Privacy Policy

This policy applies to BARE WELLNESS Yoga Club LLC, a company registered in the United Arab Emirates, operating a yoga and Pilates studio on Saadiyat Island, Abu Dhabi (“BARE WELLNESS”, “we”, “us”).

For privacy enquiries: privacy@barewellness.ae

We collect the following categories of personal data:

• Account data — name, email, phone number, and the magic-link authentication token used to sign you in.
• Member profile data — date of birth, emergency contact, optional medical notes you choose to share with us, and your marketing consent preference.
• Payment data — we do not store full card numbers. Payments are processed by Stripe; we receive a customer ID, the last four digits of the card, the brand, and the billing address.
• Booking and attendance data — classes you book, attend, cancel, or no-show; waitlist entries; check-in timestamps.
• Waiver records — the version of the liability waiver you accepted, the timestamp, your IP address, and your browser user-agent string. We retain these as proof of consent.
• Technical data — server logs, IP address, browser/device information, and basic interaction events for operating the site.

• To operate your membership and process bookings.
• To process payments and issue receipts.
• To send transactional communications (booking confirmations, reminders, cancellations, waitlist promotions, payment receipts, password-free sign-in links).
• To enforce studio policies (late cancel, no-show, freeze).
• To comply with UAE legal obligations (tax records, consumer protection, health-and-safety waivers).
• With your separate, opt-in consent, to send marketing communications about events and offers.

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and its executive regulations, we process your data on the following bases:

• Performance of a contract — to deliver the services you purchase from us.
• Legal obligation — to retain tax and accounting records.
• Consent — for marketing communications and any optional sensitive data you choose to share (e.g. medical notes).
• Legitimate interests — for fraud prevention, security monitoring, and improving the service.

We share only what is strictly necessary with the following processors, each bound by their own data-protection commitments:

• Stripe Payments Europe, Ltd. — card processing, subscription billing, tax calculation.
• Resend — transactional email delivery (sign-in links, booking notifications, receipts).
• Neon (Postgres) — primary database hosting.
• Vercel — web application hosting, CDN, and platform infrastructure.

We do not sell your personal data, and we do not share it with advertising networks.

Some of the processors above may store or process data outside the UAE (typically in the European Union or United States). Where this occurs, we rely on the processor’s contractual safeguards, including Standard Contractual Clauses where applicable, to ensure your data receives an equivalent level of protection.

• Active account data — for as long as your membership or account remains active, and 12 months after final cancellation.
• Tax and payment records — 7 years, as required by UAE tax law.
• Waiver records — for as long as you may attend classes and 5 years after final attendance, for evidentiary purposes.
• Marketing preferences — until you withdraw consent or we close your account.
• Server logs — typically 30 days.

Under the UAE PDPL you have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• request deletion (subject to legal retention obligations);
• restrict or object to certain processing activities;
• data portability where technically feasible;
• withdraw consent at any time, without affecting prior processing;
• lodge a complaint with the UAE Data Office if you believe your rights have not been respected.

To exercise any of these rights, email privacy@barewellness.ae. We will respond within 30 days.

We use only strictly necessary cookies for authentication and security (e.g. your session token). We do not use advertising or cross-site tracking cookies. If we add analytics in future, we will update this policy and present a cookie consent banner.

We use industry-standard measures including TLS encryption in transit, encryption at rest in our database and storage providers, role-based access control, and security logging. No system is perfectly secure; please use a unique, strong magic-link email account and keep your email secure.

Our services are intended for adults (18+). Minors may attend studio classes only when booked by, and accompanied or supervised by, a parent or guardian whose membership or package account is used.

We may update this policy from time to time. When we do, we will update the “Last updated” date above and notify active members by email if the changes are material.

BARE WELLNESS Yoga Club LLC
Saadiyat Island, Abu Dhabi, United Arab Emirates
privacy@barewellness.ae