Privacy Policy

App: Glow Zone

Last updated: 20 October 2026

Glow Zone shows existing eligible customers their tanning minute balance and activity, and supports related customer service. Reception staff use R12 Club tools for Glow Zone operations.

Information used

• R12 account/contact details and authentication identifiers where an account is linked.
• Age or eligibility status and age-check outcome. Staff tools can record a customer's date of birth and age-check details; identity documents should not be retained unless an approved process requires it.
• Tanning session dates, minutes used, remaining/expiring minutes, package or service purchases, refunds and payment references.
• Induction or safety acknowledgements, relevant safety notes, support/security records and staff actions in the operational system.

What it is used for

• Link an existing customer account and display the correct balance and activity.
• Check and record eligibility and required safety or induction steps.
• Record tanning use and administer minute balances, sales, refunds and disputes.
• Protect customers and staff and meet applicable financial and safety duties.

Who decides how information is used

The legal controller depends on who provides the service and decides why the relevant records are used. For gym membership, staff, attendance, induction and safety records, ask the gym or organisation that enrolled you or gave you access. For coaching records, ask the coach or organisation that arranged the coaching. For Glow Zone records, the verified website information identifies Madhouse Products and Services Limited as Glow Zone's legal operator; that fact alone does not determine its controller or processor role for each R12 activity. For Club and Glow Zone, the relevant controller and its contact details must be confirmed by the organisations providing those services.

For access, correction, erasure, objection, restriction, portability or other privacy requests, use the account-deletion route where appropriate and contact the organisation responsible for the relevant service using its published contact details. A verified general privacy contact for every R12 service still needs to be confirmed before publication.

Purposes and lawful bases

Potential Article 6 bases for this app, pending confirmation by the relevant controller: Contract for requested Glow Zone sessions, packages and account functions; legitimate interests for proportionate eligibility controls, safety administration and fraud prevention; legal obligation only for records required by applicable financial or safety law. The controller must confirm and document the basis for each purpose before collecting or using information. Code and product requirements do not establish that legal decision. Consent applies only to a genuinely optional purpose where it is freely given and can be withdrawn. Do not treat a software feature or payment setup as proof of a lawful basis.

Safety notes may reveal health information. The controller must identify an Article 9 condition before recording or using such information. Age and session information is not automatically special-category health data.

Glow Zone balances, transactions and operation

The customer app reads the existing Glow Zone customer link, minute balance and activity. Staff operations record eligibility/age checks, sales and minute deductions, with transaction and audit history. It does not create a gym membership or gym access entitlement. The source identifies Stripe as the configured products/services merchant for relevant purchases, but does not verify that every Glow Zone purchase is currently enabled. Glow Zone's public website identifies Madhouse Products and Services Limited (company number 17383213) as the legal operator. Its role as controller or processor for each R12 app activity still requires confirmation.

Service providers and sharing

The application code uses Supabase for authentication and database services and is configured for Vercel hosting. WHOOP receives an authorisation request only if you connect that integration. Stripe, GoCardless or PayPal receives transaction information only for the relevant configured flow. Authorised gym staff, coaches or organisation administrators can access records within their assigned roles. The repository does not include executed processor agreements, the deployed vendor configuration, data-location settings or international-transfer safeguards. The responsible controller must confirm its providers, their legal roles and any transfer safeguards before this notice is published.

Retention

Records are needed while an account, membership, coaching relationship or service is active. After it ends or a deletion request is made, the responsible controller should delete or de-identify records when they are no longer needed, except records retained for a specific legal duty, unresolved payment/refund, safety matter, dispute, fraud prevention or audit. Payment and accounting evidence should be kept only for the applicable statutory period. Training, WHOOP, coaching notes, staff audit trails, age-check evidence and session/minute histories should be reviewed against the purpose and deleted when that purpose ends, subject to a documented need to retain them. The repository contains no approved durations or retention schedule; the controller must set and publish record-specific periods or criteria before launch.

Account deletion and other rights

R12 provides an authenticated account-deletion request from Account settings and at the account-deletion page. Deleting the shared R12 account may affect access to every connected R12 application. If you have a linked gym membership, recurring payment agreement, coaching agreement or other service, account deletion does not automatically cancel it; cancellation is handled separately by the organisation or provider responsible for that service. Requests are reviewed before eligible personal data and the account identity are deleted or anonymised. Records required for a documented legal, financial, safety or audit purpose may be retained with restricted access.

Under UK data-protection law, rights may include access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. You may withdraw consent where consent is the basis, without affecting earlier lawful processing. Rights depend on the purpose and legal basis. Ask the relevant controller using the contact on your service documents; the controller may verify your identity and must respond within the statutory period. You may complain to the Information Commissioner's Office.

Security

The code implements authenticated accounts, organisation-scoped access, role/capability checks, row-level security in the database schema and server-side handling of integration credentials. Access to operational records is permission-controlled and some staff actions are audited. This describes safeguards present in source; the repository does not verify production configuration, vendor contracts or that each migration has been applied. No online service can guarantee absolute security.

Privacy contact

For Glow Zone privacy enquiries, the Glow Zone website identifies contact@madhousegym.online as its confirmed shared privacy contact for Madhouse Products and Services Limited and Madhouse Franchise Limited. The controller's role for each R12 processing activity must still be confirmed.

Children and wellbeing

Glow Zone sunbed services are restricted to people aged 18 or over and include age/eligibility checks. Gym and coaching age rules depend on the relevant organisation. R12 training and coaching features are not medical advice and are not medical devices.

R12 Training policy · R12 Club policy · R12 Coach policy · Glow Zone policy · Terms of Use