Privacy Policy
1. Introduction
This Privacy Policy ("Policy") governs the collection, use, disclosure, and other processing of Personal Data by Shelton Lalgy, sole proprietor trading as ShapeLab ("ShapeLab", "we", "our", or "us"), operating under the laws of the Republic of Mozambique, in connection with the mobile applications "ShapeLab Coach" and "ShapeLab" (the "Apps") and the administrative web panel (collectively, the "Services").
By creating an account or otherwise using the Services, you ("User", "you") acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree, you must refrain from using the Services.
ShapeLab acts as the Data Controller with respect to Personal Data processed through the Services, save where expressly stated otherwise.
2. Definitions
- "Personal Data" means any information relating to an identified or identifiable natural person, as defined under the EU General Data Protection Regulation 2016/679 ("GDPR") and Mozambican Law No. 3/2017 of 9 January (Personal Data Protection Law).
- "Special Categories of Personal Data" means data revealing health information and other categories enumerated in Article 9(1) GDPR.
- "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, and erasure.
- "Sub-processor" means any third party engaged by us to process Personal Data on our behalf.
- "Coach" means a User registered as a nutritional or fitness coach.
- "Client" means a User registered as an athlete connected to a Coach.
- "Super-Administrator" means the operator of the Services with administrative privileges.
3. Data Controller and Contact Details
| Data Controller | Shelton Lalgy, sole proprietor trading as ShapeLab |
|---|---|
| Place of business | Mozambique |
| Data protection contact | support@shapelab.co.mz |
| Postal correspondence | Avenida União Africana 4341, Matola, Mozambique |
ShapeLab has not appointed a Data Protection Officer ("DPO"), as appointment is not mandatory under applicable law given the nature and scale of our Processing. Any matter relating to the Processing of Personal Data should be addressed to the contact above.
4. Categories of Personal Data Processed
We process the following categories of Personal Data, distinguishing those provided by you, those generated through your use of the Services, and those collected from third parties.
4.1 Account Data (provided by you)
- Full name
- Email address
- Password (stored only as a salted cryptographic hash via Firebase Authentication; we never have access to the plaintext)
- Telephone number (optional)
- Google account identifier (only where you elect to authenticate via Google Sign-In)
4.2 Profile and Fitness Data (Clients only, provided by you)
- Body weight (kg)
- Height (cm)
- Age and biological sex
- Body fat percentage (optional)
- Self-assessed activity level
- Personal nutritional or fitness goals
4.3 Progress Data (Clients only, generated through use)
- Periodic check-in records, including body weight and circumference measurements (waist, hips, chest, arm, thigh)
- Free-text notes
- Progress photographs voluntarily uploaded by the Client
4.4 Coaching Data (generated through use)
- Nutritional plans, training plans, and feedback authored by the Coach
- Communications between Coach and Client conducted within the Apps
4.5 Subscription and Payment Data (Coaches only)
- Subscription tier, slot allocation, and renewal dates
- Manually recorded references to off-platform payments (e.g. M-Pesa transaction identifiers and amounts in Mozambican Metical)
We do not process payment card numbers, bank account details, or other financial instrument data within the Services.
4.6 Technical Data (generated automatically)
- Device push notification tokens (Apple Push Notification service, Firebase Cloud Messaging)
- Application-level event timestamps necessary for the operation of the Services
- IP address and request metadata processed transiently by our cloud infrastructure providers (not retained by ShapeLab)
4.7 Special Categories of Personal Data — Health
Where you grant explicit permission on your device, the Coach App may read health and fitness data from Apple HealthKit (iOS) or Android Health Connect (Android) (collectively, "Health Platform Data"). Such data may include calories burned, steps, heart rate, sleep, body weight, and body composition.
Health Platform Data is processed exclusively on your device for display purposes within the Coach App and is not transmitted to our servers, sub-processors, or any third party. Withdrawal of consent at the operating system level immediately ceases such Processing.
4.8 Categories of Personal Data we expressly do NOT process
We do not collect, process, or store: precise or coarse geolocation data; contacts; calendar; SMS or call logs; microphone audio; advertising identifiers (IDFA, AAID); behavioural analytics; or third-party tracking cookies.
5. Purposes and Legal Bases for Processing
We process Personal Data for the following purposes, in each case relying on the legal basis identified below pursuant to Article 6(1) GDPR (or its functional equivalent under Mozambican Law No. 3/2017):
| # | Purpose | Legal Basis |
|---|---|---|
| (a) | Account creation, authentication, and account management | Performance of a contract — Art. 6(1)(b) |
| (b) | Provision of nutritional and training plans, calculation of macronutrient targets, progress tracking | Performance of a contract — Art. 6(1)(b) |
| (c) | Coach-Client communication and notifications | Performance of a contract — Art. 6(1)(b) |
| (d) | Payment record-keeping and subscription enforcement | Performance of a contract — Art. 6(1)(b); Legal obligation — Art. 6(1)(c) |
| (e) | Detection and prevention of fraud, abuse, and security incidents | Legitimate interests — Art. 6(1)(f) |
| (f) | Compliance with legal obligations (e.g. tax, accounting, response to lawful authority requests) | Legal obligation — Art. 6(1)(c) |
| (g) | AI-assisted body fat estimation (only on user request) | Explicit consent — Art. 6(1)(a) and Art. 9(2)(a) |
| (h) | Reading of Health Platform Data on device | Explicit consent — Art. 6(1)(a) and Art. 9(2)(a) |
We do not rely on legitimate interests for the Processing of Special Categories of Personal Data; such Processing is always conducted on the basis of your explicit consent.
6. AI Processing — Body Fat Estimation Feature
Where a Client expressly elects to use the optional "AI body fat estimation" feature:
- A photograph submitted by the Client is transmitted, via our Cloud Functions backend, to Anthropic, PBC ("Anthropic"), operating the Claude Vision application programming interface, for the sole purpose of returning a numerical estimate of body fat percentage.
- The photograph is processed by Anthropic in accordance with its commercial terms and privacy policy, available at https://www.anthropic.com. Under Anthropic's standard API terms, customer content is not used to train Anthropic's models absent separate authorisation.
- Use of this feature is subject to a quantitative limit of four (4) requests per User per calendar month.
- The estimate produced is non-diagnostic, indicative only, and shall under no circumstances be construed as medical, nutritional, or professional advice.
- ShapeLab does not retain the photograph beyond the duration necessary to complete the request, save where the photograph forms part of a check-in record voluntarily saved by the Client.
By invoking this feature, the Client provides explicit consent to the transmission of the photograph to Anthropic for the purpose stated above.
7. Sources of Personal Data
The Personal Data we process is collected from the following sources:
- Directly from you, when you register, complete your profile, perform check-ins, upload photographs, or otherwise interact with the Services.
- Automatically from your device, in respect of technical data referred to in §4.6.
- From your Coach (in the case of Clients), in respect of nutritional and training plans assigned to you.
- From third-party authentication providers (Google), when you elect to use Google Sign-In, limited to the data fields disclosed at the time of authentication.
We do not acquire Personal Data from data brokers or commercial Personal Data sources.
8. Disclosure of Personal Data and Sub-processors
We do not sell, rent, or otherwise commercially disclose Personal Data to third parties.
Personal Data may be disclosed to or processed by the following Sub-processors, who act on our documented instructions and are bound by appropriate contractual protections:
| Sub-processor | Role | Categories Processed | Location of Processing |
|---|---|---|---|
| Google LLC (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging) | Hosting and core platform infrastructure | All Personal Data except Health Platform Data | European Union (Frankfurt / Zurich, region eur3); transient edge caching globally |
| Apple Inc. (Apple Push Notification service) | Routing of push notifications to iOS devices | Push notification tokens, message content | Apple infrastructure |
| Expo Inc. (Expo Push Service) | Routing of push notifications | Push notification tokens, message content | United States |
| Anthropic, PBC | AI body fat estimation (only when User invokes the feature) | Photographic data submitted by Client | United States |
| Google LLC (Google Sign-In, Google Health Connect) | Authentication; on-device health data access | Authentication identifiers; Health Platform Data (on-device only) | Per Google's terms |
| Apple Inc. (HealthKit) | On-device health data access (Coach App, iOS) | Health Platform Data (on-device only) | On-device |
We may further disclose Personal Data: (i) to comply with applicable law, court order, or lawful request from a competent authority; (ii) to enforce our terms of service or protect our rights, property, or safety, or that of our Users or third parties; or (iii) in connection with a corporate transaction (merger, acquisition, or sale of assets), in which case Users will be notified.
9. International Data Transfers
The Sub-processors listed above may process Personal Data in jurisdictions outside Mozambique and outside the European Economic Area, including the United States. Where applicable, we rely on the following safeguards for such transfers:
- Standard Contractual Clauses ("SCCs") approved by the European Commission, as incorporated by reference in our agreements with Google, Apple, Expo, and Anthropic.
- Adequacy decisions of the European Commission, where applicable.
- Supplementary technical measures, including encryption in transit (TLS 1.2 or higher) and at rest.
You may request a copy of the relevant safeguards by contacting us at the address in §3.
10. Data Retention
We retain Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, including for the duration of the contractual relationship and for such further period as is required to comply with legal obligations or to establish, exercise, or defend legal claims.
| Category | Retention Period |
|---|---|
| Account Data | Duration of the account, plus thirty (30) days following deletion request |
| Profile, Fitness, and Progress Data | Duration of the account, plus thirty (30) days following deletion request |
| Progress photographs (Cloud Storage) | Duration of the account, plus thirty (30) days following deletion request |
| Subscription and Payment records | Seven (7) years following the end of the contractual relationship, for tax and accounting purposes |
| Audit logs of administrative actions | Seven (7) years, for compliance and security |
| Push notification tokens | Until revoked by the User or expired by the device operating system |
| Backups (Firebase) | Seven (7) days rolling, automatically purged |
Upon account deletion, Personal Data is purged from active systems within thirty (30) days. Personal Data persisting in time-limited backups is overwritten in the ordinary course.
11. Security Measures
We implement appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, including:
- Encryption of all communications in transit using Transport Layer Security (TLS 1.2 or higher);
- Encryption at rest of stored data, in accordance with Google Cloud Platform's standard practices;
- Role-based access control enforced server-side via Firestore Security Rules and Cloud Storage Security Rules, ensuring strict isolation of data between Coaches, between Coaches and Clients of other Coaches, and excluding the Super-Administrator from access to Client Personal Data;
- Restriction of progress photographs to access by the uploading Client and the Client's assigned Coach exclusively;
- Screen-capture protection on screens displaying sensitive imagery (where supported by the operating system);
- Logging and audit of all administrative actions;
- Periodic review of access permissions and security configurations.
No system can guarantee absolute security. In the event of a Personal Data breach likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority and, where required, affected Users without undue delay and in any event within the periods prescribed by applicable law.
12. Your Rights as a Data Subject
Subject to the conditions and limitations set out in the GDPR and Mozambican Law No. 3/2017, you have the following rights with respect to your Personal Data:
- Right of access (Art. 15 GDPR): obtain confirmation of whether Personal Data concerning you is being processed, and access to such data;
- Right to rectification (Art. 16 GDPR): obtain the correction of inaccurate or incomplete Personal Data;
- Right to erasure ("right to be forgotten", Art. 17 GDPR): obtain the deletion of your Personal Data, subject to applicable exceptions;
- Right to restriction of processing (Art. 18 GDPR);
- Right to data portability (Art. 20 GDPR): receive your Personal Data in a structured, commonly used, machine-readable format. We provide PDF exports of nutritional plans and equivalence tables; further data may be provided upon request;
- Right to object (Art. 21 GDPR), where Processing is based on legitimate interests;
- Right to withdraw consent (Art. 7(3) GDPR), at any time, without affecting the lawfulness of Processing prior to withdrawal;
- Right not to be subject to automated decision-making (Art. 22 GDPR), including profiling that produces legal or similarly significant effects. We do not engage in such automated decision-making.
To exercise any of these rights, contact us at support@shapelab.co.mz. We will respond within thirty (30) days of receipt of a verifiable request, extendable by a further sixty (60) days where necessary having regard to the complexity and number of requests, in which case we will inform you of the extension and the reasons for it.
We may decline manifestly unfounded or excessive requests, in particular where they are repetitive, or charge a reasonable fee taking into account our administrative costs.
13. Account and Data Deletion
You may request deletion of your account and associated Personal Data by sending a verifiable request to support@shapelab.co.mz. The Coach App and Client App also offer in-app deletion functionality, where available.
Deletion will result in the permanent erasure of your Personal Data within thirty (30) days, save for: (i) data subject to mandatory legal retention obligations (e.g. tax records); (ii) data necessary to defend against legal claims; and (iii) data persisting in time-limited backup systems pending automatic overwriting.
Where you are a Coach, deletion of your account may impact the Clients connected to you. We will, where reasonably possible, notify affected Clients in advance.
14. Children
The Services are not directed to, and we do not knowingly collect Personal Data from, persons under the age of sixteen (16) years. If you are below this age, you must not use the Services.
If we become aware that we have inadvertently collected Personal Data from a person below this age without verifiable consent of a holder of parental responsibility, we will take prompt action to delete such data. Parents or guardians who become aware of such collection are invited to contact us at the address in §3.
15. Cookies, Trackers, and Behavioural Analytics
The Apps do not employ cookies, web beacons, software development kits ("SDKs") for behavioural analytics, advertising identifiers, or any other tracking technology for marketing or analytics purposes. We do not engage in cross-app or cross-site tracking.
The administrative web panel may use strictly necessary first-party cookies for the maintenance of an authenticated session.
16. Photographic Content and Sensitive Imagery
Progress photographs uploaded by Clients are private, accessible solely to the uploading Client and the Client's assigned Coach, and stored in Firebase Storage with access restricted by Storage Security Rules. We employ screen-capture protection on relevant screens where supported by the operating system.
You agree not to upload photographs that are unlawful, sexually explicit, or that depict third parties without their consent. We reserve the right to remove non-compliant content and to suspend or terminate accounts in accordance with our Terms of Service.
17. Payments
Where you are a Coach, subscription fees are settled by means of off-platform payment instruments (notably M-Pesa). We record only the transaction reference, the amount, and the date of confirmation. We do not process or store payment card data, bank account credentials, mobile wallet credentials, or biometric authentication data of any kind.
18. Third-Party Services
Where the Services interoperate with third-party platforms (e.g. Google Sign-In, Apple HealthKit, Google Health Connect), the Processing of your Personal Data by those third parties is governed by their respective privacy policies, which we encourage you to review. We are not responsible for the privacy practices of third parties.
19. Changes to This Policy
We may amend this Policy from time to time to reflect changes in our practices, the Services, or applicable law. The "Last updated" date at the top of this Policy will be revised accordingly. Material changes will be notified to Users in-app or via the email address associated with the account, in advance of the changes taking effect, where required by law.
Continued use of the Services following the effective date of the revised Policy constitutes acceptance of the changes.
20. Complaints and Supervisory Authority
You have the right to lodge a complaint with the competent data protection supervisory authority in your country of residence, place of work, or place of the alleged infringement.
In Mozambique, the competent authority is established under Law No. 3/2017. Users resident in the European Economic Area may lodge a complaint with their local data protection authority.
21. Governing Law and Jurisdiction
This Policy and any disputes arising out of or in connection with it shall be governed by and construed in accordance with the laws of the Republic of Mozambique, without regard to its conflict of laws principles.
The competent courts of Maputo shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this Policy, without prejudice to any mandatory rules of law that may afford you the right to bring proceedings in your country of residence.
22. Contact
For any matter relating to this Policy, the exercise of your rights, or any concern regarding the Processing of your Personal Data:
Shelton Lalgy, sole proprietor trading as ShapeLab
Avenida União Africana 4341, Matola, Mozambique
Email: support@shapelab.co.mz
This Policy is published in Portuguese and English. In the event of any discrepancy between the two versions, the Portuguese version shall prevail.