BIOTIME Privacy Notice

1. Who We Are

Amintara Group Co., Ltd. operates the BIOTIME brand in Thailand. For processing activities in which Amintara Group determines the purposes and means of processing, Amintara Group acts as the personal data controller under applicable Thai data-protection law.

2. Scope

This Notice applies to personal data processed by or on behalf of BIOTIME in connection with the website, Membership purchase and administration, MY BIOTIME, appointments, Club access, customer support, service communications, marketing where applicable, payments, security and related operations. Separate notices may apply to CCTV, cookies, recruitment, vendors, Technogym-related processing or other specific activities.

3. Data We May Collect

Depending on how you interact with BIOTIME, we may process identification and contact data such as name, email address and mobile number; Membership and account data; preferred language; Membership status and history; purchase, payment and transaction identifiers; appointment and booking information; LINE linkage or identifiers where you connect LINE; profile image where you choose or are permitted to provide one; access or QR identifiers; communication and delivery status; customer-service correspondence; necessary operational notes; security and technical information; marketing preferences and consent records; and other information you choose to provide or that is reasonably necessary for the relevant service.

4. Data We Do Not Intend to Replicate from Technogym

BIOTIME's intended architecture does not replicate Technogym fitness, workout, health-screening, body-composition, Checkup/InBody or training-performance datasets into BIOTIME's proprietary Member database. Those functions are intended to remain within the Technogym ecosystem. However, authorized BIOTIME personnel may access, input or use information within Technogym/Mywellness where necessary to provide onboarding, screening, training assistance or related services. The precise legal roles applicable to Technogym/Mywellness processing depend on the relevant contractual and processing arrangements.

5. Technogym Accounts

Members are required to create their own Technogym account where necessary to use connected Technogym services and separately accept Technogym's applicable terms and privacy information. A Technogym account may be usable independently of BIOTIME and outside the Club. BIOTIME does not treat acceptance of BIOTIME documents as acceptance of Technogym's separate terms.

6. Sources of Personal Data

We may obtain personal data directly from you; through BIOTIME websites and MY BIOTIME; from payment and transaction processes; through LINE or other channels you choose to connect; from BIOTIME staff in the course of Membership administration; from security and access systems; and from service providers where lawful and necessary. Data processed within Technogym systems may also be accessible to authorized BIOTIME personnel as described above.

7. Purposes of Processing

We may process personal data to create and administer Memberships; process purchases, payments, refunds and accounting records; provide onboarding and appointments; manage access and Member status; deliver MY BIOTIME functions; communicate operational and contractual information; provide customer support; prevent fraud and misuse; maintain security; investigate incidents and complaints; comply with legal, tax, accounting and regulatory obligations; establish, exercise or defend legal claims; improve services; maintain technical systems; and, where an appropriate legal basis exists, provide marketing, offers, recommendations and event information.

8. Legal Bases

Depending on the activity, BIOTIME may rely on performance of or steps connected with a contract; compliance with a legal obligation; legitimate interests where permitted and appropriately balanced; consent where consent is required or selected as the appropriate basis; establishment, exercise or defense of legal claims; protection of vital interests or other bases permitted by applicable law. We do not rely on consent where another lawful basis is more appropriate merely to make Membership administration possible.

9. Sensitive Personal Data

Certain information, particularly health-related information, may constitute sensitive personal data under Thai law. BIOTIME does not intend to store Technogym health and fitness datasets in its proprietary Member database. Where BIOTIME personnel process sensitive data within Technogym/Mywellness or otherwise, such processing will be handled under an applicable legal basis and safeguards required by law. Where explicit consent is required, it will be requested separately rather than bundled into general Membership acceptance.

10. Emergency Contact Information

Where available within the relevant Technogym/Mywellness process, a Member may provide an emergency contact. Such information should be limited to what is reasonably necessary for emergency purposes. Members should ensure they have an appropriate basis to provide another person's contact details and, where practicable, inform that person.

11. Payments

Payment transactions may be processed through payment service providers such as Stripe or other supported providers. BIOTIME may receive transaction identifiers, payment status and other information necessary to administer the purchase, but payment providers independently process payment-card or other payment information under their applicable arrangements. BIOTIME does not require a production MY BIOTIME Wallet at initial launch.

12. LINE, Email and SMS

BIOTIME may use email, LINE and transactional SMS for necessary Membership, appointment, security, payment and service communications. These communications are distinct from optional marketing. Where LINE is linked, relevant LINE identifiers and delivery or linkage information may be processed to provide the requested functionality.

13. Marketing

Where legally permitted, BIOTIME may send offers, promotions, recommendations, event information or information about additional services through channels including LINE, email or SMS. Marketing is not a condition of purchasing a Membership. Where consent is required, it will be obtained separately. You may withdraw or change marketing preferences through the available mechanisms without losing necessary service communications.

14. CCTV

BIOTIME may operate CCTV in areas such as the entrance, strength area, cardio area, lounge and bar for legitimate safety, security, incident-management and property-protection purposes. CCTV is not intended to operate in toilets, showers, changing areas or other high-privacy areas. Detailed information is provided in BT-CCTV-1.0.

15. Cookies and Online Technologies

BIOTIME websites may use strictly necessary technologies and, where implemented, analytics, preference or advertising technologies. Non-essential technologies will be managed in accordance with applicable law and the BIOTIME Cookie Policy and consent mechanism. Users should be able to manage applicable preferences where required.

16. Recipients and Service Providers

Personal data may be disclosed or made accessible where necessary to service providers supporting hosting, infrastructure, security, payments, communications, customer operations, professional advice, accounting, legal compliance and other legitimate business functions. Relevant providers may include Cloudflare, Stripe, LINE, transactional email infrastructure, ThaiBulkSMS and other providers actually used by BIOTIME. The role of each provider depends on the relevant service and contractual arrangement.

17. International Transfers

Some service providers or technology platforms may process or store personal data outside Thailand. Where a cross-border transfer is subject to Thai data-protection requirements, BIOTIME will use an appropriate transfer mechanism or safeguard as required by applicable law. The actual transfer locations and mechanisms depend on the providers and services in use.

18. Security

BIOTIME applies reasonable technical and organizational measures appropriate to the nature of the data and risks involved, including access controls, authentication measures, role-based access where appropriate, system security, vendor controls, staff confidentiality requirements and incident-response procedures. No information system can be guaranteed absolutely secure.

19. Retention

BIOTIME retains personal data only for as long as reasonably necessary for the relevant purposes, contractual relationship, legal obligations, dispute resolution, fraud prevention, security or establishment, exercise or defense of legal claims. Retention periods vary by data category. Contract and acceptance evidence may be retained for a longer period where reasonably necessary to establish the applicable legal record. When data is no longer required, it will be deleted, destroyed, anonymized or otherwise handled in accordance with applicable law.

20. Membership and Acceptance Evidence

BIOTIME may retain evidence of purchases and contractual acceptance, including Membership or order identifiers, payment identifiers, acceptance timestamps, language, exact acceptance wording, applicable legal-document versions and other information reasonably necessary to establish the contractual record. Historical legal-document versions may be retained so that the terms applicable to a past transaction remain reproducible.

21. Your Rights

Subject to applicable Thai law and any lawful limitations or exceptions, you may have rights to request access to and copies of personal data; correction; deletion or destruction; restriction of processing; objection to certain processing; data portability where applicable; withdrawal of consent where processing relies on consent; and complaint to the competent supervisory authority. Withdrawal of consent does not affect processing already lawfully carried out before withdrawal.

22. Exercising Your Rights

Requests should be submitted through BIOTIME's official privacy or contact channels published on biotime.club. BIOTIME may take reasonable steps to verify identity before acting on a request and will respond within the period required by applicable law.

23. Data Breaches

BIOTIME maintains procedures for assessing and responding to personal-data incidents. Where a breach triggers a legal notification obligation, BIOTIME will notify the competent authority and/or affected individuals within the applicable legal requirements.

24. Automated Decisions and Profiling

BIOTIME does not intend at initial launch to make solely automated decisions through its proprietary systems that produce legal or similarly significant effects on Members. If this changes, this Notice and the relevant process will be reviewed and updated as required.

25. Children and Minors

Standard BIOTIME Membership is limited to persons aged 20 or above. BIOTIME does not intentionally offer standard Membership to minors. If BIOTIME later provides a specific service to younger persons, appropriate legal, consent and privacy arrangements will be implemented before that service is offered.

26. Changes to This Notice

BIOTIME may update this Notice to reflect changes in law, services, technology, providers or processing activities. The current version and effective date will be identified. Material changes will be communicated where required or reasonably appropriate.

27. Language

This Notice is available in Thai and English. Both versions are intended to communicate the same substantive privacy information. If interpretation differs, the Thai version will prevail to the extent required or permitted by applicable Thai law.

28. Contact and Complaints

Questions, privacy requests or complaints should be directed through the official BIOTIME privacy/contact channels published on biotime.club. Information about the competent Thai personal-data supervisory authority may also be provided through those channels or as required by law.