Privacy Policy & Biometric Data Governance Statement
Comprehensive enterprise governance framework detailing personal data protection, biometric template safeguards, body composition telemetry, and privacy compliance for LazyMonkey VAHD Health Platform.
01. Introduction & Legal Scope
Welcome to LazyMonkey VAHD (hereinafter referred to as "the Platform", "LazyMonkey VAHD", "We", "Us", or "Our"). LazyMonkey VAHD delivers an integrated enterprise software-as-a-service (SaaS) ecosystem, IoT access controller middleware, biometric authentication infrastructure, body composition scanner integration modules, Point of Sale (POS) terminals, and mobile applications designed for health clubs, fitness centers, gym operators, personal trainers, and gym members worldwide.
This Privacy Policy ("Policy") governs the collection, processing, storage, disclosure, transmission, and protection of Personal Data and Sensitive Biometric Data gathered through your interaction with our cloud software, physical hardware terminals (including eSSL eBioserver middleware and connected access control turnstiles), body composition scanners (such as InBody BIA devices), web services, and native mobile applications.
By registering for an account, accessing any gym facility utilizing LazyMonkey VAHD infrastructure, consenting to biometric enrollment (facial recognition or fingerprint verification), undergoing body composition scans, or downloading our mobile application, you explicitly acknowledge that you have read, understood, and agreed to the data processing practices detailed within this Policy.
02. Key Definitions & Legal Terms
For the purposes of this Privacy Policy, the following capitalized terms shall have the exact meanings ascribed below:
- "Account": A unique authorized credential created for a Facility Owner, Staff Member, Personal Trainer, or Gym Customer to access the Platform.
- "Biometric Data": Any personal data resulting from specific technical processing relating to the physical, physiological, or behavioral characteristics of a natural person, including facial mathematical feature vector hashes, facial geometry representations, and fingerprint ridge minutiae templates.
- "Body Composition Telemetry": Quantitative physiological measurements gathered via Bioelectrical Impedance Analysis (BIA) or optical body scanners, including total weight, body fat percentage, skeletal muscle mass, total body water, visceral fat level, extracellular water ratio, basal metabolic rate (BMR), and segmental muscle distribution.
- "Facility Operator / Owner": The commercial enterprise or gym business entity operating a physical fitness location that utilizes LazyMonkey VAHD software and hardware middleware to manage operations.
- "Member / Customer": An individual registered with a Facility Operator who utilizes physical gym services, access control doors, body scanners, or mobile member portals.
- "eBioserver Middleware": The physical or cloud SOAP/HTTP server layer communicating directly with eSSL biometric hardware terminals, turnstile relays, and facial recognition devices.
- "Personal Data": Any information relating to an identified or identifiable natural person ("Data Subject"), as defined under Article 4(1) of the EU GDPR.
03. Categories of Data Collected
We process various categories of information depending on your relationship with LazyMonkey VAHD and the specific features enabled by your Facility Operator:
| Data Category | Data Fields Included | Primary Purpose |
|---|---|---|
| Identity & Contact Data | Full legal name, phone number, email address, physical address, date of birth, emergency contact details, assigned profile photo. | Account creation, identity verification, contract execution, emergency notification. |
| Biometric Identification Data | Facial vector mathematical hashes, fingerprint minutiae templates, RFID card serial numbers, verification timestamps. | Automated turnstile access control, hands-free facility entry, anti-passback verification. |
| Physiological Telemetry | Weight, height, skeletal muscle mass, body fat percentage, body water, visceral fat rating, BMR, segmental analysis, scan date/time. | Fitness progress tracking, automated trainer recommendations, body composition analytics. |
| Financial & Billing Data | Masked credit/debit card numbers, payment token hashes, billing address, transaction history, membership plan details. | Subscription billing, Point of Sale (POS) transactions, automated dues collection. |
| Technical & Telemetry Data | IP address, MAC address, browser type, OS version, device identifiers, API access logs, webhook audit trails, cookie session IDs. | Platform security, fraud prevention, server load balancing, bug diagnostics. |
04. Biometric & Body Composition Data Policy
This Section constitutes our formal Biometric Information Privacy Policy under Illinois BIPA (740 ILCS 14/), Texas Business & Commerce Code (§ 503.001), Washington Rev. Code (§ 19.375.020), and EU GDPR Article 9 (Special Category Data).
4.1 Nature of Biometric Processing
When you enroll in biometric access control at a facility powered by LazyMonkey VAHD, your facial image or fingerprint is captured by an integrated terminal (such as eSSL AiFace, ERIS, ARION, or F-series devices). The raw image is immediately processed locally by the hardware or eBioserver middleware to extract key spatial nodal points, creating an encrypted mathematical vector (hash). We do not store unencrypted raw facial photo files or raw fingerprint images in our biometric database.
4.2 Written Consent Requirement
Prior to initial biometric enrollment, every member or staff member must provide explicit written or digital consent via our enrollment portal. Consent is voluntary. If a member declines biometric enrollment, Facility Operators are required to provide alternative access mechanisms, such as RFID keyfobs, mobile QR codes, or staff-assisted entry.
4.3 Body Composition Telemetry Handling
Body composition readings captured through integrated BIA scanners are processed solely to provide personal wellness insights and graphical progress tracking to the member and their assigned certified personal trainer. BIA telemetry is classified as sensitive personal health data and receives AES-256 encryption at rest.
05. Legal Bases for Processing (EU GDPR)
In accordance with GDPR Article 6 and Article 9, LazyMonkey VAHD processes Personal Data under the following lawful legal grounds:
- Performance of Contract (Art. 6(1)(b)): Necessary to fulfill our contractual obligation to provide gym management software, process billing transactions, and allow facility entry.
- Explicit Consent (Art. 6(1)(a) & Art. 9(2)(a)): Required for processing special categories of data, specifically biometric vector templates and detailed physiological body composition scans.
- Legitimate Interests (Art. 6(1)(f)): Necessary for facility physical security, preventing unauthorized multi-person entry (tailgating), fraud prevention, and system performance monitoring.
- Legal Obligation (Art. 6(1)(c)): Processing required to comply with statutory tax, financial accounting, labor law, and health authority mandates.
06. Methods of Data Collection
Information is collected through three primary channels:
- Direct Input: Form submissions during membership registration, POS checkout transactions, trainer consultation notes, or mobile app profile configuration.
- Hardware & IoT Integration: Real-time HTTP/SOAP webhook pushes triggered when a member scans their face/fingerprint at eSSL hardware terminals or steps onto an integrated InBody scale.
- Automated Telemetry: Automatic logging of HTTP requests, IP addresses, JWT token exchanges, error stack traces, and session cookies during software interaction.
07. Purposes of Data Processing
LazyMonkey VAHD utilizes collected data exclusively for the following operational and legal purposes:
- Executing real-time physical access control door unlocks and turnstile relay triggers.
- Recording accurate member check-in logs and calculating facility peak-hour analytics.
- Generating body composition trend reports, macro recommendations, and workout schedules.
- Processing recurring membership dues, Point of Sale transactions, and trainer commission payouts.
- Enforcing facility security, investigating unauthorized access, and auditing staff operations.
- Sending transactional SMS notifications, billing reminders, and push notifications.
08. Data Sharing & Third-Party Disclosures
We do not sell, rent, or trade Personal Data or Biometric Data. Data disclosure is limited strictly to authorized service providers under contractual confidentiality terms:
| Third-Party Recipient | Purpose of Disclosure | Data Categories Shared |
|---|---|---|
| Stripe / Payment Processors | Payment tokenization, recurring subscription processing, invoice collection. | Billing name, payment token, billing address, transaction total. |
| AWS / Cloud Infrastructure | Encrypted PostgreSQL database hosting, cloud compute, encrypted backup storage. | All system data (AES-256 encrypted at rest). |
| eBioserver Middleware | Hardware-level device discovery, template syncing, and turnstile command execution. | Device serial, enrollment number, biometric vector hashes. |
| Twilio / Messaging Gateways | SMS transactional alerts, multi-factor authentication (MFA) verification codes. | Phone number, transactional message content. |
| Law Enforcement / Authorities | Mandatory compliance with valid judicial subpoenas, court orders, or search warrants. | Targeted records strictly limited to court order scope. |
09. Data Security & Encryption Standards
LazyMonkey VAHD implements defense-in-depth security architecture to safeguard sensitive health and biometric assets:
- Encryption at Rest: All database instances, biometric vector stores, and backup volumes are encrypted using FIPS 140-2 validated AES-256 algorithm.
- Encryption in Transit: All data moving between physical eSSL terminals, eBioserver middleware, FastAPI backend services, and web frontend clients is transmitted via TLS 1.3 (HTTPS/WSS) with forced Perfect Forward Secrecy.
- Network Isolation: Biometric middleware servers operate inside isolated Virtual Private Clouds (VPC) protected by strict Web Application Firewalls (WAF) and zero-trust security groups.
- Role-Based Access Control (RBAC): Strict principle of least privilege ensures staff members only access member data relevant to their role.
10. Data Retention & Automated Purging Schedules
We store data only for as long as necessary to fulfill active service contracts or comply with legal requirements:
- Active Account Data: Retained for the duration of the active membership agreement.
- Biometric Hashes: Automatically deleted within 30 days of membership cancellation or consent revocation.
- Body Composition Logs: Retained for historical progress tracking until member requests account deletion.
- Financial Transaction Logs: Retained for seven (7) years to comply with statutory tax audit regulations.
- Server Access Logs: Automatically rotated and purged after ninety (90) days.
11. International Data Transfers
LazyMonkey VAHD processes data in secure data centers located in the United States, European Union, and Asia-Pacific regions. For data transfers originating from the European Economic Area (EEA) or UK to third countries, we execute EU Standard Contractual Clauses (SCCs) and enforce supplementary technical safeguards including end-to-end payload encryption.
12. Individual Data Subject Rights
Regardless of your geographic location, LazyMonkey VAHD grants all Data Subjects the following enforceable privacy rights:
- Right to Access (Data Portability): Request a structured, machine-readable JSON copy of your personal data, biometric audit logs, and body composition telemetry.
- Right to Rectification: Request correction of inaccurate or incomplete personal contact data.
- Right to Erasure ("Right to be Forgotten"): Request immediate permanent deletion of your profile, biometric templates, and scan history (subject to financial audit retention mandates).
- Right to Withdraw Consent: Revoke biometric consent at any time without penalty or loss of gym facility access.
- Right to Restrict Processing: Request temporary restriction of data processing during a pending dispute.
To exercise any right, submit a request to roufbaig123@gmail.com or utilize the privacy settings tab in your member mobile application.
13. Children & Minors Privacy
LazyMonkey VAHD services are not directed to children under thirteen (13) years of age. For minor members aged 13 to 17 participating in gym memberships, biometric enrollment and body composition scanning strictly require explicit written authorization signed by a parent or legal guardian.
14. Cookies & Local Storage Technologies
Our platform uses essential session cookies, local storage items, and secure JWT tokens stored in HTTP-Only cookies to maintain authenticated sessions, store theme preferences, and protect against Cross-Site Request Forgery (CSRF) attacks. We do not utilize third-party cross-site tracking cookies for advertising purposes.
15. California Consumer Privacy Notice (CCPA / CPRA)
This Notice applies solely to residents of California under the California Consumer Privacy Act (CCPA) as amended by the CPRA:
- No Sale of Personal Information: LazyMonkey VAHD has not sold or shared personal or biometric information in the preceding 12 months.
- Right to Limit Sensitive Personal Information: You have the absolute right to limit our use of Sensitive Personal Information (biometrics and health telemetry) strictly to necessary facility operational purposes.
- Non-Discrimination: We will never deny services, charge different prices, or degrade service quality if you exercise CCPA rights.
16. European Union & UK GDPR Compliance Annex
For individuals located in the European Union or United Kingdom, the Data Controller for processing your information is the specific Facility Operator (gym) where you hold a membership. LazyMonkey VAHD acts as a Data Processor under GDPR Article 28. In inquiries involving controller obligations, we collaborate directly with your facility operator.
You have the right to lodge a complaint with your local EU Data Protection Authority (DPA) or the UK Information Commissioner's Office (ICO) if you believe processing infringes applicable regulation.
17. Incident Response & Data Breach Notification
LazyMonkey VAHD maintains a rigorous Incident Response Plan. In the event of a confirmed security breach involving unencrypted Personal Data or Biometric Data, we will notify affected Facility Operators and supervisory authorities within seventy-two (72) hours of breach confirmation, outlining the nature of the breach, affected records, and immediate remediation steps taken.
18. Policy Revisions & Modifications
We reserve the right to update this Policy periodically to reflect technological advancements, new hardware middleware integrations, or statutory changes. Material amendments will be communicated via email or prominent system alerts thirty (30) days prior to taking effect. Continued use of LazyMonkey VAHD following notification constitutes acceptance of the revised terms.
19. Contact Information & Data Protection Officer
If you have questions, concerns, or requests regarding this Privacy Policy, biometric safeguards, or data protection practices, please contact our Data Protection Office: