Privacy Policy

Last updated: 7 September 2026

This Privacy Policy explains how Mehras Fitness LLC (trade licence [TRADE LICENCE NUMBER], Dubai, United Arab Emirates), trading as Mehras Fitness (“we”, “us”), collects and uses personal data through mehrasfitness.com and our coaching services.

We are the data controller. For any privacy question, contact Mehrastrainer@gmail.com.

We handle personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Where we coach clients located in the European Economic Area or the United Kingdom, we also apply the GDPR and UK GDPR.

1. What we collect

Information you give us directly

• Enquiry and consultation: name, email address, phone or WhatsApp number, the service you are interested in, and the content of your message.
• Client account: name, email address, password (stored only as a cryptographic hash – we never see it), and your account activity.
• Fitness assessment: date of birth, country or city, preferred language and timezone; height, weight and body measurements (waist, hips, chest, neck, arms, thighs, calves); estimated body-fat percentage; training experience, current activity level, session frequency, training environment and available equipment.
• Health and lifestyle information: sleep, stress level, daily steps and sitting time, water intake, occupation, and any medical conditions, injuries or physical limitations you disclose.
• Nutrition information: dietary preferences, food allergies and intolerances, restrictions and supplements.
• Progress photographs: front and back images, if you choose to upload them.
• Payment information: handled by our payment providers. We receive confirmation of payment and the last four digits of a card – we never receive or store full card numbers.

Information collected automatically

• IP address, browser type, device type, operating system, referring page, pages viewed and time spent.
• Cookies and similar technologies – see our Cookie Policy.

2. Health data – please read this section

Some of what the assessment collects is health data, which receives heightened protection under both UAE and European law.

We collect it for one purpose only: to design a training and nutrition programme that is safe for you, and to know when to refer you to a medical professional instead. Our lawful basis is your explicit consent, given through the consent checkboxes on the assessment form.

You may withdraw that consent at any time by emailing us. If you do, we will delete your health data, though we may be unable to continue coaching you safely without it.

Please only tell us what is relevant to safe exercise. Do not send us diagnoses, medical records, test results or clinical documents that we have not asked for.

Where this data is stored. Our website is hosted outside the United Arab Emirates. UAE law restricts storing or transferring health data outside the country without approval from the relevant Health Authority. We are actively reviewing our arrangements to address this. If this matters to you, contact us before completing an assessment and we will arrange an alternative way to share your information.

3. Why we use your data, and our lawful basis

• Responding to your enquiry and arranging a consultation – steps taken at your request before entering a contract
• Creating and running your client account – performance of our contract with you
• Designing your training and nutrition programme – performance of our contract; explicit consent for health data
• Assessing whether exercise is safe for you – explicit consent; protection of vital interests
• Taking payment and issuing receipts – performance of our contract; legal obligation
• Sending marketing emails and newsletters – your consent, withdrawable at any time
• Understanding how the website is used – consent (analytics cookies)
• Keeping records, resolving disputes, meeting legal duties – legal obligation; our legitimate interests

4. Who we share it with

We do not sell your personal data. We never share your health data or progress photographs with advertisers.

We share limited data with service providers who help us operate:

• Hosting – our website host stores the site and its database.
• Payments – PayPal and our card processor, who handle payment details directly.
• Email – our newsletter and transactional email providers, who receive your name and email address only.
• Analytics – Google Analytics and similar, in aggregated and pseudonymised form, only where you have accepted analytics cookies.
• Professional advisers and authorities – where we are legally required to disclose.

5. International transfers

Our providers may process data outside the UAE, including in the EEA and the United States. Where we transfer personal data internationally we rely on contractual safeguards with those providers requiring a level of protection equivalent to that required by UAE law. See section 2 for the specific position on health data.

6. How long we keep it

• Enquiries that do not become clients: 12 months.
• Client records, assessments and programmes: for the duration of coaching and 3 years afterwards, so we can support you if you return.
• Progress photographs: deleted on request at any time; otherwise 12 months after coaching ends.
• Payment and invoice records: as required by UAE tax and commercial law, currently 5 years.
• Marketing consent records: until you unsubscribe, plus 2 years as proof of consent.

7. Your rights

You have the right to: access the personal data we hold about you; have inaccurate data corrected; request deletion; withdraw consent at any time; restrict or object to processing; receive your data in a portable format; and not be subject to decisions made solely by automated means.

To exercise any of these, email Mehrastrainer@gmail.com. We will respond within 30 days. We may ask you to verify your identity first.

If you are unhappy with our response, you may complain to the UAE Data Office, or – if you are in the EEA or UK – to your local data protection authority.

8. Security and breaches

We protect your data with encrypted connections (HTTPS), hashed passwords, access limited to those who need it, and regular updates. No system is completely secure, and we cannot guarantee absolute security.

If a breach occurs that presents a risk to your privacy, we will notify the UAE Data Office immediately and inform you directly where the risk to you is high.

9. Children

Our services are for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, contact us and we will delete it.

10. Changes

We may update this policy. The “last updated” date above will change, and we will notify clients directly of material changes.

11. Contact

Mehras Fitness LLC
Trade licence: [TRADE LICENCE NUMBER]
Downtown Dubai, United Arab Emirates
Email: Mehrastrainer@gmail.com
Phone / WhatsApp: +971 55 685 7400