Data Protection and Privacy Policy

Imara Concepts Ltd — ImaraPass Platform

Document control

Revision history

Approval and signature

Contact for data protection matters

1. Purpose and commitment

Imara Concepts Ltd operates ImaraPass, a platform through which employers purchase gym access packages for their staff, and through which those staff check in at partner gyms using a mobile application. The platform necessarily processes personal data about identified individuals — their names, contact details, employment relationship and gym attendance.

The Company treats that data as held in trust. This Policy sets out, in terms that a data subject, a client organisation and the Personal Data Protection Office can each verify:

• what personal data we process and where it comes from;
• why we process it and on what lawful basis under section 7 of the Data Protection and Privacy Act, 2019;
• how long we keep it and how we dispose of it;
• who we share it with and where it is processed;
• how we secure it;
• the rights available to data subjects and how to exercise them; and
• how we govern, evidence and review our compliance.

The Company is committed to processing personal data lawfully, fairly, transparently and securely, and to being accountable for doing so. This Policy is binding on the Company and on all its personnel.

2. Scope

2.1 In scope

This Policy applies to all processing of personal data by the Company, by any means, in the course of operating ImaraPass and running its business — including data held in the production database, in file storage, in system logs, in backups, in electronic mail and on paper.

2.2 Categories of data subject

2.3 Persons bound

All directors, employees, interns, contractors and third-party service providers of the Company who process personal data on the Company's behalf. Compliance is a condition of engagement.

3. Legal framework

This Policy gives effect to:

Where a client organisation is also subject to the data protection law of another jurisdiction, the Company will comply with the additional requirements agreed in writing with that client, provided they are not inconsistent with Ugandan law.

4. Definitions

5. Our role and our relationship with client organisations

5.1 The Company's status

For the purposes of the Data Protection and Privacy Act, 2019, Imara Concepts Ltd acts as a data collector, a data controller and a data processor, depending on the activity:

5.2 Allocation of responsibility with client organisations

A client organisation decides which of its staff are enrolled, and is the controller of the underlying employment relationship. The Company decides how the platform processes that data once entered. The two roles are therefore distinct and are documented in a written agreement with each client organisation, which records:

1. that the client is responsible for having a lawful basis to disclose employee data to the Company, and for informing its staff that it has done so;
2. that the client will enter only the data fields the platform requires, and will not enter special personal data, free-text health information or any data field the platform does not ask for;
3. that the client will notify the Company promptly when a member of staff leaves, so that the account can be deactivated;
4. that the Company will process the data only for the purposes in section 8 of this Policy and on the client's documented instructions;
5. that the Company will assist the client in responding to requests from its staff and to regulatory enquiries;
6. that the Company will notify the client of any personal data breach affecting its staff without undue delay; and
7. what happens to the data on termination of the agreement.

5.3 Partner gyms

Partner gyms are third parties to the relationship between an employee and their employer. The Company does not disclose employee identity to partner gyms. A gym is given only what it needs to confirm that a valid session has occurred at its premises: a session reference, the status, the times, the duration, and any rating or feedback the member chose to leave. This is enforced in software, as described in section 12.

6. Data protection principles and how we meet them

The Company applies the principles set out in section 3 of the Data Protection and Privacy Act, 2019. The following table states, for each principle, the specific measure by which the Company gives effect to it — so that compliance can be tested rather than asserted.

7. Categories of personal data processed

The following is a complete statement of the personal data fields the platform holds. Nothing outside this list is collected.

7.1 Employee members

What is deliberately not collected from employee members: national identification number, passport number, date of birth, sex or gender, residential address, next of kin, marital status, salary or payroll data, bank or payment card details, health or medical information, fitness or biometric measurements, photographs taken by the application, device location or GPS coordinates, contact lists, and advertising identifiers.

7.2 Administrative users (platform, organisation and gym administrators)

7.3 Business contacts at client organisations and partner gyms

Where a contact field contains the details of a named individual rather than a generic corporate mailbox, that individual is a data subject under this Policy and holds the rights in section 11.

7.4 Special personal data and children's data

• The Company does not intentionally collect or process special personal data as designated by the Data Protection and Privacy Act, 2019. No health status, medical record, biometric, financial, religious, political or sexual-life data is collected from employee members.
• The Company recognises that a record of gym attendance could, in aggregate, support an inference about a person's physical activity. It therefore treats session records as Confidential, restricts internal access, withholds member identity from partner gyms, and prohibits use of session data for any purpose beyond those in section 8. It does not disclose attendance data to insurers or to any other third party.
• Free-text feedback is the one field into which a member could volunteer health information. The field is optional and is presented with guidance not to include health or other sensitive information. Where such information is nevertheless volunteered, it is treated as special personal data, restricted, and deleted on request or at the end of the session retention period. Personnel are instructed not to act on it.
• Children's data. ImaraPass is a workplace benefit for employed adults. No account may be created for a person under 18 years of age. Client organisations warrant this in their agreement. The Company does not knowingly process the personal data of a child, and if it discovers that it has, it will delete the account and the associated records promptly and inform the client organisation.

8. Purposes of processing

Personal data is processed only for the following purposes:

1. Account creation and administration — creating, maintaining, deactivating and deleting user accounts across all roles.
2. Authentication and access control — verifying identity at sign-in, maintaining sessions and tokens, and enforcing role-based authorisation.
3. Membership management — recording an employee's entitlement under their employer's package, tracking visits used and remaining, and expiring memberships when the package ends.
4. Delivery of gym access — verifying at the point of check-in that the account is active, the employer is active, the membership is current, the employer's package is valid and covers the scanned gym, and visits remain; then opening and closing the attendance session.
5. Reconciliation with partner gyms — providing each gym with an anonymised record of the sessions that occurred at its premises, so that usage can be reconciled without disclosing who attended.
6. Reporting to client organisations — providing an employer with usage information for its own staff and its own packages, so that it can manage the benefit it has purchased.
7. Service communication — sending the account invitation, password reset, email verification and essential service notices. These are transactional, not marketing.
8. Support and dispute resolution — investigating and resolving a query about an account, a membership or a specific session, using the session reference for lookup.
9. Security, fraud prevention and integrity — detecting and investigating unauthorised access, credential misuse, duplicate or fraudulent check-ins, and abuse of the service.
10. Legal and regulatory compliance — meeting obligations under the Data Protection and Privacy Act, 2019, tax and accounting law, and lawful requests from a competent authority.
11. Service improvement — understanding aggregate usage patterns and acting on member feedback to improve the platform. Wherever the purpose can be achieved with aggregated or anonymised data, aggregated or anonymised data is used.

Personal data is not processed for: advertising or behavioural targeting; sale, rental or licensing to any third party; sharing with insurers, lenders or employers' other benefit providers except as instructed by the client organisation in writing for its own staff; automated decisions producing legal effects; credit scoring; or any purpose incompatible with those listed above.

9. Lawful basis for processing

Each purpose is supported by a lawful basis under section 7 of the Data Protection and Privacy Act, 2019.

9.1 Where consent is relied upon

Consent is sought only where it is genuinely free — for example, providing an optional telephone number, uploading a profile image, enabling two-factor authentication, or leaving a rating and feedback. Consent is not used as the basis for processing that is necessary to deliver the service, because withholding it would not be a real choice. Where consent is relied upon:

• it is obtained by a clear affirmative act, never by a pre-ticked box or by silence;
• the data subject is told what they are agreeing to before they agree;
• it may be withdrawn at any time, by changing the setting in the application or by contacting the Data Protection Officer, with the same ease as it was given; and
• withdrawal stops future processing on that basis, and the affected data is deleted unless another basis applies. Withdrawal does not affect the lawfulness of processing before withdrawal, and does not affect access to the core service.

9.2 Legitimate interest assessment

Where the Company relies on legitimate interest, it records an assessment identifying the interest, why the processing is necessary to achieve it, and why it does not override the rights of the data subject — together with the safeguard applied. The principal safeguards relied upon are pseudonymisation of member identity in gym-facing views, strict tenant scoping so no client sees another client's data, minimal field collection, and defined retention. The assessments are held by the Data Protection Officer and are available to the PDPO on request.

10. Transparency: how we inform data subjects

Notices are written in plain English. Where a data subject requires the information in another language or in an accessible format, the Data Protection Officer will provide it on request.

11. Rights of data subjects

The Company honours the rights conferred by the Data Protection and Privacy Act, 2019.

11.1 How to exercise a right

A request may be made by email to the Data Protection Officer at info@imaraconcepts.com, by post to the address in the document control table, or through the client organisation's administrator, who will pass it on without delay.

To protect the data subject, the Company must be satisfied of the requester's identity before disclosing or altering data. It will normally verify identity by reference to control of the registered email address, and will ask for further evidence only where doubt remains and only to the minimum extent necessary.

11.2 Timelines and cost

11.3 Limits on erasure

The Company will not delete data where retention is required by law, where it is necessary for the establishment or defence of a legal claim, or where deletion would compromise the integrity of a financial or reconciliation record that another party is entitled to rely upon. In such a case the Company will restrict the data instead of deleting it, explain why, and delete it once the reason lapses.

Data subjects are also informed that a deletion may persist in a database backup until that backup ages out of the retention cycle in Appendix B. Backups are not used for operational purposes, and if a backup is ever restored, deletions are reapplied before the restored data is returned to service.

11.4 Register of requests

The Data Protection Officer maintains a register of all data subject requests recording the date of receipt, the requester, the nature of the request, the action taken, the date of response and the outcome. The register is retained for five years and is available to the Personal Data Protection Office on request.

12. Data minimisation and pseudonymisation in practice

The Company draws particular attention to the following measures, which are implemented in software and protected by automated tests, because they demonstrate the minimisation principle concretely:

1. Partner gyms cannot see who attended. The code that retrieves session data for a gym administrator is prohibited from loading the employee or organisation relationship. The record a gym receives carries only foreign keys and timestamps. This is not a display choice — the identifying data is never fetched.
2. A pseudonymous session reference replaces identity. Gym-facing screens show a short, truncated session reference. It is sufficient for a gym to raise a support query about a specific visit, but it cannot be used to identify the member.
3. The gym data export contains no identity. The CSV export available to a gym administrator writes the session reference as its first column and has no employee column and no organisation column.
4. Each tenant sees only its own data. Organisation-scoped and gym-scoped queries are constrained in code to the caller's own organisation or gym. A valid identifier belonging to another tenant returns nothing.
5. Read-only access is genuinely read-only. The manager role shares the administrative routes but is excluded by middleware from every write route, so it cannot alter personal data.
6. Employees have no web dashboard. Employee accounts are redirected away from all web dashboards to a notice directing them to the mobile application, so the administrative surface is not exposed to them at all.
7. The mobile application does not track location. It requests camera access only, for QR scanning. It does not request, collect or transmit device location.
8. These behaviours are asserted by automated tests that fail the build if the protections are removed, so a future change cannot silently undo them.

13. Security of personal data

The Company secures personal data in accordance with section 20 of the Data Protection and Privacy Act, 2019. Controls are set out in full in the Information Security Policy (IMP-ISP-001), which is submitted alongside this Policy. In summary:

Known limitations and the Company's committed remediation plan are disclosed transparently in Appendix D of the Information Security Policy.

14. Retention and disposal

Personal data is kept only as long as necessary for the purpose for which it was collected, or as required by law. The full schedule is at Appendix B. In outline:

• Active accounts and memberships are retained while the membership is live.
• Employee accounts are retained for 12 months after the last membership expires or the account is deactivated, to allow for re-enrolment and to resolve any dispute, and are then deleted or anonymised — unless the client organisation instructs earlier deletion, or the data subject requests erasure and no other basis applies.
• Session records are retained for 24 months from the session date for reconciliation and dispute resolution, and are then anonymised so that only non-identifying aggregate usage remains.
• Authentication artefacts are short-lived: password reset tokens expire 60 minutes after issue; web sessions expire after 120 minutes of inactivity; API tokens are revoked on sign-out.
• Logs are retained between 90 days and 12 months.
• Backups age out on a 14-day on-server cycle, with longer off-site cycles as recorded in Appendix B.
• Compliance records — the data subject request register, the breach and incident register, consent records and training records — are retained for 5 years.
• Business and accounting records are retained for the statutory period under the Tax Procedures Code Act, 2014.

Automated scheduled jobs support retention: memberships past their package end date are expired daily, and stale attendance sessions are closed hourly. Disposal is by deletion from the production database, with dependent records removed by referential cascade, and by the secure disposal methods in the Information Security Policy. Disposal at the end of a retention period is recorded.

15. Cookies, tracking and analytics

The Company does not use advertising cookies, third-party tracking pixels, cross-site trackers, social media plug-ins, behavioural profiling or advertising identifiers on the web application. Web fonts are self-hosted, so that loading a page does not disclose the visitor's IP address to a font provider.

The mobile application does not contain an advertising or analytics software development kit. It does retrieve typefaces from a third-party font service at runtime, which discloses the device's IP address to that service; this is recorded in the processor register at Appendix F and is under review for replacement with bundled fonts, consistent with the approach already taken on the web application.

16. Automated decision-making and profiling

The Company does not take decisions about individuals based solely on automated processing that produce legal effects or similarly significantly affect them. There is no credit scoring, no eligibility scoring, no risk profiling of individuals and no algorithmic performance assessment.

The platform does apply a deterministic rule check at the moment of check-in, to decide whether a session may start. It verifies only that the account is active, the employer is active, a current membership exists, the employer's package is valid and covers the scanned gym, visits remain, and no session is already open. If the check refuses a session, the reason is stated to the member in plain language, the refusal is recorded with its reason code, and a person may review and override it. The check applies contractual entitlement rules; it does not evaluate, score or profile the individual.

17. Disclosure and cross-border transfer

17.1 Who we disclose personal data to

The Company does not sell personal data, does not disclose it to data brokers, advertisers or insurers, and does not disclose it to any party not listed above without a lawful basis and, where required, the data subject's consent.

17.2 Response to requests from authorities

Requests from law enforcement or other authorities are directed to the Data Protection Officer. Each request is assessed for legal validity, scope and proportionality; only the minimum necessary data is disclosed; the disclosure is logged; and the data subject is informed unless the Company is prohibited by law from doing so. The Company will challenge a request that is overbroad or lacks lawful authority.

17.3 Cross-border transfer

Section 19 of the Data Protection and Privacy Act, 2019 restricts the processing or storage of personal data outside Uganda. The Company will process or store personal data outside Uganda only where the country concerned has in place measures adequate to protect the data at a level at least equivalent to that provided by the Act, or where the data subject has consented, and in either case in accordance with the Regulations.

Current status. The production environment has not yet been commissioned, and the hosting region is not yet finalised. The Company will not process live personal data outside Uganda until the following steps are completed and recorded, and the record will be produced to the Personal Data Protection Office on request:

1. Selection and disclosure of the hosting region. The final region will be recorded in Appendix F and disclosed in this Policy at the next revision, and to data subjects in the privacy notice.
2. Preference for in-region hosting. Where a hosting option within Uganda or the East African region meets the Company's technical and availability requirements, it will be preferred.
3. Transfer impact assessment. Where data will be held outside Uganda, the Data Protection Officer will assess and record the legal framework of the destination country, its adequacy relative to the Act, the risk of access by foreign authorities, and the technical and contractual safeguards applied.
4. Contractual safeguards. The provider agreement will impose the processor obligations in section 18 of this Policy, restrict onward transfer, and require breach notification in time for the Company to meet its 72-hour obligation.
5. Technical safeguards. Encryption in transit, encryption of any backup leaving the primary environment, and strict access control will be in place before live data is loaded.
6. Notification. The privacy notice and this Policy will state the destination country and the safeguard relied upon before live processing begins.

Currently identified prospective transfers, all of which remain subject to the steps above, are recorded in Appendix F.

18. Data processors and sub-processors

The Company engages processors only under a written agreement complying with section 21 of the Data Protection and Privacy Act, 2019, which requires the processor to:

1. process personal data only on the Company's documented instructions and only for the specified purpose;
2. implement appropriate technical and organisational security measures;
3. impose confidentiality obligations on its personnel;
4. obtain the Company's prior written authorisation before engaging a sub-processor, and flow down equivalent obligations;
5. notify the Company of any personal data breach without undue delay, and in time for the Company to notify the Personal Data Protection Office within 72 hours;
6. assist the Company in responding to data subject requests and regulatory enquiries;
7. not transfer personal data outside Uganda except on the Company's written instruction and in accordance with section 19 of the Act;
8. submit to audit or provide equivalent assurance on reasonable request; and
9. delete or return all personal data on termination and certify that it has done so.

Before engagement, the Data Protection Officer conducts and records a due diligence assessment. The processor register is at Appendix F and is reviewed at least annually. Data subjects and client organisations are informed of a change of processor that materially affects the processing.

19. Personal data breach management

The Company's incident response procedure is set out in section 16 of the Information Security Policy. In summary, as it concerns personal data:

1. Any person who becomes aware of an actual or suspected breach must report it immediately to the Data Protection Officer at info@imaraconcepts.com.
2. The Data Protection Officer records the report, contains the incident, preserves evidence and assesses the categories and volume of personal data affected, the number of data subjects, the likely consequences and whether the data was rendered unintelligible.
3. Where there are reasonable grounds to believe that personal data has been accessed or acquired by an unauthorised person, the Data Protection Officer notifies the Personal Data Protection Office within 72 hours of the Company becoming aware of the breach, in accordance with section 23 of the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021. Where full information is not yet available, an initial notification is made within the deadline and supplemented as the investigation proceeds.
4. Affected data subjects are notified without undue delay, in plain language, stating what happened, what data was involved, what the Company has done, what the data subject should do and how to contact the Data Protection Officer.
5. Where the affected data subjects are employees of a client organisation, the Company also notifies that organisation without undue delay so that it can meet its own obligations.
6. Every incident is recorded in the breach and incident register, whether or not it was notifiable, together with the reasoning where a decision was taken not to notify. The register is retained for at least five years and is available to the Personal Data Protection Office on request.
7. A post-incident review is completed within 15 working days of closure, and corrective actions are tracked to completion.

The notification fields the Company will provide are set out at Appendix D.

20. Accountability and governance

20.1 Data Protection Officer

The Company has designated a Data Protection Officer, whose contact details are published in this Policy and in the in-application privacy notice. The Data Protection Officer:

• owns this Policy and the Information Security Policy;
• maintains the record of processing activities, the retention schedule, the processor register, the data subject request register, the consent records, the breach and incident register and the risk register;
• conducts data protection impact assessments and legitimate interest assessments;
• advises the business on data protection by design in new features;
• delivers training and monitors compliance;
• is the point of contact for data subjects, client organisations and the Personal Data Protection Office; and
• reports to the Board at least quarterly, and immediately on a significant incident.

The Data Protection Officer performs this function independently and may not be penalised for performing it.

20.2 Record of processing activities

The record of processing activities is maintained at Appendix A and reviewed at least annually and on any material change.

20.3 Data protection impact assessment

A data protection impact assessment is conducted before: introducing a new category of personal data; introducing a new purpose or a new disclosure recipient; engaging a new processor or changing the hosting location; introducing any location tracking, biometric or automated decision-making capability; or making a change that materially increases the volume, sensitivity or accessibility of personal data. Each assessment identifies the processing, the necessity and proportionality of it, the risks to data subjects, and the measures adopted to address those risks. Where a high residual risk cannot be mitigated, the Company will consult the Personal Data Protection Office before proceeding. Assessments are retained for five years.

20.4 Registration with the Personal Data Protection Office

The Company registers as a data collector, data processor and data controller with the Personal Data Protection Office in accordance with the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021, maintains that registration, renews it as required, and notifies the Office of any change to its registered particulars.

20.5 Training and confidentiality

All personnel sign a confidentiality undertaking before being granted access to personal data, complete data protection induction before privileged access is granted, and complete annual refresher training. Attendance is recorded and retained for five years as evidence of compliance. Training covers this Policy, the principles in section 6, the rights in section 11, breach reporting, and the specific obligations of the Data Protection and Privacy Act, 2019.

20.6 Direct marketing

The Company sends transactional service messages only. It does not send marketing communications to employee members. Where the Company markets to business contacts at client organisations or partner gyms, it does so on an opt-in basis, identifies itself, and includes an unsubscribe mechanism in every message. An objection to direct marketing is honoured immediately and absolutely, and the objection is recorded so that it is not overridden by a later import.

21. Complaints and remedies

21.1 Complaining to the Company

A data subject who is dissatisfied with how the Company has handled their personal data may complain to the Data Protection Officer at info@imaraconcepts.com or by post to the address in the document control table. The Company will:

• acknowledge the complaint within 7 days;
• investigate and respond substantively within 30 days;
• explain its findings, and what it will do; and
• record the complaint and its outcome in the complaints register.

21.2 Complaining to the regulator

A data subject may complain to the Personal Data Protection Office at any time, whether or not they have complained to the Company first.

The Company will cooperate fully with any investigation by the Office and will implement any direction it issues.

21.3 Judicial remedy

Nothing in this Policy limits a data subject's right to seek a remedy in a court of competent jurisdiction, including compensation for damage suffered as a result of a contravention of the Data Protection and Privacy Act, 2019.

22. Review of this Policy

This Policy is reviewed at least once every 12 months by the Data Protection Officer and approved by the Board. An out-of-cycle review is triggered by: a change to the Data Protection and Privacy Act, 2019, its Regulations or guidance issued by the Personal Data Protection Office; a new category of personal data, purpose, recipient or processor; a change in hosting location; a notifiable personal data breach; or a regulatory or audit finding. Each revision is recorded in the revision history. Material changes are communicated to data subjects before they take effect, through the application and by email where appropriate. The current version supersedes all previous versions.

Appendix A — Record of processing activities

Appendix B — Retention schedule

Appendix C — Data subject request handling procedure

Appendix D — Personal data breach notification content

The following information will be provided to the Personal Data Protection Office, so far as it is available, within 72 hours of the Company becoming aware of a breach, and supplemented as the investigation proceeds.

Appendix E — Data flow summary

Appendix F — Register of processors and sub-processors

To be finalised before go-live and reviewed at least annually. The processing location determines the transfer assessment required under section 17.3.

The Company does not use any advertising network, analytics provider, customer data platform, or artificial-intelligence service as a processor of ImaraPass personal data.

Appendix G — Items to be completed before commencement of live processing

End of document — Data Protection and Privacy Policy, IMP-DPP-001, version 1.0.