Privacy Policy

1. Introduction

At Physique by Sari (physiquebysari.com), operated by Sarani Tillekeratne in Colombo, Sri Lanka, we respect your privacy and are committed to safeguarding the personal information you entrust to us.

This Privacy Policy sets out how we collect, process, store, and protect your personal, health-related, and financial data in compliance with the Personal Data Protection Act (PDPA No. 9 of 2022) of Sri Lanka and international data privacy standards.

2. Information We Collect

To provide customized, science-backed fitness coaching and nutrition programming, we collect information across the following categories:

• Personal Identification & Contact Details: Your full name, email address, mobile/WhatsApp telephone number, and residential city.
• Fitness, Physical & Lifestyle Diagnostics: Age, gender, height, current body weight, target fitness goals, lifestyle habits, activity levels, dietary preferences/allergies, and self-reported health history (including PCOS diagnoses, insulin resistance metrics, and past injuries) provided voluntarily in intake questionnaires.
• Transactional & Order Information: Purchased program details, transaction reference numbers, order timestamps, and payment status verification receipts.

3. How We Use Your Information

We process your information strictly for legitimate coaching and operational purposes:

• Formulating bespoke workout schedules, macronutrient targets, and lifestyle advice tailored to your physiology.
• Scheduling and executing 1:1 online coaching calls via Google Calendar and video conferencing.
• Dispatching one-time security passwords (OTP) via SMS for verification and authentication.
• Generating official electronic payment receipts and order status confirmations.
• Providing ongoing WhatsApp coaching support and progress monitoring.
• Maintaining compliance with commercial and taxation records mandated by Sri Lankan law.

4. Payment Security & PayHere Gateway Integration

All online debit card, credit card, and internet banking transactions on our platform are processed directly through PayHere, an approved payment service provider authorized by the Central Bank of Sri Lanka (CBSL).

• Zero Card Storage Policy: Physique by Sari never stores, views, or captures your full 16-digit payment card number, CVV/CVC security codes, or card PIN numbers on our databases or web servers.
• Your payment details are encrypted using banking-grade 256-bit TLS/SSL encryption and transmitted directly to PayHere's PCI-DSS Level 1 certified vault.
• PayHere transmits only masked token confirmations (such as payment status, transaction ID, and card brand) back to our system to activate your coaching program.

5. Data Sharing & Third-Party Service Providers

We never sell, rent, lease, or trade your personal or health data to third-party advertisers or data brokers.

We share limited data exclusively with trusted technical infrastructure providers necessary to fulfill coaching services:

• Payment Processing: PayHere (PayHere Private Limited, Sri Lanka).
• SMS Gateway: Licensed Sri Lankan telecommunications gateway for OTP verifications and payment alerts.
• Cloud Hosting & Database: High-security encrypted cloud infrastructure with daily automated backups.
• Legal Disclosures: We disclose information only if required by a formal subpoena or statutory directive issued by a court of competent jurisdiction in Sri Lanka.

6. Data Retention & Protection Measures

We retain your intake diagnostics and coaching records for the duration of your active program and a reasonable period thereafter to enable seamless progression into subsequent coaching cycles.

We enforce modern industry security safeguards, including HTTPS protocol encryption across all web traffic, hashed user authentication, strict database firewall rules, and restricted administrative dashboard access.

7. Your Privacy Rights

Under the Sri Lanka Personal Data Protection Act, you possess the right to:

• Access the personal health and contact data we maintain about you.
• Request corrections to incomplete or inaccurate personal records.
• Request the deletion or anonymization of your profile and data once your coaching engagement concludes.
• Opt out of non-essential transactional communications at any time.

8. Privacy Inquiries & Data Protection Contact

For any questions, requests for data review, or concerns regarding our privacy practices, please contact our Data Protection Desk:

Physique by Sari — Data Privacy Desk
Attn: Sarani Tillekeratne
Email: info@physiquebysari.com
Telephone / WhatsApp: +94 77 846 3717
Operating Jurisdiction: Colombo, Sri Lanka