Flexbook App Privacy Policy

Effective date: 18/03/2026 

Introduction 

• Flexbook is a service provided by Vigyr (ABN 46 276 349 233) (“Vigyr”, “we”, “us”). We supply the Flexbook mobile application (“App”) to gyms and health clubs (“Clubs”) to help them manage member bookings. 

• This Policy explains how personal information is handled under the Australian Privacy Act 1988 (Cth) and, where applicable, the EU/UK GDPR. 

• Because we provide the App to Clubs, each Club remains the data controller for its members. Vigyr acts as the processor/service provider. 

• Contact: admin@vigyr.com for service questions; contact your Club for access/correction requests.

Roles & Responsibilities 

• Clubs (Controllers): decide what member data is entered, dictate retention requirements, and respond to member privacy requests. 

• Vigyr (Processor): hosts the platform, processes data only per Club instructions, and supports Clubs with privacy requests. 

• Where Vigyr must act as a controller (e.g., account security logs), we meet all controller obligations. 

Data We Collect 

• Member profile data supplied by the Club: name, email, phone, address, date of birth, gender, membership identifiers. 

• Images uploaded for profiles. 

• Booking details: selected classes/creche sessions, waitlist status, attendance history, optional notes. 

• Device and usage diagnostics (app version, device model, error logs). No cookies or telemetry analytics are implemented in the current version of the App. 

• Creche profiles (Club-created, fields limited to child first/last name, date of birth, gender, relationship to the member, and additional comments). 

• System logs and security data (timestamps, IP-derived region). 

• We do not collect or store payment card numbers, CVVs, or banking credentials. 

How & Why We Use Data
Processing is limited to:  

• Authenticating members and presenting schedules/bookings per Club contract (legal basis: performance of contract with the Club). 

• Managing bookings, waitlists, passes, and notifications (contract/legitimate interest). 

• Providing support, diagnostics, fraud prevention, and service improvements (legitimate interest). 

• Meeting legal obligations (e.g., responding to lawful requests).
  Any optional marketing communications are controlled by the Club; members can opt out via the Club. 

Children and Creche Information 

• Child profiles are created by Clubs with parental consent. Mandatory fields: first name, last name, date of birth. Optional fields: gender, relationship to the member (parent/guardian/caregiver), additional comments relevant to care. 

• Data is used solely to manage creche bookings, ensure child safety, and communicate with the parent/guardian. 

• Parents/guardians may access, correct, or request deletion via their Club at any time. 

Payments 

• All payments are processed by Debit First via CyberSource (PCI DSS–compliant). Members enter card details directly with the processor. 

• CyberSource tokenises transactions immediately; neither Vigyr nor the processor stores full card numbers or CVVs. Vigyr receives only transaction tokens and status information to apply bookings and issue receipts. 

Data Storage, Security & Retention 

• All App data is stored on Vigyr-managed infrastructure located in Australia. We do not transfer data outside Australia. 

• Safeguards include encrypted databases, TLS for data in transit, strict access controls, monitoring, and incident-response procedures. 

• We retain member data while the Club’s contract is active and delete it within 30 days of contract termination unless the law requires otherwise. Creche records follow the same schedule. Data may also be deleted earlier if needed for a valid legal directive. 

Sub-processors 

• We engage Australian-based infrastructure, messaging, and support providers under written agreements that mirror our privacy obligations. A current list is available on request from  admin@vigyr.com. No sub-processors store data overseas. 

Your Rights 

• Members can request access, correction, restriction, portability, or deletion of their personal data by contacting their Club. Vigyr will support the Club in fulfilling these requests. 

• To report a concern or lodge a complaint, contact  admin@vigyr.com. We’ll investigate promptly and respond in writing. You may also contact the OAIC (Australia) or your local privacy regulator. 

Choices & Consent 

• Using the App is optional; choosing to use it constitutes consent for the Club and Vigyr to process your data as described. Individuals under 16 must have parental/guardian consent obtained by the Club. 

• Members may restrict certain uses (e.g., marketing) by instructing their Club. Limiting processing may affect App functionality. 

Data Sharing & Legal Disclosures

• We only share data with authorised Club staff, approved sub-processors, and authorities when legally required. We never sell personal data. 

Cookies & Tracking

• The Flexbook App currently does not deploy cookies or third-party telemetry/analytics frameworks. Device-level diagnostics are limited to essential crash/error logs required to maintain the service. 

Policy Updates

• We may update this Policy to reflect service changes or legal requirements. Clubs will be notified by email and/or in-app notice at least 14 days before the change takes effect. Continued use after the effective date means the updated Policy applies. 

For any App privacy-related queries, email admin@vigyr.com. For access or corrections to your data, please contact your Club directly.