Privacy Policy

For gym owner accounts and subscriptions, Gymnion decides how data is used. For member data, the gym is responsible for collecting it lawfully, and Gymnion processes it on the gym's behalf to run the service.

• Account data: name, email, phone number, password (stored encrypted by our authentication provider) and role.
• Gym data: gym name, gym code, owner phone, address, fee plans and subscription status.
• Member profile: name, phone, email, date of birth (used to calculate age), address and optional profile photo.
• Attendance: QR check-in and check-out times (recorded in Indian Standard Time).
• Payments: amount, plan, date, status, Razorpay order and payment IDs. We never see or store your full card number, CVV, UPI PIN or net-banking password — these are handled only by Razorpay.
• Razorpay connection: for gyms that connect Razorpay, secure access tokens so member fees go to the gym's account.
• Technical data: device and browser type, and basic logs used to fix errors and keep the service secure.
• Enquiries: details you submit through our contact form.

• To create accounts and let members check in with their gym's QR code.
• To show dashboards, attendance history, plans and payment records.
• To process subscriptions and member fee payments through Razorpay.
• To send receipts, fee reminders, trial and renewal notices by email.
• To back up a gym's attendance to that gym's own Google Sheet, when enabled.
• To prevent fraud, secure the platform and meet legal and tax obligations.

We do not sell personal data and do not use member data for advertising.

• Your gym: a member's data is visible to the admin(s) of the gym they belong to. Gyms cannot see other gyms' data.
• Razorpay: to process payments.
• Google: for email delivery and optional Google Sheets attendance backup.
• Cloud hosting and database providers: to store data securely.
• Authorities: only when required by Indian law or a valid legal order.

Some providers may process data outside India with appropriate safeguards.

Data is encrypted in transit (HTTPS), access is restricted by role and gym with row-level security, profile photos are kept in private storage, and payment signatures are verified on our servers. No system is perfectly secure; if a breach affecting you occurs, we will notify you and the relevant authority as required by law.

• Account, member and attendance data: while the gym's account is active, and up to 90 days after closure so it can be exported.
• Payment and invoice records: up to 8 years, as required by Indian tax and accounting laws.
• Security logs: a limited period needed to investigate issues.

Under the DPDP Act, you may ask to access, correct or erase your data, withdraw consent, and nominate someone to exercise your rights. Members should contact their gym first; you can also write to us and we will help coordinate. Withdrawing consent may mean you can no longer use check-in or payments.

Members under 18 may only be added by a gym with verifiable consent from a parent or guardian. We do not track or target children.

We use only essential browser storage to keep you signed in and remember preferences. We do not use advertising cookies.

We may update this policy and will notify you of significant changes by email or in-app.