Privacy Notice

1. Who is responsible for your data

Fraym Growth Systems, S.A. de C.V. (Fraym), with its address at Av. Santa Fe No. 546, Int. 39 E, Col. Santa Fe Cuajimalpa, Cuajimalpa de Morelos, Ciudad de México, C.P. 05348, México, is responsible for processing your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, published in the Diario Oficial de la Federación on 20 March 2025, and other applicable rules.

Our personal data protection department handles everything related to this notice at privacidad@joinfraym.com.

This English version is provided for convenience. If it differs from the Spanish version, the Spanish version prevails.

2. Who this notice applies to

This notice applies to the people whose data Fraym processes for its own purposes:

• Clients who create an account in the client portal at joinfraym.com or in the Fraym app for iPhone, or who book and buy through them.
• Visitors to joinfraym.com.
• People who apply for Fraym access for their business or book a call with us.
• Owners and staff of the studios, spas, salons and brands that have a Fraym account.

When a studio records your data in its own panel (for example, because you arrived at a class without a Fraym account, or because a platform such as Wellhub or TotalPass signed you up), the studio is responsible for that data and Fraym only processes it on the studio's behalf, as a processor. In that case, please also read the studio's own privacy notice.

3. Personal data we process

Depending on how you use Fraym, we process the following data:

• Identity and contact: first name, last name, email, phone, date of birth, gender and, if you choose to upload one, your profile photo.
• Address and location: street, city, state, postal code and the coordinates of the address you pick in the address search. If you allow it in your browser or in the app, your device's location, which we only use to calculate distances and do not store on our servers.
• Emergency contact: the name and phone of the person you choose, if you provide them. By providing them you confirm that person agrees.
• Parent or guardian: if you are between 13 and 17, the name and email of the adult who authorises your account, and the date they did.
• Account data: password (stored with a one way hash, never in readable form), language, the interests you choose, how you heard about Fraym or the studio and, where applicable, the account of the person who recommended it.
• Bookings and activity: the studios you visit, the classes, events and private events you book, attendance, no shows, cancellations, waitlists, chosen spots, guests you bring, what you save in your lists (which only you can see), the reviews you post and the packages, memberships, gift cards and coupons you use. Also what you do in Explore: the searches you type and the businesses, classes and events you open, save or book. If you explore without an account, that activity is recorded with nothing that identifies you.
• Payments: description, amount, currency, date and status of each payment or refund and, for the cards you save, only the brand, the last four digits and the expiry date. Your full card number is received and processed by Stripe; Fraym never sees or stores it.
• Technical data: IP address, device type, operating system and browser, access and error logs, and the information from the cookies and technologies described in section 12.
• Business and staff data: business name, city, business type, size, goals, the name, email, phone and role of the person representing it, the business's billing data and the messages sent to us through the support chat.

Sensitive personal data. The information about your health that you choose to share with the studios (injuries, medical conditions, pregnancy or any other circumstance of your health a coach should know) is sensitive personal data. We only keep and share it with your express written consent, which you give by ticking the corresponding boxes when you write it. If you answer that you have nothing to report, we keep no health data at all. See the Health Data Notice.

We do not process any other sensitive data, such as racial or ethnic origin, religious, philosophical or moral beliefs, union membership, political opinions, sexual orientation, or genetic or biometric data.

4. What we use your data for

Necessary purposes. They are essential to your relationship with us and with the studios, so they do not require your consent:

• Creating and managing your account and verifying your identity when you sign in or recover your password.
• Showing you studios, classes and events, calculating how far they are from you and ordering them by your bookings, your saved studios and your interests.
• Measuring how Explore is used in order to improve it, and showing each business aggregated figures of how many people viewed its page or its classes or booked, with nothing that identifies you.
• Managing your bookings, waitlists, spots, guests, packages, memberships, gift cards, coupons, events and private events.
• Processing your payments and refunds, and the no show or late cancellation fees a studio applies under its own policies.
• Sharing with each studio where you book or buy the data it needs to look after you, as explained in section 6.
• Sending you messages about your account and bookings: confirmations, reminders, changes, cancellations, receipts, security notices and password recovery.
• Handling your support requests and your ARCO requests.
• Preventing fraud and abuse and protecting the security of the platform, its users and the studios.
• Meeting legal, tax and accounting obligations and responding to requests from competent authorities.
• For businesses and their staff: reviewing their application, creating and running their account, charging the subscription and supporting them.

Purpose based on your express consent. Keeping your health information and showing it to the studios where you book and to their coaches, so they can look after your safety in class. We never use it for anything else.

Secondary purposes. They are not necessary to provide the service:

• Sending you promotions, offers, news and greetings from the studios where you have an account and from Fraym.
• Asking you to rate your experience or leave a review of a studio.
• Personalizing Explore and your home: ordering and explaining what you see based on the classes and events you attended and the places you saved, and showing you your Passport. It is worked out from your own data, shared with nobody, and you never have to write anything down.
• Publishing the reviews you choose to write on that business's page, with your first name and the initial of your last name, never your full last name or your contact details. You can only review a place where you have taken a class, you can edit or remove it at any time, and when you delete your account it stops showing and we erase its text.

You can refuse the secondary purposes at any time without affecting your bookings or payments: by ticking the corresponding box when you create your account, by switching off Promotional emails in your profile, by using the unsubscribe link in every promotional email, or by writing to privacidad@joinfraym.com.

We do not make decisions based solely on automated processing that produce legal effects for you or significantly affect you.

5. Artificial intelligence

Some Fraym features use third party artificial intelligence models, which we access through OpenRouter, Inc. (United States):

• Recommendations in the client portal. To word the reason for a recommendation we only send the names of the classes and coaches, the spots available and the suggested reason. We never send your name, email, phone, health information or any identifier of yours.
• Tools for studios. The assistant, campaign copy, analyses and the support chat process business figures and what studio staff write. They do not send your health information.

Fraym does not use your personal data to train artificial intelligence models. If we ever wanted to share your personal data with a third party artificial intelligence, we would tell you clearly and ask for your permission first.

6. Who we share your data with

Transfers. We share personal data with the following third parties:

• The studios, spas, salons and brands where you book or buy, which receive it as independent controllers to provide the service you purchased, charge for it, keep their client records and contact you about your bookings. Each one receives your identity, contact details, date of birth, gender, photo, emergency contact, how you heard about it, your bookings and payments with that studio and, only if you authorised it, your health information.
• Stripe Payments México, S. de R.L. de C.V. and its affiliates, which process your payments on the studio's behalf and also process some data as controllers to prevent fraud and meet their legal obligations, under their own privacy notice.
• Competent authorities, when a law or a lawful order requires us to.

These transfers do not require your consent because they are necessary to perform the contract entered into in your interest and the legal relationship you have with us and with each studio, or because the law requires them. The only exception is your health information, which we only share with the studios if you gave your express consent. If we ever wanted to make a transfer that does require your consent, we would ask you before making it.

Providers that process data on our behalf. To run Fraym we use providers that process your data only on our instructions and are contractually bound to protect it with measures equal or equivalent to those in this notice. Some are outside Mexico:

• Supabase, Inc.: database (servers in the United States).
• Vercel Inc.: hosting for the website and the app, and photo storage (United States).
• Resend, Inc.: email delivery (United States).
• Stripe: payment processing and card storage.
• OpenRouter, Inc.: access to artificial intelligence models, on the terms of section 5 (United States).
• komoot GmbH, through its Photon service: address suggestions. It only receives the text you type in the address search (Germany).
• Google LLC: delivery of the site's icon font, which receives your IP address when the page loads (United States).
• Apple Inc.: delivery of notifications to the iPhone app, once you turn them on (United States).

We do not sell your personal data, we do not share it for advertising, and we do not let third parties track your activity on other sites through Fraym.

7. How to limit the use or disclosure of your data

• Switch off Promotional emails in your profile, or use the unsubscribe link in any promotional email.
• Ask to be added to our exclusion list by writing to privacidad@joinfraym.com: we will not send you promotions from Fraym or from the studios through Fraym again.
• Delete your health information whenever you want by choosing No, nothing to report in your profile.
• Deny or withdraw the location permission in your browser or phone settings; you can still search by city or address.
• If you receive advertising calls or messages, you can register in the Registro Público para Evitar Publicidad run by Mexico's Federal Consumer Protection Agency (Profeco).

8. Your ARCO rights

You have the right to access your personal data and learn how we process it, to rectify it if it is inaccurate or incomplete, to cancel it when you consider it is not needed for the purposes in this notice, and to object to its processing for specific purposes.

You can make many changes yourself from your profile: edit your additional details, your location, your interests, your health information and your email preferences, and delete your account. For anything else, send your request to privacidad@joinfraym.com from the email registered to your account, with:

• Your name and the email or phone of your account, so we can reply.
• If you write from a different email or through a representative, a valid official ID and, where applicable, the document proving the representation.
• The right you want to exercise and a clear description of the data it concerns (unless you are asking for access).
• For a rectification, the change you are asking for and, if needed, the document that supports it.
• Anything that helps us find your data, such as the studio's name.

We will reply by email within 20 business days of receiving your complete request and, if it is granted, we will carry it out within the following 15 business days. These periods may be extended once for an equal period when justified, and we will let you know. We will deliver access as an electronic document. Exercising your rights is free; only shipping or reproduction costs may be charged, as the law allows.

Studios keep their own client records. For the data a studio keeps in its panel, you can also exercise your rights directly with that studio.

If you believe we did not handle your request as the law requires, you may go to the Secretaría Anticorrupción y Buen Gobierno, the Mexican authority in charge of personal data protection, within 15 business days of our reply or of the deadline for giving it.

9. How to withdraw your consent

You may withdraw any consent you gave us at any time. For your health information, just choose No, nothing to report in your profile: we delete it immediately and the studios stop seeing it. For any other consent, write to privacidad@joinfraym.com with the same requirements and periods as in section 8.

Withdrawal does not apply retroactively, and it does not apply where the law requires us to keep processing certain data. If you withdraw a consent that is needed to provide the service, we may not be able to keep providing it.

10. How to delete your account

You can delete your account at any time from Profile › Delete my account, in the portal and in the app. Deletion is immediate and cannot be undone:

• We delete your name, email, phone, date of birth, gender, photo, address, location, emergency contact, interests, health information and password, from your account and from the record of every studio where you were a client.
• We cancel your upcoming bookings and your waitlist spots, cancel the recurring charges of your memberships and remove your saved cards.
• We sign you out on all your devices. Your email and phone become free in case you ever want to create a new account.

We keep, without any data that identifies you, the record of the payments and bookings you made, because the law requires accounting and tax records to be kept (five years under article 30 of the Código Fiscal de la Federación and ten years under article 38 of the Código de Comercio) and because the studios need it for their own accounts. Our database's encrypted backups renew automatically, and deleted data disappears from them within 90 days at the latest. If you ever unsubscribed from our emails, we keep your address only on the exclusion list, so we never write to you again.

11. How long we keep your data

• Your account data, for as long as your account is active.
• Your health information, until you delete it or delete your account.
• Payment and booking records, for the legal periods in section 10, without data that identifies you once your account is deleted.
• Technical and security logs, for short periods, unless they are needed to investigate an incident.
• The data in business access applications and booked calls, for as long as it is needed to follow them up.

When a piece of data is no longer needed we block it, meaning we keep it only to address possible liabilities during the applicable limitation period, and then we delete it.

12. Cookies and similar technologies

We only use the technologies Fraym needs to work:

• frame-session: a cookie that keeps you securely signed in.
• frame-locale: a cookie that remembers your language.
• Local storage in your browser or the app: remembers the location you allowed and some display preferences, only on your device.
• Stripe cookies: when you pay or save a card, Stripe uses its own cookies to prevent fraud.
• Emails: our emails may include an invisible image and links that tell us whether the email was opened and whether a link was clicked, so we know our messages arrive.

We do not use third party advertising or analytics cookies. Because we do not track your activity across sites, we do not respond to browser Do Not Track signals, and the result is the same as if we did. You can delete or block cookies in your browser settings, but without the session cookie you will not be able to sign in. To stop email opens from being recorded, turn off image loading in your email app.

13. How we protect your data

We apply administrative, technical and physical safeguards: encrypted connections, passwords stored with a one way hash, access limited to the people who need it, and providers bound to protect the data. If a security breach significantly affected your rights, we would tell you immediately so you can take action.

14. Minors

People aged 13 to 17 may have an account only with the authorisation of their parent or guardian, given when it is created: the adult writes their name and email and ticks the box that authorises the account and the processing of the minor's data under this notice, including their health information if they choose to share it. We send them an email to let them know. The parent or guardian may exercise the minor's ARCO rights and ask us to delete the account by writing to privacidad@joinfraym.com.

Fraym does not let anyone under 13 open an account and does not knowingly collect their data; a child under that age is registered by the studio directly. If we find an account belonging to someone under 13, or a minor's account without their guardian's authorisation, we will delete it.

15. If you live in the United States

This notice describes the categories of data we collect (section 3), their sources (you, the studios and your device), what we use them for (section 4), who we share them with (section 6), how long we keep them (section 11), how you can review them and request changes (section 8) and how we will notify you of changes (section 16). We do not sell or share personal data for targeted advertising, we do not use it to train language models, and we do not allow third parties to collect your activity over time and across other sites through Fraym.

Depending on your state, you may ask us to confirm whether we process your data, access it, correct it, delete it, receive a copy in a portable format and withdraw your consent. Write to privacidad@joinfraym.com; we reply within 45 days. If we deny your request, you may appeal by replying to our email with the word Appeal, and we will decide within 60 days. If you disagree with the decision, you may contact your state's Attorney General.

If you live in Washington, Nevada or Connecticut, the Health Data Notice explains how we handle your consumer health data.

16. Changes to this notice

We will publish any change on this page with its update date. If the change is material, such as a new purpose or a new kind of recipient, we will also tell you by email or inside the portal and the app, and ask you to accept it again where the law requires.