This document sets out the privacy policy of Recovr Pty Ltd ABN 33 648 288 760 (referred to in this privacy policy as 'we', 'us', or 'our').
We take our privacy obligations seriously and we've created this privacy policy to explain how we store, maintain, use and disclose personal information.
By providing personal information to us, you consent to our storage, maintenance, use and disclosing of personal information in accordance with this privacy policy.
We may change this privacy policy from time to time by posting an updated copy on our website and we encourage you to check our website regularly to ensure that you are aware of our most current privacy policy.
Recovr provides software-as-a-service (SaaS) to gyms, fitness studios, and similar businesses ("Customers") to help them manage client retention and engagement.
This privacy policy applies to:
When we process personal information about gym members on behalf of our Customers, we do so as a service provider acting on their instructions. Our Customers remain responsible for ensuring they have appropriate consent and legal basis to collect and process their members' personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
The personal information we collect may include the following:
We do not store payment card numbers. Card payments are processed by our payment providers, Stripe and Outseta, depending on the Customer's billing arrangement, and card credentials are held by them rather than by us. Where a Customer's booking platform sends us their membership records, those records can include the last four digits of a card, which we store as part of the membership record.
We may collect personal information either directly from you, or from third parties, including where you:
We may also collect personal information from you when you use or access our website or our social media pages. This may be done through use of web analytics tools, 'cookies' or other similar tracking technologies that allow us to track and analyse your website usage. Cookies are small files that store information on your computer, mobile phone or other device and enable and allow the creator of the cookie to identify when you visit different websites. If you do not wish information to be stored as a cookie, you can disable cookies in your web browser.
We may use Google Analytics to collect and process data, including when you use third party websites or apps. To find out more see How Google uses data when you use our partners' sites or apps.
We collect and use personal information for the following purposes:
We use artificial intelligence (AI) technology to assist our Customers in analysing member retention patterns and generating engagement recommendations.
Our AI systems may process:
Our automated background analysis (retention scoring, message classification and engagement suggestions) is not given the following as data fields:
Message and note text is analysed as written, so it can include details a member or staff member typed into it. When a staff member uses an assistant we operate, such as Ask Recovr, the assistant can retrieve the member details that staff member can already see in Recovr, including contact details and billing history, to answer their request.
Our AI capabilities are provided by third-party services including Anthropic, OpenAI, Google AI, and xAI, located in the United States and Singapore. These providers operate under their respective enterprise service agreements.
We do not permit these providers to use personal information processed through our platform for training their AI models.
A Customer can choose to connect Recovr to an AI assistant it uses, such as Claude (provided by Anthropic) or ChatGPT and Codex (provided by OpenAI), through the Recovr MCP server or the Recovr plugin. To connect, the Customer’s authorised staff member signs in with their Recovr account, chooses the location the assistant may access and approves the permissions shown on the consent screen, or creates an API key for that location. No member information is shared with the assistant before this is done.
When a staff member uses the connected assistant, Recovr returns the information needed to answer their request to the assistant’s provider. Depending on the request, this can include member names, contact details (email addresses and phone numbers), dates of birth, attendance, membership, package and billing history, staff notes, retention scores and message history for that location. Anything the staff member types into the assistant is handled by the assistant’s provider, not by Recovr.
The Customer chooses the assistant and directs Recovr to share this information with it. The assistant’s provider receives it at the Customer’s direction and handles it under the provider’s own terms with the Customer, not under Recovr’s agreements with the AI service providers we engage. Our commitment above that providers do not train on personal information applies only to the providers we engage directly. Whether a connected assistant’s provider keeps or trains on the information depends on the Customer’s plan and settings with that provider.
Recovr enforces the location and permissions the staff member approved on every request. Sending a message to a member is marked to the assistant as an action that cannot be undone, so that the assistant asks the staff member first; whether that prompt is shown depends on the assistant. Bulk messaging is not available through the connection.
Recovr does not keep a separate copy of the information it returns to a connected assistant. Records of assistant requests, which we keep for security and troubleshooting, are deleted after 30 days.
A Customer can disconnect an assistant or revoke an API key at any time by contacting support@recovr.com, or from Account → MCP in the Recovr app where it is available to them. More information is available at https://retention.recovr.com/mcp.
By default, AI-generated content (such as suggested messages) requires review and approval by our Customer's staff before being sent. Customers may adjust this setting based on their operational requirements.
We engage third-party service providers to help deliver our services. These providers may have access to personal information as necessary to perform their functions.
A list of our current service providers is available at: https://retention.recovr.com/subprocessors
Data processing agreements with our service providers are available on request.
Where you provide your mobile phone number and consent to receive text messages from a gym or fitness studio that uses the Recovr platform, that number and your SMS opt-in consent are used solely to operate the messaging program (for example, class and appointment reminders, membership follow-ups, and replies to your conversations with your gym).
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with, or sold to, any third party. Message frequency varies, and message and data rates may apply. You can opt out at any time by replying STOP, and get assistance by replying HELP or contacting support@recovr.com. Details of how consent is collected are published at https://retention.recovr.com/sms-opt-in/index.html.
We may disclose personal information to service providers located outside Australia, primarily in:
Before disclosing personal information overseas, we take reasonable steps to ensure the overseas recipient handles the information in accordance with the Australian Privacy Principles, or is subject to a law or binding scheme substantially similar to the Privacy Act 1988 (Cth).
Details of our overseas service providers are available at: https://retention.recovr.com/subprocessors
Where a Customer connects a third-party AI assistant (see Connected AI Assistants above), the assistant’s provider, currently located in the United States, receives member information at the Customer’s direction, and the Customer is responsible for that disclosure.
We do not collect medical records, clinical or fitness-assessment results or biometric data, and we do not require health information in order to provide our services. We do not provide medical or health advice and we do not refer anyone to a medical or health service provider.
Health-related information can still reach us in several ways. In each case we hold it as a service provider, on the Customer's instructions, and use or disclose it only to provide our services to that Customer or to comply with our legal obligations:
Where a Customer connects an AI assistant (see Connected AI Assistants above), that assistant can read the member records the gym holds in Recovr. That includes notes recorded against a member, whether written by staff or imported from the booking platform (including medical alerts), the member's messages, activity-timeline entries such as a summary of a form they submitted, and the answers stored against their record as custom fields. Any of these may mention an injury or a health concern, so a Customer should treat connecting an assistant as disclosing their members' records to that assistant's provider.
A member's retention score (also shown as a health score) measures engagement with the gym, not health. It is calculated from how often and how recently they attend, the trend in their attendance, how they are using their package, how long they have been a member and how regularly they attend, plus any manual adjustment the gym's staff apply. It is not derived from medical, clinical, fitness-assessment, injury or biometric data, and it is not health information.
If we hold sensitive information for any other reason, we will only collect it with your consent, and we may use or disclose it to comply with our legal obligations.
We take reasonable steps to ensure your personal information is secure and protected from misuse or unauthorised access. Our information technology systems are password protected, and we use a range of administrative and technical measures to protect these systems, including:
However, we cannot guarantee the security of your personal information.
We retain personal information for as long as reasonably necessary to:
When a Customer terminates their subscription, or closes their account, we retain the data in a closed state so it can be restored if they return. Closing an account is not by itself an erasure. We will delete or de-identify end user data within 90 days of a deletion request from the Customer, unless we are required to retain it by law.
Our platform uses automated systems to calculate retention scores and engagement assessments for gym members. These assessments help our Customers identify members who may benefit from additional engagement.
These automated assessments inform our Customers' decision-making. Our Customers are responsible for how they act on these insights in their interactions with their members.
In the event of an eligible data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required under Part IIIC of the Privacy Act 1988 (Cth) (Notifiable Data Breaches scheme).
Our website may contain links to other websites. Those links are provided for convenience and may not remain current or be maintained. We are not responsible for the privacy practices of those linked websites and we suggest you review the privacy policies of those websites before using them.
If you wish to request access to the personal information we hold about you, please contact us using the contact details set out below including your name and contact details. We may need to verify your identity before providing you with your personal information. In some cases, we may be unable to provide you with access to all your personal information and where this occurs, we will explain why. We will respond to all requests for access to personal information within 30 days.
If you think that any personal information we hold about you is inaccurate, please contact us using the contact details set out below and we will take reasonable steps to ensure that it is corrected.
If you are a member of a gym that uses our services and wish to access, correct, or request deletion of your personal information, please contact your gym directly. As a service provider, we process this information on behalf of the gym, who is responsible for responding to your request.
If you wish to complain about how we handle your personal information held by us, please contact us using the details set out below including your name and contact details. We will investigate your complaint promptly and respond to you within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of
the Australian Information Commissioner:
Website: www.oaic.gov.au
Phone: 1300 363 992
For further information about our privacy policy or practices, or to access or correct your personal information, or make a complaint, please contact us using the details set out below:
Privacy Officer
Recovr Pty Ltd
Adelaide, South Australia
Privacy enquiries: privacy@recovr.com
Customer support: support@recovr.com
Website: https://retention.recovr.com