Privacy Policy

Information you give us — your name, contact details, account and booking records, and payment information when you reserve a class or buy a package.

Information collected automatically — device and browser data, IP address, and usage analytics, including via cookies.

Information from third parties — our booking platform JoinIn2, payment processors, and any social login you choose to use. We do not knowingly collect data from under-18s except through a parent or legal guardian, and the account holder is authorised to exercise her rights on her behalf.

To provide and manage your account, classes and packages; to respond to enquiries and provide support; to send marketing only where you've opted in; to improve and personalise the experience; and to keep the service secure and meet our legal obligations.

We share data only as needed to run the service — with trusted providers such as JoinIn2, payment gateways and email platforms; with analytics partners; with affiliated KARVE entities; and with authorities where required by law. We do not sell your personal data.

KARVE REWARDS runs on information we already hold: your account and booking records, what you have bought, the classes you have taken, and the rewards you have been given and used. From those we work out your tier and your milestones automatically, each night. We do this to run a programme you are a member of, and because we have a legitimate interest in recognising and keeping our members. You can object at any time and we will take you out of the programme.

Your card reaches you as a private link. We record when a programme email is delivered and opened, and whether a link in it was followed, so that we can tell which of our messages are useful and stop sending the ones that are not. You can stop the programme's messages from your card at any time without losing your tier, your classes or any reward you hold.

If you add your card to Apple Wallet or Google Wallet, the pass carries your first name, your tier, your class count and your member code, and we update it when they change. Apple and Google handle the pass on your device under their own terms; they do not receive your booking history.

The studio screen shows first names only, and only when a member reaches a milestone. You can hide yourself from it, from your card.

When a member gives a guest a complimentary class, she gives us the guest's name, mobile number and email; the member is the source of these details. We use them to book that class and contact the guest about it, and, if the guest becomes a client, to check from our own records whether she attended the class and made a qualifying first purchase, so that the member's complimentary class can come back to her. We rely on our legitimate interest in running the programme, and we tell the guest about this when we first contact her directly. If the guest joins, we tell the member that she has joined, using her first name only; we never tell the member what she bought or how much she spent. We treat the guest as not having agreed to marketing until she tells us otherwise herself. A guest who takes a class with us has an account with us, and we keep her details as part of our client records, for the same period as any other client's. A guest may ask us at any time, using the contact details below, to see or delete her details or to stop us using them.

We keep programme records for as long as you are a member, and for the period we are required to keep our business records. Reward and membership records form part of those records.

When you have an InBody scan with us, we collect and keep the measurements it produces: your weight, skeletal muscle mass, body fat mass and percentage, the segmental breakdown by arm, leg and trunk, your visceral fat level, your total and extracellular body water, and the InBody score. We also keep a photograph of the printed result sheet, the date of the scan, and which member of our team recorded it. The scan itself is also stored on the InBody device.

Body-composition data is health data, which Saudi law treats as sensitive personal data. We hold it to give you the service you came for: to show you your result, to explain it, to compare it with your previous scans so you can see what has changed, and to recommend training that suits what the numbers show. We do not use it for advertising, we do not profile you with it, and we never sell it.

We keep your scans for as long as you are a member, and afterwards for the period we are required to keep our business records, because a scan is only useful as part of a series. You can ask us to delete them sooner.

We do not share your scans with anyone outside KARVE unless you have specifically agreed to it. The one case where this arises today is our nutrition programme: if you take part, a qualified nutrition specialist needs your results to build your plan. Before anything is sent we ask you separately, in plain language, naming the specialist, and we record your answer. Consent to that is never bundled into these terms or into any other agreement.

If you agree, only your InBody results and their analysis are shared, and only for as long as your programme with that specialist runs. Nothing else about you is sent. The specialist is an independent practitioner, responsible for your data in her own right and bound by her own professional obligations.

You can withdraw that consent at any time, from your KARVE REWARDS card or by telling us, and it takes effect immediately. Withdrawing stops any further sharing; it does not undo what has already been sent, and it does not affect the rest of your membership.

KARVE can be used through AI assistants (such as ChatGPT or Claude) via our live schedule feed and a read-only lookup tool. When an assistant looks up class times or availability for you, we record analytics that do not identify you directly — which assistant was used, the search terms, the classes shown, and, if you tap a booking link, that click and its approximate city (from your IP address) — so we can understand demand. This is the same kind of analytics we keep for our website.

These AI tools are read-only. They show classes and hand you a booking link, but they cannot book or pay on your behalf and never receive your name, email, phone number or JoinIn2 password. Booking and payment always happen after you sign in to JoinIn2 or the KARVE app, under JoinIn2's own privacy terms. We do not sell this data or use it to identify you individually.

We protect your data with SSL/TLS encryption and restricted access, and store it on secure servers. Where data is transferred internationally, we apply appropriate contractual safeguards.

Under Saudi PDPL you may: know why we collect and process your data and on what legal basis; see your data and get a copy in a clear, readable format; have it corrected, completed or updated; ask us to destroy it once it is no longer needed for the purpose it was collected for; ask us to restrict processing while you are disputing whether the data is accurate, until it is verified; withdraw your consent at any time where processing rests on consent; object to your data being used for direct marketing; complain to the Saudi Data & AI Authority (SDAIA); and seek compensation for damage where the law provides for it. Contact us using the details below and we will respond within 30 days of receiving your request.

We send marketing only with your consent, and you can unsubscribe at any time. We don't share your details with third parties for their own marketing without your permission.

Some of our providers may process or store data outside the Kingdom of Saudi Arabia. Where data is transferred internationally, we apply appropriate safeguards — including contractual protections — so it stays protected to the standard required by Saudi law.

We may update this policy from time to time. Material changes will be communicated through our website or by contacting you directly.

Questions about your data or this policy? Email Karve@alfmile.co or write to us at Midtown Plaza, Prince Sultan Road, Ar Rawdah, Jeddah 23435, Saudi Arabia.