ZynergiaStart for free

Privacy Notice

Last updated: September 23, 2026

This is an unofficial, machine-assisted translation provided for convenience and has not been reviewed by a lawyer. The Spanish version is the original, legally binding text — in the event of any conflict or discrepancy, the Spanish version prevails.

This notice applies to the Zynergia site and platform (zynergia.app), operated by Javier Ismael Nabte Ake, a self-employed individual with business activity, Mexican tax ID (RFC) NAAJ970805KB6, domiciled at Calle 88 x 71-A y 73, Fraccionamiento Los Almendros, Ciudad Caucel, C.P. 97314, Mérida, Yucatán, Mexico (“Zynergia,” “data controller”), in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties published in the Official Gazette on March 20, 2025 (LFPDPPP) and other applicable provisions.

Zynergia is management software that fitness, yoga, pilates and wellness studios ("studios") use to run their own classes, bookings and students. With respect to your data as a student, the studio you enroll with is the data controller (it decides what information to collect from you and how it's used in its operations) and Zynergia acts as data processor: it stores and processes that data on the studio's behalf, on the platform's infrastructure. If you register directly as a studio owner, or visit Zynergia's marketing site, Zynergia is the direct controller of that data.

1. Data we collect

2. Sensitive data

The platform does store sensitive personal health data, on the studio's behalf. When a studio turns on the physical-readiness questionnaire, Zynergia stores the answers the Student declares and the detail they write for each one — the studio writes the questions itself, and they typically cover medical conditions, injuries, medications, pregnancy and instructions to train under medical supervision —, the resulting status (account cleared or under medical review) and, if the Student attaches one, the medical authorization they upload. If the studio also uses an Informed Consent document, we store the express-consent checkbox for processing that health data, ticked separately from accepting the document.

The purpose of this processing is the safety of the physical activity: so the studio can assess the readiness its Student declares before letting them book, and have that information on hand when responding to an emergency. The basis is the express, written consentthe studio obtains from its Student by electronic signature, as Article 8 of the LFPDPPP requires. As explained at the start of this notice, the studio is the controller of that data — it decides whether to enable the questionnaire, what it asks, and who on its team gets access to its dashboard — and Zynergia stores and processes it on the studio's behalf as data processor. Inside the dashboard, what you declared is visible to studio personnel with access to the Student's record; clearing a medical review can only be done by that studio's owner, an administrator, or its staff.

Zynergia does not request any other sensitive data on its own account (racial or ethnic origin, religious beliefs, sexual orientation, and others the law classifies as sensitive). If a studio collects additional information of this kind on its own, that studio is responsible for obtaining the consent the LFPDPPP requires and for handling it in accordance with that law.

3. Purposes of processing

We use your data for the following purposes, which are necessary to provide the service and to fulfill your legal relationship with the studio or with Zynergia (and do not require your additional consent under Article 9, section IV, of the LFPDPPP):

  1. Operating your account and, if applicable, the studio's site (scheduling, bookings, credits, payments).
  2. Processing payments and commissions with our providers (Stripe, Mercado Pago).
  3. Sending operational emails: confirmations, class reminders, password recovery.
  4. Preventing fraud and protecting platform security.
  5. Collecting and retaining the evidence of the consents, authorizations and signatures the studio requires, and making it available to the studio and to you.

Separately from the above, if the studio turned on the physical-readiness questionnaire we process your health data for two purposes: so the studio can assess the readiness you declare before letting you book — an answer that triggers a medical review blocks booking until the studio clears you — and so it has that information on hand when responding to an emergency during the activity. These purposes do not rest on Article 9 of the LFPDPPP but on the express, written consent you give when signing (Article 8), as explained in section 2.

We also secondarily use aggregated usage statistics to improve Zynergia. This secondary purpose is optional: you can opt out without affecting the core service, by writing to us through the channels in section 10.

If you signed up as a Student, or left your data as a prospect (“lead”) of a Studio, that Studio may use the Platform's email tool to send you its own marketing campaigns (promotions, news, invitations) — separate from the operational emails described above. Each campaign includes a link to unsubscribe from those emails without affecting the operational emails you still need for your account. As explained at the start of this notice, the Studio is the controller for those campaigns; Zynergia only provides the sending infrastructure.

4. Who we share data with

We do not sell your data. Depending on what you use within Zynergia, we share it with:

The following providers process data on our behalf (processors) so the platform can work:

Data also reaches:

Images and videos for the studio's site, profile photos and the legal documents the studio publishes are stored with Bunny.net, a storage and content delivery network (CDN) provider, and are served publicly so the site works. Medical authorizations a Student attaches to their physical-readiness questionnaire are handled differently: they are stored encrypted with AES-256-GCM in private storage, with keys that do not reside with the storage provider; they have no public address; they can only be opened through the platform, by studio staff authorized to view the Student's record; and every access is recorded in an access log.

Additionally, as explained in the Cookies section below, Zynergia's marketing site and, optionally, each studio's site, may share browsing data with Google and Meta through their analytics and advertising tools.

Some of these providers process data on servers outside Mexico (for example, in the United States and the European Union). Communicating data to a processor is not a transfer under Article 2, section XX, of the LFPDPPP; where there is a transfer (for example, to Stripe or to the studio), it is necessary to fulfill the legal relationship with you and does not require your consent under Article 36, sections IV and VII, of the LFPDPPP. In all cases it takes place under each provider's data-protection standards.

5. Retention and minors

We keep your data while your account is active and, after deletion, for the additional period the law requires (for example, tax or payment records Stripe/Mercado Pago must retain). Our own studio-registration and contact forms are intended for adults, and we do not knowingly collect minors' data through them.

When a Studio enrolls a minor as a Student — for example, in family or kids' classes — that Studio remains the controller of that data: it decides whether it admits minors, from what age, and what information it asks of them. For those cases, the platform provides its own flow to obtain and keep the legal guardian's authorization: from the date of birth the Student enters at sign-up, it detects that they are a minor according to the age of majority the Studio configured; it asks for the parent or guardian's email; it sends a one-time codeto that address, which expires in 10 minutes and limits attempts; and only once the code is entered correctly does it enable the guardian's authorization block. For the Informed Consent document, the teenager must also tick their own assent separately. If the Studio set a minimum age, the platform prevents booking below it.

From that process we keep, alongside the signature: the legal guardian's name, their verified email, the flag that a guardian granted the authorization, the minor's assent, the date and time, the IP address and the browser the signature came from. The code itself is never stored in plain text — only its cryptographic hash — it stops being valid after 10 minutes, and its record is deleted as soon as the signature is completed or a new code is requested. If the legal guardian answers or supervises the physical-readiness questionnaire, their name is stored with the answers as well.

While a Studio keeps using Zynergia, its Students' data is retained to provide it the service it contracted. If you want your data deleted, the request follows the ARCO-rights channels in section 8, and the Studio you enrolled with is the one that handles it, as the controller of that data — Zynergia keeps it as processor for as long as the Studio needs it. As explained in section 8, there is an exception: the signatures of the legal documents and the health-questionnaire answers are not deleted on request, because by design the platform only lets them be added, never edited or deleted.

6. Security measures

We protect your data with encryption in transit (HTTPS) across the entire site, passwords we never store in plain text, and role-based access control to the database: every query goes through rules that limit what each person can read, based on the studio they belong to and the role they hold there. Signatures and health-questionnaire answers additionally cannot be edited or deleted from within the platform — not even by the studio — because they are the record that evidences what was consented to and when.

Medical authorizations are additionally stored encrypted with AES-256-GCM in private storage, can only be opened through the platform by authorized staff, and every access is recorded in an access log (see section 4). Health data is never sent to Artificial Intelligence providers or to analytics or advertising tools.

No system is 100% infallible; if a security breach significantly affects your property or personal rights, you will be informed immediately in accordance with Article 19 of the LFPDPPP — by the studio, where it concerns your data as a student, using the information Zynergia provides to it.

7. Cookies and tracking technologies

Zynergia uses strictly necessary session cookies to keep you logged in — these do not require your consent and cannot be disabled without losing the login function.

Zynergia's marketing site (zynergia.app) also uses its own Google Analytics and Meta Pixel (Facebook/Instagram), to measure the performance of our own campaigns — not the studio you enrolled with. These DO require your consent: when you enter the site you'll see a notice where you can accept or declinetheir loading; until you choose, they stay inactive. You can change your choice by clearing this site's browsing data in your browser, which will show the notice again. Exception: if you have JavaScript disabled you won't be able to see that notice (it depends on JavaScript to work), and in that case Meta may log a basic visit without having been able to ask for your consent.

On Zynergia's public pages (home, pricing, blog, sign-up and login) we also use Microsoft Clarity, which records how the page is browsed (clicks, scrolling) so we can improve it. It only loads if you accept in that same cookie notice. Clarity does not loadin studios' admin dashboards or in the platform dashboard, where student data is shown.

On the Zynergia platform's pages and dashboards (not on studios' sites) we use Umami, an analytics tool Zynergia hosts on its own server, without cookies and without identifying you individually: it only counts aggregate visits (pages viewed, country, browser). That is why it does not require your consent.

Additionally, the studio you enroll with may — optionally, with its own identifiers and under its own responsibility as the controller of that data — integrate those same third-party analytics and advertising tools into its site, to measure its own campaigns' performance, with the same notice-and-consent mechanism. In both cases, these tools install their own cookies or identifiers and share browsing data with Google or Meta, per each one's privacy policy. Once you are signed in or have left your details in a form, the Meta pixel is additionally sent your email and phone as a cryptographic hash (SHA-256), never in the clear, so Meta can attribute the visit — that is how its own tool works. Payment data and health data are never shared. If the studio you enrolled with activated them, you'll see it disclosed in that studio's own privacy notice.

8. ARCO rights and how to exercise them

You have the right to Access your personal data, Rectify it if inaccurate, Cancel it when you believe it is no longer needed for the stated purposes, and Objectto its processing for specific purposes — in addition to revoking any consent you've given at any time. You can exercise these rights by writing to us through the channels in section 10, or by following the steps in Delete my data. To process your request we need: your name, the email you're identified by in Zynergia, a clear description of what you're requesting, and any document supporting your request. We will respond within a maximum of 20 business days and, if applicable, make the change effective within the following 15 business days.

There are two records that are not deleted on request, and you should know it before asking: the signatures of the legal documents and the health-questionnaire answers. By design, the platform only allows adding them, never editing or deleting them — they are precisely the proof of what you consented to and when, and they would lose all their value if they could be altered afterwards. For as long as the studio needs to keep them to evidence that consent or to defend itself against a claim, the LFPDPPP (Articles 24 and 25) allows keeping them blocked despite a cancellation request; once that need ends, they are deleted along with the rest of your data within the periods in section 5. Revoking your consent to the processing of your health data does take effect going forward, but it means the studio will no longer be able to let you book while it keeps the questionnaire enabled.

What you can do yourself, with no paperwork: view and print each document you signed, with its date and version, from the “My signed documents” section of your account; correct a health declaration that has gone out of date by answering the questionnaire again — the previous declaration is not deleted, it is kept as history and the new one is what counts, and if it triggers a medical review again your account returns to that status; and revoke at any time your image and voice consent from that same screen, because that one does only keep its current value.

If you're not satisfied with our response, or believe your right to personal data protection has been violated, you can contact Mexico's Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the competent authority under the LFPDPPP (which took over the functions of the former INAI), by filing a rights-protection request.

9. Changes to this notice

Any changes will be published on this same page with a new update date.

10. Contact

To exercise your rights or for questions about this notice, write to us through our official channels.