Privacy Policy

This Privacy Policy explains what personal information Zyken collects, why we collect it, who we share it with, how long we keep it and the choices you have. It applies to the Zyken mobile app (iOS and Android), the Zyken web portal used by vendors, gyms and administrators, and the public Zyken web pages, which all run on the same system.

We have written it in plain language. If anything is unclear, email us at [email protected].

1. Who we are

Zyken is operated by Zenthrive Studios, Godawari-11, Lalitpur, Nepal ("Zyken", "we", "us"). We decide how and why your personal information is processed on Zyken, so we are responsible for it.

We process personal information in line with the Individual Privacy Act, 2075 (2018) and the Individual Privacy Regulation, 2077 (2020), together with the Electronic Transactions Act, 2063 (2008) and other laws of Nepal that apply to us.

• Contact and grievance email: [email protected]
• Postal address: Zenthrive Studios, Godawari-11, Lalitpur, Nepal

Coaches, vendors and gyms on Zyken are independent businesses. When they receive your information through Zyken (for example, a vendor receiving your delivery address), they must use it only for the purpose described in this policy and in their partner terms (coaches, vendors, gyms).

2. The short version

• We collect what we need to run your account, your coaching, your orders and your gym passes, and nothing for advertising.
• Your medical information is encrypted and is shown only to a coach you explicitly choose to share it with, while you are that coach's active client. Every time a coach opens it, we log the access, and you can see that log.
• If you use Zyken Care, your health readings and medicine schedules get the same encryption as your medical information. Family members see only what you choose to share with them, and every view is logged (section 7).
• We do not sell your personal information. We have no advertising SDKs and no third-party analytics or ad trackers in the app or on the web portal.
• Payments are handled by eSewa, Khalti and Fonepay. We never see your wallet PIN, password or card details.
• Photos you upload are re-processed and stripped of EXIF metadata, including GPS location, before they are stored.
• You can delete your account in the app or at /delete-account. After a 14-day grace period your personal data is erased or anonymised; financial records are kept in anonymised form for 7 years because the law requires it.

3. What we collect, feature by feature

3.1 Account and sign-in

• Phone number (a Nepali mobile number) — your main account identifier. We verify it by sending a one-time password (OTP) by SMS.
• Email address (optional) — used for receipts and, if you choose, for email OTPs.
• Password (optional) — stored only as a one-way hash, never in readable form.
• OTP records — when you request a code we store the target (phone or email), the purpose (for example sign-in, guest checkout or account deletion), a hash of the code (never the code itself), its expiry (5 minutes by default), the number of attempts and the IP address of the request. Codes are rate-limited to protect you from abuse.
• Roles and settings — whether you are a client, coach, vendor admin, gym staff member or administrator, your preferred language (English or Nepali), and records of which versions of our legal documents you have accepted.

3.2 Profile

• Name, profile photo and bio.
• Client profile: date of birth, gender (including "prefer not to say"), height, weight, fitness level, preferred workout types, city, and your journey visibility setting (Public, Followers or Private).

3.3 Medical and health information (sensitive)

If you choose to fill in the medical section, we store: blood type; medical conditions; medications (name, dose, frequency); allergies; injuries; past surgeries; pregnancy status; smoking and alcohol habits; answers to a physical-activity readiness questionnaire (PAR-Q, for example heart conditions, chest pain, dizziness, joint problems, blood pressure medication); whether a doctor has cleared you for exercise; an emergency contact (name, relationship, phone); and free-text notes.

This is sensitive personal information. Section 6 explains the extra protection it gets. Filling it in is always optional.

If you use Zyken Care, we also collect health readings, medicine schedules and dose logs, and details of your family circle. Section 7 explains these.

3.4 Goals, progress and training

• Goals (for example target weight, body fat, strength, workout frequency) and progress entries.
• Body metrics — weight, body fat, waist, chest, hips, arm, thigh and resting heart rate, with dates and optional notes.
• Workout logs — the exercises, sets, reps and weights you record, and plans you follow.
• Meal and nutrition plans assigned to you by a coach, and any meal logs you keep.

3.5 Coaching

• Subscriptions and bookings — the coach and package you buy, price, billing period, status (active, paused, cancelled, expired), period dates and reference numbers such as SUB-2026-000123.
• Sessions — date and time, mode (online, in person or chat), gym branch for in-person sessions, meeting link, notes, and whether a session was completed, cancelled or missed.
• Reviews you write about a coach (rating, title, text) and coaches' replies.

3.6 Chat

When you message a coach (or another member you mutually follow), we store the text, and any photos, videos or documents you attach, shared plans or media, and read receipts. If you block the other person the conversation becomes read-only (see section 3.9). Chat attachments are served only through short-lived signed links, not public URLs.

3.7 Store orders

• Order details — order number (for example ZYK-2026-000123), items, prices, shipping fee, payment method and status.
• Contact and delivery details — contact phone, optional email, and the delivery address with the recipient's name and phone.
• Guest checkout — if you buy without an account, we verify your phone (or email) with an OTP and store the same order details, but no account.
• Shipment tracking — courier, tracking number and delivery status updates.

3.8 Payments

• Online wallet payments (eSewa, Khalti, Fonepay) — you pay on the provider's own page or app. We receive only the result: a transaction reference, amount, status and the provider's confirmation message. We never receive or store your wallet PIN, password, MPIN or card number.
• Bank slips — if you pay by bank transfer, we store the photo of the slip you upload and the reference you enter, plus the review outcome and any rejection reason.
• Cash on delivery — we record that the order was paid on delivery.

3.9 Social feed

Posts (text, photos, videos, workout or goal summaries), comments, likes, follows and followers.

• Blocks — the list of members you have blocked (who and when). We use it to hide their posts and comments from you and yours from them, to stop messages and follows between you, and to hide their coach reviews from you. The blocked person is not told, but they may notice they can no longer see your profile or message you.
• Reports — reports you make about posts, comments, members, chat messages or coach reviews (the item, the reason you chose and any note you add), and the moderation decision (the action taken, the moderator's note and when). Our moderators see the reported item; for a reported chat message they see that message and its attachment, not the rest of the conversation.
• Moderation — warnings, removed content and suspensions on your account (including the suspension's end date and reason).

3.10 Partner gyms

• Memberships and day passes — gym, plan, price, start and end dates, visits used, reference number (for example GYM-2026-000123).
• QR check-ins — each time staff scan your rotating QR pass we record the date and time, the gym branch, the staff member who scanned it and the result (for example "OK" or "expired").

3.11 Coach, vendor and gym applications

• Coaches: certifications (title, issuer, date, document), identity proof documents, experience, specialties, rates, availability, city, languages, cover image, intro video and media.
• Vendors: business name, PAN/VAT number, PAN document, distributor licence number, licence document and expiry date, contact details and address.
• Gyms: business name, PAN/VAT number and document, registration number and certificate, contact details, address and map location, description and photos.
• Payout account details for coaches, vendors and gyms — method (bank, eSewa or Khalti), account name and number, bank and branch.

3.12 Devices, notifications and location

• Push tokens — if you allow notifications, we store your device's push token, platform, app version and locale so we can send you notifications. We also store your notification history and preferences (categories, quiet hours).
• Location (optional) — if you tap "near me" when searching for gyms, the app asks for your location only while you are using it. Your coordinates are sent with that search to calculate distances and are not saved to your account or stored by us. You can use Zyken fully without granting location access.
• Camera and photo library — used only when you choose to take or pick a photo or scan a QR code.

3.13 Technical information

Our servers keep technical logs (for example IP address, date and time, the request made, error details and device or browser type) to keep Zyken secure and working. Phone numbers and similar identifiers are redacted from our SMS delivery logs.

4. Why we use your information

We rely on the grounds recognised under the Individual Privacy Act, 2075: your consent, what is necessary to provide the service you asked for, compliance with legal obligations, and our legitimate interests in running a safe, working service, where those interests are not overridden by your rights. We do not use your information for advertising or to build advertising profiles.

5. Who can see your information

5.1 Other people on Zyken

• Coaches you subscribe to can see your name, photo, public profile, client profile, goals and recent body metrics, your sessions and adherence, and the chat you have with them, while you have an active subscription with them. They see your medical information only if you have shared it with them (section 6).
• Vendors receive the details needed to fulfil the items they sold you: order number, items, recipient name, delivery address and contact phone. They do not see your other orders or your profile.
• Gyms where you hold a membership or day pass see your name, phone number, membership details and your check-ins at that gym. The front-desk view shows a masked phone number.
• Family members in your Care circle see only the Care information you chose for them, after they accept your invitation (section 7).
• Other members can see your public profile (name, photo, bio) and your posts, comments and likes according to your settings: Public posts are visible to everyone, Followers posts only to your followers, and Private posts only to you. Your journey visibility can further restrict this. Coach reviews are shown on the coach's public profile with your name.

5.2 Zyken staff

A small number of authorised Zyken staff can access data where needed to provide support, review applications, approve payments and bank slips, handle reports, process refunds and payouts, or meet legal obligations. Medical information and individual Care data (readings, medicines, circles) are not shown in the administration tools; administrators see only aggregate Care statistics (section 7).

5.3 Service providers (processors)

We use the following providers to run Zyken. They process data on our instructions and only for these purposes:

5.4 Legal requirements

We may disclose information when required by Nepali law, a court order or a lawful request from a government authority, or where necessary to protect the safety of a person, to prevent fraud, or to establish or defend legal claims.

5.5 Business changes

If Zenthrive Studios reorganises, merges or transfers the Zyken business, your information may pass to the new operator, who must continue to protect it in line with this policy. We will tell you in advance.

We do not sell, rent or trade your personal information.

6. Your medical information

We treat your medical information with extra care:

1. Optional and consent-based. You decide whether to enter it and what to enter.
2. Encrypted at rest. Your medical profile is stored encrypted with keys kept separately from the database. The keys can be rotated. It is decrypted only in memory when you, or a coach you have authorised, view it, and it is never written to logs.
3. Shared only with coaches you choose. A coach can see it only if you turn on sharing for that specific, verified coach and you are that coach's active client. No other coach, vendor, gym or member can see it.
4. Every access is logged. Each time a coach opens your medical information we record who, when and where. You can review this access log in the app.
5. Revoke any time. You can turn off sharing for a coach at any moment in the app. Access stops immediately. Coaches must not copy, export or keep your medical data outside Zyken (coach terms).
6. Deleted on request. You can clear your medical profile at any time, and it is deleted when your account is deleted.

Zyken is not a healthcare provider and does not diagnose or treat. See our Terms of Service for our health and fitness disclaimer.

7. Zyken Care: health readings, medicines and family

Zyken Care is an optional part of the app for people living with conditions such as high blood pressure, diabetes or thyroid disease, for pregnancy and after birth, and for healthy ageing. This section explains what Care collects, who can see it and how long we keep it. Everything in section 6 also applies to your Care data.

7.1 What Care collects

• Health readings — blood pressure and pulse, blood sugar (with its context, for example fasting or after a meal), lab values such as HbA1c, TSH, free T4 and liver tests (ALT, AST), and oxygen saturation (SpO2), with the date and time and any note you add.
• Medicines — your medicine schedules (medicine name, dose and instructions exactly as you enter them, and the times and days) and your dose log (Taken, Skip or Snooze, and when).
• Care conditions you mark on your medical profile (for example high blood pressure, diabetes, pregnancy with a due date, or the date and type of delivery after birth), and your confirmation that a clinician has cleared you for a pregnancy or post-partum program, with the time you confirmed it.
• Care settings — for example senior mode and how many days without a reading should alert your family.
• Your Care circle — the people you invite, the phone number you entered for each, their relation to you, the scopes you chose and the status of each invitation.

Health readings, medicine schedules and dose logs are sensitive health data. We collect them only when you enter them, or when a family member you have given the Readings scope logs a reading for you; we record who logged each reading. They are encrypted at rest with the same protection as your medical profile (section 6) and are never written to logs in readable form.

7.2 How we use it

We use your Care data only to show you your readings, trends and weekly summaries, to show safety messages (for example "sit quietly and re-measure" for a very high blood pressure reading), to run your medicine reminders, to send the family alerts you have turned on, and to recommend Care programs and guides that match your conditions. We do not sell Care data and we do not use it for advertising.

7.3 Medicine reminders stay on your device

Medicine reminders are scheduled and stored on your phone as local notifications, so they work without an internet connection. Our server keeps your schedule and your Taken, Skip and Snooze log (used for your adherence percentage and for family alerts), not the notifications themselves. Reminders are removed from the phone when you sign out.

7.4 Your family circle

• You choose each person and each scope. You can invite up to 10 people by phone number and choose, for each person, what they may see: Readings, Medicine adherence, Activity and/or Alerts.
• They must accept. Nothing is shared until the person accepts your invitation in the app.
• Either side can revoke at any time. You can remove a person or change their scopes, and a family member can leave your circle. Access stops immediately.
• Invitations by SMS. If the number you enter does not belong to a Zyken account, we send an invitation by SMS to that number. By sending the invitation you confirm that you have the person's permission to give us their number and to contact them.
• Every view is logged. Each time a family member or a coach opens your Care data, we record who, when and what they viewed. You can see this log in the app.
• Alerts to family. If you give someone the Alerts scope, they receive a notification when you record a reading in the crisis or low range (for example a very high blood pressure or a low blood sugar), when you have not logged a reading for the number of days you set, or when you miss two or more doses in a day. Alerts are limited to one of each kind per day.

7.5 Coaches and Zyken staff

• Coaches see your Care readings only if you share Readings with them through medical sharing, while you are their active client. You can stop sharing at any time. Coaches cannot log readings for you.
• Zyken administrators see only aggregate statistics (for example how many people use a program), with small groups of fewer than 5 people hidden. They never see your individual readings, medicines or circle.

7.6 Not medical advice, not an emergency service

Zyken Care gives general information and reminders. It does not diagnose, prescribe or change your medicines, and it is not an emergency service. Family alerts may be delayed or may not arrive. In an emergency call 102 (ambulance).

7.7 Keeping and deleting Care data

We keep your Care data only until you delete it. You can delete any reading, medicine schedule (with its dose log) or circle member at any time in the app. All Care data is deleted when you delete your account (section 11); we do not keep an anonymised copy of it.

8. Transfers outside Nepal

Our servers and file storage are hosted by Amazon Web Services in Mumbai, India. Resend (email), Google Firebase Cloud Messaging and Apple Push Notification service are based in the United States, and map tiles come from OpenStreetMap servers abroad.

We protect these transfers by using established providers with strong security certifications, encrypting data in transit (TLS), limiting what each provider receives to what it needs, encrypting medical data and provider credentials before storage, and binding providers to process data only for providing their service to us. By using Zyken you understand that your information will be processed in these countries, where data protection laws may differ from Nepal's.

9. How long we keep information

10. Your rights

Under the Individual Privacy Act, 2075, you have the right to:

• Access — ask what personal information we hold about you and get a copy.
• Correction — correct inaccurate or incomplete information. Most of it you can edit yourself in the app.
• Deletion — delete specific items (posts, metrics, medical profile) or your whole account (section 11).
• Withdraw consent — for example, turn off medical sharing with a coach, remove a person from your Care circle, turn off push notifications, or turn off location access in your phone settings. Withdrawing consent does not affect what was done before.
• Object — object to processing based on our legitimate interests.
• Complain — raise a grievance with us (section 16) and, if not satisfied, with the relevant authority in Nepal.

To exercise a right, email [email protected] from the email on your account or tell us your registered phone number. We may ask you to confirm your identity with an OTP before acting. We respond within the timelines in section 16. Some requests may be limited where the law requires us to keep information (for example, tax records).

11. Deleting your account

You can delete your account in two ways:

• In the app: Settings → Delete account. You confirm with an OTP sent to your phone.
• On the web: at /delete-account, by entering your registered phone number and the OTP we send. This works even if you no longer have the app.

Things that must be finished first. We cannot delete an account while it has, for example, orders that have not yet been delivered, active coaching subscriptions or gym memberships, or, for partners, active clients or members, open orders, an unpaid balance or pending payouts. The app shows you exactly what is blocking deletion so you can resolve it or contact us.

14-day grace period. When you confirm, your account is deactivated and you are signed out everywhere. If you sign in again within 14 days, the deletion is cancelled and your account is restored. After 14 days deletion is automatic and cannot be undone.

What is deleted: your name, email, photo, date of birth and client profile; your medical profile, shares and access log; your Care readings, medicine schedules, dose logs, Care circle, alerts and Care settings; goals, body metrics, workout and meal logs; the text of chat messages you sent and all attachments you sent; your posts (with their media), comments, likes and follows; coach reviews you wrote; delivery addresses on your orders (redacted); push tokens, notifications and notification preferences; carts and saved OTP records; coach profile media, certificates and ID documents; and vendor or gym application documents. Your phone number is released so it can be used to sign up again.

What is kept, in anonymised form: orders and order items, payments and transactions, bank slips, receipts, ledger entries, payouts, and subscription and gym membership records (for 7 years, as required by tax and accounting law); records of your legal acceptances (as proof of consent); and gym check-in counts. These records are no longer linked to your name, contact details or profile.

12. Children

Zyken is intended for people aged 16 and over.

• If you are 16 or 17, you may use Zyken only with the consent of a parent or legal guardian, who should review this policy and our Terms of Service with you.
• People under 16 may not create an account or use Zyken.

If we learn that an account belongs to someone under 16, we will delete it. If you believe a child under 16 is using Zyken, please email us.

13. Security

We protect your information with measures including:

• Encryption in transit (HTTPS/TLS) between the app, the web portal and our servers.
• Encryption at rest of medical data, including Care readings and medicine schedules, with rotatable keys, and separate encryption of payment and messaging provider credentials.
• Hashed OTPs and passwords; OTP codes expire after 5 minutes by default and are limited in attempts and frequency.
• Short-lived sign-in tokens that are revoked when you sign out or delete your account.
• Access controls so coaches, vendors, gyms and staff see only what their role needs; gym front desks see masked phone numbers.
• Private file links — chat attachments, bank slips, and coach, vendor and gym verification documents are never public: they are served only to the people allowed to see them, through signed links that expire within minutes.
• Image clean-up — every uploaded photo is re-encoded and stripped of EXIF, GPS location and other metadata.
• Rotating QR passes for gym entry, valid for about a minute, so a screenshot cannot be reused.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authority as required by Nepali law.

14. Cookies and device storage

• Web portal: we use one strictly necessary cookie, an encrypted session cookie that keeps you signed in. We also save small interface preferences (such as a collapsed menu or table columns) in your browser's local storage. We use no tracking, analytics or advertising cookies, so there is no cookie banner to accept.
• Mobile app: sign-in tokens are kept in your phone's secure storage (Keychain on iOS, Keystore on Android), and some content is cached on your device so the app works offline. Zyken Care medicine reminders are scheduled as local notifications on your phone. This data is removed when you sign out or uninstall the app.
• No trackers: the app contains no advertising SDKs and no third-party analytics. Firebase is used only to deliver push notifications.

15. Changes to this policy

We may update this policy as Zyken changes or the law changes. Each version is numbered and dated. If a change is material, for example a new use of your data or a new type of recipient, we will ask you to review and accept it in the app before continuing. For minor changes, such as clearer wording, we will update the page. Earlier versions are available from us on request.

16. Grievances and contact

If you have a question, request or complaint about your personal information, contact our grievance officer:

• Zenthrive Studios — Grievance Officer (Zyken)
• Email: [email protected]
• Address: Godawari-11, Lalitpur, Nepal

We acknowledge grievances within 3 business days and aim to resolve them within 15 days. If a matter is complex, we will tell you why and when to expect an answer.

If you are not satisfied with our response, you may take your complaint to the relevant authority under the laws of Nepal, including the Individual Privacy Act, 2075.

Related documents: Terms of Service · Refund & Cancellation Policy · Community Guidelines · Delete your account