Client Terms of Use & Privacy Notice

1. Who this is for

This document is between C-Suite Holdings (Pty) Ltd, registration number 2025/812492/07, of 382 Highland Road, Kensington, Johannesburg, 2094, South Africa (“C-Suite Holdings”), trading as Phorm, and you — a person who receives coaching services from an independent coach, trainer or instructor (your “Coach”) and uses the Phorm client portal in connection with those services. You accept it when you open your portal from your Coach’s invitation, and it applies for as long as you use the portal. It is written to be read on its own, and it sits alongside Part B of the Service Agreement and the Confidentiality & Non-Disclosure Agreement, which also apply to you.

2. The portal, and how signing in works

The portal is where your check-ins, measurements, progress photos, programme and intake answers live. There is no password. Signing in works by a link sent to your email address, so whoever can read your email can open your portal. Keep your mailbox secure — use a strong password and, where available, two-factor authentication on your email account — and tell your Coach or info@c-suite.co.za promptly if your email account is compromised or if the address stops being yours, so access can be moved or closed. Sign-in links are single-use and expire quickly, but they are only as private as the inbox they land in.

3. What is stored, and who sees it

The point of the portal is that your Coach can see how you are doing. When you submit a check-in, a measurement, a progress photo or an intake answer, it is stored on the platform so that your Coach can see it and use it to coach you. That is the purpose of the portal, not a side effect. Your information is visible to:

• you;
• your Coach, and staff of your Coach’s business who have been given access to the coach portal;
• C-Suite Holdings, to the limited extent needed to operate, secure and support the platform; and
• the operators listed in section 7, who host and deliver the service.

It is not visible to other clients, is not sold, and is not used for advertising. Everyone with portal access — your Coach included — is bound by the Confidentiality & Non-Disclosure Agreement in respect of your information.

4. Health information

Some of what you share — intake answers about your health, medications, injuries, and notes your Coach records about your condition — is health information, a special category of personal information under section 26 of the Protection of Personal Information Act 4 of 2013 (“POPIA”). We process it with your consent, which you give when you accept this document and each time you choose to submit such information, and only to deliver the coaching service. You are never required to share health information through the portal, and you may withdraw consent at any time by writing to info@c-suite.co.za — after which we will stop processing it and delete it, subject to section 8. Withdrawing consent may limit what your Coach can safely programme for you; that conversation belongs with your Coach.

5. Who is responsible for your information

POPIA distinguishes the party that decides why information is processed from the party that processes it on instruction. For the coaching use of your information — what is asked of you, how it informs your programme — your Coach is the responsible party, and C-Suite Holdings processes that information as an operator on your Coach’s behalf. For the platform itself — your account, sign-in records, security logs and the operation of the portal — C-Suite Holdings is the responsible party. Our information officer can be reached at info@c-suite.co.za. Requests about the content of your coaching record can go to either your Coach or us; whoever receives one will involve the other where needed.

6. Why we process your information

We process your personal information to provide the portal under this agreement, to let your Coach deliver the coaching service you have contracted for, to keep the service secure, and to comply with law. Health information is processed on the basis of your consent as set out in section 4. We do not sell personal information and do not use it for advertising.

7. Operators and where your information goes

We use a small set of operators, as POPIA sections 20 and 21 describe: Vercel (hosting), Neon (database), Resend (transactional email, including your sign-in links) and Paystack (payment processing). Some operators process data outside South Africa; those transfers rely on the safeguards in POPIA section 72 — contractual protections at or above the standard POPIA sets.

8. How your information is protected

All personal information is encrypted in transit and protected by access controls. Health information is additionally encrypted at the level of the individual field, inside the application, under a key specific to your Coach’s organisation — so possession of the database alone does not yield your health record, and one organisation’s key cannot decrypt another’s data. Every read of a health field is logged. Health fields are also excluded from list and search views by default, so they are opened deliberately, one record at a time, not browsed.

9. Retention and deletion

Your portal access exists in support of your coaching relationship and ends when that relationship ends. Your coaching record is retained while the relationship is active. You may at any time request access to, correction of, or deletion of your personal information by writing to info@c-suite.co.za; we action deletion requests except where law requires retention — records of payments, for example, carry statutory retention periods — in which case we retain only what the law requires, for as long as it requires, and tell you so. Before deletion you may request an export of your own data.

10. Your rights under POPIA

Under POPIA you may request access to your personal information, request correction or deletion, object to processing, and withdraw consent to the processing of health information. Requests go to info@c-suite.co.za and are free of charge. If you are not satisfied with our response, you may complain to the Information Regulator (South Africa): inforeg.org.za, complaints.IR@inforeg.org.za.

11. Your coaching comes from your Coach

The coaching services you receive through the portal — every plan, instruction and recommendation — are provided by your Coach as an independent business, under your agreement with your Coach. Phorm is the software, not the coach. Part B of the Service Agreement sets this out in full, including the health and safety notice: nothing on the platform is medical advice, and you should consult a medical professional before beginning any exercise or nutrition programme.

12. Acceptance and changes

You accept this document by ticking the acceptance box when opening your portal — electronic acceptance is binding under the Electronic Communications and Transactions Act 25 of 2002 — and we record the version accepted, the date, and the device details of the acceptance. Material changes are published on this page with a new effective date, and continued use of the portal after that date is acceptance of the change.

13. Contact

Support: team@phorm.fitness. Privacy requests and legal notices: info@c-suite.co.za. This document is governed by South African law, and the South African courts have jurisdiction over any dispute arising from it. If any clause is found unenforceable, the remainder stands.