This policy explains what Gymologia, operated by Ganda Group Technologies, collects, why, and what you can do about it. It is written to match what the software actually does.
Why we ask for your age and not your date of birth
We store your age, never your date of birth. A date of birth is a key to the rest of your life — banks, government records, and identity checks all use it, and a leak of it is far more damaging than a leak of a number like "27". Age is all a gym needs to train you safely, so age is all we keep.
What we collect
Account: your phone number, name, age, and email if you give one. Email is optional.
Body measurements: weight and height, when you enter them. You choose to add these; they are yours and they follow you if you change gyms.
Membership and attendance: which gym you belong to, your plan dates, your stated training goal, your assigned trainer, leave requests, and the days staff marked you present or absent.
Payments: for gym owners, the subscription record and a reference from our payment provider. We never see or store your full card number.
Identity documents: for gym owners only, the KYC details required to verify a business. These are stored encrypted and are visible to the small number of Gymologia staff who carry out verification.
Chat: messages you send through the app.
Gym photos and location: gym owners can upload photos of their gym and pin its location on a map. Both are shown publicly on the gym's page.
Technical: IP address, device and app version, and security-relevant events such as repeated failed sign-in attempts.
Location: only if you grant it, and only to sort nearby gyms. Decline it and you can search by locality name instead — the app works either way.
Who can see what
Your gym's staff can see your membership, attendance and leave. Your weight and height history is visible to gym staff and your trainer only if you choose to switch on progress monitoring. It is off by default; you must turn it on yourself in the app, and you can turn it off again at any time.
Other members see only what you send in a chat you are part of.
Gymologia staff can see your records where it is necessary to answer a support request, verify a gym, or investigate abuse. Every such action is written to an audit log.
Chat is not end-to-end encrypted
Message content is encrypted at rest with a key we hold. That means we can read messages when we have to — for abuse investigations, support, or a lawful order. We are telling you this plainly rather than describing the encryption in a way that implies more privacy than it gives.
How long we keep it
Account and profile data: kept while your account is open, anonymised 30 days after you request deletion. Health metrics (weight/height): deleted immediately when your account is anonymised. Attendance and membership records: kept for 7 years after the gym relationship ends. Identity documents (Aadhaar, PAN, GSTIN, address proof) for a gym: kept while the gym is active, and for up to one year after it is suspended with no subscription covering it; after that the documents are cleared and a resubscribing gym is verified again from scratch. Payment and tax records: kept for the period Indian tax law requires (currently 8 years from the year of assessment). Security and audit logs: kept for 3 years, then deleted. OTP codes: deleted within 24 hours of expiry.
Your rights
You can ask us to show you the personal data we hold about you. An in-app download is available in Settings under "Download my data". You can also correct anything wrong, or delete your account — both available in Settings. Write to support@gymologia.com from the number or email on the account if you need help and we will verify it is you before acting. Where deletion conflicts with a record we are legally required to keep, we will tell you which record and why.
You can withdraw consent for progress monitoring yourself, in the app, at any time. Withdrawing it does not delete historical measurements already recorded; to delete those, use the account deletion flow.
Security
Sensitive fields, including identity documents and message bodies, are encrypted before they are stored. Sign-in codes are hashed, never stored in readable form. Access to data is checked on every request against the role you hold at that gym. We keep an audit trail of administrative actions and monitor for attacks against the service.
No system is perfectly secure. If a breach affects you, we will tell you and the relevant authority as the law requires.
Children
The app is intended for users aged 18 and above. Users aged 13 to 17 may use the app only with verifiable parental or guardian consent, collected through an OTP verification of the guardian's phone number at the time of registration or enrolment. We do not knowingly collect data from anyone under 13. If you believe a child under 13 has an account, or that guardian consent was not properly obtained, write to support@gymologia.com and we will investigate and remove the account promptly.
Grievance officer
Under the Digital Personal Data Protection Act 2023, we have designated a Grievance Officer for data-related complaints:
Name: Sarthak Ganda, Ganda Group Technologies
Email: support@gymologia.com
We will acknowledge complaints within 48 hours and resolve them within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.
Breach notification
If we become aware of a personal data breach that is likely to cause harm, we will notify the Data Protection Board of India and inform affected users as required under DPDP Act 2023 Section 8(6).
Changes
If we change this policy materially we will tell you in the app.