Gymogy is a multi-role fitness platform used by members, trainers, gym operators, staff, and authorized delegates. The platform processes both ordinary account data and higher-risk health or fitness data, so Gymogy applies purpose-based access controls, role checks, and consent-gated sharing rather than treating all profile data as universally visible.
These documents are written for India-facing operations and are intended to align with the Digital Personal Data Protection Act, 2023, the Consumer Protection Act and E-Commerce Rules, applicable RBI payment and mandate rules, and current Gymogy product flows.
1. Scope And Contacts
This policy applies whenever Gymogy collects or processes personal data through the public website, the authenticated web application, the mobile application, customer-support channels, subscription and payment workflows, notifications, analytics, account-export tools, and security or audit systems.
If you need privacy help, a rights request, or a grievance escalation, you may contact Gymogy using the support and privacy channels published on this page. If your account or purchase is tied to a gym or trainer that operates as an independent business through Gymogy, that seller may also act as a separate data handler or business contact for the offline service it provides to you.
2. Data Gymogy Collects
Gymogy collects the data needed to create and secure accounts, deliver coaching or gym-management workflows, process subscriptions and quota-based access, and operate member, trainer, and gym relationships safely. Some fields are optional; some are required to complete a purchase, booking, onboarding, or compliance workflow.
- Identity and contact data, such as name, email address, phone number, username, role, business display name, and support-contact details.
- Profile and fitness data, such as age, body weight, height, measurements, goals, injuries, medical-condition notes, workout history, active sessions, personal records, body-composition entries, progress images, and related coaching metadata.
- Relationship and consent data, such as trainer-member links, gym-member links, delegation records, consent requests, consent grants, revocations, visibility settings, and privacy defaults.
- Commercial data, such as plan selection, orders, invoices, package assignments, quota purchases, refund requests, policy snapshots, subscription status, auto-pay references, and freeze records.
- Technical and security data, such as IP addresses, device identifiers, app/browser details, push-notification tokens, session metadata, audit logs, fraud indicators, and error or abuse reports.
3. Why Gymogy Processes Data
Gymogy processes personal data only for defined product, operational, commercial, safety, support, and legal purposes. Those purposes include account creation, authentication, access-control enforcement, workout and progress tracking, scheduling, billing, subscription management, refunds, freezes, quota allocation, notifications, reporting, support resolution, service security, and statutory compliance.
Gymogy does not claim a general right to use health or fitness data for unrelated advertising or unrestricted profiling. Where a purpose requires consent, relationship-based visibility, or admin override, the product is designed to use those controls instead of assuming blanket permission.
4. Consent And Role-Based Sharing
Gymogy uses granular consent controls for certain member-facing data categories, including personal information, health data, fitness data, communication data, and analytics-related data. Trainers and gyms do not automatically receive unrestricted access to everything a member stores in Gymogy.
Where the product requires consent, a member can grant, deny, modify, or revoke access through in-app consent flows. Gymogy also records consent actions in audit logs so the platform can show who requested access, which grantor relationship applied, which category was affected, and when the status changed.
- A trainer or gym may only access categories permitted by the member, the active relationship, and the applicable account role or entitlement.
- Masked or hidden fields remain restricted even if another part of the profile is visible.
- Revoking consent may limit trainer, gym, or delegate features that depend on those data categories.
5. Payments, Providers, And Third Parties
Gymogy uses third-party providers for payment execution, messaging, hosting, analytics, crash monitoring, notifications, and similar infrastructure services. Payment credentials such as full card numbers are handled by the payment provider flow and are not intended to be stored in raw form on Gymogy servers.
Depending on the feature you use, Gymogy may share data with payment processors, cloud and storage providers, notification providers, customer-support tools, or legally authorized government, regulatory, or law-enforcement authorities. Gymogy does not sell personal data as a data broker.
- Payment and refund flows may involve providers such as Razorpay, banks, UPI networks, card networks, or app-store billing systems.
- Push notifications, OTP delivery, or support operations may require sharing limited identifiers with delivery providers.
- Infrastructure providers may process logs, files, and encrypted payloads for hosting, backup, or security operations.
6. Retention, Export, And Deletion
Gymogy retains data for as long as needed to provide the service, protect the platform, resolve disputes, comply with contractual or legal obligations, and preserve required audit or accounting records. Different categories may have different retention periods because a refund record, payment ledger entry, safety log, and workout log do not all serve the same purpose.
Gymogy currently supports account-data export and account-deletion requests through in-app settings flows. Where the platform offers a 7-day deletion grace period, the request is scheduled first and then finalized unless the process is cancelled or legal retention rules require part of the record to be preserved.
- Operational and security logs may be retained longer where required for abuse prevention, incident response, or Indian cybersecurity obligations.
- Invoices, refund records, and policy snapshots may remain in preserved audit form even after an account is closed.
- Backups may take additional time to age out after a live-system deletion request is completed.
7. Security And Incident Handling
Gymogy uses layered administrative, technical, and organizational controls, including authentication, role-based access control, encrypted transport, environment-scoped secrets, logging, and audit trails. No platform can guarantee absolute security, so users must also protect their own devices, credentials, and delegated access.
If Gymogy confirms a material breach affecting personal data, Gymogy may investigate, contain, document, and notify affected parties or authorities as required by applicable law and the severity of the incident.
8. Your Rights And Choices
Subject to applicable law and verification, you may request access, correction, export, deletion, consent withdrawal, or grievance review. Gymogy may ask for additional information where needed to authenticate the request, protect other users, or apply a lawful exception.
You may also control some disclosures directly in the product through privacy settings, consent-management screens, notification preferences, and relationship-level sharing controls.
9. Minors And Sensitive Use Cases
Gymogy is not intended to be used by minors in a way that bypasses required parent, guardian, institution, or other lawful authorization. If a parent, guardian, school, sports organization, or gym uses Gymogy on behalf of a minor, that party is responsible for ensuring that the collection and sharing instructions it gives Gymogy are lawful and appropriate.
Gymogy is also not an emergency service, medical provider, or crisis-response tool. Sensitive health notes entered into Gymogy should not be treated as a replacement for direct medical care or emergency communication.
10. Policy Updates
Gymogy may update this policy when product features, legal requirements, processor relationships, or security practices change. Material changes may be published in-app, on the website, at checkout, or by other reasonable notice. Continued use after an effective-date update means the current version governs to the extent permitted by law.