Privacy policy

This policy explains which personal data we process when you use the Zenness app and the Zenness centre, why we process it, who receives it, how long we keep it and what rights you have. It applies under the General Data Protection Regulation (GDPR).

Who is responsible for your data

The data controller is Neo Medical Systems S.A., a société anonyme under Luxembourg law, 2 rue Jean Engling, L-1466 Luxembourg, RCS Luxembourg B148 809, VAT LU26214843. Neo Medical Systems S.A. operates the Zenness wellness centre and app; in this policy, "Zenness", "we", "us" and "our" refer to it.

For any question about this policy or your data, write to info@neoms.com.

What data we process

We only process the data needed to run your account, your bookings and your purchases. In detail:

• Identity and contact: your name, email address, phone number (with country code) and the language you chose in the app.
• Account: your password (stored in hashed form by the authentication service; nobody, including us, can read it), account status, creation and activation dates, sign-in timestamps, and the session tokens kept on your device.
• Bookings and use of the centre: equipment booked, dates, durations, booking status (booked, completed, cancelled, missed), the QR code of each booking, the time of validation at the entrance and the staff member who validated it, and your minute balances and their movements.
• Purchases: offers bought, amounts, payment status, card brand and last four digits, Stripe identifiers, invoices (name, email and, if you provide them, address and VAT number), refunds and credit notes.
• Gift cards: sender name, recipient name, personal message and the gift code.
• Contracts and consents: for a subscription, the text of the contract, the name you typed, the image of your drawn signature, the date, your IP address and the app version; for every checkout, the consents you gave, with the date, time, IP address, app version and the exact text shown.
• Notifications: your device's push token (Firebase Cloud Messaging), platform (iOS or Android), language and last activity; a log of the notifications and emails sent to you (time, type and delivery status).
• Marketing preference: whether you agreed to receive news and offers, with the date and the source of that choice. It is off by default.
• Staff actions: an internal log of manual actions taken by staff on your account (for example minutes granted, a plan assigned, a no-show excused or a refund), with the staff member concerned and an internal note.

What we do not collect

We do not collect your date of birth, gender, photo, postal address (except on a business invoice, at your request), health data, location, contacts, photo library or advertising identifiers.

As regards health: before a purchase you declare on your honour that you have read the contraindications and that none applies to you. We only store the fact that you accepted that declaration, together with its text. We do not ask for, or store, any information about your health.

No tracking

The app contains no analytics, tracking or advertising tools. We do not profile you, we take no automated decisions about you, and we never sell your data. The app does not track you across other apps or websites.

Why we use your data, and on what legal basis

• To perform our contract with you: creating and managing your account, bookings, access control at the entrance, payments, minute balances, subscription management, service notifications (booking reminders, failed payments, renewal reminders) and customer service.
• To comply with legal obligations: invoicing and accounting, tax obligations, and keeping proof of the consents required by consumer law (in particular for the right of withdrawal).
• For our legitimate interests: the security of the centre and of the app, preventing fraud and abuse, keeping evidence and defending legal claims (contracts, consents, logs), and internal statistics on bookings and occupancy.
• With your consent: marketing messages, if you opt in under Profile → Terms and privacy (you may withdraw at any time in the same place); and push notifications, through your device's permission.

Who can see your data

Within Zenness, only authorised staff can access your data, and each person only sees what their role requires. At the entrance, the reception scanner shows the staff member your name and booking. Other staff roles cover bookings, customer files and finance, each on a need-to-know basis.

Service providers and other recipients

We use the following providers, under contract with us:

• Supabase Inc. — database, authentication and server functions, hosted in the European Union.
• Stripe Payments Europe Ltd (Ireland) — payments, refunds and subscriptions. For some processing, such as fraud prevention and its own legal obligations, Stripe acts as an independent controller.
• Apple and Google — when you choose Apple Pay or Google Pay, under their own terms.
• Google (Firebase Cloud Messaging) — delivery of push notifications.
• Resend — delivery of transactional emails, such as the code to reset your password.
• Google Fonts — delivery of typefaces. The app may download fonts from Google's servers, which then receive your device's IP address.

Where the law requires it, we also share data with our accountant and with public authorities (for example the tax authorities or the courts).

Transfers outside the European Economic Area

Some providers (Google, Stripe, Resend and Supabase support) may access data from the United States. Such transfers are covered by the EU-US Data Privacy Framework and/or by the European Commission's Standard Contractual Clauses.

How long we keep your data

• Account data: for as long as your account exists. When you delete it, we proceed as described below.
• Invoices and accounting documents: 10 years, as required by Belgian and Luxembourg accounting and VAT law.
• Signed contracts and checkout consents: for the duration of the contract and then 10 years (the limitation period), as evidence.
• Booking and usage history: for the duration of our relationship, then only in anonymised form for statistics.
• Push token: until you sign out, delete your account, or your device invalidates it.
• Notification and email logs, and technical payment events: up to 3 years.
• Marketing consent record: for as long as your consent stands, plus the period during which we may need to prove it.

Deleting your account

You can delete your account yourself in the app, under Profile → Delete my account, by typing a confirmation word. Deletion is not possible while a subscription is active, being cancelled or in payment default; the subscription must have ended first.

When you delete your account:

• your name is replaced by an anonymous label;
• your email address, phone number, password and marketing choice are removed;
• the image of your drawn signature and the IP address recorded when you signed a contract are removed;
• the names on gift cards are removed;
• you are signed out on every device.

The law, or the need to keep evidence, requires us to keep:

• invoices already issued, with the name, email and address as they appear on them;
• the text of signed contracts, with the name you typed;
• the consent records made at checkout, with the IP address and time;
• your booking and usage history, under an anonymous identifier that is no longer linked to your name or contact details.

Stripe keeps its own payment records under its own legal obligations.

Device permissions and storage

The app may ask for the following permissions:

• Notifications — optional. We only ask after a screen explaining what they are for, and you can withdraw permission at any time in your device settings.
• Camera — used only by the staff scanner. Members do not need to grant it.

The app never asks for access to your location, contacts or photos.

On your device, the app stores your session and your chosen language. The public legal web pages use no cookies and no analytics. The staff back-office stores its session and interface language in the browser; this is strictly necessary for it to work.

Security

We protect your data with encrypted connections (TLS), access control per user at database level, role-based access for staff, hashed passwords, records that cannot be altered for invoices, contracts and consents, and logging of staff actions.

Minors

Our services are reserved for adults (18 and over). We do not knowingly collect data relating to minors.

Your rights

Under the GDPR you have the right to:

• access your data;
• have inaccurate data corrected;
• have your data erased;
• restrict processing;
• receive your data in a portable format;
• object to processing, including processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing carried out before.

To exercise any of these rights, write to info@neoms.com. We will reply within one month. We may ask you for proof of identity before acting on your request.

Complaints

If you believe your data is not being handled properly, you may lodge a complaint with:

• the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be;
• the Luxembourg National Commission for Data Protection (Commission nationale pour la protection des données, CNPD), 15 Boulevard du Jazz, L-4370 Belvaux;
• or the data protection authority of the country where you live.

Changes to this policy

We publish every new version of this policy in the app and at https://app.zenness.be/legal/privacy, with its date. We will notify you of any significant change.

Last updated: 6 October 2026