Privacy Policy

1. Introduction to TheGymFlex

TheGymFlex ("we", "us", "our") operates the cloud-based gym management software platform hosted at https://thegymflex.com and its web application at https://app.thegymflex.com. Our platform empowers fitness clubs, boutique studios, gyms, and sports facilities to streamline member registrations, attendance check-ins, automated billing reminders, diet planning, and multi-branch operations.

In providing our Software-as-a-Service (SaaS) solution, TheGymFlex operates in two distinct data capacities pursuant to the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable data protection frameworks:

• Data Fiduciary (Controller): For the account credentials, business billing details, communications, and support inquiries of gym owners, operators, and authorized administrators.
• Data Processor: On behalf of gym owners and fitness studios (who act as primary Data Fiduciaries) for the personal records, fitness metrics, attendance check-in logs, and contact details of their registered gym members and staff.

2. Information We Collect

We collect only information strictly necessary to provide, optimize, and secure our gym management platform.

2.1 Gym Owners, Managers, and Staff Information

When an athletic business registers with TheGymFlex, we collect:

• Identity & Contact Details: Business owner name, gym/facility name, business email address, phone number, and physical correspondence address.
• Authentication Credentials: Passwords stored using industry-standard one-way cryptographic hashing (bcrypt/argon2).
• Staff & Trainer Profiles: Names, phone numbers, assigned roles, and internal system access permissions created by the gym owner.
• Billing Information: Invoice details, subscription plan choice, GST number (if provided), and transaction identifiers generated upon checkout.

2.2 Gym Member Information (Inputted by Gyms)

Gym owners and authorized staff enter member details into TheGymFlex to administer memberships. This may include:

• Personal Contact Information: Member's full name, phone number, email address, emergency contact details, and gender.
• Membership Plan Details: Plan tier, joining date, expiry date, admission fees, payment status, and discount records.
• Operational & Attendance Records: QR-code check-in timestamps, attendance logs, and branch visit histories.
• Fitness & Health Information (Where applicable): Height, weight, body measurements, trainer-assigned workout schedules, and diet or nutrition templates recorded at the gym's discretion.

2.3 Technical Telemetry & Device Data

When you access our web application or marketing website, our servers automatically log standard operational telemetry:

• IP address and approximate geographic location (city level).
• Browser type, operating system, screen resolution, and language settings.
• System access timestamps, URL referrers, and error logs used exclusively for performance diagnostics and DDoS prevention.

3. How We Use Your Information

TheGymFlex processes data solely for legitimate business operations:

• To provision, authenticate, and maintain gym management tenant accounts.
• To generate member digital passes, verify QR check-ins, and record attendance.
• To deliver automated SMS, WhatsApp, or email notifications for membership renewal notices, receipts, and schedule updates configured by gym owners.
• To process SaaS subscription billing and generate GST-compliant tax invoices.
• To provide customer support, troubleshoot technical issues, and improve platform functionality.
• To safeguard platform infrastructure against unauthorized access, fraudulent abuse, and malicious attacks.

4. Payment Processing & Gateway Security

TheGymFlex integrates with authorized Payment Aggregators regulated by the Reserve Bank of India (RBI) to process online transactions securely.

• No Sensitive Card Storage: When gym owners purchase a SaaS subscription, payment processing occurs through a secure checkout environment. TheGymFlex never collects, views, or stores full credit card numbers, debit card numbers, CVVs, net banking passwords, or UPI PINs on our servers.
• PCI-DSS & Tokenization Compliance: All card transactions and UPI payments are handled by our payment gateway partners in compliance with PCI-DSS (Payment Card Industry Data Security Standard) requirements and RBI card tokenization guidelines.
• Transaction Records: TheGymFlex receives and stores only non-sensitive transaction confirmation details (such as order ID, transaction reference, amount, currency, timestamp, payment method type, and payment status) to generate invoices and fulfill service delivery.

5. Third-Party Service Providers

We do not sell, rent, or lease personal data to data brokers, advertising agencies, or unauthorized third parties. We share data only with trusted infrastructure providers bound by confidentiality and data processing agreements:

• Cloud Infrastructure: High-availability cloud servers and managed database hosting with automated encrypted backups and multi-tenant isolation.
• Payment Processing: Authorized payment gateway partners for secure payment processing and settlement.
• Communications Infrastructure: Transactional email and SMS gateways strictly to send password resets, invoices, and automated renewal reminders on behalf of gyms.

6. Cookies and Tracking Technologies

TheGymFlex uses minimal, privacy-respecting cookies:

• Essential Authentication Cookies: Necessary to maintain user sessions, identify logged-in gym owners and staff, and prevent cross-site request forgery (CSRF).
• Preference Cookies: Used to remember your dashboard theme or table viewing preferences.
• No Invasive Advertising Cookies: We do not employ third-party behavioral tracking or ad network cookies that profile users across external websites.

7. Data Retention and Account Deletion

• Active Accounts: We retain tenant data as long as the gym maintains an active subscription or free trial with TheGymFlex.
• Data Portability: Gym owners can export their member databases, attendance logs, and financial transaction histories in standard CSV/Excel formats at any time from the admin dashboard.
• Account Closure & Deletion: Upon subscription termination or written request to support@thegymflex.com, all associated tenant database records and member data will be permanently purged within 30 days, except where statutory retention of tax/invoicing records is required under applicable Indian laws (e.g., GST audit requirements).

8. Data Security Practices

We employ robust, multi-layered technical and administrative safeguards to protect your data against unauthorized access, loss, or alteration:

• Transport Layer Security: All data transmitted between your browser and our servers is encrypted using modern TLS (Transport Layer Security) 1.2 and 1.3 protocols with HTTPS enforcement.
• Password Security: User passwords are never stored in plaintext; they are securely hashed using salted cryptographic algorithms.
• Multi-Tenant Data Isolation: Gym tenant data is logically isolated so that gym owners and staff can access only records belonging to their authorized facility.
• Role-Based Access Control (RBAC): Granular permissions allow gym owners to restrict staff and trainer access to sensitive financial or member information.

9. User Privacy Rights (DPDP Act, 2023 Compliance)

In accordance with the statutory provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and Indian Information Technology regulations, you (as a Data Principal) are entitled to the following rights regarding your digital personal data:

• Right of Access & Summary (Section 11): You have the right to request an accessible summary of personal data held and processed about you, along with identities of any third-party processors.
• Right to Correction, Updating & Completion (Section 12): You have the right to request correction of inaccurate or misleading data, updating of obsolete entries, and completion of incomplete personal information.
• Right to Erasure / Deletion (Section 12): You may request the erasure of personal data that is no longer necessary for the specified purpose for which it was collected, subject to statutory retention obligations under Indian law (e.g., taxation, audit).
• Right to Withdraw Consent (Section 6(4)): Where data processing is based on your consent, you have the right to withdraw your consent at any time as easily as giving it, by emailing support@thegymflex.com. Upon receipt, we will cease processing unless otherwise mandated by law.
• Right to Nominate (Section 14): You have the right to nominate an individual who, in the event of your death or incapacity, shall exercise your personal data rights on your behalf.
• Right of Grievance Redressal (Section 13): You have the right to accessible and expeditious grievance redressal through our designated Grievance Officer before escalating to the Data Protection Board of India.
• Member Privacy Inquiries: Gym members whose records are maintained within a gym's account should initially contact their fitness facility management (the primary Data Fiduciary). If the gym does not respond, members may contact us for technical assistance.

10. Policy Updates

We may update this Privacy Policy from time to time to reflect operational, technological, or legal developments. When changes occur, the updated policy will be published on this page with a revised "Effective Date". We encourage you to review this policy periodically.

11. Contact Us & Grievance Redressal Officer

In accordance with Section 13 of the Digital Personal Data Protection Act, 2023 (DPDP Act) and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, TheGymFlex has appointed a designated Grievance Redressal Officer:

• Legal Entity: ASHWANI BISEN (TheGymFlex)
• Department: Privacy & Data Governance Desk
• Support Email: support@thegymflex.com
• Phone / Direct Line: +91 6260196974
• Response & Redressal Timeline: Grievance inquiries are acknowledged within 24 hours and resolved within 15 calendar days.
• Correspondence Address: Raipur, Chhattisgarh – 492001, India