Privacy notice

The short version

We collect what we need to hold your booking and tell you about it: your name, WhatsApp number and email. For massage we ask three health questions so your therapist can treat you safely. For the Kidz class we ask each child's first name and age. Nothing else.

We never sell your details, and we never send marketing.

Who is responsible

GiliFit Fitness Resort, Gili Trawangan, Lombok, Indonesia, is responsible for this information. Contact us at management@gilifit.com.

What we collect, and why

Name, WhatsApp number and email — to hold your booking and send your confirmation, reminder and any changes.

Your booking history and attendance — so reception knows who is expected, and to apply the cancellation and no-show rules.

Your acceptance of the Liability Release — the version you saw, when, in which language, and from which device and internet address. We keep this as evidence that it was accepted.

Massage intake answers (injuries or conditions, pressure preference, areas to avoid) — health information, collected only with your separate explicit consent, and used only so your therapist can treat you safely.

Kidz class: each child's first name and age — collected from the parent or guardian, to run the class safely and keep it to ages 2–6.

Who can see it

GiliFit reception and management. Trainers and therapists see the bookings for their own sessions; massage intake answers are visible only to the therapist treating you and to management.

Our suppliers process it on our behalf and may not use it for anything else: Supabase (the database, in Singapore), Vercel (the website, in Singapore), Resend (email), Meta's WhatsApp Business Platform (WhatsApp messages) and Cloudflare (the check that blocks automated bookings). Using WhatsApp means Meta handles your number under its own terms.

We never sell your information or share it for advertising.

How long we keep it

Massage intake answers: deleted automatically 90 days after your appointment.

Children's details: deleted automatically 12 months after the child's last booking.

Booking and guest records: kept while you are a customer and afterwards for our own records and legal obligations.

Liability Release acceptances: kept for as long as the booking record exists, as evidence. These are not deleted on request.

Your rights

You can ask what we hold about you, ask us to correct it, ask for a copy, or ask us to delete it. Write to management@gilifit.com and we will answer within 30 days.

You can withdraw consent for the health questions at any time; we will delete those answers, though we may then not be able to offer a massage safely.

Deleting everything means we cannot keep your bookings, so any upcoming ones will be cancelled. Release acceptances are kept as evidence, as above.

Keeping it safe

Everything travels over an encrypted connection. The database is in Singapore, backed up daily, and reachable only by GiliFit staff accounts. Booking links use long random codes that cannot be guessed. If information is ever lost or exposed, we will report it to the authorities and tell affected guests as the law requires.

Children

Children do not book themselves. A parent or guardian books, gives the child's first name and age, and accepts the Liability Release on the child's behalf.