Privacy Policy

FitStat ("we", "us", "our") operates fitstat.in, including our fitness events, gym-operations products, and our online personal-training ("PT") marketplace (collectively, the "Platform"). This Privacy Policy explains what personal data we collect from Customers, Trainers, and visitors, why we collect it, how we protect it, and the rights available to you under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian law. Under the DPDP Act, FitStat acts as the "Data Fiduciary" and you, as a user whose personal data we process, are the "Data Principal".

1. Information We Collect

a. Account information (Customers and Trainers): name, email address, phone number, and a securely hashed password.

b. Trainer profile & verification data: bio, specialties, years of experience, profile photo/photo URL, pricing plans, weekly availability; and, for KYC purposes, PAN, Aadhaar, and certification documents, plus bank account number and IFSC code for weekly payouts. PAN, Aadhaar, and bank account numbers are treated as sensitive personal data and are stored using field-level encryption; only masked values (e.g., the last few digits) are ever displayed on screen, including to our own admin team.

c. Customer health/fitness data: body weight, height, body-fat percentage, and body measurements (chest/waist/hip/arm/thigh) that you choose to log, and any health-relevant information you share with a Trainer to make a Session safe. This is sensitive personal data relating to your health, and we collect it only with your explicit action (you choose what to log) and use it only to support your training and to show it back to you as a progress history.

d. Booking & payment data: Session date/time, pricing plan, booking status, and Razorpay order/payment identifiers and signatures used to confirm payment. We do not collect or store your card number, UPI ID, or net-banking credentials — these are handled directly by Razorpay, our PCI-DSS-compliant payment processor, under its own privacy policy.

e. Ratings & feedback: the ratings and comments Customers and Trainers leave for each other after a Session, and any platform feedback you submit.

f. Communications: messages you send us via the contact form, the on-site chat widget, or WhatsApp, and event-registration details (e.g., step counts or proof screenshots for challenges).

g. Technical data: a signed session cookie used to keep you logged in, and standard web server logs (IP address, browser type, pages visited) used for security and troubleshooting.

h. Video session data: Sessions are conducted through the Platform's own in-platform video calling feature (powered by our video infrastructure partner) rather than a third-party meeting link, so Trainers and Customers do not need to exchange personal contact details to conduct a Session. To make this work, we generate a short-lived, Session-scoped video access token for each side, valid only for a short window around the scheduled Session time. We do not currently record Session audio or video. If we introduce Session recording in the future, we will update this Policy and obtain your consent separately before doing so.

2. Why We Process Your Information

• To create and administer your Customer or Trainer account.
• To display Trainer profiles, pricing, and availability, and to compute bookable slots.
• To process Bookings and payments, and to confirm Sessions.
• To verify Trainer identity/certifications (KYC) and prevent fraud, as required for a platform that processes payments to individuals.
• To calculate and pay weekly Trainer payouts.
• To show you your own booking history, ratings, and body-measurement progress.
• To respond to support requests, grievances, and platform feedback.
• To comply with applicable tax, accounting, and other legal obligations.

We process your personal data on the basis of your consent (given at signup, at KYC-document upload, and whenever you choose to log a body measurement) and, where applicable, to perform our contract with you (fulfilling a Booking) or to comply with a legal obligation.

3. Sharing of Information

• We share only the limited Customer details a Trainer reasonably needs to conduct a confirmed Session (name, and any health information you chose to share for that Session) — and, correspondingly, the Trainer's name and profile details are shared with the Customer. Because Sessions are conducted through the Platform's own in-platform video calling feature, Trainer and Customer personal contact details (phone number, email address) are not shared with each other.
• Payment details are shared with Razorpay solely to process your payment.
• KYC documents and bank details are visible only to our authorised admin team for verification and payout approval.
• We may share participant names or handles on our public event leaderboard or social media, as agreed during event registration.
• We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
• We may disclose personal data where required by law, regulation, or a valid court/government order.

4. Data Security

Passwords are stored using industry-standard one-way hashing (bcrypt); PAN, Aadhaar, and bank account numbers are stored using field-level encryption; uploaded documents are stored on access-controlled infrastructure; and the Platform is served over HTTPS. Repeated failed login attempts trigger a temporary account lock as an anti-brute-force measure. That said, no method of storage or transmission over the internet is 100% secure, and we cannot guarantee absolute security.

5. Data Retention

We retain your account, booking, and payment data for as long as your account is active and thereafter for as long as needed to meet our tax, accounting, and other statutory record-keeping obligations under Indian law. KYC documents and bank details are retained for as long as required for compliance and payout purposes and are deleted or anonymised once no longer required. You may request earlier deletion, subject to these legal retention requirements (see Section 6).

6. Your Rights as a Data Principal

Subject to the DPDP Act and its rules, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct or update inaccurate or incomplete personal data (most account and profile fields can be edited directly from your dashboard).
• Erasure of your personal data, once it is no longer needed for the purpose it was collected for and we are not otherwise required to retain it by law.
• Withdraw consent at any time for processing based on consent — for example, you may stop logging body measurements at any time; withdrawing consent for KYC data will mean we can no longer verify or pay out a Trainer account.
• Grievance redressal — see our Grievance Redressal Policy to raise a privacy-related complaint with our Grievance Officer.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email hello@fitstat.in from your registered email address.

7. Cookies

We use a single signed session cookie to keep you logged in to your Customer, Trainer, or admin session. We do not use third-party advertising or cross-site tracking cookies. See our dedicated Cookie Policy for the full list of cookies we use, the third-party resources our pages load, and how to control cookies in your browser.

8. Children's Data

The Platform is intended for users aged 18 and above. Where a minor between 13 and 18 participates with parental/guardian consent (see our Terms of Use), the account and any associated personal data is treated as being provided under the responsibility of that parent/guardian.

9. Storage Location

Your personal data is processed on servers located in India. If we ever need to process data outside India (for example, through a sub-processor), we will do so only where permitted under the DPDP Act.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Platform or applicable law. The "Last updated" date above will change accordingly, and material changes will be highlighted on this page.

11. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of India. Subject to the grievance redressal process referred to above, the courts at Bengaluru, Karnataka shall have exclusive jurisdiction over any dispute arising out of or relating to this Policy.

12. Contact Us

For any questions about this Privacy Policy, or to exercise your rights above, contact us at hello@fitstat.in or +91 7200613902. For unresolved grievances, see our Grievance Redressal Policy.