Data Processing Addendum

For a venue's client personal data captured through Wellnuts (client contacts, bookings, notes), the venue is the controller and Wellnuts is the processor, acting only on the venue's documented instructions — which include the venue's use of the platform's features.

For Wellnuts's own account and platform data (for example the accounts customers create in the Wellnuts app), Wellnuts is the controller; see our Privacy Policy.

Subject-matter and duration: provision of the Wellnuts booking, payments and client-management platform for as long as the venue's contract runs, plus the return and deletion period in section 8.

Data subjects: the venue's clients and leads, and its staff users.

Categories of data: identity and contact details, booking and attendance history, packages and memberships, payment status, notes and tags the venue records, and marketing-consent status.

Health and safety alerts: venues can record a structured client alert (injury, pregnancy, allergy, medical, other) so reception and practitioners see safety-relevant facts at check-in. Every alert requires the staff member to confirm the client agreed to it being stored; Wellnuts records who confirmed and when, keeps alerts out of segments, offers and exports, and never shows them to platform staff or to other venues. The venue must not record other sensitive data.

Wellnuts will: (a) process client data only on the venue's instructions and to run the platform; (b) keep it confidential and ensure everyone with access is bound by confidentiality; (c) apply appropriate technical and organisational security — encryption in transit and at rest, role-based access, database row-level security and audit logs; (d) help the venue answer data-subject requests within 5 working days of being asked; (e) notify the venue within 24 hours of becoming aware of a personal-data breach affecting its clients, with the information it needs for its 72-hour notification to the Personal Data Protection Centre; (f) assist with impact assessments and regulator enquiries.

The venue authorises Wellnuts to use these sub-processors: Supabase (database, authentication and hosting — European Union), Vercel (application hosting), Cloudflare (storage and email routing), Paymob (card payments — Egypt), Resend (email delivery), Expo, Apple and Google (push notifications) and Sentry (error monitoring).

Wellnuts imposes equivalent data-protection obligations on its sub-processors, remains responsible for them, and gives venues at least 30 days' notice of a new sub-processor; a venue that objects on reasonable data-protection grounds may end its contract before the change takes effect.

Some sub-processors operate outside Egypt. Wellnuts transfers client data abroad only under the safeguards permitted by the PDPL and its Executive Regulations and, where required, under a cross-border transfer licence from the Personal Data Protection Centre.

The venue must have a lawful basis for the client data it collects; give its clients a privacy notice; obtain any required consents, including for marketing it sends and for health alerts; not instruct Wellnuts to act unlawfully; and hold its own registrations or licences with the Personal Data Protection Centre where they apply.

Wellnuts makes available the information reasonably needed to show compliance with this addendum. A venue may audit once a year, on 30 days' written notice, during working hours and subject to confidentiality; further audits are possible after a breach or at a regulator's request.

For 30 days after the contract ends the venue can ask us for a full export of its client data (CSV), which we provide within 10 working days. Wellnuts then deletes the venue's client data within a further 30 days, except records the law requires to be kept (such as payment and tax records), which are kept only for the legal period.

If this addendum conflicts with the Terms or the venue's contract on data-protection matters, this addendum prevails for the processing it covers.