PRIVACY POLICY

Effective Date: May 9, 2026 Last Updated: May 9, 2026 Document Version: 2.0

1. Purpose

This Privacy Policy explains how Tamreen collects, uses, stores, shares, protects, and deletes Personal Data when Users and Service Providers use the Platform.

Tamreen is the data controller for Personal Data processed through the Platform. Privacy requests may be sent to support@Mytamreen.com.

Tamreen's commercial registration number is 531660 and its license number is 2026/4823.

2. Data Collected

Tamreen may collect account data, identity data, contact details, date of birth, gender, profile photo, language settings, Service Provider Civil ID and credential documents, bank details for provider payouts, Fitness and Wellness Data, payment transaction records, in-app messages, location permissions, device data, usage data, error logs, consent records, marketing preferences, and analytics data.

Tamreen does not store full card numbers or CVV codes on its own servers. Payment processing is handled by MyFatoorah or another designated payment processor.

3. Sensitive Fitness and Wellness Data

Tamreen treats fitness goals, measurements, dietary information, training progress, and self-reported health information as sensitive information. This data is used to personalize services and deliver Programs. It is shared with Service Providers only where the User gives the required consent through the Platform, unless disclosure is required by law or necessary for safety, dispute handling, or Platform integrity.

4. Purposes of Processing

Tamreen processes data to create accounts, authenticate Users, deliver Programs, personalize experience, process payments, manage subscriptions and refunds, facilitate messaging, transfer provider earnings, maintain safety, investigate abuse, improve the Platform, send service communications, send marketing where consent is given, maintain Consent Records, comply with law, and respond to authorities or court orders.

5. Third Parties

Tamreen may use service providers such as MyFatoorah, AWS, Firebase, Sentry, Google Analytics, Mixpanel, Segment, Customer.io, Apple Push Notification Service, Firebase Cloud Messaging, Meta, TikTok, Google Ads, Snapchat, and similar tools.

Third-party tools may process data only as needed for their services, subject to their own privacy and security obligations. Tamreen should not activate non-essential tracking on websites unless the required consent or lawful basis is in place and clearly disclosed.

6. Storage and Transfers

Tamreen may store data on AWS or other infrastructure providers outside Kuwait, including in the UAE and Europe. Users acknowledge that data may be transferred outside Kuwait. Tamreen should maintain appropriate contractual and technical safeguards for cross-border processing.

7. Retention

Account data is retained for the account duration and a reasonable period after closure. Transaction records may be retained for up to ten (10) years where required for commercial, accounting, legal, or dispute purposes. Consent Records may be retained for seven (7) years. Usage and technical data should be retained only as long as reasonably needed for security, analytics, support, and improvement.

8. User Rights

Subject to Kuwait law and operational requirements, Users may request access, correction, deletion, restriction, consent withdrawal, objection to marketing, and account closure. Requests may be submitted through account settings or support@Mytamreen.com. Tamreen aims to respond within fourteen (14) business days.

9. Children and Minors

The Platform is available to Users aged sixteen (16) and above. Users aged twelve (12) to fifteen (15) may use the Platform only with verified parent or legal guardian consent and supervision. Users under twelve (12) are not permitted to create an Account or use the Platform.

10. Security

Tamreen uses reasonable technical and organizational safeguards, including encryption in transit, access controls, logging, monitoring, and vendor security controls. No system is completely secure.

11. Lawful Basis for Processing

Tamreen relies on the following lawful bases under applicable Kuwaiti data protection law, including CITRA Resolution No. 26 of 2024 on the Data Privacy Protection Regulation, and on applicable GCC and international frameworks where relevant:

12. Automated Decision-Making and Profiling

Tamreen does not make decisions that produce legal effects on Users based solely on automated processing without human review. Tamreen may use automated tools to recommend Programs, personalize content, detect fraud or abuse, and rank search results. Where any automated decision would have a significant effect on a User, Tamreen will provide a meaningful explanation, allow the User to contest the decision, and arrange human review on request to legal@Mytamreen.com.

13. Data Breach Notification

Tamreen maintains an incident response process. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected Users, Tamreen will notify the competent supervisory authority (the Communication and Information Technology Regulatory Authority, CITRA) and affected Users without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of the breach. The notification will describe the nature of the breach, the categories and approximate number of Users affected, the likely consequences, and the measures Tamreen has taken or proposes to take.

14. International Transfers and Safeguards

Where Tamreen transfers Personal Data outside Kuwait, including for hosting, analytics, payments, customer support, or vendor processing, it relies on appropriate safeguards. These include contractual data protection clauses with processors, vendor security certifications (such as ISO/IEC 27001 or SOC 2), encryption in transit and at rest, access controls, and processing only for documented purposes. Users may request a summary of safeguards by contacting legal@Mytamreen.com.

15. Data Protection Contact and Complaints

Tamreen has designated a contact point for privacy and data protection matters. Users may exercise any right listed in Section 8, request information on processing, or raise a complaint by contacting legal@Mytamreen.com. Tamreen aims to respond within fourteen (14) business days. If a User is not satisfied with Tamreen's response, the User has the right to lodge a complaint with the Communication and Information Technology Regulatory Authority (CITRA) in the State of Kuwait, or with another competent supervisory authority.

16. Retention — Legal Anchors

The retention periods in Section 7 are anchored in the following legal and operational sources: Kuwait Commercial Companies Law and Kuwait commercial accounting record-keeping requirements (transaction records); Kuwait Electronic Transactions Law and consumer protection record-keeping (Consent Records); CITRA Data Privacy Protection Regulation (general principle of storage limitation); and Tamreen's internal record-management policy. Where a legal hold, regulatory inquiry, audit, or active dispute requires longer retention, the affected records will be retained for the duration of that hold.

17. Updates and Contact

Tamreen may update this Privacy Policy from time to time. Material changes will be notified through the Platform, by email, or by another reasonable channel at least thirty (30) calendar days before they take effect, except where a shorter period is required by law or by an urgent security or regulatory need. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy. General privacy requests: legal@Mytamreen.com. General support: support@Mytamreen.com.