Privacy Policy

Fitness360 (“we”, “us”) is gym management software operated by GymKhana Fitness 360. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our web application as a gym operator, staff member, or when your gym records member information in the system.

We process data to provide membership, billing, attendance, and communication features. We do not sell personal data.

Depending on how your gym uses Fitness360, we may process:

• Account data: name, phone number, email, role (admin/staff), login credentials (passwords stored hashed).
• Member data: name, contact details, membership plan, payment history, attendance records, optional notes.
• Operational data: gym/branch identifiers, audit logs, QR attendance events, billing documents.
• Technical data: IP address, browser type, session cookies, error logs (sanitized where possible).

We process personal data to perform our contract with the gym (providing the service), for legitimate interests (security, fraud prevention, product improvement), and where required by law.

Gyms are typically the data controller for their members’ data; Fitness360 acts as a data processor when handling member records on the gym’s instructions.

We retain data for as long as the gym’s account is active and as needed to comply with legal, tax, or accounting obligations. Gyms may request export or deletion of data subject to applicable law and backup cycles.

We apply industry-standard safeguards including encrypted transport (HTTPS), hashed passwords, role-based access, parameterized database queries (no string-concatenated SQL), input validation, security headers (CSP, HSTS in production), and secrets stored only in environment variables—not in source code.

We may use infrastructure providers (e.g. hosting, database, messaging) under contractual confidentiality obligations. We do not share member data with advertisers.

• Hosting and database (e.g. Vercel, PostgreSQL/Supabase as configured by the operator).
• Optional integrations: WhatsApp Business API (Meta Cloud), push notifications—only when enabled by the gym.

Depending on applicable law (including India’s DPDP Act where relevant), individuals may request access, correction, deletion, or restriction of their data. Members should contact their gym first; gyms may contact us at the address below.

We use essential cookies for authentication and session management. These are required for the app to function. We do not use third-party advertising cookies in the core product.

Questions about this policy: mailgymkhana@gmail.com. Last updated: 19 May 2026.