LVL Privacy Policy

This Privacy Policy was last changed [26 Jun 2024].

1  Who we are

Switch Lifestyle ME FZ LLC (registered office address: Fujairah Creative Tower P.O. Box 4422 Fujairah) (we, us, our or LVL) provides an online platform via our website (available at www.lvl-wellbeing.com ) or any other website, device or platform provided from time to time (the Site), that provides live-streamed and archived wellness and fitness sessions and other related content as well as other services that we may provide in relation to this content, such as corporate customer support, social media, community channels and other websites that we may operate from time to time (together the Services). Providing these Services involves the collection and processing of personal data.

Subscription to the Services is only available to corporate members and all subscription packages are purchased by a company that intends to offer the platform as part of their employee wellness benefits or customer benefits programs to individual users.

In this Privacy Policy we refer to employees of corporate members who we liaise with in relation to the corporate subscription and contracts as B2B Contacts and individuals who utilise the Services or access the Site as Users. Our third party partners will provide sessions as part of the Services and they are referred to as Partners in this Privacy Policy. Unless otherwise stated, all sections of this Privacy Policy are applicable to B2B Contacts, Users and Partners.

LVL values the trust you place in us and the protection of your privacy rights in respect of any personal data we process about you. Please carefully read this Privacy Policy to understand how we use and share your personal data and the measures we take to protect it.

This Privacy Policy sets out how LVL, as data controller, collects and uses your personal data, why we use it, when we share it, the rights to which you may be entitled and your choices about our use of your personal data.

This Privacy Policy covers our use of your personal data when:

• you enquire about and/or enter into a corporate subscription with us for the Services if you are a B2B Contact;

• you register for an account with us and use our Site and Services if you are a User;

• when you get in touch with us including via our Site contact form, by email, social media or by phone (if you are a B2B Contact, User or one of our Partners);

• you enquire about or enter into a partner agreement with us to provide content and sessions to our Users (if you are a Partner); and

• we collect analytics information through cookies and similar technologies when you browse the Site.

Please see:

• Your LVL User terms and conditions (if you are a User) for information relating to the contractual relationship between you and us in respect of your use of the Services and/or Site;

• Your corporate agreement (if you are a B2B Contact) for information relating to the contractual relationship between our corporate customer and LVL in respect of the Services;

• Your partner agreement (if you are a Partner) for information relating the contractual relationship between you and us in respect of you providing content and sessions to Users; and

• Our Cookie Policy for information relating to our use of cookies and similar technologies on this Site.

2  How we collect and use your personal data

Data Collection and Usage

We will collect and use your personal data when you enquire about and/or enter into a corporate subscription with us, you enquire about and/or enter into a partner agreement with us, register for an account with us and use our Site and Services, and when you get in touch with us including via our Site contact form, by email, social media or by phone and from cookies as described in the Cookie Policy.

If you are a User, LVL may also be provided with your personal data by our corporate customers when they sign up to our Services in order to enable you to register an account and use our Services. Our corporate customers will only share your personal data with us if they have previously informed you about this data sharing (e.g. your employer will inform you they will share certain personal data with us (such as name, email address, role) to enable you to register and sign up to use the Services).

As a LVL user, we collect personal and sensitive user data through the following methods:

• Direct input: Information you provide when creating an account or using our services.
• Wearable device integration: With your explicit consent, we collect health and fitness data from connected wearable devices.
• Health Connect API: If you choose to connect our app with Health Connect, we access specific health and fitness data points as permitted by you.

The table below sets out how we collect your personal data, the types of personal data and how this personal data is used.

If personal data is required to enter into a contract with you or otherwise provide Services to you we may be unable to enter the contract or provide Services if you fail to provide the requested personal data. We will inform you if this is the case.

3  Our legal basis for using your personal data

We rely on the following lawful bases under data protection law for our use of your personal data:

Consent: you have given your consent to the processing;

Performance of a contract: it is necessary for the performance of and compliance with your contract with us or in order to take steps prior to entering into that contract;

Legal or Regulatory Obligation: we need to process your personal data in order to comply with a legal or regulatory obligation; or

Legitimate Interests: it is necessary for our legitimate interests (or those of a third party). Please see section When do we have legitimate interests? below for more information.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

4  When do we have legitimate interests?

We use your personal data where this is necessary for our legitimate interests (or those of a third party). This includes where use of your personal data is necessary to:

• Ensure effective administration and management of our Site;

• Administer our operations and business in an efficient and effective way;

• Manage and administer our Services, Site, Partners and corporate customer arrangements;

• Provide and administer accounts on our Site for Users;

• Understand how individuals use our Site;

• Understand and respond to queries, complaints and feedback;

• Research and analyse the Services our Users want;

• Organise, collect and analyse responses to our surveys, member panels and workshops;

• Operate competitions for Users;

• Understand how you use our Services;

• Send direct marketing to B2B Contacts;

• Improve and develop our Services;

• Maintain a public profile;

• Transfer personal data in relation to an actual or proposed sale, transfer or re-organisation of all or part of our business and the acquisition of the business;

• Ensure network and information security; and

• Enforce our legal rights and manage any dispute and legal claims and take legal or other professional advice.

5  Children’s Privacy

Our Site is not intended for anyone under the age of 18, and we do not knowingly collect data relating to children under the age of 18. No one under age 18 may provide any personal data to or on our Sites without legal parental or guardian consent. If you believe we have collected any Personal Information from a child younger than 18 years of age, please notify us immediately.

6  How long we retain your personal data

We keep personal information for no longer than is reasonably necessary or required by applicable law. How long we keep personal data depends on the type of personal information and the purpose(s) for which we collected it and the applicable legal requirements.

The criteria we use to determine the retention period is as follows:

• the length of time that you are a User of the Site and Services;

• the duration of your contract with us;

• whether there are contractual or legal obligations that exist that require us to retain the data for a period of time;

• whether there is an ongoing legal claim that relates to your relationship with us; and

• whether any applicable law, statute, or regulation allows for a specific retention period.

We may use personal data to generate aggregated and anonymised information to assist in our planning, development and improvement of products and services. This information will cease to be personal data once it is made anonymous and aggregated and may be retained for longer than the retention periods set out above.

7  Legal requirements

Your personal data may be processed if it is necessary on reasonable request by a law enforcement or regulatory authority, body or agency or in the defence of a legal claim. We will not delete personal data if relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved.

8  Information we share

LVL does not sell, rent, or lease your personal data, including any health and fitness data collected through wearable integrations, such as Health Connect, to any third party. We do not share your data with advertising platforms, data brokers, or information resellers.

There are also certain circumstances where we will transfer your personal data to third parties. These include:

• Group companies – so we can provide the best service across our group. We also share your personal data within our group for management forecasting and financial planning purposes – although this would generally be aggregated data where no individual is identifiable.
• Corporate customers – LVL will share your personal data including name and details of sessions attended with the corporate customer that enabled your account. This is the corporate customer whose activation code you used when signing up for an account on our Site to use our Services. The information shared with corporate customers is limited and provides information about how many Users have signed up for our Services on the corporate account and usage/activity of those Users. In addition, Lvl will share photos (including screenshots) and videos of sessions with our corporate customers so that our corporate customers can use these for the purposes of internally promoting the Services, for employee engagement purposes and for external brand promotion purposes including in printed publications, on its website and social media channels;
• Partners (Wellbeing Coaches) – LVL will share your personal data with our Partners. Our Partners provide sessions through our Site. We will share limited personal data with our Partners in order to provide information for Partners on which Users attend their sessions and about attendance of their sessions (including names of Users who attend sessions and numbers attending).
• For data accessed through wearable integrations, such as Health Connect, we only transfer this data to third parties when necessary to provide or improve the specific features you use in our application. This data is never used for any other purpose. Any such transfers are conducted with appropriate safeguards in place to protect your privacy and in compliance with applicable data protection laws.
• Other service providers – We may engage carefully selected third-party service providers to process your personal data on our behalf, including IT and infrastructure providers, data management and analytics services, customer support tools, payment processors, security and compliance services, and professional advisors. These providers are contractually obligated to maintain data confidentiality and security, and may only use your data as necessary to provide services to us. For services accessing sensitive data like health information, we implement strict data protection measures and limit sharing to what’s essential for specific features you use. We do not sell your data to these providers or allow its use for their own purposes. All data sharing complies with applicable laws and our privacy standards. You can contact us for more information about our specific service providers.

Our suppliers and service providers will be required to meet appropriate standards on processing information and security when processing your personal data. The information we provide them, including your information, will only be processed in connection with the performance of their function. They will not be permitted to use your information for any purposes other than those outlined in this Privacy Policy.

Your personal data may be transferred to other third party organizations in certain scenarios, such as:

• If we’re discussing selling or transferring part or all of our business – the information may be transferred to prospective purchasers under suitable terms as to confidentiality;
• If we are reorganized or sold, information may be transferred to a buyer who can continue to provide services to you;
• If we’re required to by law, or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority  for example the Police e.g. in order to assist fraud protection and minimize credit risk; or
• If we are defending a legal claim your information may be transferred as required in connection with defending such claim.

We may share aggregated, anonymized data sets that provide population-level insights and trends. These data sets are carefully curated to exclude any individually identifiable information. For example, we may share overall wellness trends, but we employ strict data thresholds and statistical techniques to prevent any possibility of linking this aggregate information back to specific individuals. This approach allows us to provide valuable insights while rigorously protecting individual privacy. Your personal, identifiable data is never shared in these aggregated reports.

9  Data Protection and Security

We implement robust security measures to protect your personal and sensitive data, including:

• Encryption: All sensitive data, including health and fitness information, is encrypted both in transit and at rest using industry-standard encryption protocols.
• Access controls: We employ strict access controls and authentication measures to ensure only authorized personnel can access user data on a need-to-know basis.
• Secure data storage: All data is stored in secure, access-controlled environments with regular backups.

10  Your rights

You have a number of rights in relation to our handling of your personal data. These rights are not applicable in all circumstances and exemptions may apply.

Depending on your location, your rights may include the following:

• Access: you are entitled to ask us if we are processing your personal data and, if we are, you can request access to your personal data (commonly known as a data subject access request). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

• Correction: you are entitled to request that any incomplete or inaccurate personal data we hold about you is corrected.

• Erasure: you are entitled to ask us to delete or remove personal data in certain circumstances. There are also certain exceptions where we may refuse a request for erasure, for example, where the personal data is required for compliance with law or in connection with claims.

• Restriction: you are entitled to ask us to suspend the processing of certain of your personal data about you, for example if you want us to establish its accuracy.

• Transfer: you may request the transfer of certain of your personal data to another party in some circumstances.

• Objection: where we are processing your personal data based on a legitimate interest (or those of a third party) you may object to processing on this ground. However we may be entitled to continue processing your information based on our legitimate interests.

• Withdraw consent: where you have provided your consent to the collection and processing of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.

You may also have a right to lodge a complaint with a supervisory or regulatory authority.

In particular if you are an EEA or UK resident you may lodge a complaint with the supervisory authority in the UK or Member State in the European Union where you are habitually resident, where you work or where an alleged infringement of data protection legislation has taken place.

11  Direct Marketing

LVL values your privacy and aims to provide you with control over the communications you receive from us. We may send you different types of communications based on your relationship with us and your communication preferences:

Service Communications:

We will send you essential service-related communications regarding your account, service updates, and transaction confirmations. These messages are necessary for the operation of our service and cannot be opted out of while you maintain an active account.

Marketing Communications:

With your consent, we may send you marketing communications about our products, services, and special offers that we believe may interest you. These may include:

• Email newsletters
• Push notifications (if you’ve installed our mobile app)
• In-app messages
• SMS messages (where you’ve provided your mobile number for this purpose)

You have control over these marketing communications:

• When you create an account or use our services, you’ll have the opportunity to choose your communication preferences.
• You can update your preferences at any time through your account settings or by contacting our support team.
• Each marketing email we send includes an unsubscribe link, allowing you to opt out of future marketing emails.
• You can disable push notifications through your device settings.

Personalization:

To make our communications more relevant to you, we may use information about your interactions with our service to tailor the content of our marketing messages. This personalization is based on your usage patterns and preferences within our platform.

Changes to Your Preferences:

You can change your communication preferences at any time by:

• Adjusting your settings in your account dashboard
• Clicking the “unsubscribe” link in any marketing email
• Contacting our customer support team at hello@teamlvl.com

Please note that even if you opt out of marketing communications, we may still contact you for service-related matters, such as billing information, account management, or responses to your requests.

We respect your choices and aim to only send you communications that you find valuable. If you have any questions about our communication practices, please don’t hesitate to contact us.

12  Wearable integrations

LVL integrates with wearable devices to allow for automatic tracking of activities you complete. To achieve this, we request your explicit permission to access specific data points such as steps taken, heart rate, sleep data (if applicable), and distance traveled. We consider data that reveals details about your health or well-being to be sensitive.

Key points regarding our handling of this data:

• Consent: We only collect data you explicitly agree to share. You can revoke access at any time.
• Transparency: We clearly explain what data we collect and how we use it within the app.
• Data Minimization: We only collect and store the minimum amount of data necessary to provide the automatic activity tracking features.
• No Sale of Data: We do not sell your Health Connect or wearable data to any third party.
• Limited Use: This data is only used to provide or improve features within our app, such as personalizing your experience, providing insights, and suggesting relevant wellness goals.
• Security: We implement industry-standard security measures, including encryption, to protect your data from unauthorized access, use, disclosure, alteration, or destruction.
• Third-Party Sharing: We only share this data with third parties when necessary to provide or improve the specific features you use in our application. It is never shared for advertising or any purpose unrelated to app functionality.
• Employer Access: We only share aggregated population-level information to identify trends and insights to your employer. LVL ensures data thresholds are in place to protect any linkage of aggregate wearable-related data to individual employees.

By using these integrations, you agree to our collection and use of this data as described in this policy. You can disable these integrations at any time through your device or app settings.

13  How to contact us

If you want to exercise any of these rights or if you have any questions about this Privacy Policy, please contact us:

• By email at hello@teamlvl.com; or

• By post at: Fujairah Creative Tower P.O. Box 4422 Fujairah

14  Third party links

You might find links to third party websites on our website. These websites should have their own privacy policies which you should check. We do not accept any responsibility or liability for their policies whatsoever as we have no control over them.

15  Changes to the policy

This Privacy Policy may change from time to time and is available on our Site. You can tell when this Privacy Policy was last updated by looking at the date at the top of the Privacy Policy. If we make changes to this Privacy Policy, we will post the updated version on our Site.

If we make a change that significantly affects your rights or, to the extent we are permitted to do so, significantly changes how or why we use personal data, we will notify you by way of a prominent notice on our Site or, if we have your email address, by email.

Any changes to this Privacy Policy will become effective upon posting. We encourage you to review this website from time to time for the latest information.