Privacy Policy

1. Introduction

NOVA (SG) LABS PTE. LTD (“NOVA”, “we”, “us”, “our”) is a Singapore-registered entity operating wellness and recovery services in Thailand. We are committed to protecting your personal data in accordance with the Personal Data Protection Act (Thailand).

This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our website, services, and facilities (the “Platform”).

2. Data Controller

The data controller responsible for your personal data is:

3. Personal Data We Collect

We collect and process the following categories of personal data:

4. How We Use Your Data

We use personal data for the following purposes:

• To create and manage user accounts
• To manage bookings, memberships, and facility access
• To track session attendance and facility usage
• To process payments and generate receipts
• To communicate with you (including confirmations and service updates)
• To send marketing communications (with opt-out available)
• To improve our services and user experience
• To ensure safety, security, and fraud prevention
• To comply with legal and regulatory obligations

5. Research and Analytics

We may use collected data for:

• Research and statistical analysis
• Service improvement and performance optimisation
• Development of data-driven insights
• Training and improvement of artificial intelligence models

Where possible, data will be aggregated or anonymised. Where identifiable personal data is used, we will rely on appropriate legal bases under PDPA.

6. Legal Basis for Processing

We process personal data under the following lawful bases:

• Contractual necessity — to provide services and memberships
• Consent — for marketing communications and certain tracking technologies
• Legitimate interests — platform improvement, analytics, and security
• Legal obligations — compliance with applicable laws

7. Sharing of Personal Data

We may share your personal data with:

• Payment processors such as Stripe
• Analytics providers such as Google Analytics
• Technology and hosting providers (e.g. Railway, AWS)
• Royal Bangkok Sports Club (for payment records, receipts, and operational purposes)
• Regulatory or legal authorities where required

We do not sell personal data.

8. International Data Transfers

Your data may be transferred to and processed in jurisdictions outside Thailand, including Singapore, where our servers are located.

We take appropriate measures to ensure that such transfers comply with PDPA requirements and that your data remains protected.

9. Data Retention

We retain personal data only for as long as necessary:

• Account data: retained while your account is active
• Post-account closure: retained for legal, accounting, and operational purposes
• Payment records: retained as required by applicable financial and tax laws
• Usage data: retained for service improvement and analytics purposes

10. Your Rights

Under the Personal Data Protection Act (Thailand), you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw consent at any time
• Object to or restrict processing

You may exercise your rights by contacting contact@rbscnova.com or visiting our facility.

11. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• HTTPS encryption
• Secure hosting infrastructure
• Access controls and authentication systems
• Database and field-level encryption
• Restricted access to authorised administrators only

12. Cookies and Tracking

We use cookies and tracking technologies to:

• Enable essential functionality
• Analyse platform performance
• Improve user experience

This includes tools such as:

• Google Analytics
• Meta (Facebook) Pixel

Users can manage cookie preferences via browser settings and our cookie consent mechanism.

13. Marketing Communications

We may send marketing communications via email or SMS where permitted by law. Users can opt out at any time using:

• Unsubscribe links
• Direct request via contact@rbscnova.com

14. Third-Party Services

Our Platform integrates third-party services (e.g. payment processors, analytics providers). These services operate under their own privacy policies, and we encourage users to review them.

15. Account Deletion

Users may request deletion of their personal data at any time by:

• Emailing contact@rbscnova.com, or
• Contacting staff at our facility

We will process such requests in accordance with applicable legal requirements.

16. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

17. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated “Last updated” date.

18. Contact

For any questions regarding this Privacy Policy or your personal data: