Privacy Policy

Introduction

Essa Technologies Pvt Ltd (“we,” “us,” or “our”) operates the Gymmerse platform: the website, the web app and the iOS and Android apps. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what happens when you delete your account.

We aim to comply with applicable data protection laws, including the Information Technology Act, 2000 (India) and the Digital Personal Data Protection Act, 2023 (DPDP Act).

Gyms and Gymmerse. Each gym on Gymmerse runs its own business on our software. Information about a gym's members (memberships, attendance, payments to the gym) is held by us on that gym's behalf, and the gym decides how it uses it. If you are a member, your gym's own privacy practices also apply.

Information We Collect

1. Account Information

• Name, email address and phone number
• Password (stored only as a one-way hash)
• Profile picture (optional)
• Country and timezone
• The gym and branch you belong to, and your role there

2. Business Information (Gym Owners)

• Gym name, description, address, photos and map location
• Bank account details, where the gym receives payouts from us
• Tax identification numbers, where provided

3. Trainer Information

• Profile, qualifications, photos, videos and posts that a trainer publishes
• For independent trainers paid by Gymmerse: bank account details for payouts, and a PAN if provided (stored encrypted) for tax deduction at source
• If a trainer verifies their identity with Aadhaar through DigiLocker (via Cashfree), we store only that the verification succeeded, the provider's reference and a one-way hash used to prevent duplicate accounts. We do not store the Aadhaar number.

4. Health & Fitness Data

• Age, gender, height, weight and other body measurements
• Fitness goals, activity level, dietary preferences and food allergies
• Medical conditions or medications, if you choose to enter them
• Meal and water logs, workout history, personal records and progress
• Apple Health and Health Connect: if you connect them in the app, we read your steps, active calories and sleep, and the workouts recorded on your watch or phone with their duration, calories, distance and heart rate, so your daily goals, workout history and streak use what you actually did. We only read this data — we never write to Apple Health or Health Connect — and we never use it for advertising, sell it, or share it with anyone except to run these features for you. It is deleted when you delete your account. You can disconnect at any time in your phone's Health settings.
• Weekly check-ins with your trainer: measurements, scores, notes and up to three progress photos. Progress photos are stored privately and are visible only to you and the trainer you sent them to — not to your gym's owner or staff.

5. Attendance, Location and Door Access

• Check-ins: when you check in or out, we record the time and method (manual, QR code, GPS or door device).
• Location: GPS check-in uses your device's location, only with your permission, to check you in and out when you are at your gym. We record the coordinates with each GPS check-in and check-out to confirm you were at the gym and to detect misuse. We do not use your location for anything else, and you can turn the permission off at any time.
• Biometric door devices: some gyms use fingerprint or card door devices (such as eSSL / ZKTeco). Your fingerprint is enrolled on, and stored by, the gym's device. Gymmerse keeps the device's user number (PIN) linked to your account, a record of each door entry (time, device, and whether access was allowed), and instructions sent to the device (for example to block access when a membership ends). We do not use fingerprint templates. Some raw device messages we keep for a short while for troubleshooting may contain fragments of the encoded data the device sends.

6. Financial Information

• Payment card, UPI and netbanking details are entered with our payment partners (Cashfree, Razorpay, or Apple for in-app purchases on iOS). We do not receive or store your card number.
• Records of payments, refunds, dues, payouts and subscriptions

7. Communications and Content

• In-app chat messages, attachments and reactions
• Reviews, posts, reports and feedback you submit
• Emails, SMS and WhatsApp messages we send you, and their delivery status
• Support conversations with us

8. Video Calls

Online personal training sessions can use in-app video calls. Calls connect directly between the two devices where possible; when they cannot, the encrypted call is relayed through a server we operate. Our servers only help the two devices find each other. Calls are not recorded.

9. Device and Usage Data

• Login activity, sessions and devices (including push notification tokens)
• IP address, browser and operating system
• Error and crash reports, and performance data

10. Cookies and Local Storage

We use cookies and your browser's local storage to keep you signed in and remember your settings. We do not use advertising cookies. You can clear them in your browser, but you will then be signed out.

How We Use Your Information

• Create and run your account, and let your gym manage memberships, bookings and attendance
• Take payments, issue refunds and make payouts to gyms and trainers
• Control door access on gyms that use door devices
• Generate AI nutrition and workout plans and analyse meal logs (see below)
• Send reminders and notifications (for example membership expiry, bookings and payments) by email, SMS, push or WhatsApp
• Moderate content, detect fraud and misuse, and keep the platform secure
• Fix problems and improve the product
• Meet legal, tax and accounting obligations

AI Processing

Some features send data to AI providers (OpenAI and Anthropic) to produce a result:

• Diet and workout plans: your health profile (such as age, gender, height, weight, goals, activity level, dietary preferences, allergies, any medical conditions you entered, and your region for local foods). We do not send your name, email or phone number with it.
• Meal logging: the text you type to describe a meal, so it can be turned into foods and nutrition values.
• Meal photos: a photo you take or choose to log a meal is sent to identify the foods and portions. We do not keep the photo.
• Voice logging: speech is turned into text on your device. No audio is sent to us or stored; only the resulting text is used, as for a typed meal.
• Barcodes: a product barcode you scan or type may be looked up in Open Food Facts, a public food database. Only the barcode number is sent.
• Content moderation: posts, photos and videos that trainers publish are screened by an AI model for prohibited content.

AI-generated plans are suggestions, not medical advice. Plans may be reviewed by your gym or trainer before you see them.

Third-Party Services & Data Sharing

We use the following service providers to run Gymmerse. Each receives only what it needs for its job.

• Hetzner: the servers that run our application and database.
• Amazon Web Services (AWS): SES for email, SNS for SMS (including login codes), S3 for file storage, and hosting for our video-call relay server.
• Cloudflare: hosting for our website and web app, and R2 storage for files, media and archived records.
• Cashfree and Razorpay: payment collection, refunds and payouts to bank accounts. Cashfree also provides DigiLocker identity verification for trainers.
• Apple: in-app purchases on iOS, and push notifications to Apple devices.
• Google Firebase: push notifications (Firebase Cloud Messaging) and app crash reports (Crashlytics).
• Meta (WhatsApp Business): WhatsApp reminders and messages from your gym, where the gym has turned them on.
• OpenAI and Anthropic: AI features, as described above.
• Google Maps and Mapbox: turning gym addresses into map locations and showing gyms on a map.
• Google reCAPTCHA: protecting sign-in from automated abuse.
• Sentry and AppSignal: error and performance monitoring. Error reports can include technical details of the request and your user ID.

Your gym can see the information it needs to run your membership: your profile, memberships, payments to the gym, bookings, attendance and, if you use them, personal training records. Trainers can see the information about clients they train.

We may also disclose information when required by law, to respond to legal process, or to protect the rights and safety of our users and the platform.

Important: We do not sell, rent, or trade your personal information.

Multi-Tenant Data Isolation

Each gym's data is kept separate from other gyms'. Database queries are scoped to the gym, and role-based permissions control what each staff member can see.

Data Security

• HTTPS/TLS encryption for data in transit
• Passwords stored only as one-way hashes
• Sensitive identifiers such as PAN stored encrypted
• Token-based sign-in with refresh tokens kept in HttpOnly cookies on the web
• Rate limiting and account lockout against password guessing
• Access controls, and audit logs of privileged access

Important: No system is completely secure. Please use a strong password and keep your sign-in details to yourself.

Deleting Your Account

You can delete your account yourself, from your profile or settings in the app or on the web, by confirming your password. Deletion takes effect immediately.

Removed immediately

• Your name, phone number and profile picture; your email is replaced so you can no longer sign in
• Your health profile (including medical conditions, allergies and medications)
• Your devices and sessions — you are signed out everywhere
• Verification tokens and similar sensitive data

Kept, without your name

• Payment records are kept for tax and accounting law, with the link to you removed.
• Chat messages stay in the other person's conversation, shown as from “Deleted User”.
• Reviews and personal training session history remain, shown as “Deleted User”, so trainers' and gyms' records stay correct.
• Workout and attendance logs, and complaints or suggestions sent to your gym, are kept for the gym's records.

Gym owners

• If you are the gym's only owner and the gym still has active members, deleting your account puts the gym into closing mode: members can use the memberships they have paid for until they end, and no one new can join. We email you a link that lets you restore your account and gym later.
• If the gym has no active members, it is deactivated. Its financial records are kept as described above.
• Super-admin accounts cannot be deleted through self-service; contact us instead.

Data Retention

• Account data is kept while your account is active, and handled as above when you delete it.
• Financial records are kept for as long as tax and accounting law requires.
• Audit logs are moved from our database to archive storage (Cloudflare R2) after 90 days, and door-device entry logs after a year.
• Records of commands sent to door devices are deleted after 30 days.
• Expired sign-in tokens are deleted after 7–30 days.
• Information subject to a legal hold or an open dispute is kept until it is resolved.

Your Rights & Choices

• View and update your profile and health information in the app at any time
• Ask us for a copy of your personal data, or to correct data you cannot edit yourself
• Delete your account in the app, as described above
• Turn off location permission; you can still check in by other methods your gym offers
• Control push notifications in your device settings, and opt out of marketing messages
• Withdraw consent for optional processing, such as AI plans, by not using those features

To exercise your rights, contact us at info@essatechnologies.in. We will respond within 30 days. Requests about data your gym controls may be passed to your gym.

Children's Privacy

Our platform is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us, and we will delete it.

International Data Transfers

Some of the providers listed above (for example Hetzner, AWS, Cloudflare, Google, Meta, OpenAI, Anthropic, Sentry and AppSignal) may store or process data outside India. We choose established providers and send them only what each needs.

Changes to This Privacy Policy

We may update this Privacy Policy as the product or the law changes. We will update the “Last updated” date and, for material changes, tell you by email or in the app.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: