Privacy Policy

This Privacy Policy applies to all personal data collected through the FitOS web portal, mobile applications, API services, reception check-in terminals, and customer support channels.

"Data Fiduciary": Any entity that determines the purpose and means of processing personal data.

"Data Principal": The individual to whom the personal data relates (Gym Owners, Trainers, Staff, and Members).

"Personal Data": Any data about an individual who is identifiable by or in relation to such data.

"Consent Manager": An interoperable entity registered under DPDP Act provisions to manage consent workflows.

For gym-specific member contracts and local physical rules, the Gym Owner acts as the primary Data Fiduciary, and FitOS acts as the Data Processor.

For platform authentication, core user accounts, security logs, and multi-tenant infrastructure, FitOS acts as an independent Data Fiduciary.

We process: (a) Identity and Contact data, (b) Membership records, (c) Attendance records, (d) Athletic workout logs, (e) Nutritional logs, (f) Biometric templates (where gym-enabled), (g) Billing records, and (h) Device telemetry.

Your mobile number is our primary cryptographic identity identifier. We use SMS/WhatsApp OTP verification to prevent unauthorized account hijacking.

You may optionally upload a profile photograph, specify gender, and list your emergency contact details for gym safety purposes.

Timestamped access logs are generated when you scan QR terminals or verify entry at a participating fitness facility.

We store workout routines, exercises, sets, repetitions, weights, and rest intervals you record within the mobile app.

Nutritional logs, meal timestamps, and macro totals submitted by users are processed to track dietary goals.

Where enabled by a gym facility, biometric hardware converts physical traits into irreversible mathematical hashes. Raw images are never uploaded or retained in cloud storage.

We store payment receipt IDs, GST invoices, and settlement status. All sensitive payment instruments are tokenized via PCI-DSS certified payment gateways.

We collect IP addresses, device hardware identifiers, OS build versions, and crash analytics to maintain system integrity.

We utilize essential HTTP cookies and local browser storage strictly for session authentication, security tokens, and theme preferences.

Data is processed to: (a) authenticate users, (b) record gym attendance, (c) compute training progression, (d) process subscriptions, and (e) safeguard platform security.

We process personal data based on: (a) Explicit Data Principal Consent, (b) Contractual Necessity to deliver requested software services, and (c) Compliance with statutory Indian laws.

FitOS presents separate, itemized consent checkboxes for Terms of Service, Privacy Policy, AI Personalization, and Marketing Communications. Essential service access is never contingent on consenting to optional marketing.

You may withdraw optional consent at any time via Settings -> Legal & Privacy. Upon withdrawal, processing of optional features ceases immediately without affecting core gym tools.

All consent transactions are cryptographically logged with user ID, IP address, user agent, document version, and timestamp to prove compliance.

Algorithmic models process historical exercise volume to suggest training recovery metrics. AI processing does not make automated legal decisions affecting your civil rights.

Users can independently disable AI-based routine generation and opt out of contributing anonymized training data in privacy settings.

We partner with enterprise sub-processors including AWS India (Cloud Hosting), Razorpay (Payments), and Gupshup/Twilio (SMS/WhatsApp). All sub-processors are bound by stringent Data Protection Agreements.

When you register under a gym, authorized staff and trainers of that gym can view your attendance logs, membership status, and assigned workouts.

FitOS never sells, rents, monetizes, or trades your personal data, workout metrics, or phone numbers to third-party brokers or advertisers.

We may disclose personal data only when required by valid court order, governmental investigative warrant, or statutory legal process in India.

All core user data is hosted within data centers situated in the Republic of India in accordance with DPDP cross-border transfer rules.

We maintain robust safeguards including TLS 1.3 in-flight encryption, AES-256 database encryption, role-based isolation, firewall defenses, and periodic penetration testing.

FitOS employees access production systems strictly under least-privilege protocols, MFA authentication, and immutable access logging.

In the event of a confirmed data breach impacting personal data, FitOS will notify affected Data Principals and the Data Protection Board of India in accordance with prescribed statutory timelines.

Data is retained as long as your account is active. Financial transaction records are retained for 8 years to comply with Indian tax regulations.

We collect only the minimum data required to deliver requested fitness features and securely purge obsolete temporary tokens after 90 days.

You have the right to obtain a summary of your personal data processed by FitOS, including the categories of data and processing purposes.

You have the right to correct inaccurate or misleading personal data directly via your profile settings or by contacting our team.

You can submit a formal account deletion request via Settings -> Legal & Privacy. Your data will be scheduled for permanent purge following a 30-day safety buffer.

You can download a structured machine-readable archive (JSON / CSV) of your workout history and profile metrics from the Settings portal.

Under the DPDP Act 2023, you have the right to nominate an individual who, in the event of death or incapacity, may exercise your data rights.

You have the right to readily available grievance redressal mechanisms through our designated Grievance Officer before escalating to statutory boards.

Grievance Officer: FitOS Compliance Desk

Email: [GRIEVANCE EMAIL]

Postal Address: [LEGAL ENTITY NAME], [REGISTERED ADDRESS]

Acknowledgement turnaround: within 24 hours. Resolution turnaround: within 15 business days.

If you are unsatisfied with our grievance resolution, you may lodge a formal complaint with the Data Protection Board of India (DPBI) pursuant to Section 28 of the DPDP Act, 2023.

FitOS does not knowingly process personal data of children under 18 years without verifiable parental consent obtained through the participating gym.

We do not engage in behavioral tracking or targeted advertising directed at children.

For individuals with disabilities, verified lawful guardians may provide consent and exercise data subject rights on their behalf.

We may aggregate and anonymize usage patterns (such as peak gym visit hours) to produce industry insights. De-identified data does not constitute personal data.

Administrative operations (member deletion, role elevation, data export) are immutably logged for security compliance and audit readiness.

FitOS may provide links to external partner services. We are not responsible for the privacy practices of third-party external applications.

Critical transactional alerts (OTP codes, billing receipts, security alerts) cannot be disabled. Promotional notifications can be toggled in profile preferences.

In the event of a corporate reorganization, merger, or asset transfer, user data will remain subject to the commitments made in this Privacy Policy.

We may periodically update this Privacy Policy. Substantive modifications will be highlighted via in-app notices requiring re-affirmation where required by law.

This Privacy Policy is governed by the Digital Personal Data Protection Act, 2023, Information Technology Act, 2000, and related Indian data rules.

Please review the Data Collection Table below for an itemized breakdown of categories, purposes, lawful bases, and statutory retention windows.

For questions, data subject access requests (DSAR), or privacy inquiries:

Privacy Desk: [PRIVACY EMAIL]

Support Desk: [SUPPORT EMAIL]

Entity: [LEGAL ENTITY NAME]