Privacy Policy
Last updated: July 2026
1. Introduction
Heidi YogaFit ("we", "us", "our") operates a yoga and movement studio in Hong Kong, serving clients online and at various studio locations across Hong Kong. This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data when you visit our website (heidiyogafit.com), book our services, communicate with us via email, phone, or WhatsApp, or interact with us in any other way. We are committed to complying with the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") of Hong Kong and the six Data Protection Principles set out therein.
2. Data controller
The data controller is Heidi YogaFit, based in Hong Kong. For privacy enquiries, contact us at Heidiwong520@gmail.com.
3. Personal data we collect
We may collect the following categories of personal data: (a) Identity & contact: full name, email address, telephone number, preferred contact method (email, phone, or WhatsApp); (b) Booking information: preferred date, time, service type, session mode (online or face-to-face), studio location preference, and any notes you voluntarily provide about your health or goals; (c) Marketing preferences: whether you consent to receive wellness updates; (d) Technical data: IP address, browser type, device information, and pages visited when you use our website; (e) Communications: records of correspondence with us. We do not knowingly collect data from persons under 16 without parental consent.
4. How we use your data
We use your personal data to: process and manage bookings; send confirmations, reminders, and service updates; respond to enquiries; improve our classes and website; comply with legal obligations; and, only with your consent, send wellness-related updates.
5. Legal basis & PDPO principles
We collect data only for lawful purposes directly related to our functions. Data collected shall be adequate but not excessive. We take practicable steps to ensure accuracy and security, and retain data only for as long as necessary.
6. Disclosure to third parties
We may share data with trusted service providers who assist our operations (e.g. cloud hosting via Supabase, transactional email via Resend, analytics). These providers process data on our instructions and must protect it appropriately. We do not sell your personal data.
7. Data retention
Booking records are retained for as long as needed to provide services, handle disputes, and meet legal or accounting requirements, after which they are securely deleted or anonymised.
8. Security
We use industry-standard measures including encrypted connections (HTTPS) and secure cloud infrastructure. No method of transmission over the internet is 100% secure, but we take reasonable steps to protect your data.
9. Your rights under the PDPO
You have the right to: request access to your personal data; request correction of inaccurate data; request deletion where applicable; withdraw marketing consent; and lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD). Contact us at Heidiwong520@gmail.com to exercise these rights.
10. Cookies & analytics
Our website uses essential cookies for basic functionality (e.g. language preference). We may use privacy-conscious analytics to understand site usage. You can control cookies through your browser settings.
11. Direct marketing
We will only send promotional messages if you have given explicit consent. You may opt out at any time by contacting us or using the unsubscribe method provided.
12. Policy updates
We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last updated" date at the top of this page will reflect any changes. Material changes may also be communicated via email or a notice on our website. Continued use of our services after updates constitutes acceptance of the revised policy.
13. Contact us
For privacy-related enquiries, data access requests, correction requests, or complaints, please contact us at Heidiwong520@gmail.com. We aim to respond within 14 business days. You may also contact the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong if you are unsatisfied with our response.