Privacy Policy

Last updated 10 September 2026.

This explains what CoachFit, operated by [Registered business name — as on your Udyam certificate], does with personal information. It covers both the gym owners and staff who buy the service and the members whose records they keep in it.

1. Who is responsible for what

Two different relationships run through this service, and they carry different responsibilities under the Digital Personal Data Protection Act, 2023.

For gym owners and staff. We are the Data Fiduciary. We decide what to collect to run your account and we answer to you for it directly.
For gym members. The gym is the Data Fiduciary and we are a Data Processor acting on its instructions. If you are a member with a question about your record, ask your gym first — they control it. We will help them respond.

2. What we collect

From gym owners, staff and trainers

Name, mobile number, email address, and a profile photo if you upload one.
Sign-in credentials: a one-time code sent to your phone or email, a Google sign-in, or a password or device PIN. Passwords are stored only as a salted hash — never as text.
Your gym’s details: name, city, logo, branches, plans and prices, and the UPI or bank details you enter so members can pay you.
Records of how the account is used: sign-ins, actions taken by staff, the device and browser used, and the IP address a request came from.

About gym members, entered by the gym

Name, mobile number, email address, photo, gender and date of birth.
Body measurements where the gym records them — weight, height and the BMI calculated from them. This is health-related information, and we treat it accordingly.
An emergency contact’s name, number and relationship.
Membership plan, start and end dates, fees due and paid, and payment history.
Attendance: check-in and check-out times, and how the check-in was recorded. Where the gym uses app check-in, this can include the location of the device at that moment.
Personal-training sessions booked, attended and paid for.

Biometric attendance devices

Some gyms use a fingerprint or face-recognition terminal. The biometric template never leaves that device. The device matches the person locally and sends us only an attendance event — a numeric identifier, a timestamp and the device’s serial number. We store a flag recording that someone has enrolled, and nothing that could reconstruct a fingerprint or a face.

3. Why we use it

To provide the service: memberships, attendance, fees, sessions and reporting.
To send the messages the gym has asked for — sign-in codes, renewal reminders, receipts.
To take payment for subscriptions and to keep the records tax law requires.
To keep accounts secure, investigate misuse and fix faults.
To answer support requests.

We do not sell personal information, and we do not use a gym’s member data to advertise anything to those members.

4. Who else sees it

We use the following providers to run the service. Each receives only what it needs, and each is bound to use it only for that purpose.

MongoDB Atlas — the database where records are stored.
Render — runs the application server.
Vercel — serves the web app.
Razorpay — takes subscription payments. Card and bank details go straight to them; we never receive or store them.
Meta Platforms (WhatsApp Business Platform) — delivers sign-in codes and reminders. Meta receives the recipient’s number and the message content.
Google (Firebase) — verifies Google Sign-In.
Zoho — sends transactional email.

Some of these process data outside India. Where that happens we rely on the provider’s contractual protections. We will also disclose information where the law requires it, or to establish or defend a legal claim.

5. How long we keep it

While the gym’s account is active, for as long as the gym keeps the record.
After an account closes, for 90 days, so it can be recovered or exported. After that it is deleted.
Payment and tax records are kept for eight years, as Indian law requires, regardless of the above.

6. Security

Traffic is encrypted in transit. Passwords are hashed. Each gym’s data is separated at the query level so one gym cannot read another’s, and staff see only what their role allows. Access to production systems is limited and logged. No system is perfectly secure, but if a breach affects you we will tell you and the Data Protection Board as the Act requires.

7. Your rights

Under the DPDP Act you may ask us to:

tell you what we hold about you and who it has been shared with;
correct anything inaccurate or incomplete;
erase it, where we are not required to keep it;
nominate someone to exercise these rights if you cannot.

Write to privacy@coachfit.in. We will respond within 30 days. If you are a gym member, we will pass your request to your gym, since your record belongs to them.

Grievance Officer

[Name of the person answering data requests] — privacy@coachfit.in, [Registered business name — as on your Udyam certificate], [Registered address, including city, state and PIN code]. If we do not resolve your complaint you may escalate it to the Data Protection Board of India.

8. Messaging

Sign-in codes and account notices are part of the service and cannot be switched off while you hold an account. Renewal reminders are sent by your gym, and you can ask your gym to stop sending them. You can block our number in WhatsApp at any time; if you do, sign-in codes will stop reaching you and you will need another way to sign in.

9. Children

Accounts are for adults. Where a gym records a member under 18, the gym is responsible for obtaining a parent’s or guardian’s consent, as the Act requires of it.

10. Storage on your device

We store your sign-in session in your browser so you are not asked to sign in on every page, along with small preferences such as the branch you last looked at. We do not use advertising or third-party tracking cookies.

11. Changes

We will post any change here and update the date at the top. If a change is significant we will tell you in the app or by email before it takes effect.