How GymX24 handles personal data in the GymX24 app, the member web app and the gym console.

1. Who we are

GymX24 is a gym management platform made up of the GymX24 mobile app (for members and gym staff), the member web app and the gym console. It is provided by Anantavya Techworks Pvt. Ltd, [Registered office address, India] ("GymX24", "we", "us").

This policy explains what personal data the platform handles, why, who it is shared with, how long it is kept, and the choices and rights you have. It applies to gym members, people who join or enquire through a gym, gym staff and gym owners.

2. Your gym and us

Gyms use GymX24 to run their business. When you are a member of a gym that uses GymX24, your gym decides what it records about you and why. Under India's Digital Personal Data Protection Act, 2023, your gym is the Data Fiduciary for your member data, and we process it on the gym's behalf as its Data Processor. Questions about how your gym uses your data, and most requests about it, are best sent to your gym; we will help them answer.

For the accounts of gym owners and staff, and for running and securing the platform itself, GymX24 is the Data Fiduciary.

3. What we collect

• Identity and contact: your name, mobile number, email address, postal address, gender, date of birth and an emergency contact. For members under 18, a parent or guardian's details.
• Health and fitness details your gym records or you add: blood group, medical notes, body measurements, weight, progress photos, and workout and diet plans from your trainer.
• Photos: a profile photo, and progress photos only when you choose to take or add them.
• Membership and visits: your plans, class and personal training bookings, freezes, check-ins and check-outs (including when you scan a door's QR code, which door and when), and feedback you give.
• Payments: invoices, receipts, amounts, payment method (for example UPI or card) and the reference from the payment gateway. We never receive or store your full card number, CVV, UPI PIN or bank login.
• Forms and consents: waivers you sign (your typed name and signature) and the consents you give or withdraw, with the time and how they were recorded.
• Messages: the WhatsApp, SMS and email messages the gym sends you through the platform, and your replies on WhatsApp to the gym.
• Device and app: a push notification token (if you allow notifications), the app version, and technical logs (such as IP address and request times) used for security and to fix problems.
• Staff: name, email, mobile number, role and branches, work attendance (clock in and out), and salary details for payroll.

We do not collect your location, contacts, call logs, SMS inbox or microphone audio, and the app shows no advertising.

4. Camera and photos

The app asks for camera access to:

• scan the QR code on your gym's door, to check in;
• take progress or profile photos;
• for staff, scan members' check-in codes.

Scanning reads the code only; no picture is saved. A photo is uploaded only when you take or choose one and save it. Access to your photo library is used only when you pick a photo to add.

5. Fingerprints and face recognition

Some gyms use fingerprint or face devices at the door. Your gym asks for your separate consent before enrolling you. The fingerprint or face template is stored on the gym's device and matched there; our servers receive only who checked in and when, never the template. You can withdraw this consent and ask your gym to remove you from the device at any time.

6. Why we use it

• To run your membership: sign-in, check-in at the desk, kiosk or door, bookings, plans, attendance and progress tracking.
• To bill and take payments: issue GST invoices and receipts, and run autopay if you set it up.
• To send you messages your gym has set up: sign-in codes, receipts, renewal and payment reminders, class reminders and, only if you agree, offers and news.
• To keep the platform secure: verify sign-ins, prevent fraud and misuse, and keep an audit log of changes to money and access.
• To meet legal duties: keep tax records and answer lawful requests.
• To support and improve the service: for example, fix errors and answer your questions.

We process data on the basis of the consent you give (which you can withdraw), and for the legitimate uses the law allows, such as providing the service you asked for and complying with law. We do not sell personal data and do not use it for advertising.

7. Who we share it with

We share data only with the service providers needed to run the platform. Each is bound to protect the data and use it only for that purpose.

• Your gym and its staff, according to their role and branches.
• Payment gateways your gym uses to collect payments, such as Razorpay, PhonePe, Cashfree, PayU, Paytm, Stripe or PayPal, and card machine providers such as Pine Labs. They receive the amount and the contact details needed for the payment, under their own privacy policies.
• Messaging providers: Meta (WhatsApp Business), our SMS provider (such as MSG91) and our email provider (such as Resend), to deliver the messages described above.
• Push notifications: Expo, and Google Firebase Cloud Messaging or Apple Push Notification service, which deliver notifications to your phone.
• Hosting and infrastructure providers that run our servers, databases and backups.
• Authorities, when the law requires it, or to protect the rights, safety and property of you, your gym, other people or GymX24.
• A buyer or successor, if GymX24's business is transferred, under the same protections.

8. Where it is kept

Data is stored on servers we use for the platform, which we aim to keep in India. Some of the service providers above (for example messaging, push or payment providers) may process data outside India. Where they do, it is under contracts that protect it and as permitted by Indian law.

9. How long we keep it

• Member data is kept while your membership is active, and afterwards for as long as your gym needs it to serve you or the law requires.
• Invoices, receipts, credit notes and payment records are kept for as long as tax law requires (in India, up to eight years).
• Security and audit logs are kept for a limited period.

When data is no longer needed, or when you ask and the law allows, it is deleted or made anonymous. Copies in backups are removed as those backups expire.

10. How we protect it

• Data is sent over encrypted connections (TLS) and stored encrypted.
• Each gym's data is kept apart in the database itself, and staff only see what their role allows.
• Sensitive actions such as refunds need a manager's approval code and are written to an audit log.
• Payment gateway keys and similar secrets are stored encrypted.
• Sign-in codes are one-time and expire.

No system is perfectly secure. If a breach affecting your data occurs, we will inform you and the authorities as the law requires.

11. Your choices and rights

Subject to the law, you can:

• Ask for a summary of your personal data and how it is used, or a copy of it (gyms can export a member's data from the console).
• Ask for incorrect or incomplete data to be corrected, or update some details yourself in the app.
• Withdraw a consent, such as for WhatsApp, SMS or email messages, marketing, photos or biometrics, in the app's profile or by asking your gym. Withdrawing does not affect what was done before.
• Ask for your data to be erased. Your gym can erase a member's personal details; records that tax law requires us to keep, such as invoices, are kept with the minimum details needed.
• Nominate someone to exercise these rights if you die or become unable to.
• Make a complaint to our Grievance Officer and, if you are not satisfied, to the Data Protection Board of India.

To use these rights, ask your gym, or write to [privacy email, e.g. privacy@gymx24.com] from the mobile number or email your gym has on record, so we can confirm it is you. We answer within the time the law sets. You can also stop messages by replying STOP to a gym's WhatsApp message.

12. Deleting your account

Gym members' accounts are created and held by their gym. To delete your account and data, ask your gym at the desk or through the app, or write to [privacy email] with your name, mobile number and gym. We will make sure it is done, or tell you what the law requires us to keep and for how long. Gym owners can ask us to close their gym's account the same way.

13. Children

Members under 18 can only be registered by their gym with the verified consent of a parent or guardian, which the platform records. We do not knowingly use children's data for tracking, behavioural monitoring or targeted advertising. If you believe a child's data was recorded without consent, contact us and we will help remove it.

14. Changes to this policy

We may update this policy as the platform or the law changes. The date at the top shows the latest version. If a change significantly affects how your data is used, we will tell you in the app or by message before it takes effect.

15. Contact and grievances

We acknowledge complaints within 48 hours and aim to resolve them within 30 days.