LifePass Privacy Policy

This Privacy Policy explains how LifePass ("LifePass", "we", "us", "our") collects, uses, shares, and protects personal data when you use our website and mobile application. We are committed to protecting your privacy and processing your data in compliance with the EU/EEA General Data Protection Regulation (GDPR) and Icelandic data protection laws.

By using LifePass, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices, please do not use our services.

• Company: Sporta ehf.
• Registration number (kennitala): 490925-1470
• VAT (VSK): 161242
• Address: Hverfisgata 88, 101 Reykjavík, Iceland
• Email: support@lifepass.is

Sporta ehf. is the data controller responsible for your personal data. We determine the purposes and means of processing your personal information.

We collect the following categories of personal data.

A. Information you provide

• Account information: full name, email address, and encrypted password.
• Sign in with Apple or Google: if you choose to sign in with Apple or Google, we receive from them your name (Apple shares it only the first time, and only if you choose to), your email address, and an account ID for your Apple or Google account, which we use only to recognise you when you sign in again. From Google we also receive the link to your Google profile picture, which we do not use. If you choose Apple's "Hide My Email", we receive an Apple forwarding address instead of your own, and the emails we send to it reach you through Apple. We do not receive your Apple or Google password or your contacts. If you sign in with Apple or Google using the email address of an existing LifePass account, both ways sign you in to the same account. If you delete your LifePass account in the app after signing in with Apple, we ask Apple to end the link between your Apple account and LifePass. Apple and Google handle the sign-in itself under their own privacy policies. We keep this data for as long as your account exists, like the rest of your account information.
• Gift recipients: when you buy a visitor pass as a gift, we collect the recipient's name and email address, and any personal message you write, in order to deliver the gift by email and bind the claim to the recipient's email. If you receive a gift, this is data about you supplied by the buyer; we use it only to deliver and honour the gift. After the six-month claim window an unclaimed gift can no longer be claimed; 30 days later the recipient's name, email address and message are deleted. For a gift that was claimed, they are deleted six months after the claim. Only the record that a gift was bought stays with the purchase transaction history, which keeps no copy of them (Section 7).
• Identification number (kennitala): your Icelandic kennitala, which we collect and verify through our identity-verification partner Kenni (auðkenni) when you start a subscription or activate an employer-paid benefit. We use it to confirm your identity, prevent fraud and duplicate or shared memberships, and (for company plans) match you to your employer's authorised-employee list. When you book a class at a partner venue that uses the Abler booking system, we send your kennitala to Abler ehf. and to the venue, so that the booking can be matched to you (see Section 4.C). A check-in sends only a LifePass account identifier, not your kennitala. We also pass your verified kennitala to our payment processor Kling when you start a subscription or save a payment card, as Kling requires it to set up and bill your payment agreement (see Section 4.D). See Section 4.G for how the verification works and Section 3 of our Terms for why it is required. We rely on Article 13 of the Icelandic Data Protection Act No. 90/2018, which permits use of a kennitala where there is an objective reason to identify a person reliably.
• Profile data: language preference, account settings and nationality. Nationality is optional. You can pick one when you sign up, and add, change or clear it at any time in your profile on the website. The website does not fill it in for you or guess it from your email address. Some versions of the app suggest one at sign-up from the country ending of your email address (for example Iceland for an address ending in .is), which you can change or clear before you sign up. Accounts that already existed when we added the nationality field were set to Iceland; if that is not right, change or clear it in your profile on the website. We use nationality only for bookings at partner venues whose booking system needs it (Section 4.B); if such a booking needs it and none is on file, we ask you for it before the booking is made.
• Communications: messages you send to us, support requests, feedback, and reviews (including any photos you attach to them).
• Coach questions and answers: when you use the LifePass Coach in the app, we receive what you give it for that request: the answers you pick for a day plan (your goal, the day and time of day, how long and how hard, a class type, and either a region or "near me"), any words you type or dictate, the changes you ask for (such as "closer" or "show me something else"), and, in a chat, the earlier messages of that conversation. We use them to answer that request, with the help of our AI provider (Sections 3, 4.E and 5). The Coach answers without your name, email address, kennitala or account details, and we do not send them to our AI provider unless you write them in a message or note yourself; your account is used only to check that you are signed in, to see whether it has a membership or a visitor pass (which decides how many Coach requests it can make) and to count your Coach requests. Members and holders of an active visitor pass can make 10 Coach requests a day (the day starts at midnight, Reykjavík time), and any other account can make 3 in any 30 days; building a workout plan counts as one request. To apply those limits, we keep a count of how many Coach requests your account makes each day (the date, the number and the time of the latest one, never what you asked). It is kept for 30 days and deleted with your account (Section 7). We do not store your Coach messages on our servers; a generated day plan may be kept in a cache that is not linked to your account (Section 7). The app keeps your three most recent Coach conversations (a title taken from your first message, the date and the text, without the venue cards) in the app's storage on your device, and in any backup of your device you make, so you can reopen them. They stay there until you delete the app, and signing out does not remove them. Please do not include sensitive personal information in what you write to the Coach. Coach chat is not part of health and fitness tracking and does not need your health consent, so please leave health details, such as illnesses, injuries, medication or pregnancy, out of it; the Coach reminds you of this in the chat. Workout plans, and the questions you answer for them, are part of health and fitness tracking (Section 2.G).
• Health and fitness data (optional): only if you turn on tracking: your weight and height, workout plans and the workouts you log, weekly check-ins, your meal log and, if you connect it, daily summaries from Apple Health. We collect it only with your separate, explicit consent. See Section 2.G.

B. Payment information

• Transaction history, purchase amounts, and subscription details.
• Payment tokens from Kling, including a saved card-on-file reference and limited display details (card brand, last four digits, and expiry month/year) that we retain to charge membership renewals, co-pay monthly shares, and per-visit surcharges/drop-ins without re-entering your card. For memberships and co-pay plans a saved card is necessary to perform the contract (recurring charges); for one-time visitor passes the card is saved by default and you can opt out at checkout; when you pay a per-visit charge on our provider's hosted payment page, the card used is saved for future one-step payments. We do not store full card numbers, CVV, or complete card details. You can remove a saved card at any time (see the Terms, §5.1).

C. Usage data

• Subscription information: plan type, remaining monthly visit allowance, active passes, subscription status, and commitment period dates.
• Booking data: activities booked, booking times, cancellations, headcount, and (for third-party reservation venues) a booking reference issued by the reservation platform.
• Check-in records: venue visits, check-in timestamps, and location of check-in.
• Booking-policy records: late cancellations and no-shows (strikes), and any temporary booking block that results from them (see Section 7).
• Favourites: venues and activities you save.

D. Technical data

• IP address, browser type and version, and operating system.
• Device identifiers and type.
• Pages visited, time spent, referring URLs, error logs, and performance data.
• If you arrive through an affiliate or partner link, a record of that arrival: the partner, the page you landed on, the date and time, and a keyed code (a hash made with a secret key) of your IP address or, when your IP address is not available to us, a keyed code derived from your browser string together with a technical marker noting that the fallback was used. See Section 6.

E. Cookie data

• Session identifiers and authentication tokens.
• Preferences and settings.
• Analytics data, with your consent.

F. Location and device permissions

• Precise location (GPS): if you use a "near me" feature ("find venues near me" on the map, or "Near me" and "Show distances" on the Browse page), your browser or device asks your permission to share your precise location. If you have already given the website that permission, the Browse page uses your position when it opens, without asking again. We use it only in the moment: to centre the map, to sort venues by distance, to show how far away the venue of each class is, and in the app for the Coach features described below. On the Browse page the distances are worked out in your browser, and your position is not sent to us. We do not store your GPS coordinates or track your location in the background. You can decline, or revoke the permission later in your browser or device settings; the map and the Browse page still work without it.
• Location for Coach plans near you: when you ask the Coach for a plan "near me", the app sends your position to our server, and our server rounds it to about a kilometre before anything else reads it. Only that rounded position is used, for that request only, to find nearby venues, classes and sights. Neither the position your device sent nor the rounded one is written to our database or logs. Our AI provider receives at most the name of the nearest town and the region (or, if you are more than 100 km from every place we list, only that you are outside Iceland), together with the places we picked nearby, and never your coordinates or your distance from any place. So that you can ask for a change to a plan without us keeping your position, the rounded position is returned to your device inside the plan's reference and comes back to our server only if you ask for a change. If you prefer, pick a region instead and no position is sent.
• Location for Coach searches within a short drive: when you ask the Coach in the app for venues within a short drive, the app uses your device's precise location on the phone and asks Apple Maps for the driving time from there to up to 20 of the nearest venues. Apple receives your position and those venues' locations under Apple's own terms. LifePass does not receive or store your position for this search. If the app has no location fix, it measures from central Reykjavík instead.
• Microphone and speech recognition: in the app you can dictate a message to the Coach instead of typing. With your permission, the app uses Apple's speech recognition to turn your speech into text, on your device where your device supports it and otherwise through Apple under Apple's own terms. The text appears in the message field and is sent to us only if you send it. LifePass does not receive or store the recording.
• Camera: checking in at a Venue uses your device camera to scan a QR code. We process the scan to validate your booking; we do not record, store, or transmit camera images. You can decline camera access and ask Venue staff to check you in manually. If you use the meal log (Section 2.G) in versions of the app that include the meal scanner, the app's camera also reads a food barcode or takes a photo of a meal, when you choose: a barcode is read on your phone, and a meal photo is handled as Section 2.G describes. You can also pick one photo from your library instead; the app then receives only that photo, not access to your library.
• Apple Health: in versions of the app that include Apple Health, if you connect it for tracking, the app asks Apple's permission to read the data types listed in Section 2.G, and reads only the ones you allow. You can change what LifePass may read at any time in the Health app on your iPhone. Tracking works without it.
• Notifications: if you allow notifications in the LifePass app, the app schedules its reminders on your device itself (local notifications), for example shortly before a class you booked starts, before unused monthly visits run out, a few days after you install the app if you have not yet chosen a plan or pass, or, if you use a workout plan, on workout days and for the weekly check-in. The app works them out from information it already holds. We do not collect or store a push notification token, and these reminders are not sent from our servers. You can turn notifications off at any time in your device settings.
• Map tiles: map features on the website load tiles and styles from Mapbox (see Section 4.E), which receives the technical request data necessary to serve the map. Maps in the iOS app are drawn with Apple Maps (MapKit), and Apple receives the technical request data necessary to serve them under Apple's own terms.

G. Health and fitness data (Coach tracking)

Members can turn on health and fitness tracking in their account on the website and in versions of the LifePass app that include it: a workout plan of 4, 8 or 12 weeks, a log of the workouts you do, a weight log, weekly check-ins, a meal log (with calorie estimates from a photo of your meal, a description of it in words, a food barcode or our food list) and, if you choose, daily summaries from Apple Health. This is health data, a special category of personal data under Article 9 GDPR and Article 3, point 3, of the Icelandic Data Protection Act No. 90/2018. We process it only if you turn tracking on and give your separate, explicit consent, and only to build and adjust your own plan, keep your logs and show you your progress. Tracking is optional: your membership, venues, classes and the Coach's chat and day plans all work without it.

Where you manage it. You manage tracking in your account on the website and in versions of the LifePass app that include tracking. In your account on the website you can turn it on or off, download your data and delete it, at any time and whichever version of the app you have. Workout plans, the meal photo and barcode scanner and Apple Health are in versions of the app that include them.

Legal basis. Your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR, and Article 11(1), point 1, of Act No. 90/2018). You give it in your account on the website or in versions of the app that include tracking, by ticking a box and turning tracking on. We record when you gave it, which version of the consent text you were shown, and whether your age was confirmed by your verified kennitala or by you. You can withdraw it at any time (see "Your choices" below); withdrawing does not affect processing before it.

Who can use it. Members aged 18 or over with an active membership, including a free trial, a membership paid by an employer and a co-pay plan. Tracking is not included with visitor passes. If your kennitala is not verified, you confirm that you are 18 or older when you turn tracking on. If your membership ends, or a renewal payment has not gone through, you can still see, download and delete what you stored, but you cannot add to it until your membership is active again.

What we store.

• Body log: your weight and, if you give it, your height, with the date and where each entry came from (you, the weekly check-in, the plan questions or Apple Health).
• Workout plans: your answers to the plan questions (goal, focus, experience, how many weeks, how many days a week and on which weekdays, and whether you train in a gym, in classes, in a pool or outdoors), your age range if your kennitala is not verified, your sex and daily activity level if you give them, and the plan built from them, including the calorie and protein targets our code works out from your body log.
• Safety questions: before building a plan, the app asks about medical conditions or medication, injuries, pregnancy or breastfeeding, and any history of an eating disorder. Your answers are used once, to decide whether a plan can be built and how gentle it should be, and are then discarded. We keep only the outcome: whether the plan is a gentle one, and which body areas it leaves out. If you answer yes to pregnancy or breastfeeding, or to a history of an eating disorder, the app also turns off food and weight in your monthly feedback. We store only that setting, which you can turn back on, never the answer.
• Workouts: each planned workout and whether you did, moved or skipped it (with the reason you picked), how long it took, the sets, repetitions, times, distances and weights you log, how it felt, and any extra workouts you add. When you check in at a venue on a workout day, or Apple Health records a workout, we may mark that day's workout as done.
• Weekly check-ins: your rating of the week and a summary of it: workouts planned and done, your average weight and its change, your average calories and protein, how many times you checked in at a venue, and how many weeks in a row you have trained.
• Monthly feedback: on the 1st of each month, our code writes you a short look back at the month before from what you stored: workouts planned and done, venue visits, sleep and steps from Apple Health if you connected it, the days you logged food and how they compared with your calorie and protein targets, and your weight trend towards any target weight. In the middle of a month it may also leave at most one short note, when a clear pattern shows, such as two weeks of short nights. Both are written by fixed rules, never by AI, and shown only to you. We store which lines were chosen and the numbers behind them, and whether you have opened them. You can turn the report and the note off, or leave food and weight out, under Body and goals. Food and weight are only included once you have made a workout plan with the Coach, which asks the safety questions above, or if you switch them on yourself.
• Meal log: each meal's foods, amounts, calories and nutrients, which meal it was and when you ate it; for a scanned product, the barcode and the product details from Open Food Facts; and foods you create yourself, which are saved with the meal you logged them in.
• Calorie goal and food list: a calorie goal you set outside a plan (the goal, your sex, age range and activity level, and any calorie number of your own), and the foods you removed from your own food list.
• Target weight: if you choose to give one when your goal is to lose or gain weight, the weight you are aiming for, when you set it, and the date a weigh-in first reached it. Our code uses it only to ease your calorie target off as you get close, to switch to a target that keeps your weight steady once you reach it, and to show a rough estimate of how many weeks it may take.
• Apple Health: daily summaries, if you connect it (below).

What reaches our AI provider, and what never does. Workout plans and meal estimates are made with Anthropic, our AI provider (Section 4.E). Before anything is sent, we take out everything that says who you are. The numbers in your plan (the workouts, sets and repetitions, and the calorie and protein targets) are worked out by our own code from a reviewed exercise and food library; the AI writes the plan's short texts and may swap an exercise for another one from the same library.

• For a workout plan, Anthropic receives your goal, focus and experience, how many days a week and how many weeks, the kinds of places you train in, your age range (for example 25 to 34), your body mass index range (for example 25 to 29.9), your daily activity level, the language, and the outline of the plan: for each week, how hard it may be and which days of the week are training days and which are rest days, the exercises our code picked, and other exercises from the same library that the AI may swap in.
• For a meal estimate, Anthropic receives the photo, which meal it is (for example lunch) and the language, and sends back a list of foods with estimated amounts and nutrients.
• For a meal you describe in words, Anthropic receives the words you type or dictate, which meal it is and the language, and sends back the same kind of list.
• Anthropic never receives your name, email address, kennitala, phone number or any account or plan identifier; your exact weight, height or age, or your target weight; your answers to the safety questions or your sex; the calendar dates of your plan (Anthropic sees only which days of the week are training days); your location; notes or anything you type for a plan; your meal log (apart from the words of a meal you describe, as above); your monthly feedback; or any data from Apple Health.
• Coach chat is different: chat messages are sent as you write them (Section 2.A), so please leave health details out of chat.

Meal photos. The app makes the photo smaller and removes hidden details, such as where and when it was taken, before sending it. Our server accepts only a small JPEG image (at most 1,568 pixels on its longest side), removes any such details again, and sends the photo to Anthropic for that one estimate. The photo is processed in memory: it is never written to our database, file storage, caches or logs, and it is discarded as soon as the estimate comes back, whether or not the estimate worked. Anthropic, which makes the estimate, receives the photo as our processor and deletes it within 30 days under its standard retention, with the exceptions in Section 4.E. We keep only the estimate, as a draft meal for you to check and save; a draft you never save is deleted after 30 days. Each member can make 10 photo estimates a day.

Meal descriptions. If you describe a meal in words instead of searching for it, the words you type or dictate are sent to Anthropic for that one estimate, with the meal and the language. Describe only the food: words that look like an email address, a link, a phone number or a kennitala are not sent at all. Your words are processed in memory: they are never written to our database, caches or logs. Anthropic receives them as our processor and deletes them within 30 days under its standard retention, with the exceptions in Section 4.E. We keep only the estimate, as a draft meal for you to check and save; a draft you never save is deleted after 30 days. If you turned on tracking before this feature existed, or in a version of the app without it, we ask you to accept this with one tap before your first description; if you turn it on later, the consent screen includes it. Each member can describe 15 meals a day. An estimate is general fitness guidance, not medical advice.

Barcodes. When you scan a food barcode, your phone looks the product up directly in Open Food Facts (Section 4.J), which receives the barcode, your phone's internet address and the version of the app, and nothing else. At the same time our server checks whether you have logged that barcode before. If you add the product to a meal, its name, brand and nutrition values are saved with that meal.

Apple Health. If you connect Apple Health on your iPhone, the app reads only the types you allow in Apple's permission screen, and only these: sleep, steps, active energy, resting heart rate, heart rate variability, body weight and workouts. It never writes to Apple Health. Watches, rings and scales from other makers work only through Apple Health; LifePass has no direct connection to any of them. The app turns each day into one summary: minutes asleep and in bed, when the night started and ended, steps, active energy, resting heart rate, heart rate variability, your weight and when it was measured, and your workouts (when each started, how long it lasted, what kind it was, its energy and distance), each with the name of the device maker. Individual readings, such as your heart rate through the day, stay on your phone: we receive and keep only the daily summaries.

We use the summaries to show your sleep, recovery and activity in the app, in your monthly feedback and in your account on the website, to make that day's workout lighter after a short night or a low recovery estimate, to mark a planned workout as done when Apple Health recorded it, and to add weigh-ins recorded in Apple Health to your body log. They are never sent to our AI provider and never used for advertising or marketing. We also keep a record that Apple Health is connected (Section 7), including a one-way code for each iPhone allowed to send data, so that an iPhone later signed in to another account cannot send data to yours. You can disconnect it at any time in your account on the website or in versions of the app that include Apple Health, and choose whether to delete the stored summaries. Weigh-ins already added to your body log stay there like any other weigh-in: until you delete them, turn tracking off or ask us to delete your account, or until the retention period in Section 7 ends.

Not medical advice. Plans, targets, estimates and monthly feedback are general fitness guidance, worked out by rules and, for plan texts and photo estimates, with AI. They can be wrong, and they are not medical advice (see Section 4.11 of our Terms).

Your choices.

• Turn tracking off at any time under Body and goals, in your account on the website or in versions of the app that include tracking. Turning it off withdraws your consent and deletes, in the same step, your body log, workout plans and workouts, weekly check-ins, monthly feedback and its settings, meal log, calorie goal, target weight and food list, and your Apple Health summaries and connection record.
• Asking us to delete your account withdraws the consent and deletes the same data at once, when you make the request, even though other account data is kept for the periods in Section 7.
• You can delete single weigh-ins and meals, discard a suggested plan, and disconnect Apple Health.
• You can download a copy of your account data as a file, including all of your health and fitness data, up to twice a day: in your account on the website, whether or not tracking is on, and, while tracking is on, in versions of the app that include tracking. Besides your health and fitness data, the file holds your profile and consent records, your bookings and check-ins, memberships, purchases, payments, passes and gifts, no-show and late-cancellation strikes, company-plan membership, your venue reviews and every review photo you uploaded, and your identity checks (whether and when you were verified, never the kennitala itself). For anything else we hold about you, such as support emails, ask us (Section 8).

What we never do. We never use your health and fitness data for marketing or advertising, never sell it, and never share it with venues, your employer (even on a company plan) or anyone else apart from the service providers in Section 4.E that process it for us. It is not shown to venue staff or company administrators, or in LifePass's administration screens, and it is never used to decide your price, your access or your membership (Section 3.2). Our server logs never contain your health values: they record only which task ran, how it ended, how many records it touched and what an AI call cost.

Apart from the health and fitness data in Section 2.G, which we collect only with your separate, explicit consent, we do not intentionally collect special category data such as health data or biometric data. Please do not submit sensitive personal information in free-text fields such as reviews, support messages or Coach chat messages.

We process personal data for the following purposes.

3.1 Marketing communications

We send marketing emails (newsletters, offers) only if you have actively opted in: the opt-in is unticked by default and you choose to enable it. We record when you gave or declined consent and which version of this notice applied at the time. You can withdraw your consent and stop marketing emails at any time, either by clicking the unsubscribe link in any marketing email or by changing the setting in your profile; this does not affect marketing we sent before you withdrew.

If you have opted in, we may also send you one reminder when you start a purchase and don't finish it, naming the product and price. At most one per unfinished purchase, and never after you've bought since or been refunded.

Transactional messages that are part of the service (booking confirmations, receipts, cancellation and renewal notices, password resets, and similar) are not marketing and are sent on the basis of our contract with you regardless of your marketing preference.

3.2 No solely-automated decisions

We do not make decisions that produce legal effects for you, or similarly significantly affect you, based solely on automated processing. Matching your verified kennitala to an employer's authorised-employee list, and granting or expiring visit allowances and passes, are rule-based steps carried out to perform our contract with you; they do not involve profiling that significantly affects you, and our team can review any outcome on request (see Section 8).

The AI Coach makes suggestions only. Its plans and answers are generated automatically from what you ask and from our catalogue of venues, classes and sights, but the Coach does not book, charge or change anything on your account, and it does not decide your access, prices or eligibility for anything. Nothing the Coach produces is a decision with legal or similarly significant effect on you, and you are free to ignore any suggestion.

The same is true of health and fitness tracking (Section 2.G). Workout plans, calorie and protein targets, meal estimates and the monthly feedback are worked out automatically, by our own rules and, for short plan texts and photo estimates, with AI. Our rules may decline to build a plan or a calorie target (for example for a body mass index of 40 or over, or during pregnancy) and then suggest that you talk to a doctor or a dietitian. None of this affects your price, your access, your membership or anything else about your account, so it is not a decision with legal or similarly significant effect on you, and our team will review any outcome on request.

We share your personal data with the following categories of recipients.

A. Partner venues

When you check in at a venue, we share:

• your name, for identification;
• membership status and validity;
• booking details for the specific activity.

Venues use this information solely to validate your access and provide services. At partner venues that manage bookings through Abler, the venue sees your booking and attendance in its Abler system, including the details described in Section 4.C.

B. Third-party reservation platforms (Bokun)

Certain partner venues (currently including Forest Lagoon and Vök Baths, with others potentially added over time) manage their live booking inventory through Bokun, an online reservation platform operated by Tripadvisor LLC (400 1st Avenue, Needham, MA 02494, USA), with an EU representative at Tripadvisor Ireland Limited, Dublin.

When you complete a booking at a Bokun-integrated venue through LifePass, we transmit the following personal data to Bokun so that Bokun can create the reservation on the venue's behalf and issue the entrance ticket:

• first name;
• last name;
• email address;
• your nationality, only for products that need it, as it is on file in your profile (accounts that already existed when we added the nationality field were set to Iceland, and you can change or clear it in your profile on the website, see Section 2.A; if a product needs it and none is on file, we ask you for it before the booking is made);
• venue, date, time, and headcount of the booking;
• a LifePass booking reference.

We do not share your kennitala, password, payment details, LifePass subscription state, visit allowance, check-in history at other venues, or any other information beyond what is strictly necessary to confirm the reservation.

Bokun's role. Bokun (Tripadvisor LLC) acts as an independent data controller for the booking data it receives: it determines its own purposes and means of processing under its own privacy policy, which includes further sharing with the Tripadvisor group of companies, Bokun's own service providers, and direct marketing subject to your rights to object. Your GDPR rights (access, rectification, erasure, restriction, objection, portability) therefore apply against Bokun directly for the data Bokun holds, and can be exercised at info@bokun.is. Please refer to Bokun's Privacy Policy for full details of how they process your data.

Legal basis. We rely on Article 6(1)(b) GDPR (performance of a contract) to share this data with Bokun: completing a reservation at a Bokun-integrated venue cannot be performed without transmitting these identifying details to the venue's reservation platform.

When you delete your account. We tell Bokun that you have asked for erasure, giving only the booking references Bokun issued, and ask it to delete your data where it no longer needs it. Bokun decides that under its own privacy policy; you can also contact Bokun directly at info@bokun.is.

C. Abler (club booking system)

Some partner venues (clubs) manage their classes through Abler, a booking system operated by Abler ehf. (kt. 660117-0670, Höfðabakki 9c, 110 Reykjavík, Iceland). When you book at such a venue, we disclose your data to Abler ehf. and to the venue. Abler ehf. is an independent data controller for the Abler user profile we create or match for you, under our agreement with Abler. The venue is a controller of its own booking and attendance records.

When. Only when you book, or try to book, a class at an Abler venue. Browsing timetables sends nothing about you.

What we send.

• your first and last name;
• your email address;
• your kennitala, if you have verified it with Kenni (a kennitala contains your date of birth);
• a LifePass account identifier;
• the class you book.

We send these each time you book. Cancellations and QR check-ins send only the account identifier and the class. We do not send your phone number, nationality, payment or subscription details, or any health and fitness data.

Why your kennitala. Abler and the clubs identify their members by kennitala, so sending it lets the booking be matched to the right person and prevents duplicate or mismatched profiles. We do not use it for any other purpose with Abler (its other uses, identity verification and payment set-up, are described in Sections 4.G and 4.D).

What we receive. Abler sends us attendance (present or absent) and cancellations for your bookings, which we record in your booking history and use for your visit history, venue reconciliation and usage accounting (Section 7). We also regularly ask Abler for the status of your bookings so that no attendance mark is missed. When you check in with the LifePass QR code, we mark you as present in the venue's Abler system.

Legal basis. Article 6(1)(b) GDPR, as the data is necessary to make the booking you ask for; for the kennitala, also Article 13 of the Icelandic Data Protection Act No. 90/2018, which permits use of a kennitala where there is an objective reason to identify a person reliably.

Where. Abler ehf. is established in Iceland. As an independent controller, Abler decides where it stores data; according to its privacy policy this may be in the EEA or in the United States under the EU-U.S. Data Privacy Framework (Section 5).

Retention and your rights. Our copy of your bookings follows Section 7. Abler keeps its copy under its own privacy policy (currently up to 7 years after your last activity in Abler). Deleting your LifePass account cancels your upcoming Abler bookings; we then tell Abler that you have asked for erasure, giving only your LifePass account identifier, and ask it to delete the profile it holds. Abler decides that as a controller of its own. You can also ask Abler directly to access or delete your data at privacycompliance@abler.io, giving your name, your kennitala and the email address on your LifePass account (see Abler's privacy policy and its page on requesting data deletion). You may also contact us, and we will forward your request to Abler.

D. Payment processors

Kling processes all payments. Kling is PCI-DSS compliant and acts as an independent data controller for payment data. See Kling's Privacy Policy.

When you start a subscription or save a payment card, we also pass your verified kennitala, name, and email address to Kling, which requires them to set up and bill your payment agreement. Kling processes this data as an independent controller under its own privacy policy. Our legal basis is Article 6(1)(b) GDPR (performance of a contract) and, for the kennitala, Article 13 of the Icelandic Data Protection Act No. 90/2018.

E. Service providers

• Hosting and database: Supabase for cloud infrastructure, data storage, and account authentication.
• Application hosting: Vercel, which runs the LifePass website and application servers; technical request data (such as your IP address and request logs) is processed on Vercel's infrastructure when you use the platform. We also use Vercel Web Analytics, which counts page views without cookies (the page address with sensitive parameters removed, the referring page, device type and country) so we can understand how the website is used; our legal basis is legitimate interests.
• Email services: Resend for transactional and marketing emails.
• Identity verification: Auðkenni ehf. (Kenni), which verifies your kennitala (see Section 4.G).
• Maps: Mapbox, which renders the venue map on the website and receives your approximate location and map-tile requests when you use the map. In the iOS app, Apple Maps (MapKit) draws the maps and, for the Coach's short-drive search, calculates driving times; Apple does this under its own terms rather than as our processor (see Section 2.F).
• Analytics: Google Analytics 4 and Google Tag Manager (Google Ireland Ltd / Google LLC), which measure how the website is used. Google's tags run in Consent Mode: no analytics cookies are set and no analytics identifiers are stored until you consent via the cookie banner; before consent the tags operate in a cookieless, consent-denied state as described in Google's own documentation. Google's advertising signals stay off whatever you choose in the banner.
• Consent management: CookieYes, which operates the cookie consent banner and records your consent choices.
• Review invitations: Trustpilot A/S (Denmark). When you buy a subscription, we send Trustpilot your email address, your first name and the order reference so it can invite you to review LifePass. See Section 4.I.
• AI assistant: Anthropic Ireland, Limited (Ireland), with its affiliate Anthropic, PBC (United States), runs the AI model behind the LifePass Coach. For each Coach request it receives the text needed to answer it: your chat messages, or your plan answers and any words you added, the name of the nearest town and the region for a plan near you (or, if you are more than 100 km from every place we list, only that you are outside Iceland), and the places we picked for the plan. It does not receive your name, email address, kennitala, account identifier or coordinates, unless you write them in a message or note yourself. If you use health and fitness tracking, it also receives what Section 2.G lists for a workout plan, a meal photo or a meal you describe, and never an identifier, an exact body measurement or anything from Apple Health. Anthropic Ireland, Limited acts as our processor under Anthropic's Commercial Terms and Data Processing Addendum. Anthropic may not use this data to train its models, and deletes it within 30 days under its standard retention, unless the request is flagged by its trust and safety systems (in which case it may keep it for up to two years) or the law requires it to be kept longer.
• Request limits: Upstash, Inc. hosts, in its Frankfurt (Germany) region, the counters that limit how many requests one internet address or one account can make, so the service cannot be flooded and abuse of the sign-in, code and payment paths is slowed down. Each counter holds only that internet address, or a keyed code made from the account identifier (never the identifier itself), and a number of requests, and expires by itself within about two minutes. No name, email address, kennitala or message content is stored there.

All service providers acting as our processors are bound by data processing agreements and must comply with GDPR. Apple provides its maps and speech recognition under its own terms.

F. Legal and regulatory

We may disclose data when required by law, court order, or to protect our legal rights.

G. Identity verification (Kenni / auðkenni)

When you start a subscription or activate an employer-paid benefit, we verify your identity through Kenni, an electronic-identity verification service operated by Auðkenni ehf. (Iceland). To do this we redirect you to Kenni's secure flow, where you authenticate with your Icelandic electronic ID. Kenni confirms your identity and returns your verified kennitala and name to us.

We rely on Article 6(1)(b) GDPR (performance of a contract) and Article 13 of the Icelandic Data Protection Act No. 90/2018 for this processing: a verified identity is necessary to provide a subscription, to prevent fraudulent or shared memberships, and to match company-plan employees to their employer's authorised list. Auðkenni processes your authentication data under its own privacy policy and as our processor for the verification result we receive. We do not receive or store your electronic-ID credentials or PIN.

H. Employers (company plans)

If you join LifePass through an employer's company plan, there is a two-way exchange of limited personal data between LifePass and your employer:

• From your employer to us: your employer provides us with a list of authorised employees (by kennitala and/or work email, and sometimes name) so we can grant the agreed benefit to the right people. We use this list only to match activations and grant benefits.
• From us to your employer: through a company dashboard, your employer (and its authorised company administrators) can see which of their authorised employees have activated their LifePass benefit, the activation date and membership status (including whether it is suspended), the monthly benefit amount spent per employee and in total (in ISK), and, where your employer offers wellness reimbursements, the reimbursement requests you submit, including the amount, category, and any description you write. Your employer is shown enough to administer and reconcile the benefit they are paying for. Your individual booking history, check-in records, and the specific venues you personally visit are not exposed to your employer through this dashboard, except any details you yourself include in a reimbursement request you submit for their approval.

For the employee list your employer supplies to us, and for the activation and usage data we make available back to your employer, your employer is an independent data controller and processes that data under its own privacy notice and its employment relationship with you. We rely on Article 6(1)(b) GDPR (performance of a contract) with the employer, and our legitimate interest and your employer's legitimate interest in administering a benefit, as the legal basis for this exchange. If you do not want your employer to know whether you have activated the benefit, you can choose not to activate the company plan and instead use a personally-paid subscription or pay-as-you-go bookings.

Your employer never sees any health and fitness data (Section 2.G), and is not told whether you use tracking.

I. Public reviews and ratings

If you submit a review or rating of a Venue, the review text, the rating, any photos you attach, and the first letter of your name (your full name is shown only to you and our team) are displayed publicly on the Platform (including on Venue pages and, where applicable, in search-engine results and structured data) and can be seen by anyone. Do not include information in a review or a photo that you do not want to be public. You can ask us to remove a review you have posted by contacting support@lifepass.is.

Review photos. Before a photo you attach to a review is stored, our server redraws it and removes the hidden details a camera saves with it, such as where and when it was taken and which device took it. Only the redrawn copy is ever published. A photo you upload but do not post with a review is deleted within two days, and a photo you remove from your review, or that belongs to a review you delete, is deleted straight away. Your review photos are also deleted when your account is deleted.

Reporting a review. If you are signed in, you can report another member's review to us, for example because it is abusive or shows someone who did not agree to it. We keep the report (which review, the reason you chose, anything you wrote, and your account) so that our team can look at it and remove the review if needed. The member who wrote the review is not told who reported it. A report is deleted when the review is removed or when you delete your account.

Trustpilot review invitations. When you buy a subscription, we send Trustpilot A/S (Denmark), in a separate message, your email address, your first name and the order reference, so that Trustpilot can email you an invitation to review LifePass. We send nothing else: not what you bought or paid, your kennitala, your payment details or which venues you visit. Our legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in obtaining feedback from customers about a purchase they have made. Writing a review is entirely voluntary, and any review you write is published on Trustpilot under Trustpilot's own terms, as a separate controller of that review.

If you have opted out of marketing emails from us, we do not send your address to Trustpilot at all. You can opt out at any time (including after an invitation has been sent) by using the unsubscribe link in any of our emails or by contacting support@lifepass.is, and you can object to this processing under Section 8. To ask Trustpilot to delete data it holds about you, contact Trustpilot directly via its Privacy Policy.

J. Open Food Facts (barcode lookups)

When you scan a food barcode in the app, your phone asks Open Food Facts, a free and open food database run by the non-profit Open Food Facts association in France, for that product. The request goes from your phone straight to Open Food Facts, which receives the barcode, your phone's internet address and the version of the app, and handles them as an independent controller under its own privacy policy. We send Open Food Facts nothing about you. Product details reach us only if you add the product to a meal (Section 2.G).

We do not sell your personal data to third parties, and we do not use your personal data for third-party advertising.

We process your data in the European Economic Area (EEA) where our providers allow it: our application servers run in Dublin, Ireland, and our request counters in Frankfurt, Germany. Several of the providers below are established outside the EEA, or may process or access data from there. Where data is transferred outside the EEA, it is protected by one of these safeguards:

• EU Standard Contractual Clauses (SCCs);
• adequacy decisions by the European Commission, including the EU-U.S. Data Privacy Framework for certified US companies;
• supplementary technical and organizational measures.

Bokun (Tripadvisor LLC). Where we share booking data with Bokun as described in Section 4.B, that data may be stored or transferred to Tripadvisor LLC in the United States and to other Tripadvisor affiliates outside the EEA. These transfers are covered by the EU Standard Contractual Clauses adopted by the European Commission, together with supplementary measures Bokun describes in its own privacy policy.

Abler (club booking system). Abler ehf. is an independent controller established in Iceland. According to its privacy policy it may store data in the EEA or in the United States under the EU-U.S. Data Privacy Framework, and some of its service providers are in the United States (Section 4.C).

Google (analytics). Data processed by Google Analytics and Google Tag Manager (Section 4.E) may be transferred to Google LLC in the United States. These transfers rely on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses, as described in Google's own privacy documentation.

Anthropic (AI Coach). Anthropic Ireland, Limited and its affiliate Anthropic, PBC store the Coach request data they receive (Section 4.E), including the plan answers, meal photos and meal descriptions sent for health and fitness tracking (Section 2.G), in the United States and may process it in other countries where Anthropic or its service providers operate. These transfers are covered by the EU Standard Contractual Clauses incorporated in Anthropic's data processing addendum.

Upstash (request limits). Upstash, Inc. is established in the United States. The counters described in Section 4.E are stored in its Frankfurt (Germany) region, inside the EEA. Where Upstash accesses them from outside the EEA, that access is covered by the EU Standard Contractual Clauses in Upstash's data processing addendum. The counters hold an internet address, or a keyed code made from an account identifier, and a number, and expire within about two minutes.

Supabase, Vercel, Resend and Mapbox. Supabase, Inc. (database and sign-in), Vercel Inc. (hosting and page analytics; our application servers run in Dublin, Ireland), Resend, Inc. (email) and Mapbox, Inc. (website maps) are established in the United States. Where they transfer your data to the United States or access it from there, this is covered by the EU Standard Contractual Clauses in their data processing agreements and, for companies certified under it, the EU-U.S. Data Privacy Framework.

CookieYes and Trustpilot. CookieYes Limited is established in the United Kingdom, which benefits from an adequacy decision of the European Commission. Trustpilot A/S is established in Denmark, inside the EEA.

In the iOS app. Some versions of the app load onboarding pictures from Unsplash (imgix, United States), which receives your device's internet address with each picture, and the weather for Reykjavík on the home screen from Open-Meteo (Switzerland, which benefits from an adequacy decision), which receives your device's internet address but never your location. They handle these requests under their own terms and receive nothing else about you.

We use cookies and similar technologies as follows.

When you arrive through an affiliate or partner link, we store a first-party cookie named lp_ref for up to 30 days. It holds only the referring partner’s identifier (no personal data) and is used to apply any partner discount at checkout and to attribute your purchase to that partner. It is not shared with third parties or used for cross-site tracking.

Member referrals. When you open a friend’s LifePass invitation link, we store a first-party cookie named lp_mref for up to 30 days. It holds their referral code so that, if you go on to make your first purchase, we can credit them with a reward visit. The referring member is told only that a reward was earned, never your name, email address, or what you bought. If the purchase is refunded, the reward is withdrawn. Our legal basis is our legitimate interest in operating the referral programme (Art. 6(1)(f) GDPR), and you can object to this processing under Section 8.

Homepage test. While we compare two versions of the homepage, we keep anonymous daily totals per version: how many browsers that accepted analytics cookies were shown each version, and how many of them clicked on the homepage, signed up, started a checkout or made a purchase. The totals contain no identifier, IP address, account, order or device information, and cannot be linked to you.

We also keep a server-side record of the arrival itself, so we can report how many visits a partner sent us. That record holds the partner’s identifier, the page you landed on, the date and time, and a keyed code (a hash made with a secret key) of your IP address, used only to avoid counting the same visit twice on the same day. When your IP address is not available to us, that field instead holds a keyed code derived from your browser string, and the record carries a technical marker noting that the fallback was used. We do not store your IP address or your browser string themselves. The record contains no reference to your account or to any purchase, and the hash it stores is computed with a secret key and a formula unique to these records, so it does not match any other hash we hold and cannot be used to look you up in your account or order history. It is not used for profiling or cross-site tracking. These records are deleted after 180 days (see Section 7).

That arrival record is written on our servers when the page loads, not by a cookie, so it is not set or controlled by the cookie banner and declining optional cookies does not switch it off. Our legal basis for it is legitimate interests, and you can object to it under Section 8.

You can manage cookie preferences through our cookie banner or your browser settings. Nothing on our site uses advertising cookies: whatever you choose in the banner, Google's advertising signals stay off.

We retain your data for the following periods.

If specific records are needed to establish, exercise or defend a legal claim, for example in an open dispute, we keep those records beyond the periods above until the matter is resolved, and review the need regularly.

Note on third-party reservation platforms. Once a booking reference and the associated data have been transmitted to Bokun (Section 4.B), retention of that data at Bokun is governed by Bokun's own privacy policy, not by the periods above. Deleting your LifePass account does not by itself delete data Bokun has already received: we tell Bokun that you asked for erasure, and to exercise your rights against Bokun you can also contact them directly at info@bokun.is.

Note on Abler-integrated venues. Our copy of your Abler bookings follows the periods above. Abler keeps the profile it holds under its own privacy policy; deleting your LifePass account does not delete it, but we tell Abler that you asked for erasure and ask it to delete the profile. You can also contact privacycompliance@abler.io (see Section 4.C).

As a data subject, you have the following rights.

• Right of access: request a copy of your personal data.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): request deletion of your data, subject to legal retention requirements.
• Right to restriction: limit how we process your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: withdraw consent at any time (does not affect prior lawful processing).
• Right not to be subject to automated decisions: request human review of automated decisions that significantly affect you.

How to exercise your rights: email us at support@lifepass.is with your request. We will respond within 30 days. You can also exercise several of these rights yourself: turn off health and fitness tracking to withdraw that consent and delete the data, delete single entries, and download a copy of your data, in the ways Section 2.G describes. For data held by Bokun as a result of a booking at a Bokun-integrated venue, please also contact Bokun directly at info@bokun.is. For your Abler profile (Section 4.C), you can also contact Abler ehf. directly at privacycompliance@abler.io.

When your account is erased we tell Abler and Bokun, where you booked with them, that you asked for erasure (giving only your LifePass account identifier or the Bokun booking references) and ask them to delete what they hold. Each decides that as a controller of its own.

Right to complain: you may lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd) at www.personuvernd.is or postur@personuvernd.is.

We implement appropriate technical and organizational measures to protect your data:

• encryption in transit (TLS/HTTPS) and at rest;
• secure password hashing;
• one-way codes, never the values themselves, for the internet address and browser recorded with your consents; codes recorded since we introduced keying are also keyed with a secret only our servers hold, so they cannot be worked back by trying every possible address;
• access controls and least-privilege principles;
• regular security assessments;
• incident response procedures;
• employee training on data protection.

No system is perfectly secure. In the event of a data breach, we will notify you and relevant authorities as required by law.

LifePass is not directed to children under 16 years of age. We do not knowingly collect personal data from children under 16.

Group bookings at some venues may include child or infant guests brought by an adult member. For these guests we record only the number of guests in each age band (for pricing and venue capacity); we do not collect names, kennitala, or any other personal data about accompanying children. LifePass accounts themselves remain restricted to people aged 16 or older.

Health and fitness tracking (Section 2.G) is available only to people aged 18 or over. A verified kennitala under 18 cannot turn it on, an account without a verified kennitala must confirm that its holder is 18 or older, and if a later verification shows that the holder is under 18, we turn tracking off and delete the data.

If you believe we have inadvertently collected data from a child under 16, please contact us immediately at support@lifepass.is.

We may update this Privacy Policy from time to time. When we make material changes:

• we will update the "Last updated" date at the top of this policy;
• we will tell you about them by email or in the app before they take effect.

Where a change needs your consent, we will ask for it; we never treat your continued use of LifePass as consent.

For questions, requests, or concerns about this Privacy Policy or your personal data:

Sporta ehf.
Hverfisgata 88, 101 Reykjavík, Iceland
kt. 490925-1470 · VSK 161242
Email: support@lifepass.is
Website: www.lifepass.is