Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Gym Software Terms between FitStat Co, a partnership firm registered in Karnataka, GSTIN 29AAKFF9529R1ZA, whose registered address is E 403, Renaissance Reserva, 54, MES Road, Ward 17, Gokula Extension, Muthyala Nagar, Jalahalli, Bengaluru, Karnataka - 560013 ("FitStat"), and the Gym. It applies to the personal data FitStat processes for the Gym in the Service, under the Digital Personal Data Protection Act, 2023 and its rules ("DPDP law"), and, until DPDP law's duties apply in full, section 43A of the Information Technology Act, 2000 and its rules on sensitive personal data.

1. Roles

The Gym is the data fiduciary: it decides why and how its members', leads' and staff's personal data is processed. FitStat is its data processor and processes that data only to provide the Service and on the Gym's documented instructions, which are these Terms and the Gym's use of the gym app. FitStat also runs its own gym on the Service and is the data fiduciary only for that gym's own members.

2. What is processed

• People: the Gym's members (including any under 18), their family members on family plans, leads and enquiries, staff and trainers, and corporate account contacts.
• Data: names, phone numbers, email and postal addresses, date of birth, gender, photos, membership, payment and invoice records (including payment references such as UPI reference, UTR or cheque number, and balances owed), the branch's UPI ID, check-ins, body measurements, workout and diet plans, staff attendance and payroll, and, where the Gym turns it on and the person consents, biometric templates held on the Gym's own device.
• Purpose: running the Gym's memberships, billing, GST invoices, check-ins, messages and reports, emailing members their receipts, and importing the Gym's records (including balances owed) from the system it used before when the Gym uploads them. An uploaded import file is deleted once its import is done, and within 6 hours if it is not.
• Duration: while the Gym uses the Service, then as section 9 says.

3. FitStat's commitments

• Process the data only for the Gym and never sell it or use it for our own marketing.
• Never disclose the Gym's data to any other gym, including the gym FitStat runs or a gym in which any partner of FitStat has an interest, and never use it for their benefit.
• Make sure everyone at FitStat who can reach it is bound to confidentiality, and that FitStat staff open a Gym's data only to give support the Gym asked for, or where the law requires. Each such access is recorded in the Gym's audit log.
• Keep it secure: each Gym's data is kept apart from other gyms' by the application and by the database's row-level security; connections are encrypted; passwords are stored hashed; backups are encrypted and copied off the server every night; device and payment secrets are encrypted; and every change to payments, refunds, dates and logins is recorded in an audit log the Gym can read.
• Help the Gym answer its members' requests to see, correct or erase their data: the gym app exports a member's data and erases a member or lead on request, and records each request.

4. Sub-processors

FitStat uses these providers to run the Service. We will tell Gyms 30 days before adding or replacing one; a Gym that objects on reasonable data-protection grounds may end the agreement with a pro-rata refund of the unused part of its paid term. No early-exit charge applies when a Gym leaves this way.

Providers the Gym connects itself (its own Razorpay or Meta account, its biometric device) are the Gym's own processors, not FitStat's.

5. Where the data is kept

The Service's servers, database and backups are in Mumbai, India (AWS ap-south-1). The providers in section 4 may handle the content of a message or payment in the countries the table shows, only as part of delivering it. FitStat will not transfer the Gym's personal data to any country the Government of India restricts by notification under section 16 of the DPDP Act, and will move to another provider if one of these countries is restricted.

6. The Gym's commitments

• Give its members and staff a privacy notice and get any consent DPDP law needs, using the gym app's notice and consent records.
• Put only data into the Service that it is allowed to, and only give logins to people who need them.
• Handle its members' requests and complaints as data fiduciary, with FitStat's help as section 3 says.

7. Breaches

If FitStat becomes aware of a personal data breach affecting the Gym's data, it will alert the Gym's owner within 6 hours, with what is known at that time, and send a fuller report within 48 hours: what happened, the data and people affected, and what FitStat is doing about it. FitStat reports the incident to CERT-In as the law requires, and helps the Gym notify the Data Protection Board and the people affected as DPDP law requires.

8. Audits

Once a year, or after a breach, the Gym may ask for a written description of FitStat's security measures and answers to a reasonable security questionnaire. When FitStat holds a recognised security certification (such as ISO 27001), it shares that instead of or as well as the questionnaire. Premium Gyms may also export their audit log. An on-site audit is allowed only after a breach affecting the Gym's data, on reasonable notice, at the Gym's cost, and under a duty of confidentiality that protects other gyms' data.

9. When the Gym leaves

The Gym can export all its data from the gym app at any time and for 30 days after the agreement ends. FitStat then deletes the Gym's personal data from the Service within 90 days of the end, and from backups as they are replaced on their regular cycle; until then a backup copy stays encrypted and is used only to recover the Service. FitStat keeps only what the law requires, for as long as it requires: its own invoices to the Gym (72 months under the CGST Act), security logs (at least 180 days under the CERT-In directions) and records of its processing (at least one year under the DPDP Rules). On request FitStat confirms the deletion in writing.

10. Members under 18

Where a Gym admits members under 18, the Gym gets the verifiable consent of a parent or guardian before their data is put into the Service, and records it in the gym app. The Gym does not send promotional messages to them or track or target them for advertising, and FitStat does not process their data for any such purpose.

11. Contact

FitStat's contact for data protection: hello@fitstat.in, or call +91 9606635003. For anything else, write to hello@fitstat.in. See also our Grievance Redressal Policy and Privacy Policy.