Privacy Policy

1. Introduction

Welcome to Gymatrix. Gymatrix ("we," "our," or "us") is a gym management software platform that provides gym owners, managers, trainers, and members with tools to manage memberships, payments, attendance, workouts, diet plans, and more.

This Privacy Policy describes how Gymatrix collects, uses, stores, shares, and protects information when you use our services, which include:

• The Gymatrix web-based admin panel
• The Gymatrix Member Android application
• The Gymatrix Trainer Android application
• Our website at gymatrix.in and any associated subdomains

By creating an account or using any part of the Gymatrix platform, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with this policy, please discontinue use of our services.

This policy applies to all gym owners (our primary customers), gym administrators, trainers, and gym members who access the platform directly or through a gym that uses Gymatrix.

2. Information We Collect

We collect information you provide directly, information generated through your use of our platform, and technical information from the devices you use to access our services.

2.1 Account Information

When you register for Gymatrix or manage your account, we collect:

• Full name of the account owner or administrator
• Email address
• Phone number
• Gym name and business name
• Gym address and location
• Profile photograph (optional)
• Subscription plan selection and billing preferences

2.2 Gym Business Data

As you operate your gym through the platform, we store and process:

• Member records: names, contact details, membership status, join dates, photos
• Subscription and plan data: plan types, pricing, renewal dates, payment status
• Payment transaction history and receipts
• Trainer profiles, schedules, and assigned member lists
• Attendance logs and check-in records
• Diet plans, workout programs, and fitness progress data
• Supplement and product inventory (if using the store module)
• Announcements, notes, and communications within the platform

2.3 Usage Data

We automatically collect information about how you interact with the Gymatrix platform:

• Features accessed and actions taken within the platform
• Login times, session duration, and frequency of use
• Screens or pages visited within the admin panel and apps
• Error logs and crash reports to help us improve stability

2.4 Device Information

When you use our mobile applications (Member App or Trainer App), we may collect:

• Device type and model
• Operating system version (Android version)
• App version
• Device token for push notification delivery (via Firebase Cloud Messaging)
• Network connection type (Wi-Fi or mobile data)

2.5 Payment Information

All payment transactions on the Gymatrix platform are processed securely by our third-party payment processing partner. Gymatrix does not store, access, or transmit full card numbers, CVV codes, or bank account credentials. Our payment processor handles all sensitive payment data in compliance with PCI-DSS standards. We receive and store only transaction identifiers, amounts, dates, and statuses necessary for account management and receipts.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Improving the Platform

To operate, maintain, and deliver all features of the Gymatrix platform — including the admin panel, member app, trainer app, attendance tracking, payment processing, and notification systems.

3.2 Processing Payments and Subscriptions

To manage your Gymatrix subscription billing, process renewal payments, generate invoices, and handle any payment-related support requests.

3.3 Sending Notifications

To send you and your gym members relevant notifications, including:

• Membership renewal reminders
• Payment confirmation and receipt notifications
• System announcements and platform update notices
• Gym-specific announcements you (the gym admin) send to your members

3.4 Customer Support and Technical Assistance

To respond to your support requests, troubleshoot technical issues, and provide guidance on using platform features effectively.

3.5 Analytics and Product Improvement

To analyse how the platform is being used in aggregate, identify areas for improvement, develop new features, and ensure the platform meets the evolving needs of gym businesses.

3.6 Legal Compliance

To comply with applicable Indian laws, respond to legal processes, enforce our Terms of Service, and protect the rights, safety, and property of Gymatrix and our users.

4. Data Sharing

We take your trust seriously. Here is our commitment on data sharing:

We share data only in the following limited circumstances:

4.1 Payment Processing Partner

We share necessary transaction data with our payment processor to process subscription payments. Our payment processor is PCI-DSS compliant.

4.2 Cloud Infrastructure Providers

Our platform is hosted on cloud servers. Infrastructure providers store and process data on our behalf solely to run the Gymatrix platform. These providers are contractually bound to maintain data confidentiality and security.

4.3 Firebase Cloud Messaging

We use Google's Firebase Cloud Messaging (FCM) to deliver push notifications to the Member and Trainer apps. Device tokens are shared with Firebase solely for notification delivery.

4.4 Anonymized Aggregate Data

We may use or share anonymized, aggregated, non-personally-identifiable data (for example, "X% of gyms use the attendance module daily") for research, marketing, or product development purposes. This data cannot be used to identify any individual gym or person.

4.5 Legal Requirements

We may disclose data if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights or safety of Gymatrix, our users, or the public.

5. Data Security

We implement industry-standard security measures to protect your data from unauthorized access, disclosure, alteration, or destruction. Our security practices include:

• Token-based authentication: All API access is secured using token-based authentication (Laravel Sanctum), preventing unauthorized access to your account data.
• Encrypted data transmission: All data transmitted between your browser, mobile apps, and our servers is encrypted using HTTPS/TLS encryption.
• Role-based access controls: The platform enforces strict role-based permissions. Gym admins, trainers, and members can only access data appropriate to their role.
• Multi-tenant data isolation: Each gym's data is logically isolated using unique gym identifiers, ensuring one gym cannot access another's data.
• Regular security audits: We conduct periodic reviews of our codebase, infrastructure, and access logs to identify and address potential vulnerabilities.
• Secure password storage: User passwords are hashed using strong cryptographic algorithms and are never stored in plain text.

While we take all reasonable steps to protect your data, no system is completely immune to security risks. We encourage you to use strong passwords and keep your account credentials confidential.

6. Your Rights

You have the following rights with respect to your personal data and your gym's data stored on Gymatrix:

6.1 Right to Access

You can request a copy of the personal data we hold about you or your gym account at any time. Much of this data is directly accessible through the Gymatrix admin panel.

6.2 Right to Rectification

If any data we hold about you is inaccurate or incomplete, you have the right to correct it. Most data can be updated directly through your account settings.

6.3 Right to Erasure

You may request deletion of your personal data and your gym's account data. We will process such requests in accordance with our data retention policy (see Section 7) and applicable legal obligations.

6.4 Right to Data Portability

You can request an export of your gym's data (member records, payment history, etc.) in a portable format. We will provide this within a reasonable time frame.

6.5 Right to Withdraw Consent

Where we process data based on your consent (such as marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6.6 Exercising Your Rights

To exercise any of these rights, please contact us at privacy@gymatrix.in. We will respond to your request within 30 days.

7. Data Retention

We retain your data for as long as your account is active and as necessary to provide our services:

• Active accounts: All data associated with an active Gymatrix subscription is retained and maintained as long as the subscription is active.
• After cancellation or expiry: Following account cancellation or subscription expiry, your gym's data is retained for a period of 90 days. During this period, you may reactivate your account or request a data export.
• After the 90-day grace period: Data is permanently and securely deleted from our systems.
• Data export on request: If you cancel your subscription, you may request a full export of your gym's data at any time within the 90-day retention window by contacting us at privacy@gymatrix.in.
• Legal obligations: In certain circumstances, applicable law may require us to retain certain data (such as payment records) for a longer period (typically up to 7 years for financial records in India). In such cases, we retain only what is legally required.

8. Cookies

The Gymatrix platform uses cookies and similar technologies to provide a secure and functional experience:

• Session cookies: The admin panel uses session cookies to maintain your authenticated login state. These cookies are essential for the platform to function and are deleted when you log out or close your browser.
• No third-party tracking cookies: We do not use third-party advertising trackers, retargeting pixels, or cookies from social media networks on our platform.
• Analytics cookies: We may use limited first-party analytics cookies to understand how the admin panel is used, helping us improve the user experience. These cookies collect anonymous, aggregate information and do not track you across other websites. You may disable them through your browser settings, though this may affect some platform functionality.

Our website (gymatrix.in) does not use invasive tracking cookies. We only use what is necessary for the site to function and to understand basic traffic patterns.

9. Children's Privacy

The Gymatrix platform and all associated services are intended for use by gym businesses and their adult staff and members. The platform is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18.

If you are a gym that enrolls junior members (under 18), you are responsible as the data controller for ensuring appropriate consents have been obtained from their parents or legal guardians for any data you enter into the Gymatrix system on their behalf.

If you believe we have inadvertently collected personal data from a person under 18 without appropriate consent, please contact us immediately at privacy@gymatrix.in and we will take steps to delete it.

10. Third-Party Links

The Gymatrix platform and website may contain links to third-party websites, applications, or services (such as payment portals or social media pages). These third-party sites have their own independent privacy policies, and we have no responsibility or liability for their content, privacy practices, or activities.

We encourage you to review the privacy policy of any third-party service you visit or use through a link from Gymatrix. The inclusion of a link does not imply our endorsement of that site or its privacy practices.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes to this policy, we will:

• Update the "Last updated" date at the top of this page
• Notify gym administrators via email and/or an in-app notification
• Where required by law, seek your renewed consent

We encourage you to review this Privacy Policy periodically. Your continued use of the Gymatrix platform after any changes have been posted constitutes your acceptance of the updated policy.