Privacy Policy for Nelia

1. Who this Privacy Policy applies to

This Privacy Policy applies when you use:

• The Nelia website
• The Nelia mobile application
• A Nelia membership or subscription
• Nelia workout, nutrition and lifestyle programs
• Nelia community features
• Nelia customer support and communication services

Nelia is intended for people aged 18 or older. We do not knowingly collect personal data from children under the age of 18.

2. Personal data we collect

The information we collect depends on which parts of Nelia you use and which information you choose to provide.

Account and contact information

When you create an account, purchase a membership or contact us, we may collect:

• Name
• Email address
• Date of birth or age
• Gender, where relevant to the service
• Username and login information
• Membership and subscription information
• Customer service enquiries and correspondence

Onboarding and personalisation information

When you complete the Nelia onboarding process, we may collect information such as:

• Your goals
• Height and weight
• Activity level
• Training experience
• Training preferences
• Available equipment
• Preferred number of training sessions
• Nutrition and dietary preferences
• Preferred number of meals
• Lifestyle and habit information
• Information about injuries, limitations or health considerations that you choose to provide

Your answers may be used to recommend or assign suitable programs, workouts and content.

These recommendations are intended to personalise your experience. They do not produce legal or similarly significant effects.

Health, fitness and nutrition information

When you use Nelia, you may choose to provide or record information such as:

• Body weight
• Body measurements
• Progress photos
• Workout activity
• Exercise logs
• Completed workouts
• Food and nutrition logs
• Calorie and macronutrient information
• Habit tracking
• Fitness goals and progress
• Heart rate
• Steps and activity levels
• Energy expenditure
• Sleep information
• Information from connected wearable devices
• Other health-related information that you voluntarily provide

Some of this information may be considered health data or another special category of personal data under applicable data protection law.

We process health-related information where it is necessary to provide the features you have requested and where you have given explicit consent.

You are not required to provide optional health-related information. However, some Nelia features may not function as intended without the information required to provide them.

Connected health services and wearable devices

Health Data Utilization

Our app collects and processes health-related information such as workout activity, exercise logs, heart rate, body measurements, nutrition information and other fitness metrics. This information is collected only with your explicit consent and is used to provide core app features, including fitness and nutrition tracking, personalised programs, progress insights and cross-device synchronisation.

We do not sell or share your health-related data with third parties for advertising or marketing purposes. Health-related data may be processed by Everfit and authorised infrastructure and service providers solely to deliver, operate, secure, maintain and support the Nelia app, subject to appropriate data processing agreements.

Health-related information is protected using appropriate technical and organisational security measures. Access is limited to authorised personnel and service providers who require access to provide, secure or support the service.

If you request deletion of your account, your associated personal and health-related data will be deleted from active systems. Some information may temporarily remain in backups or be retained where required by law, security obligations or legitimate administrative purposes. Retained information will not be actively used for unrelated purposes and will be deleted or anonymised when it is no longer required.

If you participate in the Nelia community, we may process:

• Profile information
• Posts
• Comments
• Messages
• Photos or other content you choose to share
• Reports or moderation enquiries

Content shared in community areas may be visible to other Nelia members.

You should avoid sharing sensitive personal or health information that you do not want other members to see.

Live sessions and group calls

If you participate in live sessions, group calls or other Nelia events, we may process:

• Your name
• Your email address
• Registration information
• Questions or information you voluntarily share during the session

You will be informed separately if a session is recorded.

Payment and subscription information

• Payment status
• Transaction reference
• Membership status
• Subscription period
• Payment date
• Amount paid
• The last digits of your payment card, where provided by the payment provider

Technical and usage information

When you use the Nelia website or app, certain technical information may be collected automatically, including:

• IP address
• Device type
• Operating system
• Browser type
• App version
• Language and time zone
• Login and security logs
• App interactions
• Feature usage
• Crash reports
• Diagnostic information
• Approximate location derived from technical information, where applicable

This information is used to operate, secure, maintain and improve Nelia.

Website enquiries and newsletters

If you contact us through the website or sign up for emails, we may collect:

• Name
• Email address
• The content of your enquiry
• Your communication preferences

Marketing emails will only be sent where we have a valid legal basis, normally your consent.

You can unsubscribe at any time by using the unsubscribe link in an email or by contacting us.

3. Where we receive personal data from

We primarily collect personal data directly from you.

We may also receive information from:

• Your use of the Nelia app and website
• Health services or wearable devices that you choose to connect
• Payment providers
• Apple, Google or another account provider
• Everfit, which provides the underlying technology platform for Nelia
• Customer service, email and communication providers

We do not receive information from connected health services unless you have granted the relevant permission.

4. How and why we use personal data

To provide Nelia

We use account, subscription and onboarding information to:

• Create and manage your account
• Provide your membership
• Give you access to workouts, programs, nutrition content, recipes and educational content
• Recommend or assign suitable programs
• Provide habit and progress tracking
• Provide community features
• Manage your subscription
• Provide customer support
• Send important information about the service

The legal basis is that the processing is necessary to enter into or fulfil our agreement with you.

To process health-related information

We use health, fitness, nutrition and progress information to:

• Personalise workout and nutrition features
• Recommend suitable content
• Provide progress tracking
• Display health and activity information
• Provide wearable and health-service integrations
• Help you use the tools and programs you have selected

The legal basis is your explicit consent.

You may withdraw your consent at any time.

Withdrawing consent does not affect processing that took place before the consent was withdrawn. However, it may mean that certain Nelia features can no longer be provided.

To process payments and comply with legal obligations

We process payment, transaction and subscription information to:

• Process payments
• Administer subscriptions
• Handle cancellations and refunds
• Respond to payment enquiries
• Comply with accounting and tax obligations
• Establish, exercise or defend legal claims

The legal basis is fulfilment of our agreement with you and compliance with legal obligations.

To protect Nelia and its users

We process account, technical and usage information to:

• Secure accounts and systems
• Detect unauthorised access
• Prevent fraud and misuse
• Investigate errors and security incidents
• Enforce our terms
• Protect Nelia and its users

The legal basis is our legitimate interest in maintaining a safe and reliable service.

To improve the service

We may use technical, usage, aggregated or anonymised information to:

• Understand how Nelia is used
• Identify technical problems
• Improve existing features
• Develop new features
• Improve the user experience

Where analytics involves cookies or similar technologies that require consent, we will request your consent before using them.

Health-related data will not be used for advertising or marketing.

Marketing

We may send information about Nelia, new programs, content, launches or offers where you have given consent or where otherwise permitted by law.

The legal basis is normally your consent.

You may withdraw your consent or unsubscribe at any time.

Push notifications

If you enable push notifications, we may send:

• Workout reminders
• Habit reminders
• Community notifications
• Membership information
• Service updates
• Other app-related notifications

You can disable push notifications through the app or your device settings.

5. Everfit and other service providers

Nelia uses technology provided by Everfit Technologies, Inc.

Everfit processes personal and health-related information on behalf of Elena Mellingen AS to provide and support features including:

• User accounts
• Onboarding
• Workouts and training programs
• Nutrition features
• Food and habit tracking
• Progress tracking
• Community features
• Messaging and communication
• Technical support
• Hosting and platform security

Everfit processes this information according to our instructions and the applicable Data Processing Agreement.

Everfit uses authorised infrastructure and service providers to host, operate, secure, monitor and support its platform. Everfit maintains a current list of its subprocessors.

For limited purposes relating to its own legal obligations, platform administration or security, Everfit may process certain account or technical information as an independent data controller. Such processing is governed by Everfit’s own Privacy Policy.

We may also use service providers for:

• Payment processing
• Website hosting
• Cloud hosting and storage
• Email and customer communication
• Customer support
• Security and technical monitoring
• Analytics, where permitted
• Push notifications
• Video meetings and live sessions
• Accounting and administration

These providers may only process personal data for the agreed purposes and in accordance with applicable contracts and data protection requirements.

6. Apple, Google and connected services

Apple, Google, wearable providers and other connected services may process information independently when you:

• Download or update the Nelia app
• Use an app store
• Purchase a subscription through an app store
• Enable push notifications
• Use a sign-in service
• Connect a health service or wearable device

Their processing is governed by their own privacy policies, terms and account settings.

Nelia only receives information from connected health services where you have granted the relevant permission.

7. How we share personal data

We may share personal data with:

• Everfit and its authorised subprocessors
• Payment providers such as Stripe
• Apple or Google where you purchase through an app store
• Hosting, communication, support and security providers
• Connected health or wearable services that you choose to use
• Professional advisers such as accountants, auditors or legal advisers
• Public authorities where disclosure is required by law
• A buyer or successor if the business is sold, merged or reorganised

Health-related information may be processed by authorised infrastructure and service providers solely to deliver, operate, secure, maintain and support Nelia.

8. International transfers

Everfit and some of its subprocessors are located in the United States or other countries outside the European Economic Area.

This means that personal data may be transferred to or processed in countries that have different data protection rules from Norway.

Everfit’s Data Processing Agreement incorporates the European Commission’s Standard Contractual Clauses for relevant transfers.

9. How long we keep personal data

We keep personal data only for as long as necessary for the purpose for which it was collected.

In general:

• Account and membership information is retained while your account or membership is active.
• Health, fitness and progress information is retained while needed to provide the features you use.
• Payment and accounting records are retained for the period required by accounting and tax laws.
• Customer service and communication records may be retained for as long as necessary to respond to enquiries, document agreements or handle disputes.
• Marketing information is retained until you withdraw your consent or unsubscribe.
• Technical and security logs may be retained for a limited period where necessary to protect the service and investigate incidents.

• Future renewals and payments will stop.
• You will continue to have access to Nelia until the end of the subscription period you have already paid for.
• Cancelling your membership does not automatically delete your Nelia account.
• Cancelling your membership does not automatically delete the personal or health-related information associated with your account.

If you also want your account and personal data to be deleted, you must submit a separate account deletion request.

11. Account deletion

The Nelia website may use cookies and similar technologies.

Necessary cookies may be used to:

• Operate the website
• Maintain security
• Remember essential settings
• Enable account functions
• Enable checkout and payment functions

Analytics or marketing cookies will only be used where permitted and, where required, after you have given consent.

You can manage your choices through the cookie settings available on the website.

You can also restrict cookies through your browser settings, but this may affect how parts of the website function.

13. How we protect personal data

We and our service providers use appropriate technical and organisational measures to protect personal data from:

• Unauthorised access
• Unauthorised disclosure
• Alteration
• Loss
• Misuse
• Destruction

These measures may include:

• Access controls
• Individual user accounts
• Confidentiality obligations
• Encryption during transmission
• Security monitoring and logging
• Password requirements
• Controlled development and release procedures
• Backup and recovery procedures
• Security incident management

No online service can guarantee complete security.

You are responsible for keeping your password confidential and should contact us if you believe your account has been accessed without permission.

14. Your privacy rights

Depending on the circumstances, you may have the right to:

• Request access to your personal data
• Request correction of inaccurate or incomplete information
• Request deletion of personal data
• Request restriction of processing
• Object to processing based on legitimate interests
• Withdraw consent
• Receive certain information in a structured, commonly used and machine-readable format
• Request that certain information is transferred to another data controller
• Lodge a complaint with a data protection authority

Withdrawing consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

To exercise your rights, contact:

kundeservice@nelialifestyle.no

We may ask you to verify your identity before processing your request.

We will respond within the time limits required by applicable data protection law.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority, Datatilsynet.

16. Contact us

Questions, requests or complaints concerning privacy and personal data can be sent to:

Elena Mellingen AS
Organisation number: 938 125 767
Mosamyra 36
5392 Storebø
Norway

Email: kundeservice@nelialifestyle.no