Privacy Policy.

3.1Our commitment to you

At NUA, we believe your health data belongs to you — not to us, and not to any third party. This policy explains how we handle the information you share with us, and the rights afforded to you under the Saudi Personal Data Protection Law (PDPL).

3.2The data we collect

Basic personal information

We collect the following information when you register and use the app:

• Identity information: full name, email, phone number, date of birth, gender.
• Physical information: height, weight, body fat percentage (optional).
• Health goals: your weight goal, lifestyle, activity level.
• Payment information: last 4 digits of the card only — full details are processed via a certified payment provider and not stored with us.

Health and biometric data

• Records of meals, calories, and nutrients.
• Sleep data: duration, quality, stages.
• Physical activity: steps, workouts, calories burned.
• Biometrics: heart rate, breathing rate, blood oxygen.
• Medical records you choose to add (entirely optional).

Technical data

• Device type, operating system, and version.
• IP address and approximate geographic location (city only).
• Usage logs within the app (to improve the experience).

3.3How we use your data

We use your data exclusively for the following purposes:

3.4Sharing data with third parties

We share your data only in the following limited cases:

• Technical service providers (cloud storage, performance analytics) under strict confidentiality agreements, and for service operation only.
• Official authorities when there is a binding legal request under the laws of the Kingdom of Saudi Arabia.
• Health specialists whom you yourself choose to share your data with.
• Aggregated, anonymized analytics only, used for research and service development.

We may use aggregated or de-identified health data in internal research and to develop other NUA products. Any data linked to your personal identity or individual activity is never sold to any third party under any circumstance.

3.5Storage and retention

Your data is stored on secure servers within the Kingdom of Saudi Arabia or in internationally certified data centers that comply with high security standards.

Retention periods

• Active data: as long as your account is active.
• After account termination: deleted within a maximum of 90 days.
• Financial data and invoices: 5 years (legal obligation).
• Aggregated analytics: indefinitely — but completely anonymized.

3.6Security

We follow the highest applicable security standards to protect your data:

• Data encryption in transit using TLS 1.3.
• Data encryption at rest using AES-256.
• Mandatory two-factor authentication for all staff with administrative access.
• Internal access restricted to "need-to-know" basis only.
• Regular security reviews and annual penetration tests.
• Encrypted backups stored in geographically separate locations.

In the event of any potential security breach, we commit to notifying affected users and the relevant regulatory authorities within 72 hours of discovery.

3.7Your rights

Under the Saudi Personal Data Protection Law (PDPL), you have the following guaranteed rights:

• Access: request a full copy of the data we hold about you.
• Correction: request modification of any inaccurate data in your account.
• Deletion: request deletion of your data (right to be forgotten) at any time.
• Restriction: request restriction of processing for a specific purpose.
• Portability: request transfer of your data in a machine-readable format (JSON or CSV).
• Objection: refuse processing for marketing or analytics purposes.
• Withdraw consent: withdraw your prior consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@nua.fit — we commit to responding within 30 days at the latest.

3.8External devices and apps

When you connect an external device or app to NUA (such as Apple Health, Samsung Health, Garmin Connect, Whoop), then:

• The data transferred from those sources is governed by their own privacy policies.
• NUA only receives the data you explicitly authorize sharing.
• You can disconnect any device at any time from the app settings.
• NUA is not responsible for the privacy practices of external parties.

3.9Google Health Connect

Connecting Google Health Connect is optional. NUA accesses Health Connect only after you select "Connect," review NUA's disclosure, and grant permissions through Android. NUA requests read-only access and does not write, modify, or delete Health Connect records.

NUA may read

• Steps: to display daily steps, activity history, and goal progress.
• Active and total calories burned: to display daily energy expenditure and activity progress.
• Exercise sessions: to display completed workouts, duration, workout history, and fitness progress.
• Heart rate: to display daily averages and the Average Heart Rate charts under Achievements.
• Weight: to display Weight trends, progress charts, and Recent Logs under Achievements.
• Height: to display your current height and support visible plan calculations.
• Sleep: to display sleep duration, timing, stages, history, and sleep progress.

NUA may also receive record timestamps, identifiers, recording method, source application, and available device information. This metadata is used to identify record sources, avoid duplicates, process updates, and synchronize records reliably.

If separately permitted, NUA may access older Health Connect records to provide historical trends and may synchronize authorized records in the background so dashboards remain current.

After authorization, NUA securely transmits the selected records and related metadata over HTTPS to NUA's systems and associates them with your NUA account. Health Connect's on-device records and the synchronized copies stored by NUA are separate.

NUA uses Health Connect data only to

• Provide the dashboards, charts, logs, summaries, trends, goals, and plan features described above;
• Synchronize authorized information with your NUA account;
• Calculate summaries and averages displayed to you;
• Personalize fitness, nutrition, sleep, and wellness goals; and
• Maintain, secure, troubleshoot, and improve these specific user-facing features.

NUA does not sell Health Connect data or use or transfer it for advertising, personalized advertising, data brokerage, creditworthiness, lending, insurance eligibility, or unrelated research or product development. Health Connect record values are not shared with advertising, marketing, product-analytics, or session-recording providers.

Disconnecting and deletion

You can stop future access by disconnecting Health Connect under Profile → Health Settings → Device Linking → Health Connect, or by revoking permissions in Android's Health Connect settings.

Disconnecting Health Connect or revoking permission stops future synchronization but does not automatically delete information already synchronized to your NUA account. Deleting a source record from Health Connect may also not delete NUA's previously synchronized copy.

To delete synchronized Health Connect data, email privacy@nua.fit with the subject "Delete my Health Connect data," or delete your NUA account through Profile → Settings → Delete account. Account deletion does not delete original records stored in Health Connect; those records must be managed through Android's Health Connect settings.

3.10Children and minors

The NUA platform is not intended for children under 16 years of age. We do not knowingly collect data from children. If we learn that a child has provided their data without parental consent, we delete that data immediately. If you are a parent and believe your child registered with NUA without your permission, contact us immediately at privacy@nua.fit.

3.11Updates to this policy

We may update the privacy policy from time to time to reflect changes in our services or new legal requirements. We will notify you of any material changes via email and in-app notifications at least 14 days before the effective date. Continued use of the platform after the update constitutes consent to the new policy.