Privacy Policy

Gymward is a gym management platform operated by Vantar Technologies, accessible at gymward.in and distributed as an Android application.

Gymward serves two types of users: Gym Owners (who manage gym operations through our dashboard) and Members (who track attendance, fees, fitness progress, and diet).

For privacy-related queries: 📧 privacy@gymward.in

Account & Identity Data

Gym & Attendance Data (Members)

Fitness & Health Data (Members)

Biometric Data (Optional – Face Recognition)

Business Data (Gym Owners)

Technical & Usage Data

We do not use your data for advertising, profiling, or sale to third parties.

We process your personal data under the Digital Personal Data Protection (DPDP) Act 2023 of India. Our lawful bases are:

• Consent — for biometric/facial recognition data and optional personal details. You may withdraw consent at any time.
• Contractual necessity — to provide core services (attendance, fee management, fitness tracking).
• Legitimate interests — for security, fraud prevention, and service improvements.
• Legal obligation — where required by applicable Indian law.

What we collect

Gym owners may optionally upload a member's photograph to enable AI-powered face search (powered by DeepFace). This generates a numerical facial embedding vector stored in our secure database.

Why we collect it

To allow gym owners to instantly identify members by scanning a face — eliminating manual ID lookups. This feature is entirely optional and requires explicit written consent from the member.

How we protect it

• Facial embeddings are stored in encrypted form at rest.
• Access to biometric data is restricted to authorised server processes only.
• Raw photos are not stored permanently after embedding generation.
• Biometric data is never shared with any third party.

Deletion

Members can request full deletion of facial data at any time via privacy@gymward.in or the in-app settings. Deletion is processed within 72 hours.

Gymward uses Google OAuth 2.0 for authentication. When you sign in with Google, we receive:

• Your Google account name
• Your Google email address
• Your Google profile picture URL
• A unique Google user ID (sub)

We do not receive your Google password, contacts, Drive files, or any other Google service data.

Other services we use

Google's use of data is governed by Google's Privacy Policy.

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• With your gym owner — Members' attendance, fee, and contact data is visible to the gym owner whose QR you joined with.
• Service providers — Infrastructure providers who process data only on our behalf under strict data processing agreements.
• Legal requirement — If compelled by a court order or applicable Indian law.
• Business transfer — In the event of a merger or acquisition, you will be notified and data transferred under the same policy.

Upon account deletion, all personal data is permanently erased except where legally mandated retention applies (e.g., financial records under GST rules).

Under the DPDP Act 2023, you have the following rights as a Data Principal:

• Right to Access — Request a copy of the personal data we hold about you.
• Right to Correction — Request correction of inaccurate or incomplete data.
• Right to Erasure — Request deletion of your personal data (right to be forgotten).
• Right to Withdraw Consent — Withdraw consent for any consent-based processing, including biometric data.
• Right to Grievance Redressal — Lodge a complaint with our Grievance Officer.
• Right to Nominate — Nominate another person to exercise rights on your behalf.

We implement industry-standard security measures to protect your data:

• HTTPS / TLS 1.3 encryption for all data in transit.
• AES-256 encryption for sensitive data at rest.
• JWT-based authentication with short-lived access tokens and secure refresh flows.
• Rate limiting via SlowAPI + Redis to prevent brute-force attacks.
• Role-based access control ensuring owners and members only access their own data.
• Regular security audits and dependency vulnerability scans.

In the event of a data breach posing a risk to your rights, we will notify you within 72 hours of discovery, as required by law.

Gymward is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has registered without parental consent, please contact us at privacy@gymward.in and we will delete the account promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Send an in-app notification to all active users.
• For significant changes, request fresh consent where required by law.

Continued use of Gymward after the effective date of a revised policy constitutes acceptance of the updated terms.

As required under the DPDP Act 2023, we have designated a Grievance Officer to address data-related concerns:

If unsatisfied with our response, you may escalate your complaint to the Data Protection Board of India once operational under the DPDP Act 2023.