Privacy Policy

Wellzo is for adults only. The app requires you to be at least 18 years old, and we do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a person under 18, we will delete it.

Information you give us

When you create an account and use Wellzo, you provide:

• Phone number — your unique login handle, verified by a one-time SMS code.
• Full name.
• Gender.
• Date of birth — used to confirm you are 18 or older.
• Profile photo — optional.
• Your fitness goals, preferred workout times, and favorite categories or services.
• Saved places — your home and work locations, each with a label and precise map coordinates, when you choose to pin them.
• Post likes — when you like a post published by Wellzo or a Partner, we record that as a link between your account and that post.
• Support messages — anything you send us through in-app support chat.

Information created as you use Wellzo

• Bookings and check-in / attendance history.
• Membership status, credit balance, and usage.

Information collected automatically

• Precise location. With your permission, the app uses your device’s precise location while you are using it, to show nearby venues and confirm you are within range at check-in. Most of this happens on your device; when you pin a home or work place, those precise coordinates are saved to our servers.
• A secure login token stored on your device so you stay signed in. Only one active session is allowed per account.
• Your account ID — an identifier assigned when you create your account, used to authenticate you and link your activity to your account.
• Technical request data , such as your IP address, which our servers receive when the app connects to them; we use it to keep the service secure and reliable.
• Data collected by the Google Maps software — the mapping library we use independently collects a device identifier and diagnostic data (crash reports, performance data, and how you interact with the map), for Google’s own analytics purposes. See Section 5 for more.

What the app does not do

The Wellzo mobile app does not use advertising identifiers, ad networks, tracking cookies, or third-party advertising, and it does not build a marketing profile of you across other apps.

Separately, to keep the service running reliably, we monitor our own backend servers using standard system-monitoring (observability) tools. This processes technical operational data on our servers — such as logs and request information, which can include IP addresses and account identifiers — to detect and fix errors and performance problems. This server-side monitoring is not an in-app tracker.

Sensitive information

Some of what we handle deserves extra care: health- and fitness-related information (your goals, bookings, and check-ins), your precise location, and your date of birth. We handle this information only to provide the service described in this policy.

If you use Wellzo as a Partner or company administrator

Most of this policy describes data from members (people who use the Wellzo app). If instead you use Wellzo to run a business, we also collect:

• Partners (gyms and studios): the name, role, and optional phone number and email of each staff member you set up, together with their login credentials, so they can use the Partner dashboard. Partners may also enter records about their own members — such as name, phone number, and emergency contact — to manage attendance and memberships.
• Company administrators (corporate): your name, username, email, and password, your role, and your company’s name and contact details, so you can use the corporate portal and manage your organization’s membership.

We use this information only to provide the Partner and corporate services. The rest of this policy — how we share, retain, and secure data, and the rights you have — applies to these accounts too.

We use your information to:

• Create and secure your account and sign you in (one active session at a time).
• Sell memberships and manage your credits.
• Collect your fitness goals, preferred workout time, and category interests. We don’t yet use this to generate recommendations — this is being stored for a future personalization feature — but showing nearby venues and letting you search and filter services is available today, based on your location and search choices.
• Match you with services that fit any age or gender requirements — for example, ladies-only or men-only classes.
• Let you book sessions and check in by QR code.
• Show you stories and posts published by Wellzo and Partners, and let you like posts.
• Provide support when you contact us through in-app chat.
• Show nearby venues on a map.
• Send you service messages related to your account, such as SMS verification codes and booking confirmations.
• Keep the service safe and secure, and meet our legal obligations.

We process your personal data to perform our contract with you (providing the core features you sign up for), with your consent (for optional things such as accessing your precise location and adding optional profile fields — which you can withdraw at any time), for our legitimate interests (keeping the platform safe, preventing fraud and abuse, and improving the service), and to meet our legal obligations. We handle your personal data in line with Mongolia’s Law on Personal Data Protection.

We share personal data only as described here. We do not sell your personal data.

With Partners (gyms and studios). When you interact with a Partner, that Partner can see, on their dashboard, your bookings, check-ins and attendance, membership status, and profile — so they can serve you and honor your membership.

With your employer (corporate members only). If you joined Wellzo through your company, that company can see your usage only as an anonymized summary grouped by service category (for example, "yoga" or "gym") — never the specific service, venue, or session.

With Wellzo administrators. Our staff can access data as needed for moderation and support.

With the service providers that run Wellzo. We use trusted service providers to operate Wellzo. They process data on our behalf, only to provide their service to us:

• Cloud storage and hosting providers — store the images you upload and run our servers, database, and website.
• Google — we use Google Maps for maps and location features. Independently of our own code, the Google Maps software collects a device identifier and diagnostic data (crash reports, performance data, and how you interact with the map) for Google’s own analytics purposes. Google’s handling of this data is governed by the Google Privacy Policy.
• A support-chat platform — handles your support conversations and receives an identifier that links the conversation to your account.
• Payment providers (QPay and Pocket) — process your payments when you buy a membership or credits (see below for how this works).
• Mobile carriers — deliver the one-time verification codes we send to your phone (see below).

With authorities. We may disclose personal data where the law requires it, or to protect the rights, safety, and property of our users, the public, or MFlow LLC.

Payments and phone verification

When you buy a membership or credits, we hand you off to QPay or the Pocket app — by QR code or a deeplink to your banking app — to complete the payment. You pay directly in that app, not inside Wellzo. We never collect or store your card number or bank credentials; we only learn whether the payment succeeded when we check the invoice status afterward.

When you sign up or sign in, our own systems send a one-time verification code to your phone by SMS, delivered through Mongolian mobile carrier networks (Unitel, Skytel, Mobicom, and G-Mobile, depending on your number).

Some of our service providers are located outside Mongolia, including in the United States. This means your personal data may be transferred to and stored on servers outside Mongolia.

We keep your personal data for as long as your account is active and as long as we need it to provide the service, meet our legal obligations, resolve disputes, and enforce our agreements.

You can delete your account from within the app, or by contacting us at privacy@well-zo.com; deletion requires you to be signed in, so only you can start it. Please note that deletion anonymizes your account rather than erasing every record:

• We clear your personal information, such as your name, contact details, and other profile data.
• We disable your login, so you can no longer sign in.
• Some de-identified records remain — for example, bookings — because removing them would break the integrity of Partners’ records and other members’ histories. These records are no longer tied to your identity.
• If you are a corporate member, your billing records are retained for your employer’s accounting.

Because of this, we cannot promise the complete erasure of every record; we keep only what we need for integrity, accounting, and legal reasons, in a form that no longer identifies you where possible.

Subject to Mongolian law, you can:

• See and update most of your information directly in the app.
• Ask for a copy of your data.
• Correct information that is wrong.
• Delete your account (see Section 7).
• Opt out of marketing messages at any time, without affecting the service messages we must send to run your account.
• Withdraw consent you previously gave (for example, for location access), and manage app permissions in your device settings.
• Contact us with any concern at privacy@well-zo.com. You may also have the right to complain to the relevant data-protection authority in Mongolia.

The Wellzo mobile app does not use tracking cookies, advertising identifiers, or advertising networks — aside from the limited technical data the embedded Google Maps software collects for Google’s own analytics purposes, described in Section 2. Our website, well-zo.com, uses Google Analytics to understand general, aggregated website traffic (for example, how many people visit each page); where required, this is subject to cookie-consent controls. We do not use this to track you across other apps or services.

We take reasonable steps to protect your personal data. Where an account has a password — Partner and corporate accounts — it is stored hashed, never as plain text; customer accounts sign in with a one-time SMS code instead. Your login token is kept in secure storage on your device. Data sent between the app and our servers is protected in transit using encryption (SSL/TLS), and we limit access to personal data to the people who need it. No system is perfectly secure, and we cannot guarantee absolute security; if a data breach affects your personal data, we will respond and notify you and the authorities as required by law.

Wellzo is for adults only and enforces a minimum age of 18. The service is not directed to anyone under 18, and MFlow LLC does not knowingly collect personal data from minors. If we learn that we have collected data from someone under 18, we will delete it.

We may update this policy from time to time — for example, when we add features or change how we handle data. When we make a material change, we will update the date at the top and take reasonable steps to let you know, such as an in-app notice or a notice on well-zo.com.

For any privacy question or to exercise your rights, contact:

• Email: privacy@well-zo.com
• Post: MFlow LLC, Erdene Tolgoi 45, 8th khoroo, Bayanzurkh District, Room 184, Ulaanbaatar 13280, Mongolia

This policy is governed by the laws of Mongolia. It is published in Mongolian and English; if there is any inconsistency between the two versions, the Mongolian version prevails.