Privacy Policy

Wellzo is for adults only. The app requires you to be at least 18 years old, and we do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a person under 18, we will delete it.

Information you give us

When you create an account and use Wellzo, you provide:

• Phone number — your unique login handle, verified by a one-time SMS code.
• Full name.
• Gender.
• Date of birth — used to confirm you are 18 or older.
• Profile photo — optional.
• Your fitness goals, preferred workout times, and favorite categories or services.
• Saved places — your home and work locations, each with a label and precise map coordinates, when you choose to pin them.
• Posts, stories and reviews — the photos and text you publish, and the service they are about. Other members see them once they pass moderation. You choose each photo, by taking it with your camera or picking it from your library; we receive only the photos you publish or set as your profile photo.
• Username and follows — your @username, who you follow and who follows you, and whether your account is public or private.
• Post likes — when you like a post, we record that as a link between your account and that post.
• Support messages — anything you send us through in-app support chat.

Your public profile. New accounts are public. Any member can see your name, @username, profile photo, follower and following counts, and your published posts. A private account shows its posts and follower lists only to the people you approve. You can switch in Settings at any time.

Information created as you use Wellzo

• Bookings and check-in / attendance history.
• Membership status, credit balance, and usage.

Information collected automatically

• Precise location. With your permission, the app uses your device’s precise location while you are using it, to show nearby venues and confirm you are within range at check-in. Most of this happens on your device; when you pin a home or work place, those precise coordinates are saved to our servers.
• A secure login token stored on your device so you stay signed in. Only one active session is allowed per account.
• Your account ID — an identifier assigned when you create your account, used to authenticate you and link your activity to your account.
• App usage analytics — which screens you open, the sign-up steps you complete, the services and membership plans you view, and when you start and complete a membership purchase, with your device model, operating system and app version. See Section 9.
• Technical request data , such as your IP address, which our servers receive when the app connects to them; we use it to keep the service secure and reliable.
• Data collected by the Google Maps software — the mapping library we use independently collects a device identifier and diagnostic data (crash reports, performance data, and how you interact with the map), for Google’s own analytics purposes. See Section 5 for more.
• Device push token — when you enable notifications, your device generates a push notification token that our servers use to deliver session reminders and service messages to your device via Google (Firebase Cloud Messaging). You can turn notifications off at any time in your device settings. See Section 5 for more.

Advertising measurement

We advertise the Wellzo app on Facebook and Instagram. To measure whether those ads work, the app uses Meta's app events tool (the Meta SDK). It tells Meta when the app is installed and opened, when you finish signing up, and when you buy a Wellzo membership, together with the amount paid. With these, Meta receives technical details such as your device model, operating system and IP address, and on Android your device's advertising identifier. We do not give Meta your name, phone number, email address or account ID. On iPhone the app first shows Apple's tracking prompt, and Meta receives the advertising identifier only if you allow tracking there. The Wellzo app shows no ads. You can reset or delete your advertising identifier at any time in your device settings.

Separately, to keep the service running reliably, we monitor our own backend servers using standard system-monitoring (observability) tools. This processes technical operational data on our servers — such as logs and request information, which can include IP addresses and account identifiers — to detect and fix errors and performance problems. This server-side monitoring is not an in-app tracker.

Sensitive information

Some of what we handle deserves extra care: health- and fitness-related information (your goals, bookings, and check-ins), your precise location, and your date of birth. We handle this information only to provide the service described in this policy.

If you use Wellzo as a Partner or company administrator

Most of this policy describes data from members (people who use the Wellzo app). If instead you use Wellzo to run a business, we also collect:

• Partners (gyms and studios): the name, role, and optional phone number and email of each staff member you set up, together with their login credentials, so they can use the Partner dashboard. Partners may also enter records about their own members — such as name, phone number, and emergency contact — to manage attendance and memberships.
• Company administrators (corporate): your name, username, email, and password, your role, and your company’s name and contact details, so you can use the corporate portal and manage your organization’s membership.

We use this information only to provide the Partner and corporate services. The rest of this policy — how we share, retain, and secure data, and the rights you have — applies to these accounts too.

We use your information to:

• Create and secure your account and sign you in (one active session at a time).
• Sell memberships and manage your credits.
• Collect your fitness goals, preferred workout time, and category interests. We don’t yet use this to generate recommendations — this is being stored for a future personalization feature — but showing nearby venues and letting you search and filter services is available today, based on your location and search choices.
• Match you with services that fit any age or gender requirements — for example, ladies-only or men-only classes.
• Let you book sessions and check in by QR code.
• Show you stories and posts published by Wellzo and Partners, and let you like posts.
• Provide support when you contact us through in-app chat. An AI assistant answers first, through the third-party AI provider named below, and a member of our team can join the conversation.
• Show nearby venues on a map.
• Send you service messages related to your account, such as SMS verification codes and booking confirmations.
• Understand how the app is used — for example, how many people use it each day and each month, and where people have difficulty during sign-up or when buying a membership — so we can improve it (see Section 9).
• Contact you, for example by phone, to ask about your experience of the app and to tell you about Wellzo memberships. You can ask us to stop at any time (see Section 8).
• Keep the service safe and secure, and meet our legal obligations.

We process your personal data to perform our contract with you (providing the core features you sign up for), with your consent (for optional things such as accessing your precise location and adding optional profile fields — which you can withdraw at any time), for our legitimate interests (keeping the platform safe, preventing fraud and abuse, and improving the service), and to meet our legal obligations. We handle your personal data in line with Mongolia’s Law on Personal Data Protection.

We share personal data only as described here. We do not sell your personal data.

With Partners (gyms and studios). When you interact with a Partner, that Partner can see, on their dashboard, your bookings, check-ins and attendance, membership status, and profile — so they can serve you and honor your membership.

With other members. Other members see your public profile and the posts, stories and reviews you publish, as described in section 2. When you block a member, you and they stop seeing each other.

With your employer (corporate members only). If you joined Wellzo through your company, that company can see your usage only as an anonymized summary grouped by service category (for example, "yoga" or "gym") — never the specific service, venue, or session.

With Wellzo administrators. Our staff can access data as needed for moderation and support.

With the service providers that run Wellzo. We use trusted service providers to operate Wellzo. They process data on our behalf, only to provide their service to us:

• Cloud storage and hosting providers — store the images you upload and run our servers, database, and website.
• Google — we use Google Maps for maps and location features. Independently of our own code, the Google Maps software collects a device identifier and diagnostic data (crash reports, performance data, and how you interact with the map) for Google’s own analytics purposes. Google’s handling of this data is governed by the Google Privacy Policy.
• Google (Firebase Cloud Messaging) — delivers session reminders and service messages to your device using a device push token when you enable notifications. Google acts as our processor for push delivery. You can turn notifications off at any time in your device settings.
• A support-chat platform — handles your support conversations and receives an identifier that links the conversation to your account.
• Payment providers (QPay and Pocket) — process your payments when you buy a membership or credits (see below for how this works).
• Mobile carriers — deliver the one-time verification codes we send to your phone (see below).
• OpenRouter — our AI provider, which passes each request to the AI model that answers it. Before a post, story or review appears, it receives that content's photos and text to check them against our rules; you agree to this before you publish for the first time. It also receives the messages you send in the in-app support chat, so our AI assistant can answer them.
• Our analytics provider — receives the app usage information described in Section 9, linked to your account ID, so we can understand how the app is used. It processes this information only on our behalf and does not use it for its own purposes.
• Meta Platforms — receives the advertising-measurement information described in Section 2, so we can see which of our Facebook and Instagram ads bring people to the app. Meta also uses this information under its own privacy policy.

With authorities. We may disclose personal data where the law requires it, or to protect the rights, safety, and property of our users, the public, or MFlow LLC.

Payments and phone verification

When you buy a membership or credits, we hand you off to QPay or the Pocket app — by QR code or a deeplink to your banking app — to complete the payment. You pay directly in that app, not inside Wellzo. We never collect or store your card number or bank credentials; we only learn whether the payment succeeded when we check the invoice status afterward.

When you sign up or sign in, our own systems send a one-time verification code to your phone by SMS, delivered through Mongolian mobile carrier networks (Unitel, Skytel, Mobicom, and G-Mobile, depending on your number).

Some of our service providers are located outside Mongolia, including in the United States. This means your personal data may be transferred to and stored on servers outside Mongolia.

We keep your personal data for as long as your account is active and as long as we need it to provide the service, meet our legal obligations, resolve disputes, and enforce our agreements.

App usage analytics (Section 9) is kept for up to 12 months.

You can delete your account from within the app, or by contacting us at privacy@well-zo.com; deletion requires you to be signed in, so only you can start it. Please note that deletion anonymizes your account rather than erasing every record:

• We clear your personal information, such as your name, contact details, and other profile data.
• We disable your login, so you can no longer sign in.
• Some de-identified records remain — for example, bookings — because removing them would break the integrity of Partners’ records and other members’ histories. These records are no longer tied to your identity.
• If you are a corporate member, your billing records are retained for your employer’s accounting.

Because of this, we cannot promise the complete erasure of every record; we keep only what we need for integrity, accounting, and legal reasons, in a form that no longer identifies you where possible.

Subject to Mongolian law, you can:

• See and update most of your information directly in the app.
• Ask for a copy of your data.
• Correct information that is wrong.
• Delete your account (see Section 7).
• Opt out of marketing messages at any time, without affecting the service messages we must send to run your account.
• Reset or delete your device's advertising identifier, or limit ad tracking, in your device settings.
• Withdraw consent you previously gave (for example, for location access), and manage app permissions in your device settings.
• Contact us with any concern at privacy@well-zo.com. You may also have the right to complain to the relevant data-protection authority in Mongolia.

The Wellzo mobile app does not use tracking cookies or advertising networks, and it shows no ads. It uses the Meta SDK only to measure our own ads on Facebook and Instagram, as described in Section 2, and the embedded Google Maps software collects limited technical data for Google's own analytics purposes, also described in Section 2. Our website, well-zo.com, uses Google Analytics to understand general, aggregated website traffic (for example, how many people visit each page); where required, this is subject to cookie-consent controls. We do not use this to track you across other apps or services.

App usage analytics

To understand how people use the app and to improve it, the app records which screens you open, the sign-up steps you complete, the services and membership plans you view, when you start and complete a membership purchase, and the date and time of these actions, together with technical details such as your device model, operating system and version, and the app version.

Before you create an account, this information is linked only to a random identifier created on your device. When you sign up or sign in, it is linked to your account ID, together with a few facts from your profile: your app language, your gender, your age range (not your date of birth), whether you hold a Wellzo membership, and whether you receive Wellzo through your employer.

We do not collect your name, phone number, email address, date of birth, payment details, or the content of your posts and reviews for this purpose. We do not keep your IP address for this purpose, but we may use your network connection to estimate your approximate country or city.

A third-party analytics provider processes this information on our behalf and stores it on servers in the United States (see Sections 5 and 6). We do not sell it, we do not use it for advertising by other companies, and we do not combine it with information from other companies' apps or websites. We keep it for up to 12 months, and when you delete your account it is no longer connected to your identity.

We take reasonable steps to protect your personal data. Where an account has a password — Partner and corporate accounts — it is stored hashed, never as plain text; customer accounts sign in with a one-time SMS code instead. Your login token is kept in secure storage on your device. Data sent between the app and our servers is protected in transit using encryption (SSL/TLS), and we limit access to personal data to the people who need it. No system is perfectly secure, and we cannot guarantee absolute security; if a data breach affects your personal data, we will respond and notify you and the authorities as required by law.

Wellzo is for adults only and enforces a minimum age of 18. The service is not directed to anyone under 18, and MFlow LLC does not knowingly collect personal data from minors. If we learn that we have collected data from someone under 18, we will delete it.

We may update this policy from time to time — for example, when we add features or change how we handle data. When we make a material change, we will update the date at the top and take reasonable steps to let you know, such as an in-app notice or a notice on well-zo.com.

For any privacy question or to exercise your rights, contact:

• Email: privacy@well-zo.com
• Post: MFlow LLC, Ikh Mongol Complex, 3rd Floor, 36th Khoroo, Bayanzurkh District, Ulaanbaatar, Mongolia

This policy is governed by the laws of Mongolia. It is published in Mongolian and English; if there is any inconsistency between the two versions, the Mongolian version prevails.