Privacy Policy
Effective date: 12 August 2026
Amended: 9 November 2026 (Sentry added as an operator); 27 October 2026 (the basis for sending a lab report to Anthropic); 26 October 2026 (Anthropic added as an operator)
1. Responsible party
C-Suite Holdings (Pty) Ltd, registration number 2025/812492/07, trading as Phorm, of 382 Highland Road, Kensington, Johannesburg, 2094, South Africa, is the responsible party under the Protection of Personal Information Act 4 of 2013 (“POPIA”). Our information officer can be reached at info@c-suite.co.za.
2. What this website collects
The phorm.fitness brochure site collects only what you give it: the contact-form fields (name, email, phone, client count, message), used solely to respond to your request; and standard server logs (IP address, user agent), kept for security. We measure page visits with Vercel Web Analytics, a cookie-free service that records aggregated page views without personal identifiers and does not track visitors across websites. Because this site sets no tracking cookies and no advertising trackers, it shows no cookie consent banner — there is nothing to consent to.
3. What the platform processes
For coaches, the platform processes account, billing and usage data. For coaches’ clients — processed on the coach’s instructions — the platform holds profile, check-in, programme, progress and payment-status data. Health-adjacent information a client shares in a check-in is processed only to deliver the coaching service, and never for advertising.
4. Operators
We use a small set of operators, as POPIA sections 20 and 21 describe: Vercel (hosting), Neon (database), Resend (transactional email), Paystack (payment processing), Sentry (crash reports, stored in the EU, with names, emails and answers removed) and Anthropic (reading a lab report into the bloodwork form, only when a client or their coach asks, with the client’s consent). Some operators process data outside South Africa; those transfers rely on the safeguards in POPIA section 72 — contractual protections at or above the standard POPIA sets. A lab report sent to Anthropic is sent on the client’s own consent to that transfer (section 72(1)(b)), given in the app before anything is sent.
5. Purposes and lawful basis
We process personal information to perform the coach agreement, respond to requests, bill commissions, keep the service secure, and comply with law. We do not sell personal information.
6. Retention
Contact-form submissions are retained for up to 12 months. Account data is retained for the life of the agreement plus the statutory retention periods that apply to business records — tax records, for example, are kept for 5 years.
7. Your rights
You may request access to, correction of, or deletion of your personal information, and you may object to processing, by writing to info@c-suite.co.za. You may also complain to the Information Regulator (South Africa): inforeg.org.za, complaints.IR@inforeg.org.za.
8. Security
Personal information is encrypted in transit, protected by access controls, and reachable by operators only on a least-privilege basis.
9. Changes
Material changes to this policy are published on this page with a new effective date.