Effective 15 October 2026

1. Who we are

Svaya is operated by Vyoma Technologies Limited (“Vyoma”, “we”, “us”). Svaya™ is our trademark. A US trademark application for SVAYA is pending on the Principal Register — US serial number 50018265, filed 28 July 2026 on an intent-to-use basis under § 1(b), in International Class 009. It is not yet registered, which is why the mark appears as ™ throughout and never as ®.

• Registered office: 3296 Logsdon Loop, Delaware, Ohio 43015, USA
• Privacy and data-rights contact: privacy@getsvaya.com
• General contact: hello@vyomatechnologies.com
• India grievance officer: Grievance Officer, Vyoma Technologies Limited — support@getsvaya.com, 3296 Logsdon Loop, Delaware, Ohio 43015, USA — see §11.

For users in the European Economic Area and the United Kingdom, Vyoma is the controller of the personal data described here.

---

2. The short version

1. Raw camera video is processed on your phone and is not uploaded during a workout.
2. The body-geometry data computed from that video IS uploaded and stored on our servers, and it is the core of how Svaya works. We collect it only if you agree to it before your first tracked set, and it is not anonymous.
3. That geometry includes points on your face — nose, both eyes, both ears — and, in data a high-resolution capture mode recorded before 3 September 2026, your jaw, chin, eyelids, eyeballs, and every joint of all ten fingers.
4. We train our own models on it, but only if you switch that on. Model training is a separate opt-in, default off, and revocable.
5. We never sell your data, never give it to advertisers or data brokers, and never give it to another company to train their models.
6. You can delete your account from inside the app, export your workouts and plans, and ask us for a copy of everything we hold.

Everything below is the detail behind those six lines.

---

3. What we collect

3.1 Account and identity

Data	Notes
Email address	Stored encrypted at rest; a separate one-way hash is stored for lookup
Display name
Password	Stored only as a salted hash, never in readable form
Sign in with Apple identifier	If you use Apple sign-in
Two-factor secret	Encrypted, only if you enable 2FA
Login and lockout history	Timestamps, failed-attempt counts, account-lock state
Time zone	The time zone your phone reports (for example "Asia/Kolkata"), sent when you request a coach review, so your monthly review allowance resets at midnight on the 1st where you are. If we never receive it, we use UTC.

3.2 What you tell us about your body and your health

Data	Notes
Age, gender, height, weight, body type	From onboarding and Settings
Fitness level, training experience, training frequency, time since last break
Goals, target state, sessions per week, session length
Equipment you own, and the locations you train in
Body measurements you log over time
Body areas you ask us to train around — back, knee, shoulder, hip, wrist, ankle	Picked from a list. Earlier versions of the app also asked about medical conditions such as heart conditions or pregnancy; the app no longer asks, and deletes those earlier answers from your phone. Answers an earlier version sent to us stay on our servers until the updated app next saves your profile

Health conditions and injuries are sensitive data. They are treated as special-category data under GDPR Article 9, as sensitive personal data under India's DPDP framework, and as consumer health data under Washington's My Health My Data Act.

3.3 Body-geometry ("pose") data — read this section

This is the significant one, and it is the reason this policy exists in this form.

What happens. During a tracked set, your phone runs a pose-estimation model on the live camera feed on the device. The model outputs the coordinates of a set of named body points. Those coordinates — not the picture — are uploaded to us and stored, at roughly fifteen samples per second.

What is in each stored sample:

• Named body points, each with a horizontal and vertical coordinate and a confidence value. Some capture modes additionally record a depth coordinate and a three-dimensional world position for each point.
• Computed joint angles — currently 21 named values, including both elbows, both shoulders, both hips, both knees, mid-spine, and a family of movement-specific depth metrics.
• The rep-counter signal, the detected movement phase, the running rep count, the set number, and a form score.
• Camera quality metadata: confidence, tracking quality, pitch and roll angle of the phone, and whether the phone was steady.
• Which pose engine produced the sample.

How many points, and which ones. Measured on 16 August 2026, across the 467,865 samples stored then:

Skeleton	Points	Samples	When collected
Standard (current behaviour)	23	448,203 (95.8%)	2026-04-19 → today, ongoing
High-resolution ARKit	112–113	8,886 (1.9%)	2026-08-01 → 2026-08-03 only
Partial / low-confidence	8–30	10,776 (2.3%)	throughout

The standard 23-point skeleton includes five points on your head: your nose, both eyes and both ears. The remaining eighteen are shoulders, elbows, wrists, hips, knees, ankles, heels, toes, neck and a root point. This is what we collect today, on every tracked set.

A high-resolution capture mode, used on some devices with the rear camera, additionally recorded the jaw, the chin, both eyeballs, and the upper and lower lid of each eye — and a complete hand skeleton for both hands: thumb, index, middle, ring and little finger, three to four joints each. Since 3 September 2026 that mode no longer records any of these face or hand points; it records body joints only, with the same five head points as the standard skeleton. We checked on 10 October 2026: our database holds no face or finger points from that mode. The extra body joints it recorded (spine, neck, toes, and one point at each hand) are kept like any other body-geometry sample (§8).

This is stated so precisely because it is the fact that decides how this data is regulated. A "stick figure" framing would be inaccurate: a time-series of eye, ear and nose positions is a geometric description of your face. See §4.

What is NOT in it. No image data. No video. No audio. There is no pixel, image, thumbnail or video frame among the stored values, and none of them can reconstruct a picture of you.

Why we store it (legal basis). To count your reps, score your form, drive range-of-motion and tempo feedback, keep your history consistent across devices, and let a coach you have connected review your movement. For users in the EEA/UK this is Article 6(1)(b), performance of the contract you signed up for — the same basis as storing your rep counts. It is collected only with your consent: before your first camera-tracked set the app shows you the Body-Geometry & Biometric Data Consent in full, and nothing is recorded or sent until you agree. If you choose "Not now", or later withdraw it in Profile → Privacy → Camera tracking, your sets are logged by hand, the camera does not start and nothing is sent; manual logging does not produce body-geometry data. The choice is recorded for the phone you make it on, so a new phone, or the same phone after reinstalling the app, asks again. Withdrawing does not change measurements already stored: they are deleted on the schedule in §8, or when you delete your account.

Model training is separate and opt-in. See §5.

3.4 Wearables, Apple Health, and motion sensors

If you grant access, Svaya reads the following from Apple HealthKit: heart rate, heart-rate variability, resting heart rate, active energy, VO₂ max, step count, body mass, and sleep analysis — and, if you choose to import from Apple Health, your past workouts. It writes back only your completed workouts and active energy. It never writes your weight.

What reaches our servers, corrected as of 2026-08-17

An earlier version of this policy said that nothing from Apple Health or from a wearable reaches our servers. That was true when it was measured on 16 August 2026 and is no longer true. Two changes landed on 16–17 August 2026, and this policy states them rather than inheriting the older sentence:

Heart rate is now stored, if you agree to it. Your watch already ran a real workout session and read heart rate; the app threw every sample away and kept a single overwritten number that was never persisted. If you say yes on the "Record your heart rate and workout energy" screen, it is now stored as a raw timestamped series — one row per reading, roughly one every five seconds — alongside the app state observed at that moment (which exercise phase was running, and which set number). Those state fields are recorded as contemporaneous facts about the app, not as an attribution of any heartbeat to any set, and heart rate is explicitly barred from grading a set. We store the raw observation and derive the metric later, because heart rate lags the work that caused it and any averaging window chosen before we had data to tune it against would be a guess baked in irreversibly.

Wrist and head motion can now actually reach us. The storage for it had existed for months and nothing ever wrote to it, because the watch was told to stop streaming and never told to start — a wiring defect, not a design. That path is now connected, so wrist and head motion can reach our servers. It does so only under the separate opt-in below.

Wrist and head motion (off unless you turn it on)

Only if you say yes to it — on the one-time consent screen after you sign up, or later under Wrist motion in Profile → Data Sharing — we record motion from the devices you are wearing:

Device	What we record	How often
Apple Watch	Acceleration with gravity removed, rotation rate, and the gravity direction	50 times a second
AirPods (models with motion support)	The same three, plus head orientation as a quaternion	About 25 times a second (the actual rate varies by device)

Four things about this that we want to be exact about:

• Only while a set is running. Not between sets, not during rest, not while you are setting up, and never outside a workout.
• Only if the device is actually there. We check for a paired watch and for AirPods that report motion. If they are absent we record that fact and collect nothing.
• Off by default, and nothing breaks without it. The camera counts your reps, and it counts them without this data. It never has to be there.
• On the barbell bench press, your watch and AirPods can help count. If you have turned this on, we may use wrist motion from your watch and head motion from your AirPods on that one exercise to check the reps the camera counted: to keep a press the camera saw but was unsure of, and to drop a rep you were not pressing for. When the camera confirms you are in position, a press your watch measured can count even if the camera missed it. The camera and the watch never count the same press twice. A rep counted this way is marked as watch-counted in your workout record, and its depth is not scored. On every other exercise the camera counts on its own.
• Recording it is not the same as training on it. Whether we may use it to improve our shared models is the separate "Help Train Shared Models" choice. If that is off, this data is not used for training.

We do not record sound, and we do not record your location.

This is stored with the rest of that workout under the same pseudonym, which means it is linkable to your account, not anonymous. When you delete your account, its link to you is cut immediately and permanently (§8): the motion data is then kept without any identifier, not deleted.

The two corrections, kept on the record

Corrected 2026-08-16. An earlier version of this policy claimed that head motion from AirPods never leaves the device. That is no longer true, and the sentence was removed rather than softened. If you turn on the wrist-and-head motion setting above, head motion IS sent to our servers. It is off unless you turn it on, and it is only recorded while a set is actually running.

Corrected 2026-08-16. An earlier version of this policy said the watch streamed "raw accelerometer motion" during every workout. That was never true. The database storage built to hold it was empty in all 470,599 rows — it existed and nothing ever wrote to it. The claim was wrong on the day it was written, and the change that starts collecting this data for the first time, under an explicit opt-in, does not make the old sentence retroactively correct.

Camera-derived heart-rate estimation

In the single-exercise workout screen, while you rest, the front camera can estimate your pulse from small colour changes in your face. The estimate is made on your phone and shown only on the rest screen, labelled as an estimate, not a medical measurement, and only when the reading is steady enough. It is not stored, uploaded, or used in workout summaries, analytics or advertising. The one exception is our own team's test accounts: for them we keep the estimates, alongside the heart rate from their own watch, to measure how accurate the estimate is.

3.5 Usage and diagnostic telemetry

We record which screens you open, what you tap, how you navigate, errors you hit, and workout events. This is always on; there is no decorative off switch, because we use it to keep the coaching features working and we would rather say so than offer a toggle that does nothing.

It is first-party only — it goes to our own servers under a per-device identifier. It does not go to an advertising network or a third-party analytics product.

Because it is keyed to your device rather than your account, the 90-day retention bound in §8 is also what limits it after you delete your account. Crash reports are the exception: they can carry your account identifier and have no 90-day limit; when you delete your account, the identifier is removed from them.

3.6 Consent records

Every acceptance, decline and revocation is written to an append-only, hash-chained ledger, together with the SHA-256 fingerprint of the exact text you were shown and the time you actually consented. Records made since 27 August 2026 also store the IP address and the device and app description (user agent) our server saw when the record arrived. Some early records were made without the fingerprint.

We keep this even after you delete your account, because it is the record that proves what you were shown and what you agreed to. It contains no personal data beyond your account identifier and, on records made since 27 August 2026, that IP address and device description.

3.7 Video — the cases where it does leave your device

Nothing in (a) to (c) happens during an ordinary tracked workout. Each is something you start deliberately.

(a) Live coaching calls. Your camera and microphone stream in real time to the other participant, via LiveKit (§7). Calls are not recorded — the product has no recording capability and issues no permission that would allow one.

(b) Coach demonstration clips. If you are a coach, videos you record and upload are stored as files on our server, with a pointer row in the database. Access is only ever through short-lived signed links; there is no public address.

(c) Group-session recordings a coach uploads.

⚠️ Faces in group-session video are not blurred. Automatic face blurring is not applied to group-session uploads. Today the only protection is the coach's attestation that every person visible agreed to appear and that the coach holds the rights to their likeness. If you appear in a group session, ask your coach what they are uploading.

We state this in the policy rather than only in the coach's upload screen, because the people most affected are the participants — who are not the ones reading that screen.

(d) Engineering diagnostics, for testers only. The app contains screen- and camera-recording tools used for engineering diagnostics. They are off for ordinary members: they can be switched on only from a developer screen that is shown to tester accounts. Recordings made with them stay on the phone and are never uploaded.

3.8 Coaches you connect

If you connect a human coach, they can — only with your explicit per-scope consent — view selected parts of your data, such as your workout history or your body-geometry form replay. With a one-to-one coach, each scope is granted separately and can be withdrawn at any time; your grant is written to the consent ledger (withdrawing takes effect at once but is not itself written there). If you choose a coaching team, that one choice gives the team's coaches your workout history, your form replays and the right to write and change your plan, together: you cannot take those apart, but you can change team, or leave the team at any time (in your team conversation: Team → Leave team). Leaving ends the team's access straight away and is recorded in the consent ledger; your plan, your workout history and your messages stay yours, and no one on the team can read your messages after you leave. Accepting your first live call shares your live video and your live body position together. Every staff or coach access to your data is written to an audit table (§12). The per-scope consent text is the Coach Data-Access Consent.

3.9 Training with a buddy (Train Together)

Train Together is off until you start or join a pairing, and each pairing asks you first. While you are paired, your buddy's phone shows:

• your display name, including in the notifications it sends them ("Priya started a workout"), which can appear on their lock screen;
• the exercise you are on, your set number and how many sets the exercise has, whether you are in a set, resting, paused or waiting for your turn, and how many seconds of rest you have left;
• the workout the leader shares for the session: exercises in order, sets, target reps and rest times, never weights;
• the mode the leader chose, that you are ready to start an exercise, that you set a personal best on an exercise (its name only, never the number), and when you leave the pairing;
• that you saved each other as buddies, or sent or declined a request to train.

Your buddy never receives your rep counts, weights, form scores, heart rate, camera video or anything the camera sees, your location, your workout history, your email or your health answers. This information travels through our servers and only to the other member of that pairing; we keep only the latest state of each of you, not a history. You can leave a pairing at any time, and remove a saved buddy in Train Together.

---

4. Biometric data — our position, stated plainly

Several U.S. laws regulate "biometric identifiers" specifically, and they do not all define the term the same way.

What we believe the honest characterisation is. The body-geometry data in §3.3 is a repeated geometric measurement of your body, including your face, and, in data the high-resolution mode recorded before 3 September 2026, your hands. Illinois' Biometric Information Privacy Act names "a scan of hand or face geometry" as a biometric identifier. Texas' CUBI uses similar language. Washington's My Health My Data Act reaches "biometric data" and consumer health data broadly, and covers bodily functions and measurements. We therefore treat this data as biometric, and give you the protections those statutes require, rather than arguing about whether a joint map is technically a "scan".

Accordingly:

(a) We tell you before we collect it. You accept this policy before you can use the app, and the app shows you the separate Body-Geometry & Biometric Data Consent in full before your first camera-tracked set. Nothing is recorded or sent until you agree to it.

(b) We tell you why, and for how long. Purpose: rep counting, form scoring, progress tracking, and — only with the separate opt-in in §5 — improving our own models. Retention: body-geometry samples are kept while your account is in use, so your history and replays keep working. If you delete your account, or your account becomes dormant (no sign-in and no sync for 24 months), they are unlinked from you at once and permanently deleted 180 days later. The de-identified copy described in §8 is the one exception: it is no longer linked to you and cannot be linked back. Per-session summary numbers worked out from the samples — such as rep counts and average form scores — are kept with your workout history until your account is deleted.

(c) We get your written consent. Acceptance is captured electronically with a prior E-SIGN/UETA consent step, recorded in the hash-chained ledger against the fingerprint of the exact text.

(d) We do not sell, lease, trade or otherwise profit from it. Not to anyone, under any arrangement, ever.

(e) We publish our retention and destruction schedule. It is the table in §8.

(f) We protect it. In transit with TLS; at rest on the cloud provider's standard encrypted storage (§12); stored under a pseudonym identifier rather than directly under your name.

On the pseudonym, honestly. Body-geometry samples are stored against a pseudonym rather than your account identifier. This is a single stable pseudonym per account, not a rotating one, and the samples remain linkable back to you through session identifiers. It reduces casual exposure; it is not de-identification, and we do not describe this data as anonymous. The pseudonym link is severed immediately when you request deletion.

---

5. Training our models

We use body-geometry data, and the "was that rep count right?" corrections you confirm, to train and improve our own rep-counting and form-scoring models.

• The Help Train Shared Models setting controls this. It is off by default.
• Each uploaded sample carries a training-eligibility flag set from your setting at the moment of upload. Our training pipeline selects only flagged samples.
• Turning it off in the app stops future samples from being flagged and, in the same step, removes the flag from the samples you contributed while you were opted in. You can also email privacy@getsvaya.com and we will clear them.
• We do not send this data to OpenAI, Anthropic, Google, or any other company for their model training.
• If you delete your account, the "was that rep count right?" corrections you gave us are kept in de-identified form and remain usable for this purpose. They are stripped of every identifier first, and the link back to you is destroyed rather than hidden. §8 describes exactly what is kept and what is not.

Being precise about what the toggle does and does not do. It does not control whether body-geometry data is uploaded — that is your camera-tracking consent, §3.3. It controls only the eligibility flag. We say this plainly because one of our own settings screens currently describes it as though it governed sharing, and that screen is wrong.

---

6. Automated decisions and AI

Svaya algorithmically generates your workout plans and prescribes exercises, sets and repetitions. It also produces automated form feedback and projections about how your body may change over time.

• These are software estimates, not professional advice, and they can be wrong. The full statement is in the AI & Automated-Feedback Disclaimer.
• They are not medical advice, not a diagnosis, and not nutritional advice.
• No decision with a legal or similarly significant effect on you is made by automated processing. If you are in the EEA/UK and believe otherwise, you may contact us to request human review.
• To generate plans we send a structured fitness profile to an external AI provider. See §7.

---

7. Who else processes your data

Processor	What they do	What they receive
Microsoft (Azure)	Hosting: one virtual machine in Microsoft's Central US region runs our application and our own database and holds uploaded files on its disk; nightly copies of the database are kept in Azure storage	Everything described in §3
Fly.io	No longer used. Hosted the service until 19 August 2026; the deployment is switched off and holds a frozen copy of the database as it stood then, awaiting destruction	A copy of everything in §3 as it stood on 19 August 2026
Anthropic (Claude API)	Workout-plan generation; reading the credential documents coaches submit; short form-coaching summaries	For plans, a structured fitness profile — see the note below; for coaches, the credential documents they submit; per-set form figures
LiveKit	Live video coaching sessions	Real-time audio and video, only while you are in a call
Apple	App distribution, sign-in, subscription billing, HealthKit	Per Apple's own terms
Resend	Sending email	Your email address and the messages we send you
Google ML Kit / MediaPipe, Apple ARKit / Vision, CoreML, ONNX Runtime	Pose estimation, form scoring, coach voice	Your body data never leaves the device through these — all inference is local. Google's ML Kit does, by its own declaration, collect a device identifier, diagnostics and other data for its own analytics — see below
Cloudflare R2	Media storage	Nothing today — coded, but not switched on

Live video does not pass through our servers. When you join a coaching call, your device connects directly to LiveKit's infrastructure over WebRTC. Our backend only issues the signed token that lets you into the room; it never carries the audio or video.

Google ML Kit's own data collection. The pose-detection library we bundle ships a privacy manifest in which Google declares that it collects a device identifier, diagnostic and performance data, product-interaction data, and other content and data for its own analytics and app functionality, all marked as not linked to your identity and not used for tracking. We do not send it anything and we receive nothing from it, but it is a third-party data flow inside our app and you should know about it.

Live video is not recorded. No recording capability exists in the product: the platform issues no media-egress permission for a live session.

---

8. How long we keep things

Data	Retention	Enforced by
Body-geometry samples	While your account is in use; permanently deleted 180 days after you delete your account or it becomes dormant	An automatic deletion job
Dormant accounts	An account with no sign-in and no sync for 24 months is treated as if you had asked us to delete it	The same deletion steps as below
Usage telemetry	90 days	Scheduled retention job
Crash reports	Until you delete your account; then kept without your identifier	Account deletion removes the identifier
Account, workout history, plans, measurements	Until you delete your account
Train Together	The latest state of each member while paired; your part of a pairing is deleted with your account	Account deletion
Heart-rate samples and wearable motion	Until you delete your account; then kept with the link to you cut	Account deletion replaces every identifier on them
Deleted account	Body-geometry samples unlinked from you immediately and irreversibly; the account itself permanently erased 30 days later	An automatic sweep every 6 hours, recorded in our privacy event log on every run
De-identified movement measurements and reported counts, after you delete	Kept, no longer linked to you and not linkable back	Copied at the moment of unlinking into a table that holds no identifier of any kind
Database backups	A copy of the whole database every night and before each update of the service, kept in Microsoft Azure storage and on our server	No deletion schedule is enforced yet — see step 2 below
Consent ledger	Kept indefinitely, deliberately, as a regulatory record	Append-only table

On deletion, precisely. Deletion happens in two steps, and the first one is immediate.

Step 1, at the moment you ask (irreversible). We do not merely delete the lookup table that connects your body-geometry samples to you — we rewrite the keys themselves. Every pseudonym and every session identifier on your pose frames, sensor streams, heart-rate samples and session metrics is replaced with a freshly generated value that exists nowhere else, and the old-to-new mapping is never written down anywhere. We do the same wherever your account identifier had leaked into diagnostics: usage telemetry, crash reports and the access-audit log. From that moment the samples are anonymous, and signing back in does not and cannot re-attach them to you.

Step 2, 30 days later. Your account, workout history, plans and everything that hangs off them are permanently deleted, together with any videos and credential documents you uploaded as a coach. Signing back in does not cancel the deletion, and once you confirm it there is no way to cancel it. Deleted data can remain in database backups made before the deletion until those backups are removed; we do not yet enforce a deletion schedule for backups, so we cannot promise a date.

What we keep, and why we say so here rather than in a footnote. On deletion we irreversibly de-identify your workout data and retain de-identified movement measurements and your reported counts to improve rep counting. Concretely: for each set, the number of reps you told us you actually did, how many our counter thought you did, the weight you entered, and the one-tap observation you gave us about the set. They are copied out at the moment of step 1, keyed only by the freshly generated identifier that replaced your session identifier, into a table that holds no account id, no pseudonym, no email, no device id and no foreign key to anything. Nothing you typed in free text is copied, because free text can name a person. The result is not "your data with the name removed" — the link was destroyed in step 1 and was never written down, so there is nothing left to reverse. It is a measurement of a movement that is no longer attached to anyone.

We keep it for one reason: those corrections are the only record of when our rep counter was wrong, and without them the counter cannot be made better for the people still using it.

What this replaces, stated plainly because a previous version of this document said otherwise: until 2026-08-19 deletion removed only the pseudonym record. A second link survived — each frame kept its session identifier and each session kept its owner — so 99.0% of stored body-geometry samples (477,547 of 482,151) remained one join away from the account, and no scheduled job ever deleted them. The wording here now describes the mechanism that exists.

---

9. Your rights

In the app, under Profile, you can, today:

• Export your workouts and plans from your phone as a JSON, CSV or PDF file. This is not everything we hold: for a complete copy of your data, email privacy@getsvaya.com.
• Delete your account. Your body-geometry samples are unlinked from you immediately and irreversibly; the account itself is permanently erased after 30 days. Signing back in does not stop this, and once you confirm the deletion there is no way to cancel it. We retain de-identified movement measurements and your reported counts to improve rep counting; they carry no identifier and cannot be linked back to you. §8 says exactly what is kept.
• Withdraw camera-tracking consent in Profile → Privacy → Camera tracking: your sets are then logged by hand and no new body measurements are recorded.
• Withdraw model-training consent at any time.

Your privacy event log. Every export, every deletion request, every consent change and every retention sweep is recorded in an immutable privacy event log. An in-app viewer is planned; until then, request your log via privacy@getsvaya.com.

By writing to privacy@getsvaya.com you can also request access, correction, portability, restriction, objection, and a copy of your consent history. We do not discriminate against you for exercising any of these rights.

Depending on where you live you may also complain to a supervisory authority: your national data-protection authority in the EEA, the ICO in the UK, the Data Protection Board in India, or your state Attorney General in the United States.

---

10. Children

Svaya is not directed to children, and we do not knowingly collect any personal data — including camera-derived body-geometry data — from anyone under 18. You must be 18 or older to create an account, and account creation requires an explicit age affirmation (recorded in our consent records). If we learn that data of a person under 18 has been collected, we will delete it and close the account. To report a suspected under-age account, contact privacy@getsvaya.com.

The statements below describe the mechanics as built:

• Svaya is built for adults 18 and older only, with the parent/guardian path deliberately removed.
• During onboarding you enter your date of birth, which stays on your phone; we receive only your age in whole years, and you cannot continue if it is under 18. We require an 18+ affirmation before the app can be used. This is an affirmation, not a verified date-of-birth gate.
• Svaya is not directed to children and we do not knowingly collect data from anyone under 18. If you believe we hold data from someone under 18, email privacy@getsvaya.com and we will delete it.

---

11. India

India's Digital Personal Data Protection Act applies to us now — it has no turnover or user-count threshold, and we already process personal data of people in India, including at least one coach and their clients.

• Notice. This policy, presented in English before collection, is the notice.
• Consent. Free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and capable of being withdrawn as easily as it was given.
• Your rights as a data principal. Access, correction, completion, updating, erasure, grievance redressal, and nomination of another person to exercise your rights if you die or become incapacitated.
• Grievance officer. Grievance Officer, Vyoma Technologies Limited — support@getsvaya.com, 3296 Logsdon Loop, Delaware, Ohio 43015, USA. You may raise a grievance with the Grievance Officer before approaching the Data Protection Board. We aim to respond within one month of receiving it.
• Cross-border transfer. Your data is processed and stored in the United States on infrastructure operated by our hosting provider, and by the processors listed in §7.

---

12. Security

TLS in transit. At rest, our server's disks use the cloud provider's standard storage encryption, which we have not separately configured or verified. Passwords stored only as salted hashes. Email addresses, and the two-factor secrets of coach and staff accounts, encrypted at the field level. Signing keys and database credentials kept in configuration files on our server that only its administrator can read — never in source control. Role-based access control on staff and coach access, with every access written to an audit table.

No system is perfectly secure, and we do not claim otherwise.

---

13. Changes

We version this policy. When we change it materially we re-prompt you, and you accept the new version before continuing — which generates a new, independently verifiable ledger entry against the new text.

---

14. Contact

• Privacy, data rights, and deletion requests: privacy@getsvaya.com
• Everything else: hello@vyomatechnologies.com
• Postal: 3296 Logsdon Loop, Delaware, Ohio 43015, USA

↑ Back to contents

Effective 10 October 2026

---

Why this document exists separately

Illinois' Biometric Information Privacy Act requires that, before collecting a biometric identifier, a private entity informs the subject in writing that it is being collected, states in writing the specific purpose and the length of time it will be kept, and obtains a written release. Texas' CUBI imposes a notice-and-consent duty and a destruction deadline. Washington's My Health My Data Act requires separate, specific consent for collecting consumer health data and a distinct authorisation before any sale.

Those are not satisfied by a paragraph inside a general Terms of Service. This is the separate written notice and release.

BIPA carries a private right of action and statutory damages per violation. That is the reason this document is written conservatively even though the question of whether our data is covered is genuinely arguable — see §7.

---

THE NOTICE

1. What we collect

When you run a tracked set, Svaya's camera measures where your body is, many times a second, and records the result as numbers.

Right now, each measurement records the position of 23 named points on your body. Five of them are on your head: your nose, both eyes, and both ears. The other eighteen are your neck, shoulders, elbows, wrists, hips, knees, ankles, heels, toes, and a central reference point. Each point is recorded with its horizontal and vertical position and a confidence score. Some capture modes also record a depth value and a three-dimensional position.

We also compute and store, from those points: 21 joint angles, the movement signal that drove your rep count, the phase of the movement, your rep count, your form score, and quality information about the camera.

A note about the high-resolution mode. On some devices, with the rear camera, Svaya can use a higher-resolution capture mode. Until 3 September 2026 that mode also recorded your jaw, chin, eyeballs, and both eyelids of each eye, and a complete skeleton of both hands — thumb, index, middle, ring and little finger, three to four joints each. Since 3 September 2026 it records body joints only, with the same five head points as the standard skeleton. We checked on 10 October 2026: our database holds no face or hand measurements from that mode. The body joints it recorded are kept like any other body-geometry measurement.

2. What we do NOT collect

No pictures. No video. No audio. The camera image is processed on your phone, in the moment, and thrown away frame by frame. It is never uploaded, and nothing we store can be turned back into a picture of you or of your room.

This is verifiable rather than promised: there is no image, video, or binary media column in the table that holds this data.

3. How long we keep it, and when we destroy it

Body-geometry measurements are kept while your account is in use, and are permanently deleted 180 days after you delete your account or your account becomes dormant (no sign-in and no sync for 24 months).

If you delete your account, or it becomes dormant, the record linking these measurements to you is destroyed immediately, and the measurements themselves are deleted 180 days later.

We publish this schedule here so that it is a stated, checkable commitment rather than an internal practice.

4. Why we collect it

• To count your repetitions and score your form.
• To measure your range of motion, tempo and consistency over time.
• To show you your history and progress.
• To let a coach review your movement — only if you have granted it. With a one-to-one coach it is a separate switch, off by default. Choosing a coaching team includes it, together with your workout history and plan changes, in that one choice.
• If, and only if, you switch it on: to train our own rep-counting and form-scoring models. See §5.

5. Model training is a separate choice, and it is off unless you turn it on

The Help Train Shared Models setting controls whether your measurements may be used to train and improve Svaya's own models. It is off by default.

Be clear about what this setting does and does not do:

It does control	whether your measurements are marked as usable for training our models
It does not control	whether measurements are collected and stored at all — that is this consent: with it, every tracked set records them, because that is how the app counts your reps

We spell this out because one of our own settings screens has described it loosely, in a way that could be read as an upload switch. It is not one. If you do not want body-geometry measurements stored, choose "Not now" on this consent, or withdraw it later: your sets are then logged by hand.

You can turn training off at any time. Future measurements stop being marked immediately. Turning it off also removes the marking from measurements taken while it was on.

6. What we will never do with it

• We will never sell, lease, trade, or otherwise profit from your body-geometry data. Not to advertisers, not to data brokers, not to insurers, not to anyone, under any arrangement.
• We will never give it to another company to train their models.
• We will never use it to identify you to anyone, or to match you against any other database.
• We will never disclose it except: to you; to a coach you have specifically authorised; to a service provider hosting it under contract on our behalf; or where a court order or law compels us, in which case we will tell you unless legally forbidden.

7. Our position on whether this is "biometric" data

We think the honest answer is that it should be treated as biometric data, and we have written this notice on that basis.

The measurements include the geometry of your face, and — in the August 2026 captures — of your hands, which Illinois' statute names explicitly. We could argue that a 23-point joint map is too coarse to identify anyone and is not a "scan" in the statutory sense. That argument may well be correct. We have chosen not to rely on it, because the protections the statutes require are ones we are willing to give regardless: tell you first, in writing; say why and for how long; get your written consent; publish a destruction schedule; never sell it.

8. How we protect it

• Encrypted in transit and at rest.
• Stored under a pseudonym rather than under your name. Honestly: this is a single stable pseudonym, not a rotating one, and the measurements remain linkable to you through session identifiers. It reduces casual exposure; it is not anonymisation, and we do not call this data anonymous.
• Access by our staff and by coaches is role-restricted and written to an audit log.

9. Your rights

You may, at any time:

• withdraw this consent, in Profile → Privacy → Camera tracking;
• turn off model training;
• get a copy of your data — the in-app export covers your workouts and plans; for these measurements, email privacy@getsvaya.com;
• delete your account, which destroys the link between you and these measurements immediately;
• ask us at privacy@getsvaya.com to clear the training marking from measurements already collected.

Withdrawing consent will stop tracked sets from working, because the measurement is the tracking. It does not affect manual logging, your history, or anything else in the app.

---

THE RELEASE

By tapping I agree, I confirm that:

• I have read the notice above and understand what Svaya measures, why, how long it is kept, and when it is destroyed.
• I understand that these measurements include points on my face, and that they may be treated as biometric data under the laws of Illinois, Texas, Washington and elsewhere.
• I consent to and authorise Vyoma Technologies Limited, and the service providers it names in its Privacy Policy, to collect, store, use and destroy this data as described above.
• I understand this consent is voluntary, that I may withdraw it at any time, and that withdrawing it stops camera-tracked workouts but nothing else.

Model training is a separate switch and is off unless I turn it on.

↑ Back to contents

Effective 10 October 2026

---

PLEASE READ. THIS AFFECTS YOUR LEGAL RIGHTS.

1. Exercise is inherently risky

Physical exercise carries risks that no app can remove. They include muscle strains and tears, sprains, joint and back injuries, dislocations, fractures, overuse injuries, fainting, heat illness, dehydration, aggravation of an existing condition, cardiac events including heart attack, stroke, and — rarely — serious permanent injury or death.

These risks exist whether or not you use Svaya. Some of them are increased by exercising alone, without a qualified person present.

2. Risks specific to using Svaya

You should understand these before you accept:

• Nobody is supervising you. Svaya does not watch for your safety. If you are injured, lose consciousness, or need help, the app will not notice, will not summon anyone, and cannot assist. This is true even during a live coaching call: a coach can see you but cannot reach you.
• Svaya decides what exercises to give you, by software. Those decisions are automated estimates based on what you told it and what the camera measured. They may be unsuitable for your body, your injuries, your experience or your equipment.
• The rep count, the form score and the coaching cues can be wrong. They may miss repetitions, count ones you did not do, misread your form, or tell you your form is acceptable when it is not. An absent warning is not a confirmation that you are moving safely.
• Using a phone camera changes how you train. You may position yourself for the camera rather than for good mechanics, be distracted by the screen, trip over the phone or its stand, or continue a set you should have stopped in order to complete a count.
• Your environment is your responsibility. Floor surface, obstructions, ceiling height, equipment condition and stability, and other people or animals in the space are outside our knowledge and control.

3. You confirm you are fit to exercise

By accepting, you confirm that:

• you are voluntarily choosing to exercise, and are physically able to do so;
• you have had the opportunity to consult a physician, and have done so if you have any reason to;
• you have accurately told Svaya about your injuries and health conditions, and you will update that information if it changes;
• you are not exercising against medical advice.

4. You assume the risks

Knowing what is written above, you knowingly and voluntarily assume all risks of injury, loss or damage arising from your use of Svaya — including risks arising from your own physical condition, your environment, your equipment, and from Svaya's automated suggestions, feedback, rep counts and form scores being incomplete or wrong.

5. Release

To the fullest extent permitted by the law that applies to you, you release and discharge Vyoma Technologies Limited, and its officers, directors, employees, contractors and agents, from all claims, demands, damages and causes of action for injury, loss or damage arising out of or relating to your use of Svaya — including claims based on ordinary negligence — and you agree not to bring such a claim.

What this release does NOT cover, and cannot:

• gross negligence, recklessness, wilful or wanton misconduct, or fraud;
• any liability that the law where you live does not permit to be released, including — in many places — liability for death or personal injury caused by negligence;
• the acts or omissions of an independent coach, who is not covered by this release and is responsible for their own advice;
• your statutory consumer rights.

6. On behalf of others

You accept this on your own behalf and, to the extent the law allows, on behalf of your heirs, family, personal representatives and anyone claiming through you.

7. If part of this fails

If any part of this release is held unenforceable, the rest remains in force to the fullest extent the law allows, and the unenforceable part is limited rather than struck in its entirety where that is permitted.

8. Stop if something is wrong

Stop exercising immediately and seek medical attention if you experience chest pain or pressure, pain radiating into the arm or jaw, severe shortness of breath, dizziness, faintness, an irregular heartbeat, sudden severe pain, or any symptom that concerns you. Do not wait for the app to tell you. The app will not tell you.

---

The affirmation

I have read this document. I understand the risks of exercise and the specific risks of using Svaya. I voluntarily assume those risks and agree to the release above, to the extent the law where I live permits.

↑ Back to contents

Effective 10 October 2026

---

The affirmation

I confirm I am 18 years of age or older. Svaya is available to adults only.

We record your confirmation in our consent records, in the same step as the other documents you accept, and you cannot continue without it. This is a self-attestation, not a verified date-of-birth gate; onboarding also asks for your date of birth and does not let you continue if it shows you are under 18.

↑ Back to contents

Effective 10 October 2026

What this document is

Svaya can put a human coach in your account. This page says exactly what that coach can see, how they got the ability to see it, how long it lasts, and how you end it.

This page is information: you do not accept or decline it. The choices it describes are made on their own screens — choosing a coaching team, the switches you set for a one-to-one coach (the Coach Data-Access Consent), and accepting a live call.

Every statement below is checked against the code that runs. Where the code grants more than you would expect from the screen you tapped, this page says so instead of smoothing it over. The places where the app does not yet do what it should are listed at the end, and that list is part of the document, not an appendix to it.

1. There are two ways a coach gets access, and you have one at a time

Every time a coach asks our server for your data, the server checks, on that request, which coaching you have now, and answers only from that.

You have one coaching arrangement at a time. Choosing a coaching team ends any one-to-one coaching you had, and the team screen names what will end before you confirm. Connecting a one-to-one coach ends your team.

A. You chose a coaching team

You pick a team on the team screen. Tapping "Choose this team" — and confirming, when something else would end — is the grant.

Before you tap, the screen lists what the team will be able to do — see your workouts, sets and skeleton replays; review your form and send you feedback; write and change your training plan — and shows the full notice. Your choice is written to our consent record.

There are no per-item choices on this path. You cannot keep the plan writing and take the skeleton replay off, or the other way round. If you chose your team before plan writing was added, the team cannot write your plan until you allow the updated notice, which the app asks you about.

The access is given to the team, not to a person. Every coach on the team can read your data. The app introduces you to the team's lead and its core members, but the team can include other coaches you are not introduced to; you see such a coach's name on a message when they answer you. The app does not show you how many coaches are on your team.

B. You connected one coach

You connect to one specific coach with their coach code. Before the connection completes you are shown six switches, and you can change them later in Manage Permissions.

Switch	What it lets that coach do
Workout History — always on	See your sessions, exercises, sets and form scores, your plans, and your profile context (training days, activity level, fitness level, goals)
Rep Detail	See per-rep range of motion, tempo and stability
Health Metrics	See your heart rate and calories
Session Notes	Write notes on your sessions, and read, change and remove the notes they wrote
Plan Assignment	Assign you workout plans
Form review (skeleton replay)	Replay a stick figure of your movement

The app describes Session Notes as letting the coach see the notes you write after sets. It does not: the notes you write after sets are never sent to a coach, whatever your switches say (§11).

Workout History is locked on in the app, and the server refuses a set of permissions without it. If you do not want a coach to see your workouts, the answer is not to have that coach, not to narrow the switches.

Health Metrics needs four things before a number reaches your coach: an active connection, the switch on, your agreement to let us record your heart rate and calories, and your agreement to share them with a coach. A team never gets them.

Three more permissions exist with no switch in the app. Live video and your live body position are given together when you accept your first live call with that coach (§6). Body Metrics (a body-composition band, §2) is never turned on by the app. Saving your switches in Manage Permissions keeps these three as they are; the only way to withdraw them from the app is to pause or end the connection (§8).

2. What a coach can see

The middle column is a coaching team; the right column is a one-to-one coach.

Your data	A coaching team	A one-to-one coach
Session list — activity, start and end time, status, number of sets, average form score	Yes	Yes
Full session detail — every exercise and every set, with reps, weights and form scores	Yes	Yes
Per-rep detail (range of motion, tempo, stability)	No	Only with Rep Detail on
Heart rate and calories	No	Only with Health Metrics on and your two health agreements (§1)
Skeleton replay of a recorded set (§4)	Yes	Only with Form review on
Your conversation with the team or coach, and your display name	Yes	Yes
Your training plan	They can write and change it (§1)	They can see it; assigning one needs Plan Assignment
Your profile context — training days, activity level, fitness level, goals	No	Yes
The body areas you told us about and the exercises swapped for them	Only if you choose to share them with your team	Only if you choose to share them with your coach
A body-composition band derived from your BMI (for example "OVERWEIGHT")	No	Only with Body Metrics, which has no switch (§1)
A live video call with you	No	Only through a call you accept (§6)

Session detail is delivered whole and then trimmed: heart rate, calories and per-rep detail are removed when the access does not cover them, and the notes you write after sets are never included. Everything else Svaya recorded about that session reaches the coach. So "what a coach sees in a session" is best read as everything Svaya recorded about that session, minus those things.

3. What a coach cannot see

• Video or sound from your workouts. A tracked workout sends numbers, not pictures: no video, photo or sound from a tracked set is sent to a coach, or anywhere else. (Sending a set video with a review request is built but not switched on — §5.) The one exception is a live call you accept (§6).
• Your email address, phone number or date of birth. A coach's client list carries your display name, the permissions you granted and when you granted them — no contact details.
• Your body measurements, weight or body-fat entries. Nothing that serves coaches reads them. The one exception is the body-composition band in §2, and only with Body Metrics.
• Your password, your sign-in history or your devices.
• The notes you write after sets. They are never sent to a coach.
• Another coach's notes about you. A coach sees only the notes they wrote themselves.
• A team cannot see anything marked "No" in §2 — including your heart rate, your per-rep detail and your profile context.

4. The skeleton replay, precisely

This is the most detailed thing a coach can look at, so it gets its own section.

A replay is a stick figure. It is built from 23 named points on your body, played back over time:

nose, neck, root, left and right eye, left and right ear, and left and right shoulder, elbow, wrist, hip, knee, ankle, heel and toe

Five of those points are on your head — your nose, both eyes and both ears. They are positions, not a picture of your face, and no image is stored or sent. But it is not accurate to say the replay leaves out your head, so we do not say it.

• If you turned on recording of your wrist and head motion (Apple Watch and AirPods), the replay also carries, for each frame, how your wrist was moving and which way your head was turned. The screen where you turn that on does not say that coaches see it; this page does (§11).
• Playback runs at up to 15 frames per second, and one set is capped at 900 frames. Longer sets lose smoothness, not length.
• Positions are sent rounded to four decimal places, packed as whole numbers. That is how the data is packed for sending. It is not a privacy measure and we do not describe it as one.
• Every replay a coach opens is recorded.

5. A video you send for review — built, not switched on

Sending a short video of a set to your coach with a review request is built but switched off: the app does not offer it today. When it is switched on, this is how it works.

• The app blurs faces before the file is written, by default; you can turn the blurring off for your own face, clip by clip. The server records whether the app reported blurring the faces; it does not check the video itself.
• A coach never gets the file. They get a link that stops working after two minutes, and a new link is issued only while your coach still has access.
• You can un-share a clip at any time, one clip at a time. Deleting it makes every link to it stop working at once. What a coach already opened cannot be taken back: a link works for at most two minutes as issued, and never more than five minutes under the server's settings.
• Turning off Form review, or pausing or ending your connection with that coach, deletes every clip you shared with them.
• Deletion timing. A clip is deleted 7 days after your coach finishes or dismisses the review, and in any case within 30 days of being sent. That is not the same as "deleted the moment the review is done", so we do not claim that.
• Every link issued to a coach is recorded.

6. Live video calls

A live call is possible only with a one-to-one coach, never with a team. Each call is offered to you and starts only when you accept it on its own screen; you can decline.

During a call:

• The coach's camera and microphone are on.
• Your live body position — the moving stick figure — goes to your coach for as long as you are on the call.
• Your microphone is on when you join; you can mute it.
• Your camera picture goes to your coach only if you tap Share camera.

Accepting your first call with a coach also gives that coach two standing permissions, together: live video and your live body position. There is no switch for either in the app.

• Leaving the call stops everything you were sending.
• Pausing or ending your connection with that coach ends any call in progress: our server closes the call itself, which is what actually stops a camera feed. A coach whose connection you paused or ended cannot start a call.
• There is no way to stop sending your body position while staying on the call. The app has no switch for it, and even when the permission is withdrawn on our server, the app keeps sending your body position until the call ends. Leaving the call stops it.

7. How long access lasts

Until you end it. There is no time limit.

Nothing ages out. A coach you connected a year ago and never spoke to again can still read your workouts today.

Sending a form-review request does not create a separate, shorter access. It is answered under the access you already gave.

8. How you cut it off

This is not a setting that takes effect later. Your permissions are read afresh on every single request a coach makes, with nothing cached. The next thing they tap fails.

If you have one coach

Three controls, all in the app, all immediate:

• Narrow it. Turn switches off in Manage Permissions. Turning off Form review also deletes every set video you shared with that coach (§5).
• Pause it (Pause Access). A paused connection gives the coach nothing at all, and any live call is ended. Resume Access gives back what you had granted.
• End it (Disconnect Trainer). Our server finishes the work before it answers you: the connection ends, any live call is ended and its call room closed, and every set video you shared with that coach is deleted.

If you have a coaching team

• Change team. Choosing another team ends your current team's access at once, on every screen they use; the team screen says so before you tap.
• Leave the team. In your team conversation: Team → Leave team. The team loses access at once. Your plan, your workout history and your messages stay yours, and your leaving is written to our consent record.

Your conversation follows you. When you change team, or move to a one-to-one coach, your earlier messages move with you, and the new team or coach can read them; the team you left keeps nothing. If you leave a team and later choose a team or a coach, they too can read your earlier messages. The team screen tells you "Your conversation history moves with you"; this page says plainly who it moves to.

9. What happens to data a coach has already seen

Reading is not copying, and we cannot make a coach un-see anything. What we can tell you is what remains and what goes:

• Notes and annotations a coach wrote about you stay after their access ends, and you can still read the notes on your sessions. They are deleted when your account is deleted, or the coach's.
• Your conversation stays. It is kept until you delete your account, and then deleted. Each conversation is stamped with a two-year limit when it starts, but nothing acts on that limit today, so nothing currently deletes conversations on that schedule.
• Review requests and any set videos are deleted with your account.
• The record of what a coach looked at is deliberately kept. It is the proof of what happened. If you delete your account, the record stays but no longer names you.
• Anything a coach wrote down or copied outside Svaya is outside our reach. That is true of every platform, and §11 says what we do about it.

10. Every access is recorded — and what you can currently see of it

Every time a coach opens your data, it is recorded, and so is every refused attempt, including a coach trying to reach someone who is not their client. Replays a coach opens and video links issued to them are recorded one by one.

What you can see of that record in the app is narrower than the record itself:

• With a one-to-one coach, "What your trainer did" lists the last 90 days of eight kinds of event: reviewed your history, reviewed a session, read notes, assigned a plan, left a note, edited a note, removed a note, and reviewed the health work-arounds you shared.
• It does not list each replay opened or each video link issued — the two most sensitive reads. With Form review on, the Trainer Reviews card shows which of your workouts the coach has reviewed (opened the replay or left feedback).
• With a coaching team, you can see none of this in the app.

So the accurate promise is: every coach access to your data is recorded, and we will give you the record on request at privacy@getsvaya.com. It is not yet true that you can see all of it in the app.

11. Our commitments, and where the app does not yet keep them

Svaya holds itself to four standing rules about coaches. Each is stated here with the truth about it.

Anything that affects your rights gets its own screen. Mostly kept. A one-to-one coach's permissions get a screen with real switches, and your choice is written to our consent record. Choosing a team gets its own screen, which lists what the team will be able to do and shows the full notice, and your choice is written to our consent record — but it is one choice with no parts (§1). Accepting a live call is its own screen, but your first acceptance also gives two standing permissions that have no switch (§6).

Coaches should not be able to copy your data off their screen. Downgraded, honestly. We tried to block screenshots of coach screens outright, and it made the screens blank for the coach as well. What ships instead: in the Svaya app, a coach's client screens are hidden while the screen is being recorded, mirrored or AirPlayed, and a screenshot is detected and logged against the coach's account. That runs on their device and a determined person can defeat it. It is a deterrent and a trail, not a wall. The coach website, which also shows your workouts and replays, has no such protection. No technology stops someone photographing a screen with a second phone.

Sharing your live movement is a separate choice we never assume. Partly kept. You are asked on its own screen before every call. But your first acceptance gives a standing permission with no switch, and there is no way to stop sharing your body position while staying on a call (§6).

Video access ends with the review. Not as written. A coach's access to a set video ends when you un-share it, turn off Form review, or pause or end the connection. The file is deleted 7 days after the review closes, and within 30 days regardless (§5). Sending set videos is not switched on.

Open gaps, listed plainly

• Choosing a team is one choice with no parts: there is no per-item choice.
• You cannot see how many coaches are on your team, or who they all are.
• Live video, your live body position and Body Metrics are permissions with no switch in the app.
• There is no way to stop sending your live body position while staying on a call.
• The app describes the Session Notes switch as letting a coach see the notes you write after sets; it actually lets the coach write notes on your sessions, and your own notes are not shared with a coach.
• The screen where you turn on wrist and head motion does not say that coaches see that motion in replays.
• Your access record in the app is incomplete, and clients of a coaching team cannot see it at all.
• Conversations are stamped with a two-year limit that nothing enforces.
• The coach website has no screen-recording protection.
• When set videos are switched on, the server will trust the app's report that faces were blurred, without checking.

Until each of these is closed in the code, this page is the accurate description, and the app is the thing that needs to change.

12. Questions, or a copy of your record

privacy@getsvaya.com

You can ask for the full record of every coach access to your data, and we will provide it.

↑ Back to contents

Effective 10 October 2026

---

Before you upload

You are about to put video on Svaya. Please confirm two things.

1. You have the rights

You confirm that:

• you made this recording, or you have written permission from whoever did;
• everyone visible or audible in it has agreed to appear on Svaya, and to the uses described below;
• you own or have licensed everything else in it — music, logos, branded clothing, artwork, footage or text belonging to someone else;
• nothing in it infringes anyone's rights, including rights of privacy and publicity;
• no one in it is a minor, unless you have their parent or guardian's written permission.

If you are not certain about any of these, do not upload. Music playing in the background of a gym recording is the single most common way this goes wrong.

2. The licence you are granting

For as long as your content is on Svaya, you grant Vyoma Technologies Limited a non-exclusive, worldwide, royalty-free licence to host, store, copy, transcode, watermark, excerpt for a preview, and stream your content to the people you have chosen to make it available to, and to do the technical things needed to deliver it.

What this licence does not include:

• We do not get to use your content to advertise Svaya, or in any marketing, unless you agree separately.
• We do not own your content. It remains yours, and you can license it elsewhere.
• We do not get to keep distributing it after you remove it. When you delete it, or your account, we stop serving it. Copies may persist in routine backups until those backups are removed.
• We do not use your content to train models without asking you separately.

3. How your video is protected

• No public address. Every view goes through a short-lived signed link.
• Video shared for a form review is reached only through links that expire within minutes, and is deleted 7 days after the review is finished.

4. If you upload a group session

⚠️ Faces are not blurred. Automatic face blurring is not applied to group-session uploads. Right now, your attestation is the only protection the people in your footage have. Everyone in frame will be visible to whoever you share it with.

Only upload group footage where every single person visible has actually agreed — not assumed, not implied by their being in your class. If you cannot say that with confidence about every person, do not upload it.

5. What happens if the attestation is wrong

If a rights claim is made about your content, we may remove it immediately and without notice while we look into it. Repeated or serious problems can end your ability to publish on Svaya. As set out in the Coach Agreement, you are responsible for claims arising from content you uploaded without the rights to it.

---

The attestation

I confirm I hold all necessary rights to this content, that everyone appearing in it has agreed to appear, and that I grant Svaya the licence described above. I understand Svaya relies on this confirmation and does not independently verify it.

↑ Back to contents

Effective 10 October 2026

If you connect a coach, this lets them see the heart rate and energy figures from your workouts, alongside the sets you did.

They see it to coach you — to tell whether a session was too easy or too hard for you. Nobody else sees it. We do not sell it, we do not advertise with it, and no coach can see it about anyone who is not their own client.

You choose which coach, when you connect one, and you can turn this off for everyone at any time. Turning it off does not end your coaching — your coach still sees your workouts, sets and form.

If you have not let us record your heart rate, there is nothing here to show anyone.

Either answer takes you straight into the app. You can change it later in Profile → Data Sharing.

[My coach can see my heart rate]

[Keep it private — my coach can't see it]

↑ Back to contents

Effective 10 October 2026

Based on the health information you shared, we ask you to agree — once — that you will review this plan and your workouts, including any your trainer suggests, with your doctor or another qualified health professional. This app is not a substitute for their advice.

I'll review my training with my doctor

[Start with this plan]

[Not now]

Confirm the note above to continue, or choose Not now.

↑ Back to contents

Effective 10 October 2026

For the areas you told us about, our recommendation swaps out some exercises. If you keep the original exercises, your plan includes the movements we would otherwise swap out.

Before doing the exercises we would normally swap out for you, check with your doctor or physiotherapist. You can switch back to our recommendation at any time.

[Keep the original exercises]

[Use the recommendation]

↑ Back to contents

Effective 10 October 2026

Your team answers your questions and reviews your sets. Choosing a team gives them access to your training history — that's what lets them coach you.

What your team will be able to do

• Review your form and send you feedback
• Write and change your training plan
• See your workouts, sets and skeleton replays

[Choose this team]

The full notice

Svaya coaching team access grant: by joining a coaching team you grant that team's members access to your training history, workout sessions, skeleton replays and coaching thread, AND you ask them to review, write and change your training plan. Your coaching team shares your thread. Switching to a different team ends this grant immediately; the new team can see your prior messages, the old team keeps nothing. You can leave a team at any time, and your plan stays yours.

↑ Back to contents

Effective 10 October 2026

Version 2026-10-10

You agree to coach clients honestly, safely, and within your scope of practice. No medical diagnosis, no guaranteed outcomes, no harassment or discrimination. Content must be your own or properly licensed. Violations may result in removal of content, suspension, or termination.

I have read and agree to the Code of Conduct.

Type your full name to sign

↑ Back to contents