Privacy Policy (Gopniyata Niti)Privacy Policy (Gopniyata Niti)

In simple words

• FitOS is run by ApexGrid from Sikar, Rajasthan. This one policy covers the Website, the blog and the App.
• For Member and Trainer records inside the App, the gym decides what is collected and why. We handle that data for the gym. If you are a Member, contact your gym first; we help the gym respond.
• We collect only what we need to run the Service. We do not collect ID proof, health or medical information, location, contacts, SMS or call logs.
• We do not sell Personal Data. We do not use Member data for ads. There are no ads in the App.
• On the Website, analytics and ads run only if you say "yes" in the cookie banner. You can change your mind any time.
• Members pay their gym directly. FitOS does not hold that money and does not store card or bank account details.
• You can ask to see, correct or delete your Personal Data. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.
• Some of our service providers may store or process data outside India. We follow any restrictions the Government of India sets.

1. Who we are and what this policy covers

1.1 FitOS is a gym management service. It includes the FitOS mobile app (the "App"), the website and blog at https://fitosapp.in (the "Website"), and related support (together, the "Service"). FitOS is an ApexGrid product. ApexGrid is only a brand name; it is not a separate company.

1.2 The Service is run by ApexGrid, a sole proprietorship, at Sikar, Rajasthan, India. In this policy, "FitOS", "we", "us" and "our" mean ApexGrid running the Service, and any successor described in section 6.6.

1.3 "Personal Data" means any data about a person who can be identified from it. "Account" means an account to use the App; a login on the Website for blog writers is called a "writer account". "Gym Owner", "Trainer" and "Member" mean the App users described in section 2. "Content" means text, images and other material that users add.

1.4 This policy explains what Personal Data we collect, why, who we share it with, how long we keep it, and what rights you have. It should be read with our Terms of Service, Member Terms, Website Terms, Data Processing Addendum and Cookie Policy.

1.5 We follow Indian law, including the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023 and its rules, as their provisions apply from time to time.

2. Our role: when we decide, and when the gym decides

2.1 Data protection law separates two roles. A Data Fiduciary decides why and how Personal Data is used. A Data Processor handles Personal Data on behalf of a Data Fiduciary and follows its instructions.

2.2 If you are a Member or Trainer: your gym is responsible for your gym records. Please contact your gym first for any request about those records (for example, to correct a fee entry or remove your photo). If your gym does not respond, or you cannot reach it, write to us at support@fitosapp.in. We will pass your request to the gym and help the gym respond. We may not be able to change gym records without the gym's instruction, except where law requires us to.

2.3 If you are a Gym Owner: you are responsible for having a valid reason (usually consent) to add your Members' and Trainers' data, for telling them how you use it, and for collecting parent or guardian consent for Members under 18. Our Data Processing Addendum explains how we process that data for you.

3. Personal Data we collect

The tables below list what we collect for each type of user. "Legal basis" means the reason the law allows the processing. Under the Digital Personal Data Protection Act, 2023, this is usually your consent or a legitimate use allowed by that Act (for example, data you gave us voluntarily for a specific purpose, or processing needed to meet a legal duty). Where FitOS is a Data Processor, the legal basis is the gym's, and the gym is responsible for it.

3.1 Gym Owner

3.2 Trainer

FitOS processes this data as a Data Processor for the gym.

3.3 Member

FitOS processes this data as a Data Processor for the gym.

3.4 Website visitor

3.5 Lead (waitlist, demo, contact, newsletter, deletion request)

3.6 Blog author

3.7 Advertiser

3.8 What we do NOT collect

3.8.1 We do not collect ID proof (such as Aadhaar or PAN), health or medical information, injury details, or body measurements. The App has no fields for these. Gym Owners and Trainers must not type such details into free-text fields.

3.8.2 We do not collect location, contacts, SMS, call logs or microphone audio (see section 4).

3.8.3 We do not collect or store card numbers, bank account numbers, UPI PINs or net banking passwords.

4. App permissions

4.1 The App asks for permissions only when you use the feature that needs them. You can turn them off in your phone settings at any time. Turning one off only stops that feature.

4.2 The App does not access your location, contacts, SMS, call logs or microphone.

4.3 When you tap a WhatsApp button, the App opens a wa.me link in your own WhatsApp with a pre-filled message. You decide whether to send it. We do not send WhatsApp messages for you, and we do not read your WhatsApp chats.

5. How we use Personal Data, and what we never do

5.1 We use Personal Data to:

• provide the Service: Accounts, member lists, attendance, fee records, check-ins, reports and exports;
• verify subscription payments and keep accounts;
• keep the Service secure, prevent fraud, spam and misuse, and investigate problems;
• give support and send service messages (for example, trial ending, payment received, security alerts);
• fix bugs and improve the Service, using diagnostics and aggregated usage;
• send marketing or the newsletter, only where you have agreed;
• meet legal duties and respond to valid legal requests.

5.2 What we never do:

• We do not sell or rent Personal Data to anyone.
• We do not use Member or Trainer data for advertising, and we do not show ads in the App.
• We do not build profiles of Members for third parties, and we do not share Member data with other gyms, brands or data brokers.
• We do not track or profile children, and we do not target ads at them.
• We do not use a gym's data for our own purposes beyond running, securing and supporting the Service, except in aggregated form that cannot identify a gym or a person.

6. Who we share Personal Data with

6.1 Your gym. If you are a Member or Trainer, your gym's Gym Owner and permitted Trainers can see your gym records. A Member can be active at one gym at a time. When you move to another gym, your new gym does not get your old gym's records through FitOS.

6.2 FitOS superadmin access. FitOS staff with superadmin access use multi-factor authentication. A superadmin may view a gym's data only:

• for support, when the Gym Owner asks;
• to investigate security issues or abuse;
• to verify a subscription payment; or
• when law requires it.

Every superadmin access is logged. Superadmins do not browse gym data for any other reason.

6.3 Service providers. We use the following providers to run the Service. They process Personal Data only to provide their service to us.

We will tell Gym Owners at least 15 days before we add or replace a provider that handles gym data, as set out in our Data Processing Addendum.

6.4 Legal requests. We may disclose Personal Data if a law, court order or lawful request from a government authority requires it, or to protect the rights, safety or property of users, the public or FitOS. We share only what is required. Where the law allows, we will tell the affected Gym Owner or person.

6.5 Public content. If you are a blog author, your display name and published posts are public.

6.6 Business change or successor. FitOS is now run by a sole proprietor. If the business becomes a company or LLP, or is sold or transferred, Personal Data may move to the new owner so the Service can continue. The new owner must protect it as this policy says. We will tell you before this happens, by email or in-app notice.

7. Data stored or processed outside India

Some of our service providers may store or process Personal Data outside India, on servers in other countries. Our main database is hosted in the the region shown in our sub-processor list region. We choose providers that state they protect data with reasonable security. If the Government of India restricts transfer of Personal Data to any country, we will follow that restriction.

8. Payments

8.1 Members pay their gym, not FitOS. Payments between a Member and a gym (UPI, cash or any other mode) happen outside FitOS. FitOS does not hold, receive or move that money.

8.2 Two-sided UTR check. The App lets a Member and the Gym Owner both confirm a payment using the UTR (the transaction reference number). This is a record-keeping aid only. It does not guarantee that a payment was made or received. Please check your bank or UPI app.

8.3 What we store. We store UPI IDs (the gym's, so Members know where to pay), UTRs, amounts, dates and confirmation status. We do not store card details, bank account numbers, UPI PINs or passwords.

8.4 Paying FitOS. A Gym Owner pays the FitOS subscription by UPI to our UPI ID shown on our official payment page and submits the UTR there. A FitOS superadmin checks it and marks it verified. If we add a payment gateway later, the gateway will handle payment details under its own terms, and we will update this policy.

8.5 Records are not edited. Payment records are append-only. A refund or correction is added as a new entry. We do not edit or delete payment records, so that the history stays honest and meets legal requirements. See our Refund Policy.

9. Trainer access and money masking

9.1 Each Trainer sees only what the Gym Owner allows. This is called role-based access.

9.2 Money data (fees, dues, payments, revenue) is masked for Trainers on our server, not just hidden on the screen. So even if a Trainer's phone is changed or the App is tampered with, the server does not send the hidden amounts. The Gym Owner can see everything for their own gym.

9.3 A Member can see only their own records. A Gym Owner can see only their own gym. One gym cannot see another gym's data.

10. Cookies, analytics and ads on the Website

10.1 The Website shows a cookie banner. Necessary storage is always on. Analytics and Ads are off until you turn them on. Rejecting is as easy as accepting.

10.2 If you allow Analytics, we use Plausible, which does not use cookies, and Google Analytics, which sets its own _ga cookies. If you turn Analytics off later, Google Analytics stops and we remove its cookies. If you allow Ads, we count impressions of our own labelled banner ads ("Ad" or "Sponsored"), and, only if we have switched it on, Google AdSense may show ads and set its own cookies. Campaign tags from the link you used (fitos-utm) are saved only after you allow Analytics, and the ad view check (fitos-adimp:*) is saved only after you allow Ads.

10.3 You can change your choice at any time using the "Cookie settings" link in the Website footer. Full details are in our Cookie Policy.

10.4 The App has no ads and no advertising trackers.

11. How long we keep data, and deletion

11.1 We keep Personal Data only as long as needed for the purpose we collected it, or as long as law requires.

11.2 Archive is not delete. When a Gym Owner archives a Member or Trainer, the record is hidden from the gym but stays on our server. Only a FitOS superadmin can restore or permanently delete it, at the Gym Owner's request or as law requires.

11.3 What survives deletion, and why. Even after deletion we keep:

• payment and ledger records, because tax and accounting laws require us to;
• audit logs and records of deletion requests, for the periods above, to prove what happened and to handle disputes and security issues;
• aggregated data that no longer identifies anyone;
• data in backups for up to 30 days.

We keep this data locked and use it only for these reasons.

11.4 How to request deletion. Use the deletion option in the App, or the form at /delete-account, or email support@fitosapp.in.

• Gym Owner: we delete your Account after the 30-day export window, except what section 11.3 says we must keep. Download your exports before then.
• Member or Trainer: we delete your App login. Your records at the gym belong to the gym's records. We tell your gym about your request and help it act on it. Your gym may need to keep some records (such as payment records) as law requires.
• Blog author: we delete your writer account. Your published posts are removed or shown without your name, as described in our Blog Guidelines.
• Lead or newsletter subscriber: we delete your form data or unsubscribe you, and delete your email within 30 days.

12. Security

12.1 We use reasonable security practices suited to a small business. These include:

• encrypted connections (HTTPS) between your device and our servers;
• database rules that keep each gym's data separate from other gyms;
• role-based access, with Trainer money data masked on the server;
• multi-factor authentication for superadmins and Website admins, and optional two-factor authentication for writers;
• secure token storage on your device for App login;
• logging of superadmin access and important actions;
• storing only a one-way hash of IP addresses on the Website, not the raw IP;
• bot protection and rate limits on forms;
• giving staff access only when needed.

To report a security problem, see our Responsible Disclosure Policy.

12.2 No system is completely secure. We cannot promise that Personal Data will never be accessed without permission. Please keep your password and phone safe, and tell us at once if you think your Account is at risk.

12.3 If there is a breach. If we confirm a personal data breach that affects a gym's data, we will tell the Gym Owner within 72 hours of confirming it, with what we know and what we are doing. We will also inform affected persons and the relevant authorities as the law requires.

13. Your rights

13.1 Subject to the law, you have the right to:

• Access: get a summary of your Personal Data we hold and how we use it, and the names of those we shared it with;
• Correction: ask us to correct, complete or update inaccurate data;
• Erasure: ask us to delete your data, except what law requires us to keep;
• Withdraw consent: take back consent at any time, as easily as you gave it. This does not affect processing already done. Some features may stop working;
• Grievance: complain to us and get a response;
• Nominate a person: name someone who can use your rights if you die or cannot act yourself.

13.2 How to use your rights. Email support@fitosapp.in or use the deletion form. Newsletter emails have an unsubscribe link. Website choices can be changed through "Cookie settings". If you are a Member or Trainer, contact your gym first for gym records (see section 2.2).

13.3 Identity check. To protect you, we will check that the request comes from you. We may ask you to reply from the email or phone number linked to your Account, or to confirm a one-time code. We will ask only for what is needed to verify you. We do not ask for ID proof unless there is no other way and the law allows it.

13.4 Response time. We acknowledge requests and complaints within 48 hours and aim to resolve them within 30 days, or sooner if the law requires.

13.5 If you are not satisfied with our answer, you may approach the Data Protection Board of India or any other authority the law allows, as its provisions apply.

14. Children

14.1 FitOS is a business tool for gyms. It is not directed at children. Website and writer accounts are only for people aged 18 or above.

14.2 A gym may add a Member under 18 only with verifiable consent from a parent or guardian. The gym collects and records that consent. We do not show ads to, track the behaviour of, or profile minors. See our Children and Minors Policy.

15. Changes to this policy

15.1 We may update this policy when the Service or the law changes. The date at the top shows the latest version.

15.2 For important changes, we will tell you before they take effect, by email, an in-app notice or a notice on the Website. Where the law needs your fresh consent, we will ask for it. Changes do not apply backwards to data handled before them, unless the law requires.

16. Contact and Grievance Officer

16.1 For any question about this policy or your Personal Data:

• FitOS (ApexGrid, sole proprietorship)
• Address: Sikar, Rajasthan, India
• Email: support@fitosapp.in
• Phone/WhatsApp: +91 95093 94469

16.2 Grievance Officer

• Name: ApexGrid
• Email: support@fitosapp.in
• Address: Sikar, Rajasthan, India
• Response: acknowledgement within 48 hours; resolution within 30 days, unless the law requires sooner.

See our Grievance Redressal page for the full process.

Appendix A: App-only details

A.1 Login. Your login session is kept in secure token storage on your device. Signing out removes it from the device.

A.2 Offline and exports. Exports (for example, member lists or fee reports) are files you download to your device. Once downloaded, you are responsible for keeping them safe. During READ_ONLY access, a Gym Owner can still view and export data.

A.3 Access states. Your data stays on our server in all access states (TRIAL, ACTIVE, GRACE for 3 days after expiry, READ_ONLY and SUSPENDED). It is deleted only as set out in section 11.

A.4 Trial. The trial lasts 7 days for up to 25 Members, once per gym. We do not ask for payment details for the trial.

A.5 Updates. App updates may be delivered over the air through Expo/EAS. Updates do not add new permissions without asking you.

A.6 Notifications. Push notifications carry short service messages, such as fee due or plan expiry. They do not carry ads.

A.7 Languages. The App is available in English and Hindi, with more languages coming. Changing language does not change how we handle your data.

A.8 Play Store data safety. The data listed in section 3 matches what we declare in the Google Play data safety form.

Appendix B: Website-only details

B.1 Forms. Every lead form has an unticked consent checkbox. We do not pre-tick it. Forms are protected by Cloudflare Turnstile to stop spam.

B.2 IP addresses. We store only a one-way HMAC hash of your IP address for rate limiting and for counting a page view once. We do not store your raw IP address.

B.3 Browser storage. The Website stores your consent choice in your browser. It stores campaign tags (fitos-utm) only after you allow Analytics, and ad impression checks (fitos-adimp:*) only after you allow Ads, as listed in our Cookie Policy. Writers and admins who log in get login session cookies.

B.4 Ads on the Website. Our own banner ads are clearly labelled "Ad" or "Sponsored". Impressions are counted only if you allowed Ads. Google AdSense runs only if we switch it on and only after you allow Ads.

B.5 Blog posts. Posts are moderated. A post moves through DRAFT, PENDING, PUBLISHED or REJECTED. Trusted writers may publish directly. Published posts are public and may be indexed by search engines. See Blog Guidelines.

B.6 Writer security. Writer accounts use email and password, with optional two-factor authentication. Two-factor authentication is mandatory for admins.

B.7 Links. The Website may link to other websites. Their privacy practices are their own; please read their policies.