This is an English translation. If it differs from the Indonesian version, the Indonesian version applies. Read the Indonesian version
Nadi App Privacy Policy
This policy is written with reference to Law No. 27 of 2022 on Personal Data Protection (UU PDP).
Effective from: 22 October 2026
1. Summary
A client’s health data can only be seen by their own coach, not by other coaches and not by the gym owner. We do not sell your data and we do not use Health Data for advertising.
This Privacy Policy explains how PT Kreasi Inovasi Khatulistiwa (“Nadi”, “we”) collects, uses, shares, stores, and protects your personal data when you use the Nadi app for iOS and Android, the web dashboard, and the nadi.fit site (the “Service”).
At this time, Coaches use the Nadi app for iOS and Android to manage their schedule, log training sessions, build programs, and give clients their tasks. Assessments and Health Data are managed through the web app at nadi.fit. If this changes, we will update this policy as described in section 6.4.
1.1 Data controller
For most data, Nadi acts as the Personal Data Controller. For client data that a Coach or Owner enters as part of their training services, the Coach or Owner is also responsible for the use of that data outside Nadi, while Nadi processes that data to run the Service as described in this policy.
1.2 Our five commitments
- We only collect the data needed to run training support.
- Health Data can only be read by the Coach assigned to that client. This limit is enforced in the system, not just hidden in the display.
- We do not sell personal data and we do not use it for advertising or marketing profiles.
- AI output never becomes active without the Coach’s approval.
- You can view, correct, download, and delete your data at any time.
2. Data we collect
2.1 Data you give us
| Category | Example data | From whom | Type under UU PDP |
|---|---|---|---|
| Identity and contact | Name, email, WhatsApp number, sex, date of birth | All users | General |
| Coach profile | Level (junior, senior, head), join date, certifications, studio | Coach, Owner | General |
| Studio profile | Business name, address, number of coaches, billing data | Owner | General |
| Goals and habits | Training goals, targets, frequency, experience, daily activity, sleep, eating patterns, stress level | Client | General |
| Health Data | Injury history and problem body areas, health conditions, pain complaints, weight, height, body fat percentage, waist circumference, resting heart rate, blood pressure, movement test results | Client and Coach, through the web app | Specific |
| Training data | Programs, set logs (load, repetitions), events during a session, session notes, assignments, assignment completion, progress | Coach and Client | General, some of it can contain Health Data |
| Communication | Messages to the support team, problem reports, feedback | All users | General |
2.2 Data collected automatically
- Device and technical data: device type, operating system version, app version, IP address, time zone, and a device identifier for offline sync.
- Usage data: screens opened, features used, access times, and error or crash reports.
- WhatsApp delivery data: template name, send time, delivered or read status, and the message ID from the provider.
We do not collect precise location (GPS), the contacts on your phone, photos, or data from Apple Health or Health Connect. If a feature like that is added, we will ask for your permission first and update this policy.
2.3 Data we do not ask for
We do not ask for KTP (national ID card) numbers, clients’ personal bank account details, or biometric data for identification. Your age is calculated from your date of birth and is not stored separately.
3. Purposes and basis for processing
3.1 What the data is used for
| Purpose | Data used | Basis for processing (UU PDP Pasal 20) |
|---|---|---|
| Creating an account and logging in with an email and password, a Google account, or an Apple account | Identity and contact | Performance of a contract |
| Sending launch news to people who join the waitlist on nadi.fit | Name, email, city, role | Consent |
| Preparing assessments, programs, session notes, and assignments | Goals, habits, Health Data, training data | Explicit consent for Health Data; performance of a contract for other data |
| Flagging risks and showing medical referral paths | Health Data, complaints | Explicit consent; vital interests |
| Sending invitations, reminders, assignments, and session summaries through WhatsApp | Name, WhatsApp number, assignment content | Performance of a contract |
| Showing the owner dashboard (attendance, retention, process compliance) | Aggregate data without Health Data | Legitimate interests |
| Billing and subscription administration | Studio profile, billing data | Performance of a contract; legal obligation |
| Security, abuse prevention, and error fixing | Technical and usage data | Legitimate interests |
| Measuring and improving the quality of the Service | Usage data and de-identified training data | Legitimate interests |
| Meeting requests from authorities or legal obligations | Data lawfully requested | Legal obligation |
When a Client first fills in their health history, the Client is asked to give explicit consent. The Client can withdraw this consent at any time in the app or by contacting us. Withdrawing consent does not affect processing that happened before, but it can stop some features from working.
3.2 Use of artificial intelligence
The Service does not use AI Features at this time. If AI Features are switched on, the rules below apply and we will tell you as described in section 6.4.
- AI features process assessment data, session logs, notes, and complaints to prepare draft programs, exercise explanations, session notes, assignments, and suggested adjustments.
- Every draft is reviewed by the Coach. No decision that affects a client is made solely by automated means without human involvement.
- Every AI output is stored together with the model version and its input data for quality audits.
- Any AI model provider we use must be bound by contract not to use your data to train their models.
- We can use training data that has been de-identified and aggregated to improve the quality of Nadi’s recommendations. That data can no longer be used to identify you.
3.3 What we do not do
- We do not sell or rent personal data.
- We do not use Health Data for advertising, marketing, or data mining.
- We do not share your data with advertisers, data brokers, or insurance companies.
- We do not track you in apps or on sites owned by other parties.
4. Who can see your data
4.1 Inside Nadi
| Data | The Client | Their coach | Other coaches | Studio Owner |
|---|---|---|---|---|
| Name and contact | Yes | Yes | No | Yes |
| Attendance and package status | Yes | Yes | No | Yes |
| Goals, assessments, Health Data | Yes | Yes | No | No |
| Programs and session logs | Yes | Yes | No | No |
| The coach’s internal session notes | No | Yes | No | No |
| Content of complaint reports | Yes | Yes | No | No, only knows that a complaint exists |
| The coach’s process compliance (for example, notes filled in on time) | No | Yes | No | Yes |
The Client can choose to share the session summaries sent to them as an image or a link. Once shared, how far they spread is outside our control.
4.2 Third-party service providers
We use the following providers to run the Service. They only process data on our instructions and are bound by confidentiality and security obligations.
| Provider | Function | Data processed |
|---|---|---|
| Meta Platforms (WhatsApp Business Platform) | Invitations, reminders, session summaries | WhatsApp number, name, message content |
| Supabase and Cloudflare | Server and database hosting | All Service data, encrypted |
| Rybbit and Umami | Monitoring use of the app and the site | Technical and usage data, without Health Data |
| Resend | Sending email, for example waitlist sign-up confirmations | Name and email address |
| Apple and Google | Login with a Google or Apple account, app distribution, in-app purchases, notifications | Transaction data and device identifiers under their policies |
4.3 Other disclosures
We can disclose data when required by law, a court order, or a lawful request from an authorized agency; to protect a person’s safety; or as part of a merger, acquisition, or transfer of the business. In the case of a transfer of the business, we will tell you before your data becomes subject to a different privacy policy.
4.4 Transfers outside Indonesia
Some of the providers above can store or process data outside Indonesia. We only make transfers in line with Pasal 56 UU PDP, that is, to a country with an equal or higher level of protection, or with adequate contractual protection, or with your consent. Current processing location: the database is in Singapore, and the site and web app are served by the global Cloudflare network.
5. Storage, security, and deletion
5.1 How long data is kept
| Data | Retention period |
|---|---|
| Active account | For as long as the account is active |
| Health Data and training data of a client who stops training | 12 months from the last activity, then deleted or anonymized, unless the client asks for earlier deletion |
| Data after an account is deleted | Deleted from active systems within 30 days at the latest, and from backups within 90 days at the latest |
| Billing and transaction data | 10 years, as required for company and tax records |
| Security and technical logs | 12 months |
| De-identified and aggregated data | Can be kept without a time limit because it no longer identifies you |
5.2 When a coach or client moves
- When a Client leaves a studio, the Client can still download or delete their data.
5.3 Security
We apply technical and organizational measures to protect data, including:
- encryption in transit (TLS) and at rest;
- role-based access limits enforced at the database layer and tested automatically every time the system is updated;
- passwords stored as hashes, never as plain text;
- internal staff access that is limited, logged, and only for support or security purposes; and
- temporary storage on the device for offline logging, which syncs and is cleared once the device is connected again.
No system is completely secure. If a personal data protection failure happens, we will notify you and the personal data protection supervisory authority within 3 x 24 hours at the latest, in line with Pasal 46 UU PDP, together with the data affected and the steps taken to handle it.
5.4 Deleting your account
You can delete your account and your data:
- in the app through Profil > Hapus akun (Profile > Delete account); or
- through nadi.fit/en/delete-account without having to install the app; or
- by sending a request to contact@nadi.fit from your registered email or WhatsApp number.
We process the request within 3 x 24 hours at the latest from receipt, in line with UU PDP, and send a confirmation once it is done. Data we must keep by law, for example billing data, is stored separately and is not used for other purposes.
6. Your rights and other information
6.1 Your rights as a data subject
Under UU PDP, you have the right to:
- get information about our identity, the purpose, and the basis for processing your data;
- access your data and get a copy of it;
- correct data that is inaccurate or incomplete;
- ask for your data to be deleted or destroyed;
- withdraw consent you have given, including for Health Data;
- delay or restrict processing;
- object to decisions based solely on automated processing;
- get your data in a common, machine-readable format, and move it to another controller; and
- sue and receive compensation for violations in the processing of your data.
You can use most of these rights directly in the app. For other requests, contact contact@nadi.fit. We can ask you to verify your identity through your registered email or WhatsApp number before we process a request, and we respond within 3 x 24 hours at the latest, in line with UU PDP.
6.2 Children
The Service is not intended for children under 18. Children’s data is only processed when the Coach has obtained consent from the child’s parent or legal guardian, in line with Pasal 25 UU PDP. If you are a parent or guardian and you find that your child’s data is in Nadi without your consent, contact us so that the data is deleted.
6.3 Device permissions and notifications
The app can ask for permission to send push notifications and, when you share a session summary, permission to save images. You can revoke these permissions at any time in your device settings. We do not use cross-app tracking (App Tracking Transparency) and we do not use advertising identifiers.
6.4 Changes to this policy
We can update this policy. The effective date at the top will be updated. For material changes, especially those about Health Data or the parties that receive data, we will tell you through the app or WhatsApp at least 14 days before they take effect, and ask for consent again when the law requires it.
6.5 Contact and data protection officer
PT Kreasi Inovasi Khatulistiwa
Sapphire Commercial No 15, Summarecon Bandung, Jawa Barat, Indonesia
Personal Data Protection Officer: Chrisna Aditya W
Email: contact@nadi.fit
WhatsApp: 0811-2021-008
If you are not satisfied with our response, you can file a complaint with the personal data protection authority set up by the Government.