Hubu is built on the principle that your wellness data belongs to you. This policy explains what we collect, why, who we share it with, and the rights you have under Kenya’s Data Protection Act, 2019. It applies to the Hubu app and all services operated by GConnect Wellness Limited.
Hubu is operated by GConnect Wellness Limited, a company registered in Kenya ("Hubu", "we", "us"). We are the data controller for the personal information described in this policy. For any privacy matter, contact us at info@hubu.africa.
| Data | Why we collect it |
|---|---|
| Account details (name, email, phone, city) | To create and secure your account and communicate with you about your bookings and account |
| Profile details (photo, wellness goals, fitness level) | To personalise your experience; all optional |
| Health and wellness data (daily check-ins, hydration and movement, meal logs, body measurements, health check results) | To power the wellness features you choose to use. Collected only with your explicit consent, per feature |
| Booking details (sessions, classes, times, professionals) | To operate the marketplace and keep a record of your sessions |
| Payment details (M-Pesa phone number, transaction references) | To process payments when M-Pesa payments are live. We never see or store your M-Pesa PIN |
| Messages (session chats, friend messages) | To deliver private messaging between you and your trainer or friends. Message content is visible only to the participants |
| Technical data (device type, app version, error reports) | To keep the app working and fix problems. Our analytics are privacy-first and do not track you across other apps or sites |
Health information is sensitive personal data under Kenya’s Data Protection Act, 2019. We ask for your explicit consent before collecting it, feature by feature, and you can withdraw that consent at any time in the app. We collect the minimum needed for the feature you are using.
We do not sell your personal data. Ever.
Our infrastructure providers may store data on servers outside Kenya. Where that happens, we rely on the safeguards provided for under the Data Protection Act, 2019, including contractual protections with our providers.
We keep your data while your account is active. You can delete your account at any time from the app (Profile, then Settings, then Delete account). When you do, your personal and health data is erased. If you have booking history, the booking and payment records themselves are kept in anonymised form, as we are required to keep financial records, but they no longer identify you.
Under the Data Protection Act, 2019, you have the right to access the data we hold about you, to have it corrected or deleted, to object to or restrict its processing, and to receive a copy of it. To exercise any of these rights, email info@hubu.africa. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.
Your data is encrypted in transit, access inside our team is restricted to what each role strictly needs, and sensitive documents are stored in private storage that is never publicly accessible. No system is perfectly secure, but security is a first-class requirement in how Hubu is built and reviewed.
Hubu is for people aged 18 and over. We do not knowingly collect data from anyone under 18.
If we make material changes, we will tell you in the app or by email. The date of the most recent update is shown at the bottom of this page.
For any privacy question, request or complaint, contact us at info@hubu.africa. We take privacy seriously and respond to all enquiries promptly.