Privacy Policy

Your privacy matters

We handle your personal and health data with utmost care and in compliance with Indian data protection laws (IT Act 2000, DPDP Act 2023). You have full rights over your data at all times.

1. Information We Collect

When you become a member of Brothers Gym or use our website, we collect the following information:

Personal Information

Full name and Father's name
Phone number (Ph.No)
Residential address
Email address (optional)
Emergency contact number
Age and gender (if provided)

Health & Fitness Information

Weight and height (for BMI, if you use our BMI calculator)
Medical conditions or injuries (if you disclose them)
Fitness goals and workout preferences
Attendance and gym visit records

Providing health information is optional but recommended for your safety.

Payment & Membership Information

Membership plan type and duration
Fees paid and payment method
Joining date and expiry date
Payment transaction records (UPI reference / UTR number)

Technical Information

IP address (for security purposes)
Browser type and device information
Login attempts and timestamps

2. How We Use Your Information

Membership Management: To create and manage your gym membership, track expiry, and process renewals.
Communication: To send you WhatsApp or SMS reminders about membership renewals, payment confirmations, and important updates.
Payment Processing: To confirm online UPI payments made directly to the gym's UPI account and activate your membership.
Safety & Emergency: To contact your emergency contact in case of any medical emergency at the gym.
Legal Compliance: To comply with any legal, tax, or regulatory requirements.
Service Improvement: To improve our gym services, equipment, and member experience.

3. Data Security

We take security seriously. Your data is protected by industry-standard measures:

Encrypted Storage: All data is stored in encrypted PostgreSQL databases.
Password Protection: All passwords are hashed using bcrypt (industry standard, cannot be reversed).
HTTPS Encryption: All data transfer is encrypted via HTTPS/TLS.
Rate Limiting: Login attempts are rate-limited to prevent brute force attacks.
Two-Factor Authentication (2FA): Owner accounts use OTP verification via email for login.
Access Control: Only authorized staff can access member data, with granular permissions per staff.
Session Management: Auto-logout after 30 minutes of inactivity.
Bot Protection: Cloudflare Turnstile protects login pages from bot attacks.
No Card Details Collected: Online payments are made by UPI inside your own UPI app. We never see or store your card, bank, or UPI PIN details — only the amount and an optional reference number you share to help us confirm the payment.

4. Third-Party Services

We use trusted third-party services to run our platform. Each is RBI-approved or compliant with Indian data protection standards:

UPI Apps & Banks: Online payments are made by UPI directly from your app (Google Pay, PhonePe, Paytm, or your bank) to the gym's UPI account, over India's RBI-operated UPI network. We never see or store your payment credentials.
Resend: For sending OTP verification emails and password reset codes.
MSG91: DLT-approved SMS provider for sending membership reminders (if enabled).
Google Maps: For displaying gym location and directions.
Cloudflare: For bot protection on login pages.

5. Your Rights

You have the following rights over your personal data:

Right to Access: Request a copy of all data we have about you.
Right to Correction: Request correction of any inaccurate information.
Right to Deletion: Request deletion of your data after your membership ends (subject to legal retention requirements).
Right to Opt-Out: Opt out of marketing SMS/WhatsApp reminders at any time.
Right to Portability: Request your data in a portable format (Excel/CSV).

To exercise any of these rights, contact the branch owner directly (see contact section below).

6. Data Retention

Active member data is retained for the duration of your membership.
Inactive/expired member data is retained for up to 3 years for legal, tax, and business analytics purposes.
Payment records are retained for 8 years as required by Indian tax laws.
Login logs and security data is retained for 1 year for security auditing.

7. Cookies & Tracking

We use minimal cookies necessary for the website to function:

Authentication cookies: To keep you logged in.
Session cookies: To maintain your session state.
CSRF protection cookies: To protect against cross-site request forgery attacks.

We do NOT use third-party tracking cookies, ad networks, or analytics that share your data with third parties.

8. Children's Privacy

Members under 18 years of age require parental/guardian consent. We collect the Father's Name specifically for this purpose. Parents can request access or deletion of their child's data at any time.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be notified to active members via WhatsApp/SMS. Continued use of our services after changes constitutes acceptance of the updated policy.

10. Contact for Privacy Concerns

For any privacy-related queries, data access requests, or complaints, please contact the branch owner directly using the contact information below.

Grievance Officer: The respective branch owner (see contact section below).

Response Time: Within 30 days as per DPDP Act 2023.