FitCore

the studio decides why and how your personal data is used and is responsible for it (the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023). FitCore is the software service the Studio uses; it processes the data only to provide that service to the Studio.

• Identity and contact: your name, e-mail address, mobile and alternate number, date of birth, gender, postal address and an emergency contact.
• Membership and attendance: member number, the packages and memberships you hold, class bookings, appointments, check-ins and visits, freezes and requests, and the trainer's session notes. If you use the self check-in kiosk, a PIN you choose (stored only in scrambled, hashed form).
• Payments and billing: sales, invoices, receipts, credit notes, payments and your account balance. Card, UPI and bank details are entered on Razorpay's payment page; we keep the payment reference and status, not your card number.
• Health and fitness: health notes and fitness goals you or the Studio record, body measurements, progress photos and wellness logs (sleep, water, steps, mood). Health information is sensitive personal data and is used only to train and look after you safely.
• Photos and documents: your profile photo (with the consent you gave recorded), and documents the Studio keeps for you such as a waiver, contract, ID proof or medical certificate.
• Messages and contact history: SMS, e-mail and WhatsApp messages sent to you, calls and notes from the front desk, enquiries, support tickets and reviews or ratings you give.
• Your marketing choices: whether you agreed to marketing by e-mail, SMS or WhatsApp, with the time and version of the notice you saw. Where your membership was moved from the Studio's previous software (Mindbody), the marketing choices recorded there were carried over and are marked as such.
• Sign-in and security: your login, sign-in history (time, IP address, browser), active sessions and a record of changes made to your account.

• To run your membership: bookings, check-ins, packages, reminders and the member app.
• To bill you and keep the tax records the law requires (GST invoices and accounts).
• To train you safely: trainers see the health notes they need.
• To send service messages about your bookings, payments and membership.
• To send offers and news — only when you agreed to them, on the channels you chose. You can withdraw that consent at any time (section 7).
• To keep accounts secure, prevent misuse and resolve disputes.

We do not sell your personal data. We share it only with the service providers that help us run the Studio, and only what each needs:

• Razorpay — online payments and payment links.
• MSG91 — SMS messages and the one-time sign-in codes sent to your mobile.
• SendGrid — e-mails.
• WhatsApp Business (Meta) — WhatsApp messages, when the Studio uses them.
• Exotel — phone calls from the front desk, when the Studio uses it.
• Zoho Books — the Studio's accounting: invoices and payments with your name and billing details, when the Studio connects it.
• Cloud file storage — documents and video evidence the Studio uploads.
• AI features — when the Studio switches them on, the data needed for one task (for example a cleaning-check photo, or report figures a manager asks about) is sent to an AI provider (Anthropic) to produce the answer.
• Error monitoring — technical error reports used to fix problems in the software.

We also disclose data when the law requires it, for example to tax or law-enforcement authorities.

[To confirm before publishing: where the servers and database are hosted, and whether data leaves India.]

• Membership, attendance and money records (sales, invoices, payments, bookings, visits): at least 8 years, for tax and audit purposes (they are not deleted automatically).
• Sign-in history and the account change log: 2 years by default (longer for records about money and permissions).
• Message logs: 36 months by default (the Studio can shorten this).
• Conversations with the AI assistant: 90 days after the last message.
• Staff task photos: 30 days by default.
• Other data: while you are a member and for as long as needed afterwards for the purposes above, then deleted or anonymised.

Data travels over encrypted connections. Passwords and kiosk PINs are stored only as hashes. Staff see only what their role needs, and changes to accounts, money and permissions are recorded in an audit log. Keys for connected services are stored encrypted. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.

• See a summary of your data and how it is used.
• Correct or update it — much of it in the member app (My profile), the rest at the front desk.
• Ask us to erase data we no longer need to keep (records the law requires us to keep, such as tax invoices, are kept for the period above).
• Withdraw marketing consent at any time: use the unsubscribe link in an e-mail, reply STOP to an SMS, change your preferences in the member app, or ask the front desk. Service messages about your bookings and payments continue while you are a member.
• Nominate a person to use these rights for you in case of death or incapacity.
• Raise a grievance (section 9).

Members under 18 need a parent or guardian to agree on their behalf.

When this policy changes we publish the new version here with a new version number, and ask you to accept it again where the law needs it. See also the Terms of Service.

For any question, complaint or request about your personal data, contact our Grievance Officer:

[Grievance Officer — name to be filled in by the owner]
[grievance e-mail address — to be filled in by the owner]

We will acknowledge your request and resolve it within one month. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.