Table of Contents (11 Topics)▼
1. Introduction & Developer Identity
Welcome to GYMatrix, developed and operated by GYMatrix Technologies(“we”, “us”, or “our”), registered in Ernakulam, Kerala, India. We provide a comprehensive gym management software ecosystem comprising the GYMatrix Android Mobile Application(for gym members, personal trainers, and gym staff), the GYMatrix Web Administrative ERP, and native biometric turnstile access control hardware integrations.
We are committed to protecting your privacy and handling your personal data transparently, securely, and in full accordance with the Google Play Developer Distribution Agreement, Google Play User Data policies, the Digital Personal Data Protection Act (DPDP Act, 2023) of India, and international data protection standards.
GYMatrix collects only the necessary data needed to facilitate gym memberships, generate GST invoices, authenticate facility entry through QR codes or turnstiles, and alert users about plan renewals. We never sell personal information to data brokers or advertising networks.
2. Information and Data We Collect
Depending on whether you use our services as a Gym Member, Personal Trainer, Gym Administrator, or visitor, we collect and process the following categories of data:
| Data Category | Types of Information Collected | Collection Purpose |
|---|---|---|
| Account & Profile | Full name, phone number, email address, gender, date of birth, emergency contact number, profile photo. | Member registration, authentication, emergency contact, and profile personalization in the Android app. |
| Gym Membership & Facility | Affiliated gym/branch name, membership plan (Monthly, Quarterly, Annual), start & expiry dates, assigned trainer, locker assignment. | Tracking membership status, calculating expiry, and verifying gym floor eligibility. |
| Attendance & Access Logs | Timestamps of check-in and check-out, RFID card UID, turnstile gate ID, QR code scan logs, attendance records. | Enforcing access control, gym capacity tracking, and member attendance analytics. |
| Health & Fitness (Optional) | Height, weight, BMI, body composition metrics, workout logs, trainer workout notes (only when voluntarily recorded). | Enabling members and personal trainers to track fitness progress inside the app. |
| Billing & Payments | Invoice numbers, payment amounts, tax breakdowns (CGST/SGST), payment status, transaction reference IDs. | Generating tax-compliant invoices and tracking fee receipts. (Note: We do NOT store card numbers or UPI PINs). |
| Device & App Diagnostics | Android OS version, device manufacturer/model, Firebase Cloud Messaging (FCM) push token, IP address, crash logs. | Delivering push notifications, debugging crashes, and ensuring application security. |
3. Android App Permissions & Hardware Access
The GYMatrix Android Application requires explicit device permissions to deliver specific core features. These permissions are requested at runtime only when the corresponding feature is engaged:
- android.permission.CAMERA: Required strictly for scanning dynamic QR codes displayed at gym turnstiles or reception desks for touchless check-in, and for capturing your profile photo directly from your device camera. The camera stream is processed in real time and is never recorded or transmitted elsewhere.
- android.permission.READ_MEDIA_IMAGES / READ_EXTERNAL_STORAGE: Required on Android devices to let you select a photo from your gallery to set your gym member avatar, or to download and save workout routines and tax invoice PDFs to your local storage.
- android.permission.POST_NOTIFICATIONS: Required on Android 13+ to send you crucial transactional alerts, such as membership expiry warnings, payment receipts, locker notices, and schedule updates sent by your gym administration.
- android.permission.INTERNET & ACCESS_NETWORK_STATE: Required to communicate securely over TLS with GYMatrix cloud servers and verify turnstile access in real time.
4. Biometric Attendance & Turnstile Hardware Policy
GYMatrix integrates directly with local biometric turnstiles, RFID turnstile gates, and facial recognition devices deployed by physical gym facilities:
- Encrypted Feature Templates: When a gym utilizes biometric hardware (fingerprint or facial recognition), the hardware vendor converts the scan into an encrypted mathematical hash or feature template.Raw fingerprint images or unencrypted biometric facial photographs are NOT uploaded to GYMatrix cloud servers.
- Gym Facility Consent: The physical gym facility acts as the Data Fiduciary under the Indian DPDP Act 2023 and is responsible for obtaining your explicit consent prior to enrolling your biometric data on their on-premise attendance hardware.
- Alternative Check-in: In all GYMatrix installations, non-biometric entry methods (Dynamic QR code on the Android App, RFID card/fob, or front-desk manual check-in) are fully supported as alternatives to biometric authentication.
5. How We Use Your Information
We process personal information only for legitimate business and contractual purposes:
- Service Delivery: Managing member profiles, processing gym subscriptions, verifying membership status, and recording workout progress.
- Access Control: Powering automated check-in and barrier turnstile validation at gym facilities.
- Financial Accounting: Generating digital GST-compliant tax invoices, payment receipts, and settlement logs for gym centers.
- Communications: Sending transactional notifications, membership renewal reminders, emergency gym closure alerts, and OTP authentications.
- Security & Fraud Prevention: Preventing turnstile pass-sharing, detecting unauthorized entry, and securing API endpoints.
- Legal Compliance: Retaining mandatory accounting books and tax invoices pursuant to applicable Indian tax regulations.
6. Third-Party Service Providers & Data Transfers
We do not sell, rent, or trade your personal data. We disclose information only to vetted third-party service providers who operate under strict non-disclosure and data protection agreements:
- Payment Gateways (Razorpay / UPI / Stripe): Payment transactions are handled directly through certified, RBI-regulated payment processors. GYMatrix never captures or stores full credit/debit card numbers, CVVs, or bank net-banking passwords.
- Push Notification Services (Firebase Cloud Messaging - Google LLC): Used to deliver critical real-time alerts and membership expiry reminders to your Android device.
- SMS & WhatsApp Gateways (Meta / Approved Telecom Providers): Used to transmit membership confirmation OTPs and invoice links.
- Cloud Infrastructure (AWS / Vercel): All data is stored in enterprise-grade data centers equipped with 256-bit AES encryption, strict firewall rules, and regular security audits.
7. Account Deletion & Data Deletion (Google Play Compliance)
In compliance with Google Play Store policies and data protection regulations, GYMatrix provides a clear, readily accessible method for all users to delete their account and associated personal data.
Deleting your account permanently revokes your mobile app access, deletes your workout logs, and wipes device notification tokens. Biometric credentials linked to the turnstile system will be unlinked.
Method 1: Direct In-App Account Deletion (Self-Serve)
You can initiate immediate account deletion directly within the GYMatrix Android Application:
Open Profile
Log into the GYMatrix Android app and tap on the Profile / Settings icon in the bottom navigation.
Account Settings
Scroll to the Account & Security section and select Delete My Account.
Confirm Deletion
Confirm the deletion prompt with your authentication OTP. Your profile data and credentials will be immediately purged.
Method 2: Email Request for Data Deletion
If you cannot access the Android app or wish to request complete deletion of all personal data held by GYMatrix, you may submit a written deletion request:
- Send an email to: contact@gymatrix.in
- Email Subject:
Data Deletion Request - [Your Registered Phone Number / Name] - Provide your registered mobile number and affiliated gym facility name.
- Our Data Privacy team will verify your identity and process your permanent purge within 7 business days, confirming completion via email.
Data Retention vs Deletion
Upon receiving an account deletion request, GYMatrix will delete all user profile data, login credentials, push tokens, and workout records. However, historical financial records (such as GST-compliant tax invoices and payment receipt ledgers) must be retained for the minimum statutory period mandated by Indian tax and commercial laws (typically 7 years), after which they are permanently destroyed.
8. Data Security & Encryption
All data in transit is protected using industry-standard TLS 1.3 encryption. At rest, data is encrypted using AES-256 standards with role-based access control (RBAC) preventing unauthorized gym staff from accessing confidential member data.
We enforce continuous security monitoring, automated vulnerability scanning, strict API rate limiting, and salted password hashing to safeguard your information against unauthorized access, loss, or destruction.
9. Your Legal Rights (DPDP Act 2023)
Under applicable data privacy legislation, you possess the following rights regarding your personal information:
- Right to Access: You can review the personal information we hold about you at any time in the Android app.
- Right to Correction: You can update inaccurate profile details directly or ask your gym administrator to revise records.
- Right to Erasure: You have the right to request deletion of personal information no longer required for its original purpose.
- Right to Withdraw Consent: You may withdraw consent for promotional messages or optional fitness tracking at any time.
- Right to Grievance Redressal: You have the right to register a formal grievance with our designated Grievance Officer.
10. Children's Privacy
GYMatrix does not knowingly collect personal data directly from children under 13 years of age without verified consent from a parent or legal guardian. Where a minor enrolls in a gym facility (e.g., for specialized juvenile fitness, swimming, or martial arts training), the gym management must obtain written parental/guardian consent prior to registering the child on the platform.
11. Grievance Redressal & Contact Details
If you have questions, feedback, or concerns regarding this Privacy Policy or wish to exercise your legal rights, please contact our designated Data Protection & Grievance Officer:
GYMatrix Technologies
Attention: Data Protection & Grievance Officer
Email: contact@gymatrix.in
WhatsApp Support: +91 8137005361
Physical Address: MG Road, Ernakulam, Kerala 682016, India
Response time: We acknowledge all privacy inquiries within 48 hours and resolve verified grievances within 15 calendar days.