Privacy Policy

1. Who We Are

Gymatrix is a cloud-based gym management platform that enables fitness centers, gym owners, and their members to manage memberships, payments, scheduling, and communications.

For the purposes of applicable data protection laws:

• Gymatrix is the data controller for information collected directly from gym owners and platform administrators.
• Gym Owners are independent data controllers for the personal data of their gym members collected through the Platform.

2. Information We Collect

2.1 Information You Provide Directly

• Gym Owners: Name, email address, phone number, business name, gym address, GST number, bank account details (for payment processing and payouts)
• Gym Members: Name, email, phone number, date of birth, emergency contact, health/fitness goals, membership plan details, payment information
• Trainers & Staff: Name, contact details, qualifications, assigned schedule
• KYC Documents: PAN, Aadhaar, cancelled cheque or bank statement (for Razorpay linked account verification)

2.2 Information Collected Automatically

• Device information (browser type, OS, device ID for push notifications)
• Log data (IP address, pages visited, timestamps, referral URLs)
• Usage data (features used, actions taken, session duration)
• FCM tokens for push notification delivery

2.3 Information from Third Parties

• Payment status and transaction data from Razorpay
• Delivery and contact verification from SMS/email service providers

3. How We Use Your Information

We do not use your personal data for automated decision-making or profiling that produces legal effects without human review.

4. Sharing of Information

We do not sell your personal information. We may share it with:

4.1 Service Providers

• Razorpay — payment processing, linked account KYC, and payouts
• SMS/Email providers — transactional communications delivery
• Firebase (Google) — push notification delivery via FCM
• Cloud hosting providers — infrastructure and data storage

4.2 Gym Owners (for their Members)

Gym members' data is accessible to the gym owner through whose platform the member registered. We act as a data processor for member data on behalf of gym owners.

4.3 Legal Authorities

We may disclose information if required by law, court order, or to protect the rights, property, or safety of Gymatrix, its users, or the public.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy protections.

5. Payment Data

All payment card data is processed directly by Razorpay, a PCI DSS-compliant and RBI-authorised payment aggregator. Gymatrix does not store full card numbers, CVV, or UPI credentials.

We store:

• Transaction IDs and payment references
• Payment status (success, pending, failed, refunded)
• Amount and currency information
• Razorpay order and payment IDs for reconciliation

Bank account details (account number, IFSC, cancelled cheque) collected for Razorpay linked account creation and payout processing are stored securely and shared with Razorpay for verification purposes only.

6. Cookies & Tracking

We use the following types of storage mechanisms:

• localStorage / sessionStorage: Authentication tokens, user preferences, and session data stored in your browser for seamless login experience
• Functional cookies: Essential for platform operation (session management, security)
• Analytics cookies: Aggregate usage data to improve the platform (no personally identifiable profiling)

You can clear browser storage at any time through your browser settings. Note that clearing authentication tokens will log you out of the platform.

7. Data Retention

• Active accounts: Data retained for the duration of your subscription
• After account termination: Data retained for up to 30 days, after which you may request export. Post-30 days, data is permanently deleted unless legally required to be retained
• Financial records: Retained for 7 years as required under Indian tax laws
• KYC documents: Retained as required by Razorpay and RBI regulations
• Backup data: Securely purged within 90 days of account deletion

8. Data Security

We implement industry-standard security measures to protect your information:

• HTTPS/TLS encryption for all data in transit
• Encryption at rest for sensitive data fields
• Role-based access controls limiting data access to authorised personnel
• Regular security audits and vulnerability assessments
• Secure, hashed storage for passwords (bcrypt)

9. Your Rights

Subject to applicable law, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Portability: Request your data in a machine-readable format
• Withdraw Consent: Withdraw marketing consent at any time without affecting lawfulness of prior processing
• Grievance Redressal: File a complaint with our Grievance Officer (details in Section 12)

To exercise any of these rights, email us at privacy@gymsaas.in with your request. We will respond within 30 days.

10. Children's Privacy

The Platform is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent.

Gym members between the ages of 13–18 may use the Platform with parental or guardian consent. If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify gym owners via email or in-platform notification
• Where required by law, seek your consent for significant changes

Your continued use of the Platform after any changes constitutes acceptance of the updated policy.

12. Contact & Grievance Officer

For any privacy-related queries, requests, or complaints, please contact:

• Privacy Email: privacy@gymsaas.in
• General Support: support@gymsaas.in
• Grievance Officer: grievance@gymsaas.in

As required under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our Grievance Officer is available to address complaints within 48 business hours of receipt, and to resolve them within 30 days.