Privacy Policy
1. Who we are
Athletic Sparks is the member app of Lecao Athletic Base Co., Ltd (“LAB”, “we”, “us”), a strength and conditioning gym at 129 Quoc Huong, An Khanh Ward (Thao Dien), Ho Chi Minh City, Vietnam (business registration number 0317685169). LAB decides how and why your personal data is processed in the app and in the member records behind it, and is responsible for it under Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP.
This policy explains what we collect, why, who we share it with, how long we keep it, and the choices you have. It covers the app and the member account it connects to. It does not cover other websites or apps that we link to.
2. Data we collect
You can use the app only after LAB invites you. Some of the data below comes from you in the app; some is recorded by LAB staff when you join or train with us and is shown to you in the app.
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email address, phone number, member number | LAB when you join; you can update your name and phone in the app |
| Account and sign-in | Password (stored only as a one-way hash), invitation code (stored only as a hash), sign-in sessions with the date and the device type and app version your phone reports | You, and your phone when you sign in |
| Membership profile | Date of birth, gender, address, membership start date and status, assigned coach. If you agree to an assessment, coaches may record height, weight and body composition | LAB staff |
| Emergency contact | The name and phone number of a person you choose | You or LAB staff |
| Profile photo | A photo you take or choose in the app, or that LAB adds with your agreement | You or LAB staff |
| Health information | Injuries, their status and updates, and notes that help coaches adapt your training. See section 3 | You or your coach |
| Training activity | Bookings, cancellations, waitlist entries, check-ins and attendance, sessions used, coach training notes, monthly goal progress | You and LAB staff |
| Purchases and billing | Packages and credits, orders, invoices, amounts, payment status and method (for example cash at reception). The app does not collect card numbers | You and LAB staff |
| Waiver and agreements | Which version of the training waiver you accepted and when | You |
| Preferences | Your notification choices and app appearance | You |
| Technical data | IP address and request details in server logs, used for security and to keep the service running | Your phone, automatically |
We do not use advertising, analytics or tracking tools in the app. We do not track you across other companies' apps or websites, and we do not sell your personal data.
3. Health information
Information about injuries and physical condition is sensitive personal data under Vietnamese law. We process it only to keep you safe and to adapt your training, with your explicit consent, which you give when you add an injury or agree to an assessment. Only LAB staff who coach or look after you can see it. We never use it for marketing or advertising, and we never share it with insurers or employers. You can view your injury records in the app, and you can ask us to correct or delete them at any time.
LAB is a gym, not a medical provider. Injury notes are training notes, not medical records or advice.
4. Camera, photos and calendar
- Camera. Used only when you scan the gym's check-in QR code or take a profile photo. QR codes are read on your phone. A photo leaves your phone only after you choose to use it as your profile photo.
- Photos. When you choose a profile photo, the app receives only the photo you pick, not your photo library.
- Calendar. If you add a booking to your calendar, the app asks for permission to add events only. It cannot read your calendar, and nothing from your calendar is sent to us.
You can turn these permissions on or off at any time in iPhone Settings. The rest of the app keeps working without them.
5. How we use your data
- To set up and secure your account, and to sign you in.
- To show the timetable, take bookings, manage waitlists and cancellations, and check you in.
- To track your packages, credits and invoices, and to process orders you place for payment at reception.
- To keep you safe while training, using your injury notes, waiver and emergency contact.
- To send service emails, such as your invitation code, password reset links and receipts, and the booking and schedule notices you choose in Notifications.
- To let LAB staff support you, for example when you buy a package or contact the front desk.
- To prevent abuse, investigate problems and keep records that accounting and tax law requires.
We do not make automated decisions about you that have legal or similarly significant effects.
6. Consent and legal grounds
We process your data with your consent. You give it when you activate your account in the app, where we link to this policy before you continue, when you accept the training waiver, and when you use specific features such as injury notes and profile photos. We may also process data without consent where Vietnamese law allows it: to perform your membership contract, to meet legal obligations such as accounting and tax rules, or to protect your life or health in an emergency.
You can withdraw consent at any time by emailing us (see section 14). Withdrawing consent does not affect processing that took place before, and we may be unable to provide parts of the service that depend on it.
7. Who we share it with
- LAB staff who need it for their role, such as coaches, front-desk and management staff.
- Service providers who process data on our behalf, under contract and only on our instructions:
- Amazon Web Services (AWS): hosting, database and file storage.
- Resend: delivery of service emails.
- Cloudflare: domain name services and hosting of this website.
- Authorities, when Vietnamese law requires it.
- A successor business, if LAB is reorganised, merged or sold, in which case this policy continues to apply to your data.
Apple distributes the app through the App Store under its own privacy policy. We do not receive your Apple Account details.
8. Where your data is stored
Our servers and backups are run by AWS in Singapore. Email delivery and some provider support services may involve processing in other countries, including the United States. When personal data leaves Vietnam, we transfer it in line with Vietnamese personal data protection law and require our providers to protect it to the same standard as this policy.
9. How long we keep it
- Account, profile, health and training data: while you are a member and your app account is active. After you close your account or ask us to delete it, we delete it or make it anonymous, unless the law requires us to keep it.
- Invoices, payments and orders: for the period accounting and tax law requires (generally 10 years), then deleted.
- Signed waivers: as long as we may need them to establish or defend legal claims about your training at LAB.
- Server logs: up to 30 days.
- Backups: overwritten on a rolling 7-day cycle, so deleted data leaves our backups within 7 days.
- On your phone: the app keeps a cache of your data for offline viewing for up to 7 days, and clears it, along with downloaded invoices and your sign-in, when you sign out.
10. Your rights and account deletion
Under Vietnamese law you have the right to:
- be told how your data is processed (this policy);
- access your data and get a copy of it;
- correct it. You can update your name, phone, emergency contact, photo and notification choices in the app at any time;
- delete it, or restrict or object to its processing;
- withdraw your consent;
- complain to us, and to the Vietnamese authority responsible for personal data protection (the Ministry of Public Security).
To delete your account, email [email protected] from the email address on your membership with the subject “Delete my Athletic Sparks account”, or ask at the front desk. We confirm the request, then delete your app account and the personal data linked to it, or make it anonymous, except records the law requires us to keep, as described in section 9. Step-by-step instructions are on our Support page.
For any other request, email us. We may ask you to confirm your identity first. We acknowledge every request within 2 working days and complete it within the time limits set by Vietnamese law. For example, we complete a deletion request within 20 days, or 30 days where our service providers also need to act.
11. Security
Data travels between the app and our servers over encrypted HTTPS connections. Passwords and invitation codes are stored only as one-way hashes. On your iPhone, your sign-in is kept in the iOS Keychain and does not leave the device in backups. Staff access is limited by role and important changes are logged. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
12. Children
LAB runs youth training programmes. We process a child's data only with the consent of a parent or guardian, and of the child where the law requires it. Parents and guardians can contact us to access, correct or delete their child's data.
13. Changes to this policy
We will post any change on this page with a new effective date. If a change materially affects how we use your data, we will tell you in the app or by email before it applies, and ask for your consent again where the law requires it.