Privacy Policy

Last Updated: October 4, 2026

1. Introduction

MyGymDesk ("Company", "we", "our", "us"), operated by Mygymdesk Technologies Private Limited (CIN: U62013TS2026PTC213750), is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use MyGymDesk, our cloud-based gym management software ("Service").

This policy applies to our website, our mobile applications — MyGymDesk Business and MyGymDesk Member (available on the Apple App Store and Google Play Store) — and all related services.

This Privacy Policy is published in compliance with the Information Technology Act, 2000 and the rules thereunder, the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025, and — for individuals in the European Union, European Economic Area, and United Kingdom — the EU/UK General Data Protection Regulation ("GDPR").

Where you provide consent as a lawful basis, that consent is given freely, is specific to the purposes described below, and can be withdrawn at any time (see Section 7). For many processing activities, however, we rely on lawful bases other than consent, as set out in Section 4A.

2. Our Role: Data Fiduciary / Controller and Data Processor

MyGymDesk serves two distinct roles, using the terminology of both the DPDP Act and the GDPR:

Data Fiduciary (DPDP) / Controller (GDPR): For data we collect directly from gym owners and their staff (account information, billing details, usage data). We determine the purpose and means of processing this data.

Data Processor (DPDP and GDPR): For gym member data that gym owners upload to and manage through our platform (member names, phone numbers, attendance records, payment records, health/fitness data). We process this data strictly on behalf of and on the documented instructions of the gym owner (who is the Data Fiduciary / Controller for their members' data) and only to provide the Service.

If you are a gym member whose data is managed by a gym using MyGymDesk, please contact your gym directly regarding your data rights. The gym is responsible for establishing a lawful basis (including obtaining consent where required) and for responding to your data requests. We will assist and cooperate with the gym to fulfil any such requests, as set out in our Data Processing Agreement.

3. Information We Collect

a) Information You Provide (Gym Owners & Staff)

Account registration information: full name, email address, phone number
Gym business information: gym name, address, city
Payment and billing information (processed by our payment partners — we do not store full card numbers)
Communications with us via email, WhatsApp, or in-app chat
Business address and tax identifier (e.g. GSTIN for Indian customers) collected for invoicing

b) Gym Member Data (Uploaded by Gym Owners)

Member names, phone numbers, email addresses
Membership plan and subscription details
Attendance and check-in records
Payment and billing records
Body measurements and fitness progress data (weight, BMI, chest, waist, hips, bicep measurements) — this may constitute health-related data / a special category of data under the GDPR
Biometric identifiers where a gym uses biometric attendance devices (e.g. fingerprint templates), processed on the gym's instructions
Family account details, where a gym uses family accounts (Section 10A): which members are linked to which account holder, the relationship (for example parent, guardian or spouse), whether the account holder may book, pay and receive messages for each family member, the gym's record that the account holder agreed to the link, and the account holder's own confirmation (Section 10A), each with its date and time. For a minor who is enrolled for biometric attendance, this also includes the account holder's answer, with its date and time, on whether they allow it
Any other information the gym owner chooses to record about their members

c) Information Collected Automatically

Device and browser information (type, version, operating system)
IP address
We record the country of the network you sign up from to prevent fraudulent sign-ups; the IP address is deleted after 90 days.
Usage data: pages visited, features used, time spent, actions performed
Cookies and similar technologies, including analytics and advertising-measurement tags and, on our website and business app, session recordings in which all on-screen text and form inputs are masked (see Section 9)
Error logs and performance data (collected via Sentry for debugging and Service improvement)
Camera and photo library access (only when you choose to upload photos such as member photos or profile pictures)
Push notification device tokens (if you opt in to push notifications)
If you connect an AI assistant to your account (Section 5B): a record of each request it makes — which tool it used, the details it was given, the outcome and the time

d) Information Collected by App Stores

When you download our apps from the Apple App Store or Google Play Store, those platforms may collect data as described in their respective privacy policies. We do not control and are not responsible for data collected by Apple or Google during app download or installation.

4. How We Use Your Information

We use your information for the following specific, limited purposes:

Service Delivery: To provide, operate, and maintain the Service, including processing member data, generating reports, and enabling communication features.
Payment Processing: To process subscription payments, including recurring charges on a saved payment method where you have authorized them, and to generate invoices and receipts.
Communication: To send transactional messages (billing, account updates), onboarding guidance, and product announcements via email and WhatsApp.
Push Notifications: To send membership reminders, class booking confirmations, payment receipts, and gym announcements (only if you opt in to push notifications on your device).
Family accounts: Where a gym links family members to an account holder, to show the account holder the family member's records, let the account holder book and pay for the family member, and send messages about the family member to the account holder, as described in Section 10A.
Support: To respond to your requests, troubleshoot issues, and provide customer support.
AI connector: If you connect an AI assistant such as ChatGPT or Claude to your account, to answer the questions you ask it about your gym and to make the changes you confirm (Section 5B).
Improvement: To analyse usage patterns and improve the Service, including with the product analytics described in Section 9 (using aggregated, anonymized data where possible).
Measuring our own advertising: To measure visits to our website and how our advertising performs, using the tags described in Section 9.
Security & Fraud Prevention: To detect, prevent, and address security issues, fraud, and abuse.
Legal Compliance: To comply with applicable laws, regulations, and legal processes.

We do NOT use your data or your members' data for automated decision-making that produces legal or similarly significant effects. We do NOT use the records held in the Service — such as member names, contact details, attendance, payments or health data — for targeted advertising, and we do not give them to advertising partners. Some Service features do use AI to analyse gym and member activity in order to generate coaching content, business insights and drafted messages — see Section 5A (AI Features). If you connect your own AI assistant, the information it asks for is sent to the provider you chose — see Section 5B. We do NOT sell, rent, or trade your personal data to any third party.

Where the GDPR applies, we rely on the following lawful bases (Art. 6) for processing personal data of gym owners and staff:

| Purpose | Lawful basis | |---|---| | Providing the Service under our contract with you | Performance of a contract (Art. 6(1)(b)) | | Billing, recurring charges, invoicing | Performance of a contract (Art. 6(1)(b)) / legal obligation for tax records (Art. 6(1)(c)) | | Security, fraud prevention, service improvement | Legitimate interests (Art. 6(1)(f)) | | Analytics and advertising-measurement cookies on our website | Consent (Art. 6(1)(a)), given in our cookie banner and withdrawable at any time | | Marketing communications to gym owners | Consent (Art. 6(1)(a)), withdrawable at any time | | Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |

For gym member data, the gym (as Controller) is responsible for establishing the lawful basis; we process such data only as Processor on the gym's instructions.

We share your data with the following categories of third-party service providers (sub-processors), strictly to provide the Service. Separately, if you connect an AI assistant to your account, we send the information it asks for to the AI provider you chose, on your instruction; that provider is not our sub-processor (Section 5B).

| Service Provider | Purpose | Data Shared | |---|---|---| | Supabase (Supabase Inc.) | Database hosting, authentication, file storage | All platform data (encrypted at rest and in transit) | | Razorpay Software Pvt. Ltd. | Payment processing (Indian customers) | Billing details, payment amounts, tokenized card mandate | | Stripe, Inc. | Payment processing (international customers) | Billing details, payment amounts, tokenized card mandate | | PayPal (Europe) S.à r.l. et Cie / PayPal, Inc. | Payment processing (international customers) | Billing details, payment amounts | | WhatsApp messaging provider (Meta WhatsApp Business Platform / approved BSP) | WhatsApp messaging automation | Phone numbers, message content for approved templates | | Resend Inc. | Transactional email delivery | Email addresses, email content | | Brevo (Sendinblue SAS) | Marketing email campaigns | Email addresses (gym owners only, not member data) | | Sentry (Functional Software Inc.) | Error tracking and performance monitoring | Error logs, device info, IP addresses (anonymized) | | PostHog, Inc. (data hosted in the EU) | Product analytics on our website and business app, including session recordings. Not used in the member app | Pages viewed and actions taken, device and browser information, IP address, the signed-in owner's or staff member's account identifier, and session recordings in which all on-screen text and form inputs are masked | | Google LLC (Google Analytics, Google Tag Manager) | Website analytics and measuring our own advertising (Section 9) | Pages visited, device and browser information, IP address and, where you consent, cookie identifiers | | Meta Platforms, Inc. / Meta Platforms Ireland Ltd. (Meta Pixel) | Measuring our own advertising (Section 9) | Pages visited, device and browser information, IP address and, where you consent, cookie identifiers | | OpenAI, L.L.C. | AI features: business assistant chat, WhatsApp assistant, AI-drafted workout/diet plans, the member AI coach, and searching our help articles | Prompt content for the feature used, as described in Section 5A — gym figures, and where the feature requires it a member's name, contact details, membership, attendance, bookings, payments or fitness details; the text of a support question. OpenAI does not use API data to train its models. | | Google LLC (Gemini API) | AI features: business insights, support assistant, drafting marketing email, and preparing help articles from resolved support requests | Prompt content for the feature used, as described in Section 5A — aggregated gym figures (no member names or contact details); the text of a support request, any screenshots you attach to it, and diagnostic results, which can include the details of a member or staff member you ask about and of your business's set-up; a campaign brief. Google does not use data submitted through the paid Gemini API to train its models. |

A current list of sub-processors is available on request. We will give you advance notice of any new sub-processor and a reasonable opportunity to object before that sub-processor begins processing your personal data.

We may also disclose your information: (a) when required by law, court order, or government authority; (b) to protect our rights, property, or safety; (c) in connection with a merger, acquisition, or sale of assets (with prior notice to you).

5A. AI Features

Some parts of the Service use artificial intelligence. Where one of the AI features in this section is used, the information needed to answer that particular request is sent to one of our AI sub-processors — Google LLC (Gemini API) or OpenAI, L.L.C., both in the United States — and the generated result is returned to you. The features below are listed with the provider each uses today. We may move a feature between these two providers; if we add a new AI provider, we will give notice as described in Section 5.

Features that use Google (Gemini):

Business insights (gym owners/staff): aggregated gym figures such as revenue, attendance, renewal and class numbers, together with the gym's name, city and plan names. No member names or contact details are sent.
Support assistant: the text of your support request, any screenshots you attach to it, and relevant diagnostic results. When you ask about a particular member, the diagnostics can include that member's name, phone number, status, memberships, freezes, bookings, bills and payments. When you ask about a staff member, they can include that person's name, email address, role, branch and when they last signed in. When the question is about how your business is set up, they can include your branches, your GST registration and GSTIN, whether online payments and WhatsApp are set up and how many WhatsApp messages have been used this month, your biometric devices, and the email address of a connected Zoom account. They never include staff pay, bank or ID details, or payment-gateway secret keys or WhatsApp access tokens. Our support team also uses it to help word replies to your support requests, and resolved requests are summarised into help articles.
Drafted marketing email: your campaign brief, brand tone, gym name and the names of your saved audience segments. No member data.

Features that use OpenAI:

Business assistant chat (gym owners/staff): the gym's figures, together with the names and phone numbers of members whose memberships are expiring or inactive, members on a freeze, members with dues (owners only) and recent payments by member; and, when your question asks for them, attendance, leads, staff, personal training sessions and the members you name.
WhatsApp assistant: the messages exchanged in that WhatsApp conversation and the gym's own information, plans and offers. If the person writing is a member we recognise, also their name, membership status and end date, recent check-ins and upcoming bookings.
AI-drafted workout and diet plans: the member's age, gender, current weight (if recorded), how often they visit, training goal, experience, days per week, the limitations and allergies a trainer has noted, available equipment, dietary preference, calorie target and foods to avoid. The member's name, health questionnaire answers and recorded medical conditions are not sent. A trainer reviews and can edit every drafted plan, and the member sees it only after a trainer assigns it.
AI coach (member app, where a gym offers it): the member's name, age, gender, body measurements, attendance, membership, bookings, payment history and their chat with the coach.
Help article search: the text of your support question, and our help articles, are converted into search data so that the support assistant can find the most relevant articles.

Google and OpenAI process this content to return a response. Neither uses data submitted through its paid API to train its models. These commitments cover the features in this section, which we run through our own accounts with Google and OpenAI; they do not cover an AI assistant you connect yourself (Section 5B). AI output can be wrong: it is a draft for a human to review, never an automated decision about a person.

Members under 18. The AI features that talk to an individual member — the AI coach and the WhatsApp assistant — are switched off for members we know to be under 18, and a person handles those conversations instead. This check relies on the date of birth held for that member: where no date of birth has been recorded, the member is treated as an adult. AI-drafted workout and diet plans are created by a trainer for any member and are always reviewed by a trainer before the member sees them. Gyms that enrol children should record dates of birth so the check can apply, and remain responsible for obtaining verifiable parental consent before adding a child's data to the Service.

5B. AI Connector: Connecting Your Own AI Assistant

Gym owners, and staff to whom a gym has given a MyGymDesk login, can connect an AI assistant to their own login — currently ChatGPT, provided by OpenAI, L.L.C., and Claude, provided by Anthropic, PBC. Each person connects from the AI assistant and approves the connection on a MyGymDesk consent screen. The connector works only where the gym's plan includes it.

What is shared. When you ask the assistant about your gym, or ask it to make a change, it asks MyGymDesk for the information it needs and we send our answer to that provider. Depending on the question, that answer can include personal data of your members, leads and staff — for example names and member codes, memberships and their end dates, dues and payments, one member's payment history, attendance, class and personal training bookings, leads and follow-ups, and which staff are on shift — as well as gym figures such as revenue and collections, and expenses as totals per category (never single expenses or who was paid). It can include members under 18, in the same way the app shows them to you. The assistant receives only what a question needs, one answer at a time: it cannot list or export all of your members.

Only what your role can already see. The connector uses your own login. It returns only what your role and branches already let you see in MyGymDesk, and it can make only the changes your role already allows: book a member into a class, schedule classes, cancel a class session, log a response to a follow-up, add a lead, check a member in, extend a membership, freeze a membership (only when the freeze carries no fee), send a member a payment reminder, and submit a WhatsApp template for approval. Before any change it shows you a preview of exactly what will change, and nothing changes until you confirm it. Each change is made, and recorded, as you — just as if you had made it in the app.

What is never shared. An individual's pay or salary, bank and identity-document details, passwords, and payment-gateway or WhatsApp credentials are never sent through the connector. Staff costs appear only as an expense category's total.

What happens to the data after it is sent. The connector sends information to the AI provider you chose, on your instruction. That provider is not a sub-processor of MyGymDesk: its handling of the information is governed by its own terms and privacy policy, and by the settings of the account you connect — for example, how long it keeps your conversations and whether it may use them to improve its models. We do not control the provider's processing. For your members' data, the gym, as Data Fiduciary / Controller, decides whether to use the connector and is responsible for having a lawful basis to share that data with the provider, as with any other integration a gym connects (Data Processing Agreement, Annex A-1). The providers process data in the United States (Section 11).

What we keep. We keep a record of each request the assistant makes through the connector — which login made it, which tool was used, the details it was given, the outcome and the time — for security, for support and to show who made each change. These records are kept with your account's records (Section 12).

Disconnecting. You can disconnect at any time from Connected AI apps in your MyGymDesk account, or in the AI assistant's own settings. Once disconnected, the assistant can no longer reach your gym's data. A connection also stops working when the person's access to the gym ends (for example, when a staff member is removed) or when the gym's plan no longer includes the connector. Information already sent to the provider before you disconnect remains subject to the provider's terms.

5C. YouTube API Services

MyGymDesk uses YouTube API Services to publish videos to our own YouTube channels and to see how those videos perform. We do this through a social media publishing tool that runs on our own server in India and is used only by our team. No gym, member or other user of MyGymDesk uses it, and we do not use YouTube API Services to access anyone else's YouTube account.

YouTube and Google terms. Our use of YouTube API Services is subject to the YouTube Terms of Service. Information that Google processes through YouTube is governed by the Google Privacy Policy.

What we store. For each of our connected channels, we store the access and refresh tokens Google issues when we connect the channel, and the channel's ID, name, handle and profile picture. For each video we publish, we store its YouTube video ID, title, description, visibility and publishing time. When our team looks at channel statistics, the tool requests aggregated figures, such as views, from YouTube. We do not collect information about the individual people who watch our videos.

How we use and share it. We use this information only to publish our videos and to understand how they perform. We do not sell it, use it for advertising, or share it with anyone, apart from the company that hosts our server, which stores it on our behalf. The tool does not place cookies or store any information on your device.

Revoking access. Access can be revoked at any time on Google's security settings page, at https://security.google.com/settings/security/permissions. When access is revoked, or when we disconnect a channel, we stop using its tokens and delete them within 7 days.

Deletion requests. To ask us to delete information we hold from YouTube API Services, contact our Grievance Officer (Section 14). We acknowledge a request within 7 days and complete the deletion within 30 days, unless the law requires us to keep a record.

5D. Google Calendar and Google Meet

A business that runs online classes or personal training sessions on MyGymDesk can connect a Google account so that each online session gets a Google Meet link. Only the business owner can connect it, in Settings → Integrations → Online Sessions. Members do not connect anything, and we never ask for access to a member's Google account.

What we ask Google for. When the owner connects, Google asks them to allow three things: to see the account's email address; to create a secondary calendar, which we name "Online sessions", and to create, change and delete events on calendars our app created (we cannot see or change the account's other calendars or events); and to change the settings of the account's Google Meet meetings, which we use only to let members join the meetings we create without waiting to be admitted.

What we send to Google. For each online session, we create a private event with a Google Meet link on the "Online sessions" calendar. The event holds the session's name (for a class, the class name; for a personal training session, the first names of the member and the trainer), its date and time, the business's time zone, and a short line saying how members join. We do not add members as guests, send invitations, or send anyone's surname, phone number or email address.

What we store. The access and refresh tokens Google issues, encrypted; the connected account's email address, Google account ID and whether it is a personal or a Google Workspace account; the permissions granted; and the ID of the "Online sessions" calendar. For each session, we store the calendar event's ID, its Google Meet link and meeting code, and whether the meeting is open to join.

How we use and share it. We use this information only to create, update and remove the Google Meet meetings for the business's online sessions, and to show the link to the business and its members, in the app and in session reminders. We do not sell it, use it for advertising, use it to train AI models, or share it with anyone, apart from the company that hosts our database, which stores it on our behalf. MyGymDesk's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google terms. The Google account belongs to the business. Google processes the calendar and meeting data under the business's own agreement with Google and the Google Privacy Policy.

Disconnecting and revoking access. The owner can disconnect Google at any time in Settings → Integrations → Online Sessions → Google Meet. We then revoke our access at Google (unless the same Google account is still connected to another business on MyGymDesk), delete the tokens and stop creating or changing events. Events already created stay in the business's Google Calendar and their links keep working, unless the owner chooses to delete upcoming events when disconnecting. Access can also be revoked on Google's security settings page, at https://myaccount.google.com/permissions; we then stop using the connection and ask the owner to reconnect or disconnect.

Deletion requests. To ask us to delete information we hold from Google APIs, contact our Grievance Officer (Section 14). We acknowledge a request within 7 days and complete the deletion within 30 days, unless the law requires us to keep a record.

6. Data Storage & Security

Your data is stored on Supabase's cloud infrastructure (primary region: Mumbai, India). We select hosting regions that provide reliable performance for our users.
We use TLS 1.2+ encryption for all data in transit and encryption at rest.
Sensitive credentials (such as payment gateway keys) are stored in encrypted form. We do not store full payment card numbers; these are tokenized by our payment partners.
We implement Row-Level Security (RLS) policies in our database to ensure complete data isolation between tenants — no gym can access another gym's data.
We use role-based access controls and Supabase Auth for authentication.
We conduct periodic security reviews of our application and infrastructure.

Despite our best efforts, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we take commercially reasonable measures to protect your data.

7. Your Rights

a) Rights under the DPDP Act, 2023 (Data Principal Rights)

Right to Access: Request a summary of the personal data we process and the related processing activities.
Right to Correction: Request correction of inaccurate or incomplete personal data. You can also update most information directly in your account settings.
Right to Erasure: Request deletion of your personal data, subject to legal retention requirements. If you hold a MyGymDesk account (gym owner or staff), we are the controller: request deletion in your account settings or by emailing support@mygymdesk.com, and upon a valid request we delete data within 30 days from active systems and within 90 days from backups. If you are a gym member, your gym is the controller of your records and carries out the deletion itself — ask it through the member app under Profile → Delete My Data, or without the app at mygymdesk.in/data-deletion. We record your request, notify your gym immediately so it is not lost in an inbox, and will follow it up with them if you tell us they have not responded. If you are a family account holder (Section 10A), you can make the same request for a family member you manage, from the member app; we record that you made it, and the gym handles it in the same way.
Right to Grievance Redressal: Raise a complaint with our Grievance Officer (Section 14).
Right to Nominate: Nominate an individual to exercise your rights in the event of death or incapacity, as per the DPDP Act.
Children and family accounts: A parent or lawful guardian may exercise these rights on behalf of a child. Where a gym uses family accounts, see Section 10A.

In addition to access, correction, and erasure above, if you are in the EU/EEA/UK you also have:

Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format (CSV/Excel), and have it transmitted to another controller where technically feasible.
Right to Restriction of Processing: Request that we limit processing in certain circumstances.
Right to Object: Object to processing based on legitimate interests, and object at any time to processing for direct marketing.
Rights related to automated decision-making: We do not subject you to decisions based solely on automated processing that produce legal or similarly significant effects.
Right to Withdraw Consent: Where we rely on consent, withdraw it at any time (as easily as it was given); withdrawal does not affect prior lawful processing.
Right to lodge a complaint with your local supervisory authority (and, in India, with the Data Protection Board of India).

To exercise any of these rights, contact support@mygymdesk.com. We will acknowledge your request within 7 days and complete the action within 30 days (for GDPR requests, within one month, extendable by two further months for complex requests with notice). If you are a gym member, please direct your request to your gym; we will support the gym in fulfilling it.

8. Data Breach Notification

In the event of a personal data breach that is likely to cause harm, we will:

Notify affected gym owners (tenants) without undue delay and within 72 hours of becoming aware of the breach.
Provide details of the nature of the breach, categories and approximate number of records affected, and steps taken or proposed to mitigate the impact.
Report the breach to the Data Protection Board of India as required under the DPDP Act, and — where the GDPR applies and the breach meets the threshold — support affected Controllers in notifying the relevant EU/UK supervisory authority within 72 hours.
Cooperate with affected tenants in notifying their gym members where required.

9. Cookies & Tracking Technologies

Essential: cookies and browser storage for sign-in, security and your preferences. These are always on; disabling them may affect functionality.
Analytics and advertising measurement on our website: Google Analytics and Google Tag Manager, and the Meta Pixel, measure visits to our website and how our own advertising performs. They set analytics and advertising cookies only after you agree: in the EU/EEA, the UK and Switzerland our cookie banner lets you accept, reject or choose by category; elsewhere a cookie notice asks you to accept.
Our web apps (the business app and the member app, including the mobile apps) load the same Google and Meta tags, which stay in their no-consent state there. Because your browser downloads these tags, Google and Meta receive your IP address and browser details, and Google may receive limited measurement signals without cookies, such as the page visited.
Product analytics: on our website and business app (not the member app), PostHog records pages viewed and actions taken, and may record sessions. In those recordings all on-screen text and form inputs are masked. PostHog honours your browser's Do Not Track setting.
A gym's own tracking: a gym may add its own Meta Pixel to its public sign-up page and lead form. That pixel belongs to the gym, which is responsible for it.

You can change your choice in our cookie banner where it is shown, and control cookies through your browser settings.

10. Children's Privacy

The MyGymDesk platform is a business tool intended for use by gym owners and staff who are at least 18 years of age.

Gym owners may add members who are minors (under 18) to their gym records. In such cases, the gym (as Data Fiduciary / Controller) is responsible for ensuring that verifiable parental or guardian consent has been obtained before adding a minor's data to the Service, in compliance with the DPDP Act and, where applicable, the GDPR. MyGymDesk does not knowingly collect personal data directly from minors. We do not engage in behavioural monitoring or targeted advertising directed at children's data.

Where a gym uses family accounts, a parent or guardian can manage a child's membership from their own login. Section 10A explains what they can see and do, and how the child's data is protected.

10A. Family Accounts

Some gyms let one person manage the memberships of other people in their family from a single login. That person is the account holder: for example a parent, guardian or spouse. The people they manage are family members. The gym decides who is linked and what each account holder may do, and the gym remains the Data Fiduciary / Controller for these records. We process them on the gym's instructions (Section 2).

How family members are added.

A gym can link family members to an account holder, including by importing them from a spreadsheet.
If the gym's plan includes family accounts, an account holder who has their own phone number can also add up to 10 family members from the member app.
Where the gym takes sign-ups online, family members can also be registered when the account holder joins the gym online.
Each family member added in any of these ways gets their own record at the gym.

The account holder's confirmation. The account holder confirms one of two statements: that they are the family member's parent or legal guardian and are 18 or over, or that the family member has given them permission to manage their membership and receive messages about it. If the account holder adds the family member themselves, in the app or when joining online, they confirm at that moment. If the gym links the family member, including by import, the gym records the link and the account holder is asked to confirm in the member app; the link works in the meantime. We record the confirmation, and the gym's record of the link, with the date and time.

What an account holder can see. For each family member linked to them, an account holder can see in the member app:

the family member's profile and contact details, including health details the gym holds, such as allergies and medical conditions;
memberships and packages, including freezes, transfers and upgrades;
class, personal training and service bookings, including links to join online sessions;
attendance;
payments, invoices, orders and dues;
notifications;
wallet and referral activity;
forms the gym asks to be completed for the family member, such as waivers and health questionnaires. The account holder can also complete these on the family member's behalf.

The gym cannot limit what an account holder sees, except by ending the link.

What an account holder can do. The gym decides, for each family member, whether the account holder may book for them, pay for them and receive messages about them. Within that, an account holder can use the member app to:

book and cancel classes, personal training sessions and other services for the family member, reschedule their class bookings, and enrol them in a regular class;
pay for the family member's memberships, class packages, membership-freeze fees, paid services and shop purchases. For memberships, packages, freeze fees and shop purchases, the account holder is named as the buyer on the invoice and the family member is named on the invoice line. When the gym records a payment itself or sends a payment link, the invoice is addressed to the family member's primary account holder;
update a limited set of the family member's profile details: name, date of birth, gender, blood group, allergies, medical conditions, emergency contact and profile photo;
ask the gym to delete the family member's data (Section 7).

What an account holder cannot see. The following stay visible only to the family member and to their gym:

workout, diet, food and water logs;
progress photos, body measurements and personal records;
documents;
the terms and policies the family member has accepted.

Messages about a family member:

If the family member has no phone number, email or app login of their own, messages about them go to their account holder and name the family member. Examples are booking confirmations and class and session reminders.
Payment receipts, payment and dues reminders, credit notes and membership expiry reminders also go to the account holder, as well as to the family member if they have their own contact details.
The gym can switch off messages to the account holder for a family member.

Children. For marketing and for biometric attendance (for example fingerprint check-in), a family member is treated as a minor if they are under 18, or if they are linked as a "child" and no date of birth is recorded. For a minor:

we send no marketing messages about them, such as campaigns, promotions or birthday offers;
when they are added as a family member, we do not automatically enrol them for biometric attendance unless the account holder has consented;
if they are already enrolled, the account holder is asked in the member app whether they allow it. We record the answer, with its date and time, and the gym sees a summary. A refusal is recorded but does not by itself remove the enrolment; the gym decides what to do with any biometric data it already holds.

The account holder's confirmation supports the gym's records but does not replace the gym's own duty, as Data Fiduciary, to obtain verifiable consent from a parent or lawful guardian before processing a child's data (Section 9 of the DPDP Act; see Section 10).

Ending a link. The gym can end a link at any time. A family member who has their own login and phone number can also remove an account holder from their profile in the member app. Once a link ends:

the former account holder can no longer see or act for that family member;
they keep access to the online payments and shop orders they made themselves, and to the invoices for them, because those are their own records.

Your rights. Account holders and family members have the rights set out in Section 7. As with all member data, requests go to the gym (Section 2). A parent or lawful guardian may make requests on a child's behalf, and the gym may ask them to confirm their relationship to the child.

11. International Data Transfers

Your data is primarily stored in India (Supabase, Mumbai). Some sub-processors may process data outside India (for example, Stripe, PayPal and Sentry infrastructure, PostHog in the EU, Google and Meta for website analytics, and our AI sub-processors Google and OpenAI in the United States). If you connect an AI assistant to your account, the information it asks for goes to that provider — OpenAI or Anthropic, both in the United States — on your instruction (Section 5B).

For personal data subject to the GDPR that is transferred outside the EU/EEA/UK (including to India, which does not currently benefit from an EU adequacy decision), we put in place an appropriate transfer mechanism such as the European Commission's Standard Contractual Clauses (SCCs) (and the UK International Data Transfer Addendum), together with supplementary measures where needed. A copy of the relevant safeguards is available on request.
For personal data subject to the DPDP Act, transfers outside India are made in accordance with the Act and any restrictions notified by the Government of India.

12. Data Retention

Active account: Retained for as long as your account is active and the Service is being provided.
After cancellation/termination: Retained for 30 days to allow export, then permanently deleted from active systems.
Backups: Backup data may be retained for up to 90 days before permanent deletion.
Legal obligations: Certain data (such as billing and invoicing records) may be retained as required by applicable tax and accounting laws (in India and, for international customers, their local requirements).
Anonymized data: Aggregated, anonymized data that cannot identify any individual may be retained indefinitely for analytical and product-improvement purposes.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes at least 15 days in advance via email and/or a prominent notice within the Service, and may require renewed acceptance on next login. The "Last Updated" date indicates the most recent revision.

14. Grievance Redressal / Data Protection Contact

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the following officer is designated as Grievance Officer / point of contact for data protection:

Name: Biswanath Sarkar
Email: biswa@mygymdesk.com
Address: Mygymdesk Technologies Private Limited, Flat J705, Aparna Sarovar Zicon, Nallagandla, Serilingampally, Hyderabad - 500019, Telangana, India

The Grievance Officer will acknowledge your complaint within 7 (seven) days and resolve it within 30 (thirty) days. If unsatisfied, you may complain to the Data Protection Board of India under the DPDP Act, or (for EU/UK individuals) your local data protection supervisory authority.

EU/UK Representative: If and where required under GDPR Article 27 / UK GDPR, MyGymDesk will appoint an EU/UK representative and publish their contact details here.

15. Contact Us

For privacy-related questions or to exercise your data rights:

Email: support@mygymdesk.com
Grievance Officer: Biswanath Sarkar — biswa@mygymdesk.com
Address: Mygymdesk Technologies Private Limited, Flat J705, Aparna Sarovar Zicon, Nallagandla, Serilingampally, Hyderabad - 500019, Telangana, India