1. Who controls your information
Muscle Bones Fitness Studio is responsible for the personal information described in this policy. Privacy requests may be sent to musclebonefit@gmail.com or delivered to Lot 1, Sydenham Commercial, Old Harbour Road, Spanish Town, Jamaica.
2. Information we may collect
- Account and contact information, including name, email address, telephone number and member ID.
- Membership, registration, payment status, transaction reference, billing currency and renewal history. We do not store complete card or bank-login credentials.
- Class bookings, attendance, check-ins, Zoom-session access and support communications.
- Fitness goals, training preferences, progress information, meal-plan details and other information you choose to provide to a trainer.
- Referral codes, qualifying renewals, reward balances and payout preferences.
- Technical information from public website visits, such as device type, approximate location, pages viewed and cookie choices, but only as described in our Cookie Policy.
3. How and why we use information
We use information to create and manage memberships; verify payments; control gym or Zoom access; schedule training; provide meal plans and progress support; administer affiliate rewards; prevent fraud; secure the service; respond to requests; meet legal obligations; and improve public website performance where consent is required.
4. Fitness and health-related information
Fitness goals, body measurements, meal-plan information and progress notes may be sensitive. We limit access to authorized personnel, do not sell this information and do not intentionally send it to advertising pixels. Advertising and analytics tools are excluded from member and staff portals.
5. Legal grounds and consent
Depending on the activity and applicable law, we process information to perform a membership agreement, comply with law, protect legitimate business and security interests, or act on your informed consent. You may withdraw optional cookie consent at any time through “Cookie settings.” Withdrawal does not affect earlier lawful processing.
6. Service providers and disclosures
Information may be shared only as needed with hosting and security providers, email services, Zoom for booked virtual sessions, payment or banking providers selected for a transaction, professional advisers and authorities where legally required. Providers must receive only the information needed for their role. We do not sell personal information.
7. International access and transfers
Online services and providers may process information outside Jamaica. Where this occurs, we use reasonable contractual, technical and organizational safeguards appropriate to the information and applicable law.
8. Retention
We keep membership and transaction records only as long as needed to provide services, resolve disputes, meet accounting or legal duties and protect against fraud. Training and progress information is reviewed for deletion or anonymization when it is no longer required. Cookie-choice records are retained on your device until cleared or replaced.
9. Security
We use role-based access, payment-status-only reception access, protected member sessions, encrypted transport, consent controls, security headers, logging and reasonable backup and incident-response practices. No online system is completely risk-free. Please use a unique password and notify us promptly of suspected unauthorized access.
10. Your privacy rights
Subject to applicable law, you may request access, correction, restriction, objection, deletion or a copy of personal information, and may withdraw consent. We may need to verify your identity. You may also contact Jamaica’s Office of the Information Commissioner.
11. Children
The service is not intended to collect a child’s personal information without authorization. A parent or legal guardian must provide consent where required and should contact us before a minor creates an account.
12. Breach response and policy changes
We investigate suspected incidents and provide notices where required by applicable law. Material policy changes will be posted here with a new effective date and, where appropriate, communicated directly to members.
This policy is a compliance-ready draft, not proof of registration or legal certification. The business should confirm its Jamaican data-controller obligations and obtain legal review before accepting live member data.