Kevarn - Privacy Policy

Effective date: 10 October 2026
Version: 2.7

About this policy

This Privacy Policy describes how Bring You Health Co., Ltd. (“Kevarn”, “we”, “us”, “our”) collects, uses, and protects your personal information when you use our coaching services, website (kevarn.com and its subdomains), and mobile applications.

We are the data controller for the personal information described in this policy. If you have questions or want to exercise your privacy rights, contact us at [email protected].

Who we are

Bring You Health Co., Ltd. is a company registered in the Kingdom of Thailand.

Registered address: 122 Maha Set Road, Ek-udom Building, 8th Floor, Bang Rak, Bangkok 10500, Thailand.

We trade under the name Kevarn.

Who this policy applies to

This policy applies to anyone who:

Trains with us in person in Bangkok
Uses our online coaching services
Uses our mobile applications (the Kevarn client app for clients, and the Kevarn coach portal for coaches)
Buys products or services through our website or applications
Subscribes to our newsletter or marketing communications
Contacts us with enquiries

What information we collect

Information you give us

Identity information: full name, title, gender, date of birth, nationality, occupation, country of residence
Contact information: email address, postal address, phone number, emergency contact details
Health information: height, weight, body composition measurements, blood pressure, heart rate, allergies, injuries, medical conditions, mental health concerns, sleep quality, mood, dietary information
Fitness information: goals, training history, frequency, duration, intensity, volume, programme adherence
Visual information: progress photographs, video testimonials (only with explicit consent)
Financial information: payment card details (processed by Stripe; we do not store full card numbers), billing address
Communication information: messages between you and your coach, messages to our support team, survey responses
Consent records: the version of our Terms of Service, Health Disclaimer, and Data Processing consent that you agreed to, and the date and time you agreed to it. We keep this to demonstrate compliance with our obligations under applicable data protection law.

Information collected automatically

Device information: device type, operating system version, application version, language, time zone, and a device identifier used only to deliver notifications to the right phone
Usage information: features you use, pages viewed, time spent, interaction patterns
Diagnostic information: error logs, crash reports, performance data
Authentication information: login times, session tokens (handled by Clerk, our authentication provider)
Push notification information: device tokens that allow us to send notifications you have requested

How we use your information

We use your information for the following purposes, each with a specific legal basis under data protection law:

To deliver our services to you (legal basis: contract)

Create and manage your account
Build your training programme based on your goals and health information
Track your progress and adjust your programme
Schedule sessions and send reminders
Process payments and issue invoices
Provide customer support
Send you transactional messages (account confirmations, payment receipts, schedule changes)

To run our business (legal basis: legitimate interests)

Improve our services based on how they are used
Detect and prevent fraud, abuse, and security incidents
Diagnose technical problems
Maintain backups and ensure service continuity
Defend our legal rights

Send marketing emails, newsletters, and offers (only with your consent; you can unsubscribe at any time)
Invite you to participate in surveys or research
Notify you about changes to our services or policies

To comply with legal obligations (legal basis: legal obligation)

Respond to lawful requests from courts, regulators, and law enforcement
Comply with health and safety requirements
Maintain records required by tax and corporate law

We share your personal information only when necessary, and only with parties who have agreed to protect it. We do not sell your personal information to anyone.

People who help us deliver coaching

Your assigned coach and any support staff working on your programme
Other Kevarn coaches and contractors who may cover sessions or provide specialist input

Service providers (data processors)

We use the following third-party services to operate Kevarn. Each processes your information only on our instructions and according to a written data processing agreement:

Service	Purpose	Data processed	Hosting region
Clerk	User authentication and session management	Names, emails, login activity	United States
Neon	Application database	Most personal information described above	Asia-Pacific — AWS ap-southeast-1 (Singapore)
Stripe	Payment processing	Payment card details, billing address, transaction data	Global (per Stripe’s privacy policy)
Sentry	Error tracking and diagnostics	Error reports, may include user identifiers	European Union — Frankfurt, Germany (`ingest.de.sentry.io`)
Cloudflare R2	Media storage	Photos, videos, documents you upload	Global distributed network
Expo	Push notification delivery	Device tokens, notification content	United States
Apple Push Notification service and Google Firebase Cloud Messaging	Delivering push notifications to iPhone and Android devices	Device tokens, notification content	United States
Apple App Store	App distribution (iOS)	Governed by Apple’s own privacy policy; we do not share personal data with Apple as a processor	United States
Google Play	App distribution (Android)	Governed by Google’s own privacy policy; we do not share personal data with Google as a processor	United States
Cloudflare	Website hosting and security	IP addresses, request metadata	Global distributed network

Each sub-processor that handles personal data on our behalf is bound by a Data Processing Agreement. We may add or change service providers over time. The current list is maintained accurately in this policy. Material changes will be notified to you.

Legal disclosures

We may disclose your information when required by law, when responding to lawful requests from authorities, or when necessary to protect our legal rights or the safety of others.

Business transfers

If Kevarn is sold, merged, or restructured, your information may be transferred to the new entity. We would notify you in advance and your rights under this policy would be preserved.

International transfers

Your data is hosted primarily in the Asia-Pacific region (AWS ap-southeast-1, Singapore) for our application database, with some services using United States or European Union infrastructure as listed in the sub-processors table above.

When we transfer your data outside your country of residence, we use safeguards required by applicable law:

For data transferred from the European Economic Area, United Kingdom, or Switzerland: Standard Contractual Clauses approved by the European Commission, or equivalent mechanisms.
For data transferred from other jurisdictions: contractual protections that maintain a level of protection comparable to your home jurisdiction.

How long we keep your information

We keep your information only as long as we need it for the purposes described in this policy.

Active client accounts: for the duration of your engagement with us
After your engagement ends: 7 years, to handle queries, defend legal claims, and meet tax and corporate record obligations
Marketing data: until you unsubscribe or 3 years of inactivity, whichever is sooner
Diagnostic and log data: typically 90 days, longer for security investigations
Anonymised data: indefinitely, as it can no longer identify you

You can delete your account at any time from within the app (Profile → Delete account on the client app; Settings → Delete account on the coach portal). When you delete your account, it closes straight away: we remove your name, email address and sign-in immediately, and delete your notifications and health assessments permanently. Everything else that belongs to your account, including your progress photos, food journal, body measurements, food and workout logs, task answers and messages, is deleted within 30 days. A request to erase your information by email is handled in the same way. Financial records (invoices, payments, ledger entries) are retained in anonymised form for seven years as required by law. You will receive a confirmation and your access will be revoked immediately.

Your rights

You have rights over your personal information. The specific rights available depend on where you live, but the following apply broadly:

Right of access: Ask for a copy of the personal information we hold about you
Right to rectification: Ask us to correct inaccurate or incomplete information
Right to erasure: Ask us to delete your information (“right to be forgotten”). You can also delete your account directly in the app without contacting us. Your information is deleted within 30 days, as described under “How long we keep your information”.
Right to restriction: Ask us to stop processing your information in certain circumstances
Right to data portability: Ask for your information in a portable format you can take to another service
Right to object: Object to processing based on our legitimate interests, including for marketing
Right to withdraw consent: Where we rely on your consent, you can withdraw it at any time

To exercise any of these rights, email [email protected]. We will respond within 30 days. We may need to verify your identity before acting on your request.

If we refuse a request, we will explain why. You have the right to complain to a supervisory authority if you are not satisfied with how we handle your information.

For users in the European Economic Area, United Kingdom, and Switzerland

You have the rights listed above under the General Data Protection Regulation (GDPR) and equivalent UK and Swiss laws. Your supervisory authority is the data protection regulator in your country of residence.

You can find your local supervisory authority through the European Data Protection Board: edpb.europa.eu (for EU); the Information Commissioner’s Office at ico.org.uk (for UK); the Federal Data Protection and Information Commissioner at edoeb.admin.ch (for Switzerland).

For users in California

In addition to the rights above, the California Consumer Privacy Act (CCPA) gives California residents these rights:

Right to know what categories of personal information we collect and how we use it
Right to delete personal information we hold about you
Right to correct inaccurate personal information
Right to opt out of the sale or sharing of personal information
Right to limit use of sensitive personal information
Right to non-discrimination for exercising your rights

We do not sell your personal information. We do not share it with third parties for cross-context behavioural advertising. The “Do Not Sell or Share My Personal Information” right does not currently apply to us because we do not engage in those activities, but we honour the principle.

The categories of personal information we collect, the purposes for which we collect them, and the categories of third parties we share them with are described in the sections above.

To exercise your CCPA rights, email [email protected]. We will respond within the timeframes required by California law.

For users in other jurisdictions

If your country has data protection laws granting you rights similar to those above, we honour them. Contact us at [email protected].

Children

Kevarn is not for children under the age of 16. We do not knowingly collect personal information from anyone under 16.

If you become aware that a child under 16 has provided us with personal information without parental consent, please contact [email protected]. If we become aware of such information, we will delete it and close any associated account.

Security

We use technical and organisational safeguards to protect your information:

Encryption in transit (TLS/HTTPS for all communications)
Encryption at rest for stored data
Access controls limiting who at Kevarn can see your data
Authentication systems with secure password handling (via Clerk)
Regular security review of our service providers
Backup and recovery procedures

No security system is perfect. If a security breach affects your information, we will notify you and the relevant supervisory authority as required by law.

Cookies and similar technologies

Our website uses cookies and similar technologies. These are described in our separate Cookie Policy at kevarn.com/cookies/.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will:

Update the version number and effective date at the top of this policy
Notify you by email or in-app message if you have an account with us
Where required by law, ask for your fresh consent

You can always find the current version of this policy at kevarn.com/privacy-policy/.

Contact us

For privacy questions, data subject requests, or any concerns about how your information is handled:

[email protected]

For other matters, including legal and Terms of Service questions: