THE HAMMER

Privacy notice

Effective 18 October 2026

This notice explains how The Hammer handles information in its gym software, including the installed mobile apps and connected website. The service is operated by The Hammer in Malé, Maldives. Contact [email protected] for privacy questions.

Information used by Hammer

• Account information: names, usernames, member or staff identifiers, phone numbers and other profile or contact details provided to the gym. Sign-in uses a password or an SMS verification code, depending on the account.
• Membership and activity: membership plans, expiry dates, attendance, fitness goals and workout records.
• Body composition: InBody results linked to your member profile, including measurements such as weight, muscle and body fat. The gym receives these from its InBody/LookinBody connection or authorised staff entry.
• Transactions and uploads: purchases, renewals, balances, payment details, payment slips and documents you submit. Staff and management can use records available to their assigned role.
• AI and messaging: questions you submit, the account summaries needed to answer them, and messages or workouts you choose to create or request.
• Technical information: sign-in sessions, request times, network information and operational records used to secure and troubleshoot the service.

How the information is used

Hammer uses these records to authenticate accounts, manage gym services and payments, show your activity and progress, answer requested questions, deliver requested messages, and maintain security and service reliability. Members see their own records. Authorised staff and management have access according to their role.

AI and service providers

When you ask Hammer AI, your question and a relevant account summary are sent to OpenAI. The member summary excludes names, phone numbers and uploaded documents. Avoid entering unnecessary personal information in a question. InBody measurements are included in a member AI question only when you select the InBody option or use the “Send latest results to AI” shortcut. The shortcut prepares the results and question; it does not send a request until you agree to AI data use and ask. AI guidance can be mistaken and is not a medical diagnosis. An authorised owner may explicitly attach a PDF or image InBody report for an explanation. The selected file and question are sent to OpenAI only after the owner confirms permission to share it. These uploads are not part of the automatic gym summary, are not retained as report files by Hammer, and do not add or change a member’s official InBody history. The app uses a temporary device copy while selecting and sending a file; it removes its own copy when the result is sent, removed, or the owner workspace closes. Unneeded names and contact details should be removed before sharing.

The native app saves requested answers and workouts in encrypted storage scoped to your signed-in account on your device. Ordinary chat text is not automatically retained on Hammer’s server. Requested text messages and generated workouts are saved for delivery and later viewing; usage and selected InBody-sharing attempts are recorded. OpenAI processes requests under its privacy policy and applicable service terms.

Hosting, SMS delivery and InBody/LookinBody services process information needed to provide their respective functions. This can involve processing outside the Maldives. No InBody API credential is included in the mobile app.

Cookies and website analytics

Hammer uses first-party session and security cookies to keep you signed in and protect requests. The public website uses Google Analytics to understand visits. That analytics script is excluded from the native app and from signed-in member, staff and owner pages. You can manage website cookies in your browser. The app does not request access to Apple Health, your address book or your device location.

Delete your online account and app data

In the Hammer app, open All features, Your account, then Request account deletion. Confirm the request while signed in to your own account. Hammer completes deletion within 30 days and confirms the outcome. You can also request deletion without installing the app by emailing [email protected]; include your Hammer mobile number so reception can verify your identity. Do not send passwords, sign-in codes or card details.

Deletion removes your online account credentials and personal app workout records, saved plans, uploaded workout documents and online InBody copies. Saved app data on the requesting device is cleared when you submit the request. Other devices remove the account’s saved data when they connect and receive the deletion confirmation; remove the app or clear its saved account data if a device stays offline.

Your already-paid gym membership and face access continue until expiry under the existing access rules. The physical gym identity and access records needed to provide that paid service remain separate from the deleted online workspace. Payment, invoice and tax records required for accounting are retained; GST records must generally remain for five years from the end of the relevant taxable period, and longer where required by an ongoing legal obligation. MIRA’s record-retention requirement. These retained records are not used to restore your deleted app workspace.

Retention and your choices

Physical gym and required accounting records are retained for the service and obligations described above. Online app data follows the deletion process above. Technical records and backups may also contain account information. To request a copy, correction, account closure or deletion, email [email protected] or contact reception. We will verify your identity before changing or releasing account information. Some records may need to remain for accounting, security or other applicable obligations; we will explain any limits that apply to your request.

You can sign out of the app, choose whether to include InBody results in an AI question, and manage available text/workout preferences in your account. Removing the app from your device does not remove records held by the gym.

Updates

Changes to this notice will be published here with an updated effective date.

Restricted recovery backups may retain older copies until their normal replacement. Deleted online accounts are marked in the recovery procedure, and those copies are not used to restore an online account. Access to retained paid-service, legal and recovery records is limited to authorised staff. Hammer checks associated private source files before confirming completion.