Privacy Policy

Wellzo is for adults only. The app requires you to be at least 18 years old, and we do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a person under 18, we will delete it.

Information you give us

When you create an account and use Wellzo, you provide:

• Phone number — your unique login handle.
• Password — stored only in hashed (scrambled) form; we never keep it as plain text.
• Full name.
• Username — unique and searchable, so other members can find and follow you.
• Email address — optional.
• Gender.
• Date of birth — used to confirm you are 18 or older and to personalize your experience.
• Foreign passport number — optional; you can add it to your profile, but you do not have to.
• Profile photo — optional.
• Your fitness goals, preferred workout times, and favorite categories or services.
• Saved places — your home and work locations, each with a label and precise map coordinates, when you choose to pin them.
• Social handles — your Instagram, Facebook, or TikTok, if you add them.
• Content you create — posts (captions, images, hashtags, and any linked service), stories (photos), reviews (a rating and comment), and your likes, follows, and blocks.
• Support messages — anything you send us through in-app support chat.

Information created as you use Wellzo

• Bookings and check-in / attendance history.
• Membership status, credit balance, and usage.

Information collected automatically

• Precise location. With your permission, the app uses your device’s precise location while you are using it, to show nearby venues and confirm you are within range at check-in. Most of this happens on your device; when you pin a home or work place, those precise coordinates are saved to our servers.
• Device push token. If you allow notifications, we register a push token so we can send them (see Section 6).
• A secure login token stored on your device so you stay signed in. Only one active session is allowed per account.
• Technical request data , such as your IP address, which our servers receive when the app connects to them; we use it to keep the service secure and reliable.

What the app does not do

The Wellzo mobile app does not use advertising identifiers, ad networks, tracking cookies, or third-party advertising, and it does not build a marketing profile of you across other apps.

Separately, to keep the service running reliably, we monitor our own backend servers using standard system-monitoring (observability) tools. This processes technical operational data on our servers — such as logs and request information, which can include IP addresses and account identifiers — to detect and fix errors and performance problems. This server-side monitoring is not an in-app tracker.

Sensitive information

Some of what we handle deserves extra care: health- and fitness-related information (your goals, bookings, and check-ins), your precise location, your date of birth, and — if you add it — your foreign passport number. We handle this information only to provide the service described in this policy.

If you use Wellzo as a Partner or company administrator

Most of this policy describes data from members (people who use the Wellzo app). If instead you use Wellzo to run a business, we also collect:

• Partners (gyms and studios): the name, role, and optional phone number and email of each staff member you set up, together with their login credentials, so they can use the Partner dashboard. Partners may also enter records about their own members — such as name, phone number, and emergency contact — to manage attendance and memberships.
• Company administrators (corporate): your name, username, email, and password, your role, and your company’s name and contact details, so you can use the corporate portal and manage your organization’s membership.

We use this information only to provide the Partner and corporate services. The rest of this policy — how we share, retain, and secure data, and the rights you have — applies to these accounts too.

We use your information to:

• Create and secure your account and sign you in (one active session at a time).
• Sell memberships and manage your credits.
• Help you discover services and give recommendations, based on your goals, favorites, and location.
• Match you with services that fit any age or gender requirements — for example, ladies-only or men-only classes.
• Show the social handles and profile details you choose to add on your public profile.
• If you choose to add your passport number, verify your identity where a venue or Partner requires proof of identity.
• Let you book sessions and check in by QR code.
• Run the social feed — posts, stories, likes, follows, and reviews.
• Automatically screen posted content using AI (see Section 5) to help keep the community safe.
• Provide support chat, where an AI assistant answers first and a person can take over.
• Show nearby venues on a map.
• Send you notifications and service messages, and — if you have not opted out — occasional promotional messages.
• Keep the service safe and secure, and meet our legal obligations.

We process your personal data to perform our contract with you (providing the core features you sign up for), with your consent (for optional things such as accessing your precise location and adding optional profile fields — which you can withdraw at any time), for our legitimate interests (keeping the platform safe, preventing fraud and abuse, improving the service, and sending you occasional promotional messages, which you can opt out of at any time), and to meet our legal obligations. We handle your personal data in line with Mongolia’s Law on Personal Data Protection.

We share personal data only as described here. We do not sell your personal data.

With Partners (gyms and studios). When you interact with a Partner, that Partner can see, on their dashboard, your bookings, check-ins and attendance, membership status, profile, and your reviews of them — so they can serve you and honor your membership.

With your employer (corporate members only). If you joined Wellzo through your company, that company can see your usage only as an anonymized summary grouped by service category (for example, "yoga" or "gym") — never the specific service, venue, or session.

With other members. Other users can see the public parts of your profile — your username, name, photo, posts, stories, and followers. If you make your account private or non-searchable, this is limited accordingly.

With Wellzo administrators. Our staff can access data as needed for moderation and support.

With the service providers that run Wellzo. We use trusted service providers to operate Wellzo. They process data on our behalf, only to provide their service to us:

• Cloud storage and hosting providers — store the images you upload and run our servers, database, and website.
• Google — we use Google Maps for maps and location features, and Google Firebase Cloud Messaging to deliver push notifications (which uses your device push token). Google’s handling of this data is governed by the Google Privacy Policy.
• An AI provider — powers the support chatbot and automatically screens posted content (captions, reviews, and images).
• A support-chat platform — handles your support conversations and receives an identifier that links the conversation to your account.
• Local payment providers — process your payments (see below).
• An SMS provider — sends the one-time verification codes to your phone.

With authorities. We may disclose personal data where the law requires it, or to protect the rights, safety, and property of our users, the public, or MFlow LLC.

Payments and phone verification

When you buy a membership or credits, your payment is handled by third-party payment providers, not by Wellzo directly. We do not store your full card numbers or bank credentials; the provider processes the payment and tells us only whether it succeeded and the limited details we need for your records.

When you sign up or sign in, we send a one-time code to your phone by SMS, through an SMS provider, to confirm your number.

If you allow notifications, we send push notifications through Firebase Cloud Messaging (Google) — for example, booking reminders, check-in confirmations, and account updates, and, if you have not opted out, occasional promotional messages. To do this, we store a device push token. You can turn notifications off at any time in your device settings.

Some of our service providers are located outside Mongolia, including in the United States. This means your personal data may be transferred to and stored on servers outside Mongolia.

We keep your personal data for as long as your account is active and as long as we need it to provide the service, meet our legal obligations, resolve disputes, and enforce our agreements.

You can delete your account from within the app, or by contacting us at privacy@well-zo.com; deletion is password-protected, so only you can start it. Please note that deletion anonymizes your account rather than erasing every record:

• We clear your personal information, such as your name, contact details, and other profile data.
• We retire your unique phone number and username so they cannot simply be reused, without keeping them as usable contact details.
• We disable your login, so you can no longer sign in.
• Some de-identified records remain — for example, bookings and reviews — because removing them would break the integrity of Partners’ records and other members’ histories. These records are no longer tied to your identity.
• If you are a corporate member, your billing records are retained for your employer’s accounting.

Because of this, we cannot promise the complete erasure of every record; we keep only what we need for integrity, accounting, and legal reasons, in a form that no longer identifies you where possible.

Subject to Mongolian law, you can:

• See and update most of your information directly in the app.
• Ask for a copy of your data.
• Correct information that is wrong.
• Delete your account (see Section 8).
• Opt out of marketing messages at any time, without affecting the service messages we must send to run your account.
• Withdraw consent you previously gave (for example, for location access), and manage app permissions in your device settings.
• Contact us with any concern at privacy@well-zo.com. You may also have the right to complain to the relevant data-protection authority in Mongolia.

The Wellzo mobile app does not use tracking cookies, advertising identifiers, or advertising networks. Our website, well-zo.com, uses Google Analytics to understand general, aggregated website traffic (for example, how many people visit each page); where required, this is subject to cookie-consent controls. We do not use this to track you across other apps or services.

We take reasonable steps to protect your personal data. Your password is stored hashed, never as plain text. Your login token is kept in secure storage on your device. Data sent between the app and our servers is protected in transit using encryption (SSL/TLS), and we limit access to personal data to the people who need it. No system is perfectly secure, and we cannot guarantee absolute security; if a data breach affects your personal data, we will respond and notify you and the authorities as required by law.

Wellzo is for adults only and enforces a minimum age of 18. The service is not directed to anyone under 18, and MFlow LLC does not knowingly collect personal data from minors. If we learn that we have collected data from someone under 18, we will delete it.

We may update this policy from time to time — for example, when we add features or change how we handle data. When we make a material change, we will update the date at the top and take reasonable steps to let you know, such as an in-app notice or a notice on well-zo.com.

For any privacy question or to exercise your rights, contact:

• Email: privacy@well-zo.com
• Post: MFlow LLC, Erdene Tolgoi 45, 8th khoroo, Bayanzurkh District, Room 184, Ulaanbaatar 13280, Mongolia

This policy is governed by the laws of Mongolia. It is published in Mongolian and English; if there is any inconsistency between the two versions, the Mongolian version prevails.