeguards | crisp.chat/en/privacy |
7.2 The Provider shall maintain an up-to-date list of Sub-processors, which shall be reflected in Schedule 4 and in the sub-processor tables in the Privacy Notices as published at areela.com/legal/privacy-policy and as updated from time to time, and shall notify the Customer of any changes in accordance with Clause 7.3d).
SCHEDULE 5: DATA RETENTION SCHEDULE
This Schedule is intended to be read with and kept consistent with the Data Retention Policy as published at areela.com/legal/data-retention-policy and as updated from time to time, and the retention and deletion provisions set out in paragraph 9 of Schedule 2 (Data Processing Addendum).
1. RETENTION PERIODS
1.1 The following retention periods apply to data processed through the Platform:
Data Category | Retention Period | Basis / Notes |
|---|---|---|
Coach account data (name, email, business info) | Duration of Subscription Term + 14 days (Export Window) + 30 days (deletion processing) | Contractual necessity; deleted upon written request post-termination |
Contact profile data (name, email, DOB, gender) | Duration of Subscription Term + 14 days + 30 days | Deleted when coach account is deleted or upon DSR; coach must action unless direct DSR received |
Health and fitness data (measurements, goals, medical info) | Duration of Subscription Term + 14 days + 30 days | Special category data; requires explicit consent; deleted with contact profile |
Progress photographs | Duration of Subscription Term + 14 days + 30 days | Deleted with contact profile; original resolution preserved during retention |
Nutrition data (food diary, meal plans, macros) | Duration of Subscription Term + 14 days + 30 days | Deleted with contact profile |
Wearable device data (raw) | Not retained beyond real-time processing | Raw data from Terra API is processed and displayed but not stored long-term |
Wearable device data (aggregated/derived) | Duration of Subscription Term + 14 days + 30 days | Aggregated metrics derived from wearable data; deleted with contact profile |
Workout logs and programme history | Duration of Subscription Term + 14 days + 30 days | Deleted with contact profile |
AI conversation transcripts retained by Provider | Duration of Subscription Term + 14 days + 30 days | Provider retention: Duration of Subscription Term + 14 days (Export Window) + 30 days (deletion processing). For eligible OpenAI ZDR endpoints, Customer Content is not logged for abuse monitoring or human review and is not retained beyond immediate processing. Image and file Inputs are outside ZDR and may be retained by OpenAI for Safety Classification. |
In-app messages | Duration of Subscription Term + 14 days + 30 days | Deleted with contact profile |
Check-in data | Duration of Subscription Term + 14 days + 30 days | Deleted with contact profile |
Consent records | Duration of Subscription Term + 7 years | Retained for regulatory compliance and audit purposes |
Financial records (invoices, payment history) | 7 years from date of transaction | Tax and accounting legislation (UK Companies Act 2006, HMRC requirements) |
Subscription and billing metadata | 7 years from date of transaction | Tax and accounting legislation |
Authentication logs (OTP, login events) | 12 months | Security and fraud prevention |
Error and performance logs | 90 days | Operational monitoring (Sentry) |
De-identified deletion records | Indefinite | Anonymised audit trail; not Personal Data |
Encrypted backups | Purged within 90 days of live data deletion | Standard backup rotation schedule |
De-identified / aggregated analytics | Indefinite | Not Personal Data; used for product improvement and benchmarking |
2. DELETION PROCESS
2.1 Deletion from live systems shall be initiated within 30 days of the Customer’s written request following termination.
2.2 Encrypted backups containing deleted data shall be purged in accordance with the standard backup rotation schedule, and in any event within 90 days.
2.3 The Provider shall provide written confirmation of deletion to the Customer upon request.
2.4 Data retained for legal or regulatory purposes shall be isolated, access-restricted, and not used for any purpose other than compliance with the applicable legal requirement.
3. CONTACT DATA DELETION
3.1 Where a Contact requests deletion of their data:
a) the request should in the first instance be directed to the Customer (Coach);
b) the Customer shall action the deletion through the Platform or instruct the Provider to do so;
c) where a Contact makes a deletion request directly to the Provider, the Provider shall notify the Customer and, absent objection from the Customer within 10 Business Days, process the deletion; and
d) certain data may be retained where required by law (e.g., financial records) as noted in the table above.