Privacy Policy.
Effective 3 October 2026This policy explains how RETUAL SDN. BHD. (202601037782 / 1699877-D) ("we", "us") collects, uses and protects personal data when you use the ReTUAL mobile app and the retual.my website. We process personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA).
1. Information we collect
- Account details: your name and email address.
- Profile details: age, gender, weight and height, used to calculate your personal heart-rate zones.
- Health and fitness data: with your permission, we read heart rate, resting heart rate, workouts and daily steps from Apple Health (iOS) or Google Health (Android). Access is read-only. We never write data to your health records.
- Location data: if you allow it, your approximate location is used to show activities and partner businesses near you. We do not track your routes or collect location in the background.
- Rewards activity: your weekly progress, the vouchers you claim and when you redeem them.
- Device and usage data: device model, operating system, app version, crash reports and basic in-app usage, used to keep the app reliable.
2. How we use it
- To calculate your elevated heart-rate minutes and weekly progress.
- To issue, track and verify vouchers you earn.
- To show activities and events near you.
- To provide support, send service messages and keep accounts secure.
- To fix problems and improve the app, using aggregated or de-identified data where possible.
We do not use health data for advertising or marketing, and we do not sell personal data.
3. Data sharing
We share personal data only in these cases:
- Reward partners: when you redeem a voucher, the partner receives only the voucher code needed to honour it. Partners never receive your health data.
- Service providers: companies that host our servers or provide crash reporting, under contracts that require them to protect your data and use it only on our instructions.
- Legal reasons: where required by Malaysian law or a valid request from authorities.
Health data from Apple Health or Google Health is never shared with third parties for advertising, marketing or data brokering.
4. Data retention
We keep your data while your account is active. If you delete your account, we delete your personal and health data within 30 days, except records we must keep by law, such as voucher redemption records needed to resolve disputes, which are kept no longer than necessary.
5. Your rights
- Access the personal data we hold about you, and ask us to correct it.
- Withdraw consent at any time, including turning off health or location access in your device settings.
- Delete your account and data from the Profile screen in the app, or by emailing us.
- Limit how we process your data, including opting out of non-essential messages.
To make a request, email hello@retual.my. We respond within 21 days.
6. Security
Data is encrypted in transit and at rest, and access is limited to staff who need it to run the service.
7. Children's privacy
ReTUAL is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
8. Changes to this policy
We may update this policy from time to time. We'll post the new version on this page with a new effective date, and notify you in the app before material changes take effect.