1Who this is from, and who it covers
Caytra is a trading name of Sentium Pte. Ltd., a company incorporated in Singapore (UEN 202617708M). We are responsible for the personal data described here, and we handle it under the Personal Data Protection Act 2012 ("PDPA").
This notice covers anyone who books a session with us, anyone referred to us who has been in touch, and anyone who visits caytra.com.
It sits alongside our Client Terms. Where the Terms describe what we do, this describes what we hold while doing it.
Our Data Protection Officer can be reached at privacy@caytra.com, or by post at the address above. Every request, question or complaint about your information goes there.
2What we collect
2.1Who you are. Your name, email address, mobile number, and the fact that a particular practitioner referred you, where one did.
2.2Payment. Your payment is handled by Stripe. We never see or hold your card number. What reaches us is a record that a payment was made, the amount, the date, and the name and email on it.
2.3What you send us before a session. Whatever you choose to send — recent results, a scan report, a letter from a specialist, a list of what you are taking, screenshots or exported files from a wearable. You decide what to send; we ask you not to chase anything you would have to request.
2.4What you tell us in a session. How you train, what you eat, how you sleep, what your week does to you, what you are taking, what you are worried about, and what you want to be true in six months.
2.5The transcript of a session. See section 4 — it has its own rules.
2.6What we write. Your prioritised recommendations, our working notes, the introductions we make on your behalf, and what we hear back.
2.7Correspondence. Our WhatsApp and email threads with you.
2.8How you are getting on. What you tell us at check-ins after a session, including whether a coach or practitioner we introduced you to is working out.
2.9The website. caytra.com uses no analytics, no cookies and no tracking of any kind — the site loads no JavaScript at all. Our host, Netlify, keeps standard server logs including IP addresses, as any web server does. We do not read them to identify visitors.
Some of this is information about your health. We know that, and it is why the rest of this notice is written the way it is.
3Where it comes from
Almost all of it comes from you.
The rest comes from the practitioner who referred you — usually your name, a way to reach you, and why they thought we could help — and, where you have asked us to make an introduction, from the coach or practitioner we introduced you to, telling us how it is going.
We do not buy information about you, and we do not build a picture of you from anywhere else. Today we have no access to your wearable, health app or clinical accounts — only to the screenshots and exported files you choose to send us.
If we ever build a way to connect to one of them directly, it will be something you switch on rather than something that happens. We will ask, we will tell you exactly what we would be able to see and how often, and you can say no, or turn it off later. It will never be a condition of working with us, and we will not connect to anything on the strength of your having agreed to this notice.
4How sessions are captured, and how we use AI
4.1What gets captured, and where. Sessions happen over video and in person. Video calls are usually on Google Meet, sometimes on WhatsApp, and occasionally elsewhere if that is what suits you. Either way, the session is transcribed by an AI note-taking tool — Jamie.
The audio is not saved. It is processed to produce the transcript and then it is gone. What exists afterwards is text, not a recording of your voice. The same applies to sessions where a partner coach or practitioner is with us, whether that is on a call or in the room.
4.2You are told at the outset, not asked every time. This is how we work, and we say so plainly at the start, rather than putting the same question at the top of every session. You will know the standing arrangement before the first one.
4.3You can decline, and you can stop it at any point. You can tell us not to transcribe at all, or to stop for part of a conversation, or to stop for the rest of a session. Say so and we do it. You do not have to explain why, and you can change your mind in either direction at any time.
4.4Why we do this. Two reasons, both of them about you. The first is that the person you are speaking to is listening to you rather than typing. The second is that this work runs on detail — what you actually said, in your words, and the thing you mentioned once in passing three months ago and would never think to repeat. The longer we work together, the more that matters.
Everything we collect exists to make what we recommend better. We are not gathering it because it might be useful one day. We are gathering it because the quality of what you get back depends on it.
4.5What declining costs you — said straight. We will still work with you, and the hour will still be worth having. But we will be working from notes rather than from what was said, and the more you ask us to hold across time, the more that gap shows. It is your call, and we would rather you made it knowing that than have us pretend it makes no difference.
4.6The transcript is working material. We use it to write your recommendations, to coordinate what follows, and to keep an accurate account of what was said. It is not used for marketing, not sent to any practitioner, and not used to train AI models.
4.7The tool holds the transcript on its own systems as well as ours. That is one of the reasons declining is a real option and not a formality.
4.8We keep transcripts for 12 months after your last session, then delete them, from our own storage and from the tool. There is no audio to delete, because none was kept.
4.9We use AI beyond transcription, and here is exactly how. It helps us prepare and it helps us think: summarising what you have sent, pulling together what was said across several sessions, drafting parts of your recommendations, and checking what the evidence actually says about something you have asked about. Today that means the note-taking tool, the AI built into Notion, and general assistants such as Google's Gemini.
We would rather tell you this plainly than leave you to assume it. It is a normal part of how the work gets done, and it is one of the reasons a small practice can hold as much detail about you as this one does.
4.10The rules we hold ourselves to.
- Nothing your information goes into is training a model on it. We use the business settings where that is switched off, and we check that before adopting anything new.
- A person decides. AI helps us prepare, summarise and draft. It does not decide what we recommend to you. Nothing reaches you that Arun has not read and is not prepared to stand behind.
- We use the least identifiable version that does the job. Where a question can be asked without your name attached to it, it is.
4.11What we do not do with it. We do not use AI to form conclusions about you that we then pass on unread. We do not put your information into anything that profiles you commercially or advertises to you. And nothing about you is used to build something for anybody else.
4.12If this changes. These tools move quickly. If we adopt one that handles your information differently from what is described here, that is a material change under section 15, and we tell you rather than leaving you to notice.
5Why we use it
| What for | What that means |
|---|
| To deliver the session | Reading what you sent, running the hour, writing your recommendations |
| To coordinate | Making introductions, briefing a coach, arranging an assessment |
| To follow up | Checking how you are getting on, and whether what we set up is working |
| To keep the relationship going | Booking, rescheduling, answering you on WhatsApp or email |
| To run the business | Taking payment, keeping accounts, meeting our tax obligations |
| To get better at this | Understanding what helped, across the people we work with. Wherever this does not need to be about you by name, it isn't |
| To handle a complaint | Being able to show what was actually said and recommended |
Under the PDPA we rely on your consent for the great majority of this, given when you accept our Client Terms and again at the specific moments described in section 6. Some of it we do because the law requires it — keeping financial records, for instance.
We do not sell your information. We never have and we will not.
6Who we share it with, and the rule we follow
The rule: you will know before information about you goes anywhere. Who is receiving it, what it is, and why. If you would rather see it first, ask, and you will.
6.1Our own team. Arun, and our head of concierge. As we grow, others working on your behalf. Access is limited to the people doing the work.
6.2The practitioner who referred you. Where you want it, we send them a short summary of what we have put in place — the changes, the people, the timelines. It is a note on what we have done, not a report on you.
6.3Coaches, practitioners and providers we introduce you to. They get what they need to start properly and no more. A strength coach being briefed on your goals does not need your history, and does not get it.
6.4We are not a postbox for your clinical information. There is a difference between the two kinds of paper here, and it matters.
What we will send, where you want it: our own work. Your recommendations, and a short note on what we have put in place. We wrote it, so we can stand behind it.
What we will not send: anyone else's. If your physiotherapist wants your specialist's letter, or your doctor wants your scan report, that goes between them or through you — never through us. We do not forward results, letters or notes, and we do not hold them in order to pass them on.
Where two of the people looking after you need to be talking to each other, we say so, and we leave that conversation to them.
6.5Not your family, and not your partner. People will ask. A husband, a daughter, a friend who made the introduction — usually meaning nothing but well.
We do not confirm that you are a client. We do not say whether you have had a session, or when. We do not discuss anything about you with anyone connected to you unless you have told us we can. That holds even if the person asking is the one who paid.
If you want someone brought in — a partner doing this alongside you, an assistant who runs your calendar — tell us who, and for what, and we will. Until then, what happens between us stays between us.
6.6Our service providers. The systems the business runs on. They hold information because they host it, not because we have shared it with them to use:
| Provider | What it holds |
|---|
| Google Workspace — Drive, Docs, Gmail, Calendar, Meet | Client records, correspondence, files you send, appointments, sessions, backups |
| Notion | Client records and working notes |
| Stripe | Payment records. Stripe holds your card details; we never do |
| WhatsApp (Meta) | Our message threads with you, and some video calls |
| Jamie | Session transcripts, as set out in section 4. The audio is not retained |
| Notion AI · Google Gemini | Client material we ask them to summarise, draft from or check, on settings where the provider does not train on it |
| Netlify | Hosts caytra.com. Server logs only; no client information |
6.7Where the law requires it, or where someone is at serious risk. We disclose only what is necessary, and we tell you we have had to, unless we are not permitted to.
7Where it is held, and information leaving Singapore
We are based in Singapore and so are you, most likely. Several of the providers in section 6.6 are not — Google, Stripe, Meta and our note-taking tool store and process information outside Singapore, including in the United States and the European Union.
Under the PDPA's transfer limitation obligation, we take reasonable steps to satisfy ourselves that anything we send outside Singapore is protected to a standard comparable to the PDPA, through the contractual terms those providers offer.
8How long we keep it
| What | How long |
|---|
| Session transcripts — no audio is kept at any point | 12 months after your last session |
| Your records and recommendations, notes, correspondence | 3 years after we last work together |
| Payment and financial records | At least 5 years, because tax law requires it |
| Marketing consents and opt-outs | For as long as we are operating, so that an opt-out is never lost |
At the end of a period we delete or anonymise. Where something has been anonymised — a pattern across the people we work with, with nothing in it that points to you — we may keep it, because it is no longer information about you.
9How we look after it
Access is limited to the people doing the work — today that is Arun and our head of concierge. The accounts that hold your information carry two-factor authentication. Files are shared by named, permissioned links rather than open ones, and a link is closed when the work is done. We keep the number of places your information lives deliberately small.
We are a small team, and we would rather tell you what we actually do than list controls we do not have. If something goes wrong and your information is affected in a way likely to cause you significant harm, we will tell you and we will notify the Personal Data Protection Commission, as the law requires.
10Your rights
10.1Ask for a copy. You can ask what we hold about you and how we have used it. We will come back to you within 30 days, and tell you if we need longer.
10.2Ask us to correct it. If something we hold is wrong, tell us and we will fix it, and let anyone we have passed it to know.
10.3Withdraw your consent. You can withdraw any part of it, or all of it, at any time. It takes effect from when you tell us; it does not undo what has already been sent. Withdrawing may mean there is coordination we can no longer do for you, and we will tell you plainly if that is the case rather than quietly stopping.
10.4Ask us to delete it. Tell us and we will, except where we are required to keep something — financial records, or where we need it to defend a complaint you have made.
All of this goes to privacy@caytra.com.
11Email and WhatsApp
Messages about your own work with us — your booking, your recommendations, a check-in, an introduction we are making — are part of the service and are not marketing.
Anything else — a note about a new service, an event, something we think you would find useful — we send only if you have opted in, and never as a condition of anything. Every email carries an unsubscribe link, and you can tell us to stop on WhatsApp in exactly those words.
On WhatsApp specifically. We will not send you marketing messages on WhatsApp unless you have given us clear consent to that channel, separately from agreeing to be contacted about your session. Singapore's Do Not Call rules govern this and we take them seriously. Every marketing message will identify Caytra and tell you how to stop them.
Some of the numbers in our WhatsApp Business account belong to individual people on our team as well as to the business. We keep client conversations inside the business account.
12Children
Caytra is for adults. We do not work with anyone under 18 and we do not knowingly collect information about children. If we learn that we have, we delete it.
13If you are outside Singapore
We operate from Singapore, and your information is handled here under the PDPA.
If you are in the United Kingdom or the European Economic Area, data protection law there may give you additional rights — including to object to certain uses, to ask for your information in a portable form, and to complain to your local supervisory authority. Write to privacy@caytra.com and we will deal with your request under whichever standard gives you more.
14Complaints
Write to privacy@caytra.com. We will acknowledge within two business days and come back to you properly within ten.
If we have not resolved it, you can complain to Singapore's Personal Data Protection Commission at pdpc.gov.sg.
15Changes to this notice
The version and date at the top tell you which notice you are reading. If we change something material — a new tool that holds your information, a new category of person we share with — we will tell you directly rather than leaving you to notice.