Privacy Policy
This policy explains what GymBhai collects, why, who it is shared with, how long it is kept, and how you get it erased. It covers the GymBhai Android and iOS apps and the GymBhai web app at gymbhai.com.
Last updated 23 September 2026 · Operated by GymBhai · admin@gymbhai.com
1. Who we are
GymBhai (“we”, “us”) builds GymBhai — software gyms use to run memberships, and the companion member app used to check in and track training. The member app is published on Google Play under the package com.strawhats.gymmembers.
Two parties handle your data, and the split matters for your rights:
- Your gym decides what member records to keep — your membership, fees, attendance and any training or diet plan it writes for you. Your gym is the data fiduciary for those records; we process them on its instructions.
- GymBhai decides how the GymBhai login, the app itself, and the data you add in the app work. We are the data fiduciary for those.
GymBhai accounts are created by your gym when it adds you as a member — there is no public sign-up in the app. You can still have your account deleted at any time, from gymbhai.com/delete-account.
2. What we collect
| Data | Why we have it |
|---|---|
| Name, phone number, email address | Your gym enters these when it registers you. They identify your membership and are how you sign in to GymBhai. |
| Date of birth, gender, address, photo | Optional profile fields your gym may fill in for its member records and ID. |
| Emergency contact | Optional. Held so your gym can reach someone if you are hurt on the floor. |
| Height, weight, medical conditions | Optional fitness profile, used by your trainer to write safe plans and by GymBhai to show progress. |
| Workout logs, sessions, goals, body measurements, water intake | What you record in GymBhai. Powers your streak, charts, levels and badges. |
| Health & fitness data from Health Connect (Android) or Apple Health (iOS) — steps, active calories, resting heart rate, distance and sleep | Read only after you explicitly connect a source on the Wearables screen, and only to fill your daily rings, streaks and progress charts. Read-only: GymBhai never writes back to Health Connect or Apple Health. |
| Attendance and check-in records | Created when you scan your gym's QR code or check in from the app. Your gym uses these for access and for its own attendance reporting. |
| Payment records — amount, method (cash, card, UPI, online), status, invoice number and the payment gateway's transaction reference | Your gym's record of your fees. We never see or store your full card number, CVV, UPI PIN or bank credentials — those go directly to the payment gateway. |
| Community posts, comments and reactions | What you choose to post in your gym's feed, visible to other members of that gym. |
| Push notification token and device name | So class reminders and gym announcements reach this phone. Created only if you allow notifications. |
| Approximate location | Only when you open gym discovery and allow it, to sort nearby gyms by distance. GymBhai does not track your location in the background. |
| Camera | Only while the QR scanner is open, to read your gym's check-in code. Frames are decoded on your phone and never uploaded or stored. |
| Sign-in and device diagnostics — IP address, device and app version, session times | Security: keeping sessions valid, spotting abuse, and diagnosing crashes. |
3. Health and fitness data, specifically
GymBhai can read fitness data from Health Connect on Android and Apple Health on iOS. We treat this as the most sensitive data in the app, and we commit to the following:
- We read it only after you grant permission on the Wearables screen, and only the types listed there: steps, active calories, resting heart rate, distance and sleep.
- We use it for one purpose: showing you your own activity, streaks, rings and progress charts inside GymBhai.
- We never use health or fitness data for advertising, marketing, or to build audience profiles, and we never sell it.
- We never transfer it to data brokers, insurers, employers or credit agencies.
- GymBhai is read-only against Health Connect and Apple Health — it does not write entries back.
- You can revoke access at any time in Health Connect or Apple Health settings, or by disconnecting on the Wearables screen. Revoking stops new reads immediately.
- Your trainer at your gym can see the training and progress data tied to your membership, because that is what they coach from. No other gym can see it.
4. How we use your data
- To run your membership — access, check-ins, plan validity and renewal reminders.
- To show you your own training history, streaks, goals and progress.
- To let your gym bill you and issue receipts.
- To send you class reminders, expiry reminders and announcements from your gym, over push, SMS, WhatsApp or email.
- To keep accounts secure — detecting unusual sign-ins, preventing abuse, and enforcing our terms.
- To fix bugs and improve the product, using aggregated or de-identified usage data wherever that is enough.
- To meet legal obligations, including tax and accounting rules that apply to your gym.
We do not sell personal data, and we do not run third-party advertising in GymBhai.
5. Our basis for processing
Under India’s Digital Personal Data Protection Act, 2023, we process your data on the basis of the consent you give when your gym registers you and when you grant each app permission, and on the legitimate uses the Act allows — performing the membership you signed up for, and complying with law. You may withdraw consent at any time; the effect of withdrawal is described in section 9.
6. Who we share it with
| Recipient | What they receive |
|---|---|
| Your gym (and its staff and trainers) | Your membership record, attendance, payments, plans and the training data tied to your membership. Staff access is limited by role. |
| Payment gateway | Your name, contact and the amount, to take a payment and return a transaction reference. Card and UPI credentials are entered on the gateway, not by us. |
| Google Firebase Cloud Messaging | Your device push token and the notification text, to deliver push notifications. |
| Email, SMS and WhatsApp providers | Your email or phone and the message content, only for messages you or your gym have triggered. |
| Cloud hosting and database providers | Encrypted storage and compute for the service. They act on our instructions and do not use your data for their own purposes. |
| Authorities | Only where a valid legal order, court process or statutory obligation requires it. |
Every processor above is bound by contract to use your data only for the service they provide us. We do not share data with advertisers or data brokers.
7. How long we keep it
| Record | Retention |
|---|---|
| GymBhai login and app profile | Until you or your gym delete the account, then erased within 30 days. |
| Workout logs, goals, streaks, community posts, wearable-derived activity | Erased with the account, within 30 days of a deletion request. |
| Push token and device records | Deleted when you turn notifications off, sign out, or delete the account. |
| Attendance records | Kept by your gym for its own records; erased or anonymised once its retention period ends. |
| Payment and invoice records | Retained for up to 8 years after the transaction, because Indian tax and accounting law requires your gym to keep books of account. This is the main thing that survives an account deletion, and it is kept as a financial record, not as an active profile. |
| Security and audit logs | Up to 12 months, for fraud prevention and incident investigation. |
8. Your rights
As a data principal under the DPDP Act, 2023, you may:
- Access a summary of the personal data we process about you and who it has been shared with.
- Correct anything inaccurate, complete anything missing, and update anything stale — ask your gym, or write to us.
- Erase your data and close your account, subject only to what law requires us to keep.
- Nominate someone to exercise these rights for you if you die or become incapacitated.
- Complain to our Grievance Officer, and escalate to the Data Protection Board of India if we do not resolve it.
Write to admin@gymbhai.com to exercise any of these. We respond within 30 days.
9. Deleting your account and data
You can request deletion at gymbhai.com/delete-account without reinstalling the app or signing in, or from Profile → Delete my account inside GymBhai.
Deleted: your GymBhai login and sessions, your profile and contact details, your fitness profile, workout logs, sessions, goals and measurements, activity read from Health Connect or Apple Health, your streaks and badges, your community posts and comments, your push tokens and device records, and your diet and training plans.
Retained: payment and invoice records your gym must keep under Indian tax law for up to 8 years, and minimal security logs for up to 12 months. These are held as financial and security records only — they are not used to profile or contact you. Where the law allows, we anonymise rather than keep.
We complete deletion within 30 days of verifying the request, and confirm by email when it is done. Withdrawing consent or deleting your account means GymBhai will no longer work for you; your gym may still hold you to the membership contract you signed with it.
10. Security
Traffic is encrypted in transit with TLS. Passwords are stored only as salted hashes, never in readable form. Access to production data is restricted to staff who need it, and gym staff see only their own gym’s members. No system is perfectly secure, but if a breach affects your data we will notify you and the Data Protection Board as the law requires.
11. Children
GymBhai is not intended for children under 18. Where a gym enrols a minor, it must obtain verifiable consent from a parent or legal guardian before doing so, and we do not knowingly profile or run behavioural advertising at children. If you believe a child’s data is in GymBhai without that consent, write to admin@gymbhai.com and we will erase it.
12. Where your data is stored
Data is stored on servers in India. Some processors — push, email and SMS delivery — may process data outside India; where they do, transfers are made under contractual safeguards and only to countries not restricted by the Government of India.
13. Changes to this policy
We will update this page when the product changes, and update the date at the top. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.
14. Contact and grievance officer
For any privacy question, rights request or complaint, contact our Grievance Officer:
If you are not satisfied with our response, you may complain to the Data Protection Board of India.