Your privacy and the security of your information matter to us. This Privacy Policy explains what personal data NextGen Gym collects when you join, visit the Club, use our health, nutrition and café services, or use this website. It also explains why we collect it, who we share it with and the rights you have under Kenya’s Data Protection Act, 2019.
In short
- We collect what we need to run your membership, keep the Club safe and deliver the services you ask for.
- Health information, fingerprints and facial scans are sensitive data. We handle them with extra care and only for the stated purposes.
- We never sell your personal data.
- You can ask to see, correct or delete your data, or object to how we use it, at any time.
1.Who we are
NextGen Gym Limited, including its subsidiaries trading as Generation Fitness (NextGen Gym, we, us), is the data controller for the personal data described in this policy. We are located on the 6th Floor, NextGen Mall, Mombasa Road, Nairobi, Kenya.
This policy covers the Club, our physiotherapy and orthopaedic centre, our nutrition and body-assessment services, our supplement store, WellFit Café and the website nextgengym.fitness.
2.Information we collect
| When | What we collect |
|---|---|
| You join or manage your membership | First and last name, email address, mobile number, date of birth, gender, your chosen plan and start date, payment and transaction records, and how you heard about us. |
| Emergency contact | The name, mobile number, email address and relationship of the person you ask us to contact in an emergency. Please let them know you have shared their details with us. |
| You enter the Club | Your fingerprint and/or facial scan, used by our access system, plus a record of the dates and times you check in. |
| You bring a guest | The guest’s name, contact details and signed guest disclaimer form. |
| You are at the Club | CCTV images from cameras throughout the Club (never in the changing areas or the ladies’ section), and incident or accident reports where needed. |
| You use our physiotherapy or nutrition services | Health history, medicines, allergies, pregnancy, dietary needs, assessment notes, treatment records, consent forms, and body measurements, including 3D body scan results. |
| You book personal training, assessments or appointments | Your name, contact details, booking times and any notes you share. Nutrition appointments can be booked through a Google Calendar booking page. |
| You order from WellFit Café or buy supplements | Your name, phone number, order details, allergies or dietary needs you tell us about, and delivery details where delivery is offered. |
| You contact us or give feedback | Your name, phone number, email address and what you tell us, including WhatsApp messages, emails, and answers to our feedback survey (a Google Form). |
| You use our website | Basic technical data such as browser type, pages visited and approximate location, collected through cookies and Google Analytics (see section 9). |
The chat assistant on our website answers common questions about the Club. It does not ask for your name or contact details. If you choose to continue the conversation on WhatsApp, WhatsApp’s own privacy terms also apply.
3.How we use your information
| Purpose | Legal basis |
|---|---|
| Setting up and managing your membership, payments, renewals, freezes and access to the Club | To perform our contract with you |
| Verifying your identity at the entrance gates using fingerprint or facial recognition | Your consent, given when you register your fingerprint or face |
| Providing physiotherapy, nutrition, body assessments and related advice | Your consent and our contract with you, together with our professional and legal duties of care |
| Preparing café and supplement orders and handling allergy information safely | To perform our contract with you, and your consent for health-related details |
| Contacting your emergency contact if something happens to you at the Club | To protect your vital interests |
| Keeping the Club, members and staff safe, including CCTV and incident reports | Our legitimate interests and our legal obligations |
| Sending service messages, such as booking confirmations, class changes, fee reviews and changes to our terms | To perform our contract with you |
| Collecting feedback and handling complaints so we can improve | Our legitimate interests |
| Sending news, offers and promotions | Your consent. You can opt out at any time. |
| Understanding how our website is used so we can improve it | Our legitimate interests, and your consent where required for cookies |
| Keeping financial records and meeting tax, accounting and other legal requirements | Our legal obligations |
4.Sensitive personal data
Under the Data Protection Act, 2019, health data and biometric data such as fingerprints and facial scans are sensitive personal data. We handle them with extra protection:
- Biometric data is used only to confirm your identity at the entrance gates and manage access to the Club. It is never used for marketing or shared for any other purpose.
- Clinical and nutrition records are confidential. Only the clinicians and authorised staff who need them to care for you can access them.
- We will ask for your consent before we collect sensitive data, and we will explain what it is for. For children, we obtain consent from a parent or guardian.
6.Data stored outside Kenya
Some of our service providers, such as our membership software, Google and WhatsApp, store or process data on servers outside Kenya. When this happens, we take steps to make sure your data receives appropriate protection, as required by the Data Protection Act, 2019.
7.How long we keep it
We keep personal data only for as long as we need it for the purposes in this policy, or as long as the law requires. For example:
- membership and payment records are kept while you are a member, and afterwards for as long as needed for accounting, tax and legal purposes;
- clinical and nutrition records are kept for the periods required by professional and legal rules;
- biometric data is deleted when it is no longer needed for access, and you can ask us to delete it when your membership ends;
- CCTV footage is overwritten automatically after a short period, unless it is needed to investigate an incident.
When we no longer need your data, we delete it securely or anonymise it.
8.Keeping your data secure
We use appropriate technical and organisational measures to protect your data. These include access controls, secure systems, staff confidentiality and limiting access to the people who need it. No system is completely secure, so please tell us straight away if you think your information has been misused. We will act on any data breach as the law requires, including notifying the Data Commissioner and affected people where necessary.
10.Marketing and photos
- With your permission, we may send you news about classes, events and offers by SMS, email or WhatsApp. You can opt out at any time by using the unsubscribe link, replying to the message to tell us, or speaking to our team.
- We will always ask for your permission separately before using your photo, video or testimonial in our publicity.
11.Children
Members must be at least 14. Children aged 11 to 13 may train only with a parent or guardian who is a member. We collect a child’s personal data only with the consent of their parent or guardian, and only what is needed to provide our services safely.
12.Your rights
Under the Data Protection Act, 2019, you have the right to:
- be informed about how your personal data is used;
- access the personal data we hold about you;
- object to all or part of how we process your data, including for direct marketing;
- correct data that is false, inaccurate or out of date;
- delete data that is false, misleading or no longer needed;
- withdraw your consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it;
- data portability, which means receiving your data in a commonly used format.
To use any of these rights, email generalmanager@nextgengym.fitness or speak to reception. We may ask you to confirm your identity first. We will respond within the time limits set by law.
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.
13.Changes to this policy
We may update this Privacy Policy from time to time. The latest version will always be on this page with the date it was last updated. Where a change significantly affects you, we will let you know by email or another suitable channel.
Questions about your privacy?
Last updated: 26 October 2026
