Privacy Policy

FitStat Co, a partnership firm registered in Karnataka, GSTIN 29AAKFF9529R1ZA, whose registered address is E 403, Renaissance Reserva, 54, MES Road, Ward 17, Gokula Extension, Muthyala Nagar, Jalahalli, Bengaluru, Karnataka - 560013 ("FitStat", "we", "us", "our"), operates fitstat.in, including our fitness events, gym-operations products, and our online personal-training ("PT") marketplace (collectively, the "Platform"). This Privacy Policy explains what personal data we collect from Customers, Trainers, and visitors, why we collect it, how we protect it, and the rights available to you under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian law. Under the DPDP Act, FitStat acts as the "Data Fiduciary" and you, as a user whose personal data we process, are the "Data Principal".

1. Information We Collect

a. Account information (Customers and Trainers): name, email address and phone number. Trainers and Customers of the online PT marketplace sign in with their email address and a password, which we keep only as a one-way hash. A FitStat Account (used for gym memberships bought on fitstat.in) has no password: you sign in with your mobile number and a one-time code sent to it, and we keep only a hash of the code, never the code itself.

b. Trainer profile & verification data: bio, specialties, years of experience, profile photo/photo URL, pricing plans, weekly availability; and, for KYC purposes, your PAN (or Aadhaar, only if you choose to give it instead: we never insist on Aadhaar, as the Supreme Court held in K.S. Puttaswamy v. Union of India (2019) 1 SCC 1 that a private business may not require it; if you give it, we take only a masked Aadhaar, with the first eight digits hidden, and never hold the full number) and certification documents, plus bank account number and IFSC code for weekly payouts. PAN and bank account numbers, and the last four digits of a masked Aadhaar, are treated as sensitive personal data and are stored using field-level encryption; only masked values (e.g., the last few digits) are ever displayed on screen, including to our own admin team.

c. Customer health/fitness data: body weight, height, body-fat percentage, and body measurements (chest/waist/hip/arm/thigh) that you choose to log, and any health-relevant information you share with a Trainer to make a Session safe. This is sensitive personal data relating to your health, and we collect it only with your explicit action (you choose what to log) and use it only to support your training and to show it back to you as a progress history.

d. Booking & payment data: Session date/time, pricing plan, booking status, and Razorpay order/payment identifiers and signatures used to confirm payment. We do not collect or store your card number, UPI ID, or net-banking credentials — these are handled directly by Razorpay, our PCI-DSS-compliant payment processor, under its own privacy policy.

e. Ratings & feedback: the ratings and comments Customers and Trainers leave for each other after a Session, and any platform feedback you submit.

f. Communications: messages you send us via the contact form, the on-site chat widget, or WhatsApp, and event-registration details (e.g., step counts or proof screenshots for challenges).

g. Technical data: a signed session cookie used to keep you logged in (and, if you arrive from a gym's referral link, to hold that gym's referral code until you sign your gym up), and standard web server logs (IP address, browser type, pages visited) used for security and troubleshooting.

h. Video session data: Sessions are conducted through the Platform's own in-platform video calling feature (powered by our video infrastructure partner) rather than a third-party meeting link, so Trainers and Customers do not need to exchange personal contact details to conduct a Session. To make this work, we generate a short-lived, Session-scoped video access token for each side, valid only for a short window around the scheduled Session time. We do not currently record Session audio or video. If we introduce Session recording in the future, we will update this Policy and obtain your consent separately before doing so.

i. Gym businesses that sign up for FitStat's software: the gym's name and web address, the owner's name, email address, mobile number and state, the IP address the sign-up came from, the version of our terms they accepted and the referral code of the gym that referred them, if any, and later the gym's billing details (legal name, address, GSTIN), its payments to FitStat (through Razorpay or bank transfer) and the gyms it has referred to us. If you use the sign-up checklist on our FitStat for gyms page, your ticks stay in your browser and the details you type are only sent to us when you submit the sign-up form.

2. Why We Process Your Information

• To create and administer your Customer or Trainer account.
• To display Trainer profiles, pricing, and availability, and to compute bookable slots.
• To process Bookings and payments, and to confirm Sessions.
• To verify Trainer identity/certifications (KYC) and prevent fraud, as required for a platform that processes payments to individuals.
• To calculate and pay weekly Trainer payouts.
• To show you your own booking history, ratings, and body-measurement progress.
• To respond to support requests, grievances, and platform feedback.
• To comply with applicable tax, accounting, and other legal obligations.
• For gym businesses: to set up and run their gym's FitStat account, confirm the owner's email, bill them and issue GST invoices, credit the gyms that referred them, and contact them about their account, trial and renewals.

We process your personal data on the basis of your consent (given at signup, at KYC-document upload, and whenever you choose to log a body measurement) and, where applicable, to perform our contract with you (fulfilling a Booking) or to comply with a legal obligation.

3. Sharing of Information

• We share only the limited Customer details a Trainer reasonably needs to conduct a confirmed Session (name, and any health information you chose to share for that Session) — and, correspondingly, the Trainer's name and profile details are shared with the Customer. Because Sessions are conducted through the Platform's own in-platform video calling feature, Trainer and Customer personal contact details (phone number, email address) are not shared with each other.
• Payment details are shared with Razorpay solely to process your payment.
• KYC documents and bank details are visible only to our authorised admin team for verification and payout approval.
• We may share participant names or handles on our public event leaderboard or social media, as agreed during event registration.
• We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
• We may disclose personal data where required by law, regulation, or a valid court/government order.

4. Members of Gyms That Use FitStat

Many gyms run their memberships, billing and check-ins on FitStat's gym software. For the personal data a gym keeps there about its members, leads and staff, the gym is the Data Fiduciary and decides how it is used; FitStat processes it only on the gym's behalf, under our Data Processing Agreement, and never sells it or uses it for our own marketing. The gym's own privacy notice, shown in its member portal, applies; to see, correct or erase that data, contact your gym, and we help it respond. When your gym has your email address, you get an emailed receipt for every payment it records and, only if you agreed, offers; every offer email has an unsubscribe link. When you buy a gym membership on fitstat.in, the gym is the seller and FitStat runs the page for it. If you also have a FitStat account, this Policy covers that account.

5. Data Security

Passwords are stored using industry-standard one-way hashing (bcrypt); PAN and bank account numbers (and the last four digits of a masked Aadhaar) are stored using field-level encryption; uploaded documents are stored on access-controlled infrastructure; and the Platform is served over HTTPS. Repeated failed login attempts trigger a temporary account lock as an anti-brute-force measure. That said, no method of storage or transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your account, booking, and payment data for as long as your account is active and thereafter for as long as needed to meet our tax, accounting, and other statutory record-keeping obligations under Indian law. KYC documents and bank details are retained for as long as required for compliance and payout purposes and are deleted or anonymised once no longer required. You may request earlier deletion, subject to these legal retention requirements (see Section 7).

7. Your Rights as a Data Principal

Subject to the DPDP Act and its rules, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct or update inaccurate or incomplete personal data (most account and profile fields can be edited directly from your dashboard).
• Erasure of your personal data, once it is no longer needed for the purpose it was collected for and we are not otherwise required to retain it by law.
• Withdraw consent at any time for processing based on consent — for example, you may stop logging body measurements at any time; withdrawing consent for KYC data will mean we can no longer verify or pay out a Trainer account.
• Grievance redressal — see our Grievance Redressal Policy to raise a privacy-related complaint with our Grievance Officer, Kavya S (hello@fitstat.in).
• Complain to the Data Protection Board of India if you are not satisfied with how we have handled your grievance.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email hello@fitstat.in from your registered email address.

Customers can also download everything we hold about them, or erase it, from My Account → Your data. Invoices are kept for as long as GST law requires, then the name on them is removed.

8. Cookies

We use a single signed session cookie to keep you logged in to your Customer, Trainer, or admin session. If you open our FitStat for gyms pages from another gym's referral link, the same cookie holds that gym's referral code, even before you log in, until you sign your gym up. We do not use third-party advertising or cross-site tracking cookies. See our dedicated Cookie Policy for the full list of cookies we use, the third-party resources our pages load, and how to control cookies in your browser.

9. Children's Data

Only adults register on the Platform. Online PT Sessions and Events are for people aged 18 and over only; no one under 18 has an account, books a Session or takes part in an Event.

A person under 18 may use a gym membership bought on fitstat.in, as set out in section 2 of our Terms of Use. Their parent or guardian registers and buys it from the parent's or guardian's own FitStat Account, gives consent for the young person's data, and shows their own photo ID at the gym's front desk before the first visit, so the gym can confirm the consent came from an adult (Digital Personal Data Protection Act, 2023, section 9). The young person's details are held by the gym, as part of that membership, under the parent's or guardian's consent, which they can withdraw at any time. We send no offers or promotions to anyone under 18, and do not track them or target advertising at them.

10. Storage Location

Your personal data is stored on servers in India (Amazon Web Services, Mumbai region), and our backups are kept there too. Some of the providers we use handle data outside India as part of their service:

• Meta (WhatsApp): messages we send you on WhatsApp, in the United States and other countries where Meta runs WhatsApp.
• Sentry: error reports from our software, without personal data, in the United States.

Email (Zoho), payments (Razorpay) and video sessions (100ms) are handled in India. We will not transfer personal data to any country the Government of India restricts under section 16 of the DPDP Act.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Platform or applicable law. The "Last updated" date above will change accordingly, and material changes will be highlighted on this page.

12. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of India. Subject to the grievance redressal process referred to above, the courts at Bengaluru, Karnataka shall have exclusive jurisdiction over any dispute arising out of or relating to this Policy.

13. Contact Us

For any questions about this Privacy Policy, or to exercise your rights above, contact us at hello@fitstat.in or +91 9606635003. For unresolved grievances, see our Grievance Redressal Policy.