Privacy Policy

Purpose and Scope

1.1. This Privacy Policy (“Policy”) sets out the terms upon which Total Transformation Lab Pte. Ltd. (including TSquared Lab, TSquared Physio and TSquared Pilates) (“TSquared Lab”, “we”, “us” or “our”) collects, uses, discloses, transfers, stores, retains and otherwise processes Personal Data in Singapore pursuant to the Personal Data Protection Act 2012 and all subsidiary legislation (PDPA), including the Do-Not-Call (DNC) provisions and mandatory data breach notification obligations.

1.2. This Policy applies to Personal Data processed in connection with our websites (including https://tsquaredlab.com), mobile applications, physical premises and studios, training and therapy services, communications and events, CCTV systems, Wi-Fi networks and any other channels through which you interact with us (collectively, the “Services”).

1.3.By accessing or using the Services, submitting Personal Data to us or continuing to engage with us after updates to this Policy, you acknowledge that you have read and understood this Policy.

Definitions and Interpretation

2.1. “Personal Data” means data, whether true or not, about an individual who can be identified from that data or from that data and other information to which we have or are likely to have access.

2.2. “Processing” means any operation performed upon Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, alignment, combination, erasure or destruction.

2.3. “Data Intermediary” means a processor engaged by us to process Personal Data on our behalf.

2.4. “Third Party” means any person other than TSquared Lab or its Data Intermediaries.

2.5. Headings are for convenience and do not affect interpretation. Words in the singular include the plural and vice versa.

Lawful Bases and Consent Framework

3.1. We process Personal Data pursuant to the PDPA on one or more of the following bases: (a) express consent; (b) deemed consent (including deemed consent by contractual necessity and deemed consent by notification); and/or (c) applicable statutory exceptions (including for legitimate interests, investigations, emergencies and compliance with law).

3.2. Deemed consent by notification will be relied upon only where we have notified you of the intended purposes, allowed a reasonable opt-out period, assessed and documented the risks and adverse effects and implemented appropriate safeguards.

3.3. Legitimate interests will be relied upon where our legitimate interests outweigh any likely adverse effect on you, having implemented mitigation measures (e.g., data minimisation, access controls and reasonable opt-out where appropriate). We will document our assessment.

3.4. Where we rely on consent, you may withdraw consent at any time upon reasonable notice. Withdrawal may affect our ability to continue providing the Services.

Categories of Personal Data We Process

We may collect and process the following categories (non-exhaustive):

4.1. Identity & Contact: Name, date of birth, gender, nationality, addresses, email, telephone.

4.2. Government Identifiers: NRIC/FIN or passport only where (i) required by law, or (ii) necessary to accurately establish or verify identity for a permitted purpose (e.g., insurance claims, regulatory reporting, secure access). We do not collect or retain full NRIC/FIN numbers except in accordance with applicable guidelines.

4.3. Health & Fitness: Medical history, injuries, physiotherapy notes, training plans and goals, contraindications, nutrition preferences; collected with heightened confidentiality and role-based access controls.

4.4. Transactional & Financial: Package purchases, invoices, masked payment tokens via PCI-compliant processors.

4.5. Technical & Usage: IP address, device/browser identifiers, session logs, approximate geolocation, app telemetry, Wi-Fi association logs (where you join our network).

4.6. Visual & Access Control: CCTV footage at premises; booking or event photos; optional access credentials.

4.7. Communications & Preferences: Emails, messages, calls, survey responses, marketing preferences (opt-in/out), DNC status.

Collection Channels

5.1. Directly from you (onboarding forms, PAR-Q, physiotherapy intake, check-ins, communications, contests and events).

5.2. Automatically via our websites/apps (cookies, pixels, SDKs) and on-premise systems (CCTV, access logs).

5.3. From authorised Third Parties (e.g., insurers, healthcare professionals, referral partners) where you authorise such disclosures or where permitted by law.

Purposes of Processing

6.1. Primary Purposes: Provision and administration of Services; programme personalisation; scheduling and reminders; identity verification; safety and incident management; billing and account administration; customer care; quality assurance.

6.2. Operational & Compliance Purposes: Audits, analytics, testing, service improvement; fraud prevention; security (including CCTV and access control); legal/regulatory compliance; response to regulators or courts; insurance and claims management.

6.3. Marketing & Engagement: Sending service notices and-with consent and DNC compliance-promotional offers, event invitations and content by email/SMS/phone/online advertising; preference management; creation of lookalike/retargeting audiences using de-identified or hashed identifiers. We verify DNC status within the statutory window before sending specified messages unless we hold clear and unambiguous consent in evidential form, and we honour opt-outs within the statutory timeline.

6.4. Research & Statistics: Aggregated or anonymised analytics and reporting. We will not re-identify anonymised data.

Cookies, Pixels, SDKs and Similar Technologies

7.1. We use first-party and third-party cookies, pixels and SDKs for session management, user preferences, performance monitoring and delivery of personalised content and advertising.

7.2. You may configure your browser/device to reject cookies; disabling certain cookies may affect functionality.

7.3. Where third-party tools act as independent controllers, their privacy terms apply in addition to this Policy.

Disclosure to Third Parties

8.1. We may disclose Personal Data to:

8.1.1. Data Intermediaries performing services for us (hosting/cloud, CRM/booking platforms, payment processors, communications providers, document management, analytics, cybersecurity, marketing platforms, customer support), under written contracts imposing PDPA-comparable protections,

8.1.2. Professional advisers (legal, audit, insurance),

8.1.3. Healthcare professionals involved in your care (with consent or as permitted by law),

8.1.4. Law enforcement, regulators, courts and government agencies as required or permitted by law, and

8.1.5. A purchaser or successor in the event of a corporate transaction, subject to confidentiality.

8.2. We do not sell Personal Data.

Cross-Border Transfers

9.1. Personal Data may be transferred outside Singapore (e.g., to cloud infrastructure or overseas support teams) where necessary for the purposes stated.

9.2. We shall ensure overseas recipients are bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA, including the use of appropriate contractual clauses or other recognised safeguards.

Data Security

10.1. We implement administrative, technical and physical safeguards proportionate to risk, including least-privilege access, authentication, encryption in transit where appropriate, firewalls, network segmentation, logging and monitoring, vulnerability management, secure development practices and staff training.

10.2. Access to health/therapy notes is restricted to authorised personnel (e.g., AHPC-registered physiotherapists and assigned care teams) on a need-to-know basis.

Retention and Destruction

11.1. We retain Personal Data only for as long as necessary for the purposes stated or as required by law.

11.2. Illustratively and subject to operational needs/legal requirements

11.2.1. Physiotherapy/training records: Up to seven (7) years after your last engagement,

11.2.2. Payment and accounting records: Five (5) years from transaction,

11.2.3. CCTV footage: Typically, fifteen (15) days, unless required for investigation or proceedings,

11.2.4. Access control logs: Typically, twelve (12) months,

11.2.5. Marketing preferences/consents and DNC-check logs: Up to twenty-four (24) months after last marketing contact for evidential purposes.

11.3. Upon expiry of retention, data will be securely destroyed or anonymised.

Your Rights: Access, Correction and Withdrawal

12.1. You may submit a written request to: (a) Access your Personal Data; (b) Correct inaccuracies; and/or (c) Withdraw consent.

12.2. We will respond within thirty (30) days or inform you of any additional time required where appropriate.

12.3. We may charge a reasonable administrative fee reflecting incremental costs; any fee will be notified in advance.

12.4. We may refuse, redact or limit access where permitted by law (e.g., unreasonably repetitive requests, disproportionate burden, third-party data).

Do-Not-Call (DNC) Registry

13.1. We do not send specified messages (voice, text, fax) to Singapore numbers listed on the DNC Registers unless we have clear and unambiguous consent in evidential form or another DNC exception applies.

13.2. Where consent is not relied upon, we will check the DNC Registers within the statutory validity period before sending the specified message and will cease sending such messages within the statutory period following an opt-out.

Children and Minors

14.1. For individuals under eighteen (18) years, the parent or legal guardian must provide or authorise consent to the collection, use or disclosure of Personal Data and may be required to be the contracting party.

14.2. We reserve the right to request verification of the parent’s/guardian’s identity and authority.

CCTV and In-Studio Recordings

15.1. Our premises may be monitored by CCTV for safety, security and incident investigation

15.2. Footage may be disclosed to law enforcement, insurers or other parties where required or permitted by law.

15.3. Promotional photos or recordings featuring identifiable individuals will be used only with consent, which may be withdrawn prospectively at any time.

Data Breach Management and Notification

16.1. We maintain a breach response plan encompassing containment, assessment, notification and post-incident review.

16.2. Where a data breach is notifiable (e.g., likely to result in significant harm to individuals or of significant scale), we will notify the Personal Data Protection Commission (PDPC) as soon as practicable and within the prescribed timeline after determining that the breach is notifiable, and notify affected individuals where required.

Third-Party Sites and Services

Our Services may link to Third-Party sites or integrate Third-Party SDKs or plugins. We are not responsible for the privacy practices of such Third Parties; their privacy policies govern their processing.

Changes to this Policy

18.1. We may amend this Policy from time to time to reflect legal, regulatory or operational changes.

18.2. We will post updates on our website and, where material changes are made, provide additional notice (e.g., email/SMS or prominent in-app/premises notices).

18.3. Continued use of the Services after the effective date signifies acceptance of the revised Policy.

Governing Law

This Policy and any dispute or claim arising out of or in connection with it shall be governed by, and construed in accordance with, the laws of Singapore.

Name: Utso Bhattacharya (Data Protection Officer)
Email: utso@tsquaredlab.com
Address: 991F Alexandra Road #01-28, Singapore 119974