Evolve Health Club Privacy Policy

Effective Date: 1^st September 2026

Last Updated: 1^st September 2026

1. Who We Are

This Privacy Policy explains how Evolve Health Club (the “Gym”, “we”, “us”, or “our”) collects, uses, stores, discloses, and protects personal data when you use the Evolve Health Club mobile application, website, membership services, booking services, and related services.

Data Controller / Legal Entity: Evolve Health Club Co. Ltd.

Business Address: 17/32 Moo 8, Koh Phangan, Surat Thani 84280

Privacy Contact: info@evolvekohphangan.com

2. Scope

This Policy applies to personal data collected through the Evolve Health Club mobile application, website, membership registration, class or facility bookings, customer support, and other services that link to this Policy. It applies to users in Thailand and, where applicable, users in other jurisdictions in which we provide services.

3. Personal Data We May Collect

We collect only personal data that is reasonably necessary for the purposes described in this Policy. Depending on the features you use, this may include:

• Identity and account information: name, username, member/customer ID, date of birth or age where required.
• Contact information: email address, telephone/mobile number, and other contact details you provide.
• Membership and service information: membership plan, booking/class history, attendance or check-in information, preferences, and service-related records.
• Fitness information: fitness goals, exercise preferences, measurements or other information you voluntarily provide for fitness services. We do not collect medical or sensitive health information unless the app specifically asks for it and an appropriate lawful basis and consent are in place.
• Payment and transaction information: transaction amount, payment status, invoice/receipt information and limited payment references. Where a third-party payment provider processes card or bank details directly, we do not receive or store the full payment-card information unless expressly stated in the app.
• Device and technical information: IP address, device type, operating system, app version, unique identifiers where permitted, crash/diagnostic information, and security logs.
• Usage and analytics information: information about how you use the app, such as screens or features used, where analytics tools are enabled.
• Push-notification information: push notification token and related delivery information where you enable notifications.
• Location information: approximate or precise location only if the app requests the relevant permission and the feature requires it, such as location-based functionality or check-in. If location is not used, it will not be collected for that purpose.
• Customer-support information: messages, requests, attachments, and other information you provide when contacting us.

4. How We Use Personal Data

We may use personal data for the following purposes:

• Create and manage your account and membership.
• Process bookings, subscriptions, check-ins, payments, invoices, and other requested services.
• Provide and personalize fitness-related services and recommendations.
• Communicate with you about bookings, membership status, service notices, security matters, and important account information.
• Send promotional communications only where permitted by applicable law and, where required, with your consent. You may opt out of marketing communications.
• Provide customer support and respond to requests.
• Maintain, secure, troubleshoot, and improve the app and related systems.
• Detect, prevent, and investigate fraud, misuse, security incidents, and other unlawful activity.
• Comply with legal obligations and establish, exercise, or defend legal claims.
• Conduct analytics and service improvement where such processing is implemented.

5. Lawful Bases for Processing under Thailand PDPA

Where Thailand’s Personal Data Protection Act B.E. 2562 (2019) applies, we process personal data only where a lawful basis is available. Depending on the processing activity, the lawful basis may include:

• Performance of a contract: where processing is necessary to provide membership, bookings, subscriptions, payments, or other services you request.
• Legal obligation: where processing is necessary to comply with applicable laws, accounting, tax, regulatory, or other legal requirements.
• Legitimate interests: where processing is necessary for legitimate business interests such as service security, fraud prevention, system administration, and improvement, provided those interests do not override applicable rights and freedoms.
• Consent: where consent is required or where we choose to rely on consent, including certain marketing or other optional processing. Consent may be withdrawn subject to applicable legal limitations.
• Vital interests or other lawful bases: where applicable under the PDPA.

Where we request consent, we will provide information about the purpose of the processing and will not make optional consent a condition of receiving a service unless permitted by applicable law.

6. Sharing and Disclosure of Personal Data

We do not sell your personal data. We may disclose personal data only as reasonably necessary for the purposes described in this Policy and as permitted by applicable law.

• Service providers and processors that provide hosting, cloud storage, customer support, payment processing, messaging, analytics, security, or other services on our behalf.
• Payment providers, where necessary to process a transaction. Payment providers may collect and process payment information under their own privacy notices.
• Communication providers, including email, SMS, push-notification, or messaging providers, where used to deliver requested or permitted communications.
• Professional advisers, auditors, insurers, or other parties where reasonably necessary for legal, accounting, security, or business purposes.
• Government authorities, regulators, courts, or law-enforcement bodies where disclosure is required or permitted by law.
• Business transaction parties in connection with a merger, acquisition, restructuring, financing, or sale of assets, subject to applicable law.

We do not share personal data with third-party advertising networks for cross-app or cross-website targeted advertising unless that practice is actually implemented, lawfully disclosed, and all required permissions or consents are obtained.

7. Third-Party Services and SDKs

The app may use third-party services or software development kits (SDKs), such as hosting, payment, analytics, crash reporting, push notification, email/SMS, or security services. The exact providers used by the app must be reviewed before publication of this Policy. We will disclose relevant categories of third parties and their data practices as required by applicable law and app-store rules.

Third-party providers may process information under their own privacy policies. We require service providers processing personal data on our behalf to use the information only for authorized purposes and to apply appropriate security and confidentiality measures.

8. Advertising and Tracking

Evolve Health Club does not use personal data for cross-app or cross-website tracking or targeted advertising unless expressly described in an updated version of this Policy.

If the app later introduces tracking for advertising or advertising measurement, we will update our disclosures and implement any consent or permission mechanisms required by applicable law and platform rules, including Apple’s App Tracking Transparency framework where applicable.

9. International Data Transfers

Some service providers may process or store personal data outside Thailand. Where personal data is transferred outside Thailand, we will take steps required by applicable law to ensure an appropriate level of protection and to use legally permitted transfer mechanisms and safeguards.

10. Data Security

We use reasonable technical and organizational safeguards designed to protect personal data against unauthorized access, alteration, disclosure, loss, destruction, or misuse. Depending on the system and data involved, safeguards may include encryption in transit, access controls, authentication, secure storage, logging, monitoring, backups, and security testing.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we will respond to security incidents in accordance with applicable law.

11. Data Retention

We retain personal data only for as long as reasonably necessary to provide the Evolve Health Club services, operate and secure user accounts, process memberships and bookings, maintain required business and financial records, resolve disputes, prevent fraud or abuse, and comply with legal obligations. Retention periods depend on the type of data and the purpose for which it was collected.

When an account is deleted, we will delete or anonymize the personal data associated with that account within a reasonable period, except for information that we are required or legally permitted to retain. For example, certain transaction, accounting, tax, fraud-prevention, security, or dispute-related records may be retained for the period required or permitted by applicable law. Retained information will not be used for unrelated purposes.

Subject to the conditions and exceptions provided by applicable law, individuals may have rights including:

• Right to be informed about the collection, use, and disclosure of personal data.
• Right to access personal data and request a copy.
• Right to request correction of inaccurate, incomplete, or misleading personal data.
• Right to data portability in circumstances provided by law.
• Right to object to certain processing, including certain direct-marketing or legitimate-interest processing.
• Right to request erasure, destruction, or anonymization in circumstances provided by law.
• Right to request restriction or suspension of use in circumstances provided by law.
• Right to withdraw consent where processing is based on consent. Withdrawal does not affect processing that was lawfully carried out before withdrawal.
• Right to lodge a complaint with the competent authority, including the Personal Data Protection Committee (PDPC), where applicable.

We may need to verify your identity before fulfilling a request. Some rights are subject to legal exceptions, and certain requests may be refused or limited where permitted by law.

13. How to Exercise Your Privacy Rights

To request access, correction, deletion, portability, restriction, objection, consent withdrawal, or other privacy assistance, contact us at info@evolvekohphangan.com. Please describe your request and provide enough information for us to identify your account. We will handle requests within the period required by applicable law.

13 A. Data Deletion Request Process

Users may request deletion of their Evolve Health Club account and associated personal data by either (1) using the account deletion option in the Evolve Health Club mobile application, where available, or (2) emailing a deletion request to info@evolvekohphangan.com from the email address associated with the account or providing sufficient information for us to verify the account.

A deletion request should include the user’s name, registered email address or mobile number, and a clear statement that the user wants their Evolve Health Club account and associated personal data deleted. We may request reasonable information to verify the identity of the requester and protect the account from unauthorized deletion.

After verification, we will process the request within the period required by applicable law. Personal data associated with the account will be deleted or anonymized, except for information that must or may be retained under applicable law, including certain financial, tax, accounting, security, fraud-prevention, or dispute records.

14. Account Deletion

Users can request deletion of their Evolve Health Club account through the account/profile settings in the mobile application, where the feature is available. Users who cannot or do not wish to use the app may request deletion by emailing info@evolvekohphangan.com. This provides an external deletion request mechanism for users who are unable to access the app.

When a valid deletion request is completed, we will delete or anonymize the personal data associated with the account, subject to information that we are legally required or permitted to retain. Account deactivation or freezing is not treated as account deletion.

15. Children and Minors

The app is not intended to knowingly collect personal data from children in circumstances where parental or guardian consent is required. We will apply the age and consent requirements applicable to the jurisdiction and service.

If we learn that we have collected personal data from a child without the required consent, we will take reasonable steps to delete or otherwise handle the information in accordance with applicable law. If the service is intended to be restricted to adults or a specific minimum age, the app and its registration flow should clearly state that age requirement.

16. Cookies and Similar Technologies

Our website and, where applicable, the app may use cookies, SDKs, local storage, or similar technologies for authentication, security, functionality, analytics, or other disclosed purposes. Where consent is required, we will request it before using the relevant technology.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or data practices. The updated version will be published through the relevant website or app location and will show the updated date. Where required by law, we will provide additional notice or obtain consent.

18. Contact Us

For privacy questions, requests, complaints, or concerns, contact:
Evolve Health Club
Legal Entity: Evolve Health Club Co. Ltd.
Address: 17/32 Moo 8, Koh Phangan, Surat Thani 84280
Privacy Email: info@evolvekohphangan.com

Important Publication Checklist

• Replace all bracketed placeholders before publishing.
• Confirm the legal entity name and physical address shown in the app-store developer account/listing.
• Confirm the complete list of SDKs and third-party providers actually used by the production app.
• Confirm whether the app uses analytics, crash reporting, payment gateways, push notifications, location, advertising, WhatsApp/SMS/email services, or device identifiers.
• If there is no cross-app/cross-website advertising tracking, keep the advertising/tracking section as a no-tracking disclosure and do not request Apple ATT permission solely because this Policy mentions privacy.
• Complete Apple App Store Connect App Privacy disclosures so they accurately match the production app and its third-party SDKs.
• Complete Google Play Console Data Safety disclosures so they accurately match the production app and its third-party SDKs.
• Provide a publicly accessible, non-geofenced HTTPS privacy-policy URL and make the policy accessible from inside the app.
• Provide an external account-deletion request mechanism that is accessible to Google Play users in addition to the in-app deletion flow.
• Have the final policy reviewed by qualified Thai privacy counsel before relying on it as a legal compliance document.