0 items - රු0.00 0
AthleX for Business
0 items - රු0.00 0
AthleX for Business
0 items - රු0.00 0
Close

Privacy Policy

Personal data protection statement for the AthleX Services

Effective date: 30 July 2026

Applies to: the AthleX website (www.athlex.lk), the AthleX online shop, the AthleX mobile application and cloud platform, and the AthleX for Business platform

1. Introduction and identity of the controller

This Privacy Policy (the “Policy”) is issued by Fintag Group (Pvt) Ltd, a private limited company incorporated in the Democratic Socialist Republic of Sri Lanka, having its registered office at ‘Nethmul’, Gemunu Mawatha, Bandarawela, Sri Lanka, and its principal place of business at 280/7, Koranelis Mawatha, off Madiwela Road, Madiwela, Sri Lanka (the “Company”, “we”, “us”, or “our”), trading under the brand name “AthleX”.

This Policy sets out the basis on which the Company collects, uses, discloses, stores, and otherwise processes personal data in connection with: (a) the AthleX website and online shop; (b) the AthleX mobile application and associated cloud platform (the “Platform”); (c) enquiries submitted through the AthleX for Business inquiry facility; and (d) deployments of AthleX by institutional customers (collectively, the “Services”).

By accessing or using the Services, you acknowledge that you have read and understood this Policy. Where processing is conditional upon your consent, such consent shall be sought separately and expressly, and this Policy shall not be construed as a substitute for such consent.

2. Scope of application; alternative manufacturer applications

AthleX devices may be paired either with the AthleX application or with a standard application published by the device manufacturer or any other party. The scope of this Policy differs accordingly:

2.1 Use with the AthleX application

Where a device is paired with the AthleX application, data generated by the device is stored locally on the user’s device and synchronised to the Platform, which is hosted on third-party cloud infrastructure engaged by the Company. Such data is processed in accordance with this Policy.

2.2 Use with a manufacturer or other application

Where a device is paired with the manufacturer’s own application or any other application rather than the AthleX application, the resulting health and activity data is collected and processed solely by the manufacturer under the manufacturer’s or the third parties’ own privacy terms. In such circumstances the Company does not receive, store, or otherwise process that data, and this Policy does not apply to it. Users electing this option are advised to review the applicable manufacturer’s privacy terms.

3. Categories of personal data collected

3.1 Data provided directly by you
  • Account data: name, email address, and authentication credentials (passwords are stored in hashed form by the Company’s authentication provider and are not accessible to the Company in plain text);
  • Order and delivery data: name, delivery address, contact telephone number, and email address, where you place an order through the online shop;
  • Payment data: where payment is made by card, card details are captured directly by the Company’s third-party payment gateway within its secure, PCI-DSS-compliant environment and are not stored on the Company’s systems; where payment is made by bank transfer, the Company retains the transaction reference and confirmation records necessary for reconciliation;
  • Body measurements entered manually by you within the application, where you elect to provide them;
  • Business inquiry data: organisation name, industry or segment, contact name, designation, telephone number, email address, country, approximate number of users or athletes, solutions of interest, and any stated objectives;
  • Correspondence: the contents of any communication you address to the Company by contact form, email, or messaging service.
3.2 Health, biometric, and activity data (AthleX application users only)

Where a device is paired with the AthleX application, the Company collects wellness-related data computed or reported by the device, which may include: heart rate and heart rate variability (HRV); estimated blood oxygen saturation (SpO2) and blood pressure values; sleep patterns and duration; step count and general activity data; and any body measurements entered manually.

IMPORTANT NOTICE: All such data is of wellness and performance grade only and is not of clinical grade. AthleX devices and the AthleX application do not constitute medical devices and are not intended for the diagnosis, monitoring, treatment, or prevention of any disease or medical condition. Estimated blood pressure and SpO2 values are indicative only and must not be relied upon for any medical purpose. Users should consult a qualified healthcare professional in respect of any health-related matter.

3.3 Data collected automatically
  • Technical and log data, including IP address, browser and device type, pages accessed, referring URLs, and approximate location derived from IP address;
  • Cookies and similar technologies, as described in Section 8; and
  • Application diagnostic and crash data, used to maintain the stability and security of the Services.

4. Purposes of processing

The Company processes personal data for the following purposes:

  • To establish and administer user accounts, and to process orders, payments, and deliveries;
  • To provide the core functionality of the Platform, including synchronisation of data across the user’s devices, presentation of training, recovery, and wellness insights, and, where applicable, the coach and team functionality described in Section 5;
  • To respond to enquiries, including business inquiries, and to prepare proposals for institutional customers;
  • To issue order confirmations, delivery notifications, and, where you have consented to receive them, marketing communications, which you may opt out of at any time;
  • To maintain the security, integrity, and performance of the Services, including the prevention and detection of fraud; and
  • To comply with applicable legal, tax, and regulatory obligations.
Lawful bases of processing

The Company processes personal data in reliance upon the following lawful bases under the Personal Data Protection Act, No. 9 of 2022 (as amended) (the “PDPA”): (a) your consent, including your explicit consent in respect of health data, which constitutes a special category of personal data under the PDPA; (b) necessity for the performance of a contract to which you are a party, including the fulfilment of orders and the provision of the Platform; (c) compliance with legal obligations to which the Company is subject; and (d) the legitimate interests of the Company, including the prevention of fraud and the maintenance of network and information security, save where such interests are overridden by your interests requiring protection of personal data. The provision of account data and, where you elect to use the AthleX application, health data, is a requirement necessary for the provision of the relevant Services; failure to provide such data will prevent the Company from providing those Services to you.

Marketing communications are disseminated only with your consent, which is sought separately from other matters, and every such communication shall identify the Company and include a means of opting out free of charge. The Company does not sell personal data or health data to any third party, and does not use health data for the purpose of third-party advertising.

Automated decision-making

The Company does not make any decision concerning you based solely on automated processing which produces, or is likely to produce, an irreversible and continuous impact on your rights and freedoms. Should any such processing be introduced, you will be informed and afforded the rights conferred by section 18 of the PDPA.

5. Coach, team, and organisational access

The Platform includes functionality enabling coaches and organisations to view the health and performance data of athletes or members under their supervision. Where a user elects to join a coach’s team or an organisation’s roster within the application, the user’s relevant health and performance data will thereupon become visible to the coach or administrator responsible for that team, for training and performance-management purposes.

  • Such access shall not take effect unless and until the user has been presented with, and has expressly confirmed, the applicable data-sharing arrangement;
  • A user may leave a team at any time, whereupon no further data shall be shared with the relevant coach or organisation from the date of departure; and
  • The coach or organisation concerned bears responsibility for the appropriate and confidential use of data accessed through the Platform, and for compliance with its own legal obligations toward the individuals concerned.
Institutional deployments

Where an organisation deploys AthleX for its athletes, members, students, or employees, that organisation shall act as the data controller in respect of the personal data of the individuals it enrols, and the Company shall act as a processor acting upon the organisation’s instructions. The organisation shall be responsible for obtaining all consents required from the individuals concerned (including parental or guardian consent in respect of minors) prior to enrolment, and for determining and governing internal access to such data.

6. Disclosure of personal data

The Company discloses personal data only to the extent necessary for the operation of its business, to the following categories of recipients:

  • Payment processors and financial institutions, for the processing of card payments and bank transfers;
  • Cloud hosting and database service providers engaged by the Company, which store account and health data on the Company’s behalf subject to contractual obligations of confidentiality and security;
  • Courier and delivery service providers, for the fulfilment of orders within Sri Lanka;
  • Providers of website, analytics, and information-technology services engaged in the operation of the Services;
  • Coaches, team administrators, and organisations to which the user has elected to grant access in accordance with Section 5;
  • Professional advisers, auditors, and regulatory authorities, where necessary for legal or compliance purposes;
  • Any successor in title or prospective acquirer in connection with a merger, acquisition, or transfer of the Company’s business or assets, subject to this Policy continuing to apply to the data transferred; and
  • Law enforcement or governmental authorities, where disclosure is required by law or pursuant to valid legal process.

7. Storage, retention, and cross-border transfer

Personal data, including health data collected through the AthleX application, is stored on the Company’s systems and on the infrastructure of the third-party service providers referred to in Section 6, which may be located outside Sri Lanka. Such cross-border data flows are undertaken in accordance with section 26 of the PDPA (as amended), on the following bases: (a) your explicit consent to the storage and processing of your data outside Sri Lanka, which is sought at the point of account creation after you have been informed of the possible risks of such processing, including the possibility that the destination country may not afford an equivalent standard of statutory data protection; and (b) necessity for the performance of the contract between you and the Company, the Platform being dependent upon such infrastructure. The Company shall further adopt such instruments as may be specified by directive of the Data Protection Authority of Sri Lanka to secure binding and enforceable commitments from overseas recipients, ensuring appropriate safeguards for your rights and the remedies available under the PDPA.

Personal data is retained for so long as the relevant account remains active, or as is otherwise necessary for the purposes set out in this Policy and for compliance with the Company’s legal, accounting, and tax obligations. Upon deletion of an account, the Company shall delete or anonymise the associated personal and health data within a reasonable period, save to the extent that retention of particular records is required by law.

8. Cookies

The website uses cookies and similar technologies for the purposes of site functionality (including shopping-cart and session management), preference retention, and analytics. Cookies may be controlled or disabled through browser settings; disabling certain cookies may impair site functionality, including checkout.

9. Minors

  • An AthleX application account may be created only by persons aged sixteen (16) years or above, consistent with the definition of a “child” under the PDPA as a person below the age of sixteen years. Personal data relating to a child constitutes a special category of personal data under the PDPA, and any processing of such data on the basis of consent requires the consent of the child’s parent or legal guardian. Accordingly, persons under sixteen (16) may use AthleX only where enrolled by, and under the supervision of, a parent, legal guardian, school, or club acting on their behalf and providing such consent;
  • Purchases through the online shop may be made only by persons aged eighteen (18) years or above, or with the involvement of a parent or legal guardian; and
  • Where the Company becomes aware that personal data has been collected from a minor otherwise than in accordance with this Section, it shall take steps to delete such data or to obtain the requisite consent.

10. Rights of data subjects

Subject to applicable law, including the PDPA, you have the right to:

  • Request access to the personal data held about you;
  • Request rectification of inaccurate or incomplete personal data;
  • Request erasure of your account and associated personal data;
  • Withdraw any consent previously given, without affecting the lawfulness of processing carried out prior to withdrawal;
  • Object to, or request restriction of, certain processing; and
  • Lodge a complaint with the competent data protection authority.
Manner of handling requests

Requests may be submitted in writing to privacy@athlex.lk. In accordance with section 17 of the PDPA (as amended), the Company shall inform you in writing, without undue delay and in any event within one (1) month of receipt of a request, whether the request has been granted or refused, together with reasons for any refusal save where disclosure of such reasons is prohibited by written law. Where an extension of time is required for reasons assigned, the period may be extended by up to two (2) further months, not exceeding three (3) months in aggregate from receipt of the request, and you shall be informed of any such extension before the expiry of the initial one-month period. Requests are complied with free of charge, save as may be permitted by rules made by the Data Protection Authority. Where a request is refused, you have the right of appeal to the Data Protection Authority of Sri Lanka against such refusal, and thereafter to the Court of Appeal in accordance with the PDPA. The Company may require verification of identity before giving effect to a request.

Where the data subject is a minor, the rights conferred by this Section may be exercised by a parent, a person having parental authority, or a legal guardian; where the data subject is physically or mentally unfit, by a court-appointed guardian or administrator; and, in respect of a deceased data subject, by an heir within ten (10) years of the date of death, in each case in the manner prescribed under the PDPA.

11. Security

The Company implements administrative, technical, and physical safeguards appropriate to the nature of the data processed, including encrypted transmission, access controls, and secure hosting of account and health data. While no system can be warranted as absolutely secure, the Company maintains procedures for the detection of, and response to, security incidents, and shall notify affected individuals and competent authorities where required by law.

12. Third-party websites and services

The Services may contain links to, or otherwise interoperate with, third-party websites, applications, and services, including manufacturer applications referred to in Section 2.2, payment gateways, and social-media platforms. The Company is not responsible for the privacy practices of such third parties, and this Policy does not apply to their processing of personal data.

13. Amendments

The Company may amend this Policy from time to time. The amended Policy shall be published with a revised effective date. Where an amendment is material, the Company shall give additional notice by such means as it considers appropriate, which may include notice within the application or by email, prior to the amendment taking effect.

14. Contact

All queries, requests, and complaints concerning this Policy or the Company’s processing of personal data may be addressed to:

  • Fintag Group (Pvt) Ltd
  • Registered office: ‘Nethmul’, Gemunu Mawatha, Bandarawela, Sri Lanka
  • Principal place of business: 280/7, Koranelis Mawatha, off Madiwela Road, Madiwela, Sri Lanka
  • Email (privacy matters): privacy@athlex.lk
  • Email (general): info@athlex.lk