Privacy Policy

1. Who We Are

GymPilot is a gym management SaaS platform developed and operated by Pinakra, designed to help gym owners manage members, attendance, payments, diet & workout plans, class schedules, staff, and day-to-day operations from a single dashboard and companion mobile app.

2. Roles: Data Controller & Data Processor

GymPilot is used by gyms ("Gym Accounts") to manage their own members and staff. In this relationship:

• The Gym is the Data Controller for all member data it enters into the Service — the gym decides what member information to collect, why, and how long to keep it, and is responsible for having a lawful basis and, where applicable, the member's consent to process that data.
• GymPilot (Pinakra) is the Data Processor / Platform Provider — we host, store, and process this data strictly on the gym's behalf, following their instructions as expressed through their use of the Service, and we do not use member data entered by a gym for our own independent purposes.

If you are a gym member and have a question about how your personal data is used, please contact your gym directly in the first instance, as they control your data. You may also reach us at support@pinakra.com and we will assist or route your request to the relevant gym.

3. Information We Collect

3.1 Gym Owner & Staff Account Data

When a gym signs up or a staff member (receptionist, trainer) is added, we collect: full name, email address, phone number, role/designation, login credentials (passwords are stored using one-way cryptographic hashing — we never store passwords in plain text), and profile photo (optional).

3.2 Member Records Entered by Gyms

Gyms may enter the following information about their own members into the Service:

• Identity details: full name, phone number, email, date of birth, gender, residential address
• Identity/KYC reference: last 4 digits of Aadhaar number, if a gym chooses to record this for verification purposes (we do not require or validate full Aadhaar numbers)
• Profile photograph, uploaded by gym staff for member identification
• Health & fitness information: medical conditions/notes, fitness goals, height, weight, and other notes recorded by the gym or trainer
• Diet plans and workout plans assigned to the member, including meal schedules and exercise routines
• Emergency contact name and phone number

3.3 Attendance Logs

Check-in and check-out timestamps, recorded either manually by staff or via QR-code self check-in scanned by the member.

3.4 Payment & Billing Records

We also store membership plan pricing, invoice numbers, amounts paid/pending, discounts, and payment status for record-keeping and invoice generation.

3.5 Device & Camera Data

The GymPilot app requests camera access solely to scan QR codes for member attendance check-in and, where used, for uploading payment-proof screenshots. We do not access your camera roll, capture photos or video in the background, or use the camera for any purpose other than the specific scanning/upload action initiated by the user. Camera access can be revoked at any time from your device settings; doing so only disables QR scanning and does not affect any other feature of the app.

3.6 Cookies & Session Data

We use strictly necessary session cookies to keep you securely logged in while you use the web dashboard. We do not use third-party advertising or cross-site tracking cookies. See Section 9 for details.

4. How We Use Your Information

Information collected through the Service is used strictly to:

• Provide, operate, and maintain the core gym-management features (members, attendance, payments, diet & workout plans, classes, leads, and reporting)
• Authenticate users and maintain secure sessions
• Generate invoices, receipts, and business reports for the gym
• Send operational notifications (e.g. renewal reminders, payment confirmations, class updates) via the app, email, or WhatsApp click-to-chat links initiated by gym staff
• Provide customer support and respond to enquiries
• Detect, prevent, and address technical issues, fraud, or misuse of the Service
• Comply with applicable legal and regulatory obligations

We do not use member data to serve advertisements, and we do not build advertising profiles from it.

5. Data Retention

We retain gym, staff, and member data for as long as the gym's account remains active on the Service, so that historical records (attendance history, payment history, plan history) remain available to the gym for its own operational and legal record-keeping needs.

A gym owner/admin, or an individual member, may request deletion of specific personal data or of an entire gym account at any time by writing to support@pinakra.com. Upon a verified deletion request, we will delete or irreversibly anonymize the relevant data within a reasonable period, except where we are legally required to retain certain records (for example, financial/invoice records that must be retained under Indian tax law for a statutory period).

6. Sharing & Disclosure of Information

We do not sell, rent, or trade personal data to any third party. Information is shared only in the following limited circumstances:

• Infrastructure & hosting providers who store and process data on our behalf under contractual confidentiality obligations (e.g. our web hosting and database provider), strictly to operate the Service
• Within the gym's own account — data entered by one staff member is visible to other authorised staff of the same gym according to their role and permissions, as configured by the gym owner
• Legal requirements — where disclosure is required to comply with a valid legal process, court order, or governmental request, or to protect the rights, property, or safety of GymPilot, our users, or the public
• Business transfers — if GymPilot/Pinakra is involved in a merger, acquisition, or sale of assets, data may be transferred as part of that transaction, subject to equivalent privacy protections

7. Data Security

We apply reasonable technical and organisational safeguards appropriate to the sensitivity of the data we hold, including:

• Encrypted transport (HTTPS/TLS) for all data in transit between your device and our servers
• One-way cryptographic hashing of account passwords — we cannot view your password, and do not store it in readable form
• Role-based access controls so staff only see data relevant to their assigned role and permissions
• Tenant isolation — every gym's data is logically separated and scoped to that gym's account
• Restricted administrative access, granted only to authorised Pinakra personnel for support and maintenance purposes

No method of transmission or storage is 100% secure. While we work hard to protect your information, we cannot guarantee absolute security, and use of the Service is at your own risk.

8. Your Rights

Subject to applicable law, you have the right to:

• Access a copy of the personal data we (or the relevant gym) hold about you
• Correct inaccurate or incomplete personal data
• Request deletion of your personal data, subject to the retention exceptions noted in Section 5
• Withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal
• Raise a grievance regarding how your data has been handled — see Section 13

To exercise any of these rights, please email support@pinakra.com with your request. If you are a gym member, we recommend first contacting your gym directly, since the gym controls the data it has entered about you; we will assist in coordinating the request where needed.

9. Cookies & Session Data

The GymPilot web dashboard uses a single, strictly-necessary session cookie to keep you logged in securely between page loads. This cookie is essential to the functioning of the Service (you cannot stay logged in without it) and is not used for advertising, analytics profiling, or cross-site tracking. The session cookie expires automatically after a period of inactivity or when you log out.

10. Camera & Device Permissions (Google Play Disclosure)

The GymPilot mobile app requests the following device permission:

We do not request access to your contacts, call logs, SMS messages, precise background location, or microphone. Any permission can be reviewed or revoked at any time via your device's application settings.

11. Children's Privacy

GymPilot's staff dashboard and account-holder features are not directed at, or intended for use by, individuals under the age of 18. Gym owners, staff, and trainers who create logins must be adults capable of entering a binding agreement under Indian law.

Gyms may, as part of their normal membership records, enter details of members who are minors (e.g. a junior gym member) at the discretion and legal responsibility of the gym, which is expected to obtain appropriate parental/guardian consent under applicable law before doing so. GymPilot does not knowingly collect personal data directly from a minor without such gym-level oversight.

12. Legal Compliance

We process personal data in accordance with the Information Technology Act, 2000 (including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011) and the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, as applicable to us as a data processor/platform provider and to gyms as data controllers/data fiduciaries under the Act.

As the DPDP Act's implementing rules and compliance timelines evolve, we will update our practices and this policy accordingly to remain compliant.

13. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, and the Digital Personal Data Protection Act, 2023, the details of the Grievance Officer are provided below. If you have any concerns, complaints, or grievances regarding the processing of your personal data, please contact:

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify gym owners via the dashboard or registered email. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: