LIMITLESS ME — PRIVACY POLICY

Limitless ME is a UK-based breathing and wellbeing application providing guided breathing practices, breathwork audio experiences, daily resets and related wellbeing content.

Limitless ME has been designed according to the principles of privacy by design and data minimisation.

Users are not required to provide their name, personal email address, telephone number, date of birth or other directly identifying information in order to receive an allocated account and use the standard functionality of the App.

This Privacy Policy explains how information associated with the App is handled.

Limitless ME is intended and provided for use by organisations and users located in the United Kingdom only.

The App and its services have been designed with reference to applicable UK law, including the UK GDPR and Data Protection Act 2018.

By accessing the service, users confirm that they are using Limitless ME within the United Kingdom.

The availability or technical accessibility of the App outside the United Kingdom does not constitute an offer of the service in another jurisdiction.

Limitless ME primarily operates using a business-to-business licence model.

An organisation may purchase or receive access to a specified number of Limitless ME user accounts for its employees, members or authorised users.

For example, an organisation purchasing 100 licences may receive 100 randomly generated user accounts.

These accounts are allocated using randomly generated identifiers rather than personal identities.

Limitless ME does not require the organisation to provide us with the employee's:

• name;
• personal email address;
• telephone number;
• home address;
• date of birth; or
• other directly identifying profile information

for the purpose of creating a standard user account.

Each user may access Limitless ME using a randomly generated account identifier or access credential.

For example:

LME-847291

The purpose of this system is to minimise the amount of personal information required to operate the service.

The random account identifier is used to:

• authenticate access to the App;
• confirm that the account belongs to an authorised corporate allocation;
• maintain the functionality of the account;
• manage licence availability;
• maintain security; and
• prevent unauthorised use.

Limitless ME does not need to know the real-world identity of the individual using a randomly allocated account for the standard operation of the App.

However, a random identifier may still constitute personal data under UK data protection law where it can reasonably be linked to an identifiable individual. We therefore handle account identifiers and associated technical information with appropriate data protection safeguards.

Limitless ME does not require users to provide:

• full name;
• personal email address;
• telephone number;
• postal address;
• date of birth;
• gender;
• photographs;
• contacts;
• financial information;
• medical records; or
• employment records

to create or use a standard allocated account.

Users should not enter personal, medical or confidential information into the App unless a particular feature expressly requests it and explains why it is required.

Although individual users are allocated randomised accounts, we may need to process limited information concerning the organisation purchasing or administering Limitless ME licences.

This may include:

• company or organisation name;
• business contact details;
• number of licences purchased or allocated;
• billing and transaction records;
• contractual information; and
• communications with authorised representatives of the organisation.

This information relates to administration of the commercial relationship rather than creation of individual employee profiles.

When an individual uses an application or online service, certain technical information may be processed automatically by the App, hosting infrastructure or technology providers.

Depending upon the technical configuration of Limitless ME, this may include:

• IP address;
• device type;
• operating system;
• App version;
• login timestamps;
• security information;
• diagnostic information;
• crash reports; and
• technical logs.

We aim to minimise such processing and use technical information only where reasonably necessary for operating, securing, maintaining and improving the service.

We do not use technical information to intentionally identify individual employees unless necessary for security, fraud prevention, legal compliance or investigation of misuse.

Limitless ME provides breathing and wellbeing content.

The standard App is not intended to create individual medical profiles.

Where possible, breathing activities should remain associated only with the randomly generated user account rather than a user's real-world identity.

Users should not provide medical records, diagnoses or other sensitive health information unless specifically requested through a feature that clearly explains how that information will be processed.

An organisation providing employees with access to Limitless ME does not automatically receive access to an employee's private breathing activity.

The purpose of the corporate licence is to provide access to the service rather than to create an employee surveillance system.

Unless a separate feature expressly states otherwise, Limitless ME will not provide an employer with identifiable information about:

• which breathing sessions an individual employee selected;
• an employee's personal wellbeing information;
• an employee's medical information; or
• private information entered by an employee.

Where organisational statistics are provided, our preference is to provide anonymous or aggregated information wherever reasonably possible.

Any future functionality involving identifiable employee reporting will require appropriate transparency and consideration of the applicable lawful basis before implementation.

Limitless ME does not sell individual users' personal information.

Information associated with randomly generated accounts will not be sold to advertisers or data brokers.

Limitless ME is not designed around behavioural advertising.

We do not intend to create advertising profiles of employees based on their breathwork activity.

We do not intend to use breathing activity to target individual employees with third-party advertising.

Information may be processed where reasonably necessary to:

• provide access to Limitless ME;
• validate allocated licences;
• authenticate randomised accounts;
• deliver breathing content;
• maintain the App;
• protect the security of the service;
• diagnose technical problems;
• prevent unauthorised access;
• provide support;
• manage corporate subscriptions and licences;
• comply with applicable legal requirements; and
• improve reliability and functionality.

Limitless ME follows the principle that information should not be collected merely because it could potentially be useful.

Where functionality can reasonably be provided without knowing the identity of an individual user, our intention is to provide that functionality without requiring their identity.

This principle forms part of the design of the corporate random-account system.

Limitless ME may rely on technology providers for services such as:

• hosting;
• cloud infrastructure;
• databases;
• authentication;
• security;
• application distribution;
• diagnostics; and
• technical support.

Such providers may process limited technical information necessary to provide their services.

Where a service provider processes personal data on our behalf, appropriate contractual and data protection arrangements will be used as required by UK law.

Limitless ME is intended for users in the United Kingdom.

Some technology providers may nevertheless operate infrastructure outside the United Kingdom.

Where personal data is transferred internationally, appropriate safeguards required by UK data protection law will be used where applicable.

We take reasonable technical and organisational measures designed to protect information against unauthorised access, loss, alteration, disclosure or misuse.

Randomised accounts also reduce the amount of directly identifying information stored within the App.

Users are responsible for keeping their allocated access credentials secure and should not intentionally share their account credentials with unauthorised persons.

Information will be retained only for as long as reasonably necessary for the purpose for which it is processed.

Randomised accounts may be deleted, deactivated or recycled following expiry or termination of the relevant corporate licence, subject to appropriate security and data-retention requirements.

Technical logs may be retained for limited periods where necessary for security, troubleshooting and legal compliance.

Corporate contractual and financial records may be retained for longer periods where required for accounting, taxation or other legal purposes.

Because individual accounts are randomised and may not contain an email address or verified real-world identity, deletion requests may require the user to provide their allocated Limitless ME account identifier.

A user may request deletion of information associated with their randomised account through the deletion mechanism provided by Limitless ME.

Where applicable, users may also contact:

info@karolkrupa.com

and provide their randomly generated Limitless ME account identifier.

Users should not send unnecessary identity documents or sensitive personal information when making a deletion request.

Where information associated with a randomised account constitutes personal data under UK law, users may have applicable rights including rights of:

• access;
• rectification;
• erasure;
• restriction;
• portability;
• objection; and
• withdrawal of consent where processing relies upon consent.

Some rights depend upon the circumstances and legal basis for processing.

Because Limitless ME intentionally does not know the identity behind standard randomised accounts, we may need the relevant account identifier to locate information associated with a request.

We will not unnecessarily collect additional personal information merely to identify a user where the request can reasonably be handled using their random account identifier.

Limitless ME is a breathwork and general wellbeing application.

It is not intended to provide medical diagnosis, emergency healthcare or personalised medical treatment.

Users should follow all safety instructions associated with breathing exercises and stop an exercise if they feel unwell.

The standard Limitless ME service is intended for users aged 18 years and over.

The standard corporate App is not intended for children.

Any future service specifically provided to schools or children would be subject to separate privacy, safeguarding and age-appropriate design considerations.

We may update this Privacy Policy where the App, technology providers, functionality or applicable legal requirements change.

The current version will display the date on which it was most recently updated.

Questions about privacy, randomised accounts or deletion requests may be sent to:

Limitless ME / Limitless Breath Academy

Email: info@karolkrupa.com

Users who have concerns about the handling of their personal data may contact us using the details above.

Individuals also have the right to raise a complaint with the Information Commissioner's Office (ICO) where applicable.

Limitless ME has been designed around a simple principle:

We do not need to know who you are to help you breathe.

Where possible, individual access is provided through randomised identifiers rather than personal profiles.

Our objective is to collect and process only the information reasonably necessary to provide a secure and effective breathing experience.