1. Who we are
GymBody is run from India. For anything about your data, write to support@getgymbody.com. That address also reaches our grievance officer.
2. Gyms decide about their members' data
When a gym adds its members, staff and payments to GymBody, the gym decides what is collected and why. We keep and process that data for the gym, only to run the service. If you are a member, your gym is your first contact for questions about your details; we help them answer.
3. What we collect
- Account details: name, email address, phone number, and the language you use.
- Gym records entered by a gym: members, plans, fees and receipts, attendance, workout plans, staff attendance, leave and salary.
- Member progress, if a member adds it: weight, measurements and progress photos. Photos are private to the member and their gym.
- Payments to GymBody: handled by Razorpay. We receive the payment status and amount, never card or UPI details.
- Technical data: the cookies that keep you logged in, the device's notification token for app reminders, and basic logs for security.
- Website visits: Google Analytics counts visits, pages viewed and time spent. It does not receive names, phone numbers or emails.
4. Why we use it
- To run GymBody: logins, members, fees, attendance, workouts and the member app.
- To send the reminders and receipts a gym switches on, by WhatsApp, SMS, email or app notification.
- To bill gyms for their GymBody plan and to answer support requests.
- To keep the service secure and to improve it using counts and trends, not individual profiles.
5. Who we share it with
Only with the services that help us run GymBody, each for its own part of the job:
- Amazon Web Services (servers in Mumbai, India): hosting and backups.
- Razorpay: payments to GymBody.
- Resend: emails such as login codes and receipts.
- Meta (WhatsApp): messages, if a gym connects its WhatsApp number.
- Google: Google sign-in, Analytics on the website, and AdSense ads on the public exercise pages.
- Expo and Firebase: notifications on members' phones.
6. Ads
Ads appear only on the public exercise pages of the website and, later, in the app for people who use it without a gym. Gym owners, staff and gym members never see ads in GymBody. The ads come from Google AdSense, which may use cookies; you can change how Google personalises ads at adssettings.google.com.
7. How long we keep it
We keep data while the account is in use. When a gym asks us to delete its account, we delete its data within 30 days, except records we must keep by law, such as payment invoices. Backups are overwritten within 14 days.
8. Your rights
You can ask to see the personal data we hold about you, to correct it, to delete it, or to withdraw a consent you gave. Write to support@getgymbody.com from the email on your account and we will reply within 30 days. Members can also ask their gym, which can correct or remove their details directly.
9. How we protect it
Every connection is encrypted (HTTPS). Each gym's data is kept apart from every other gym's, staff only see what their role allows, there are no passwords to leak (you log in with a one-time code or Google), and the database is backed up every day.
10. Children
GymBody is meant for adults. A gym that adds a member under 18 is responsible for having a parent's or guardian's consent.
11. Changes
If we change this policy, we update the date at the top. If a change matters for how your data is used, we tell gym owners by email before it applies.