Privacy notice

What this website collects

We collect information you supply when you submit a form, together with limited request context automatically attached to that submission, such as the submitted page, referrer, campaign source or inquiry reference where applicable. Selections on this website’s demonstration body map are not sent to us until you choose to submit a request. This does not apply to recorded recovery information in the mobile app.

Guided trial request

• Your name and your contact detail (phone number or email — whichever you give us)
• Your preferred location or area
• The sport, body areas, movement phase and training settings you selected on the body map
• The page you submitted from

Corporate enquiry

• Contact name, work email and phone number
• Company location and timeline
• Any notes you add

International product-and-business walkthrough

• Your full name, business email and phone or WhatsApp number
• Your company or business name, country and business type
• Your optional website or social profile
• Your preferred day, preferred time window and time zone
• Your optional commercial pathway, main question and preferred contact channel
• The non-sensitive inquiry reference, submitted page, referrer and campaign source associated with the request

Telegram

If you continue a conversation with our Telegram bot, Telegram gives us your Telegram display name and chat ID so we can link the conversation to your request. We do not receive your phone number from Telegram.

Analytics

We use Google Analytics to count visits and understand fixed interaction and funnel categories, such as demonstration engagement, proof-section engagement, business-fit selection and form status. Analytics never receives names, email addresses, phone numbers, company names, websites, countries, preferred schedules, free-text questions or inquiry references.

Google Analytics uses cookies to measure visits across browsing sessions, subject to your browser settings.

Enquiry source and outcomes

During your browsing session, we keep the first landing page and latest attributable source using a public page path, referring domain and limited campaign labels. This uses session storage for up to 24 hours and is attached when you submit an enquiry. Query strings, search terms and contact details are excluded from this source record. A short-lived receipt helps prevent repeat submissions and duplicate event counts.

Authorised HQ staff can link an enquiry to a confirmed booking or partner qualification to understand which sources bring useful enquiries. Form submissions and contact-link clicks are not counted as confirmed bookings.

Why we collect it

• To reply to your trial or corporate request and arrange a session
• To respond to and qualify your request for a private product-and-business walkthrough
• To confirm your preferred walkthrough time manually through a NUSBE representative
• To prepare a tailored discussion covering the proposed model, documentation, logistics and support
• To prepare the recovery summary you asked for
• To keep a record of who consented to be contacted
• To understand which content is useful, in aggregate

We do not sell your data, and we do not send marketing to people who did not ask for it. Giving us your details is voluntary — but without a contact detail we cannot reply to you.

Who it is shared with

Your data is stored and processed by these service providers on our behalf:

• Supabase — the database that stores your request
• Telegram — if you choose to continue in Telegram
• Cloudflare — hosting and delivery of this website
• Google Analytics — aggregate website statistics

Some of these providers store data on servers outside Malaysia. We do not disclose your personal data to anyone else except where the law requires it.

How long we keep it

We keep enquiry records for as long as needed to serve you and to meet our record-keeping obligations, and we remove them when they are no longer needed for those purposes.

Your rights

You may ask us to show you the personal data we hold about you, to correct anything inaccurate, to stop contacting you, or to delete your record. Email [email protected] or message us on Telegram at @CognicareMY_bot and say what you would like us to do. We may need to confirm who you are before we act on the request.

Health information

The areas you tag on this website’s demonstration body map are preferences for a wellness session, not a medical record. This website statement does not describe the recovery measurements stored in your app Passport. NUSBE does not diagnose or treat any condition. Please do not send us clinical records or medical history through this website.

NUSBE mobile app

NUSBE SDN. BHD. operates NUSBE. The NUSBE app helps you discover and book recovery services and activities, manage credits and passes, and view your recovery Passport. The app and the staff systems used to provide these services process the information described below. The app is intended for adults aged 18 and over. We do not use app data for advertising tracking or share it with advertisers or data brokers.

Your account and profile

We use your email address and account identifier to provide sign-in, verification and account support. You may add a name, username, biography, profile photo, social links, gender and body-map preference. Optional interests and recovery goals help personalise your experience. Password authentication is handled by our authentication service. When available, you can choose Google or Apple instead. We receive your provider account identifier and the name, email address and basic profile information that the provider shares for sign-in. Apple may supply a private relay email address. We do not receive your Google or Apple password. This sign-in does not request access to Gmail messages, Google contacts or Google Calendar.

You may save a private contact phone number. It is not verified and does not change your sign-in method. Where passkeys are available, our authentication service stores the credential and verification records needed for sign-in, including its identifier, public key and creation or use dates. Your device or passkey provider handles biometric approval; NUSBE does not receive your fingerprint, face scan or device passcode.

For Sign in with Apple, we securely store an encrypted authorization token on our server so we can revoke NUSBE’s access through Apple when processing an account-deletion request. This is separate from your Apple password.

Bookings, activities and payments

We keep the information needed to manage your bookings, event registrations and check-ins, credits, passes, subscriptions, invitations and referral rewards. This includes transaction references, amounts, status and relevant consent or terms records. Event organisers can receive the registration information needed to manage their events, including answers you choose or are required to provide on an event’s registration form. Payment details entered in the payment screen are handled by Stripe. NUSBE’s own app code does not store your full card number or card security code.

When you use Stripe’s payment screens, Stripe collects device and software identifiers, payment screen interactions, loading and payment timings, and error data including stack traces. Stripe may also derive approximate location from your IP address to detect fraud. Stripe uses payment and device information for its own fraud prevention, security, product analytics and product improvement. See Stripe’s privacy policy.

If you host a paid event, we store the payout details you provide: the bank account holder’s name, bank name and account number, or the recipient’s name and Touch ’n Go payment QR image. We use these details to manage host payouts and keep related payout records.

For introductory pass trials, we verify your email and use a protected identifier derived from Stripe’s card fingerprint to enforce one offer per eligible card and account. We keep the trial, consent, expiry and credit-source records needed to prevent repeat claims and calculate partner payments. Partners can choose whether to accept promotional credits; those credits do not create a cash payment to the partner.

Staff invitations, access and performance

For staff invitations and work access, we store the invited email address, account identifier once linked, role, workplace, invitation and acceptance status, membership dates, and access-change history. HQ administrators and authorised partner or branch managers can manage the teams within their assigned scope. Accepting an invitation enables the assigned work features; removing work access does not delete the person’s personal NUSBE account.

Staff performance records link eligible purchases and renewals to referral codes, events to their hosts and co-hosts, and completed services to assigned consultants. Reports may include collections, shared event contributions, attendance, returning visits and service-review ratings, with the customer or transaction details needed to review the activity. Staff can view their own performance; authorised managers and HQ can review records within their permitted scope. These work permissions do not give unrestricted access to a customer’s private Passport.

Invitation-link activity

To attribute referrals and rewards, we record invitation-link visits and actions such as download taps, open-app taps and code copies, using a visit identifier and platform category. We also record accepted referrals and qualifying purchase or reward status. Inviters can see their referral progress and available link-activity reports. A download tap does not confirm that an app was installed. Sharing sends the link to the service you choose; it does not give NUSBE access to your contacts or private chats.

Recovery information

When you use participating services, authorised staff may record and publish session measurements and assessments linked to your account. Your Passport can show skin-temperature readings before and after a session, the body areas measured, session dates, branch and measurement source, and recorded recovery assessments. These are wellness records; the app does not make a medical diagnosis. If you choose age-group comparison, we record your selected age band and consent and use eligible readings in aggregated comparisons. You can change that preference in the app. Sample screens are demonstrations, not measurements of you.

For authorised branch or event recording, we link the readings to the relevant booking or event check-in and keep who entered, published or corrected them and when. Scanning a customer’s QR identifies an eligible record; access remains subject to staff permissions and the recording window. We retain the recorder and correction history when a staff member leaves so the session remains traceable, subject to the access and deletion section below.

Photos, reviews and public content

Photos and text you submit are stored to provide the feature you use. Published events and their covers, public reviews and permitted host names can be visible to other people. Private review feedback is handled separately from the public review text. If you use a sharing action, the content shown in that action is passed to the app or recipient you select; this may include a recovery summary if you choose to share it.

Our community content rules apply to public member events, images and reviews.

Event safety and blocking

When you report an event, we store your account identifier, the event, your selected reason, any details you provide, and the report and review history. Authorised NUSBE staff use this information to investigate concerns and moderate event content. Reports are not published in the event or shared with its host through the reporting feature. When you block a host, we store that choice with your account to hide that host’s events from your discovery and direct event links. Safety records are kept as needed to investigate concerns and meet applicable obligations, subject to the access and deletion section below.

Location and device permissions

When you open Recharge, the app may request your device’s location permission. If you allow access, it calculates nearby-centre distances on your device, keeps coordinates only in memory for the current screen and does not send those coordinates to NUSBE’s database. You can still browse without granting location permission. Place searches and map previews use Apple’s map service. Camera or photo access is used when you choose a photo or scan a ticket or customer QR, and calendar actions let you add an event you select. The app does not import your address book or read your existing calendar events for a NUSBE profile.

Branch updates and notifications

Joining a branch waitlist records your membership and chosen notification consent. Email updates and optional device push notifications have separate controls. If you enable push, we store an installation identifier and push token linked to your account so we can deliver the branch messages you allow. You can change branch preferences or leave a waitlist in the app. Verification and account-service messages are separate from optional branch updates.

Device storage and service providers

The app keeps sign-in/session information and selected preferences on your device. It may also keep pending invitation links and transaction-retry identifiers to help you resume a process safely. Supabase provides authentication, database and file services; Google and Apple provide optional social sign-in; Stripe processes payments; Resend delivers configured email messages; and Apple provides iOS push and map services. These providers process information needed for the services they deliver, including technical information used for security and reliability. Public web links may also be served through our website hosting provider. Provider locations and retention practices may differ from those of your branch.

Access, correction and deletion

You can edit supported profile information in the app. To request account deletion, open Settings / Account Settings / Account Deletion. Confirm your identity using your password or the same Google or Apple account you use for NUSBE, as offered in the app, then submit the deletion request. HQ will process the request within 30 days. The app shows the request’s status and deadline while your account remains accessible. You can cancel while the app offers cancellation. Once HQ has begun processing, contact us if you need help with the request. We will delete or anonymise personal information that is no longer required, while retaining only records we are required to keep. HQ will confirm completion through your registered email. This completion confirmation is handled by our support team, rather than an automatic app email. The deletion request does not itself refund a payment or cancel a recurring payment immediately; HQ reviews these obligations as part of processing the request. We retain information only as needed for the purposes and applicable record-keeping obligations described in this notice. The 30-day processing period is not a retention period for records that we are required to keep.

For privacy questions and access, correction or deletion requests, email [email protected]. You do not need to contact support separately to initiate account deletion in the app.

For help with your account, bookings, credits or Passport, visit NUSBE app support.