Privacy Policy

1. Who controls your data

Each gym that uses Fitness Kernel is the data controller (or “data fiduciary” under India’s Digital Personal Data Protection Act, 2023 — DPDP Act) for its members’ and staff’s personal data.Vyuha Systems acts as a data processor (or “data processor” under the DPDP Act) on behalf of that gym, providing the software platform. If you are a gym member or staff user, contact your gym first for most requests; you may also write to us at info@vyuhasystems.com.

2. What we collect

Depending on your role and what your gym enables, Fitness Kernel may process:

• Identity & contact — name, phone, email, profile photo, role within the gym.
• Membership & billing — plans, renewals, invoices, payment records (amounts in Indian rupees), dues, UPI references.
• Attendance & access — check-ins, class bookings, facility access events.
• Training & health-related metrics — PT packages, session logs, body assessments, progress photos, goals (processed only when your gym uses those features).
• Operations data — leads, maintenance tickets, staff attendance, support messages (email / WhatsApp where configured).
• Technical data — authentication session, active workspace selection, device push-subscription endpoints when you enable notifications.

3. Why we process it (purpose limitation)

We process personal data only for purposes your gym reasonably needs to operate, including: providing the service; membership and payment administration; scheduling and training delivery; safety and facility operations; communications you or your gym opt into (in-app, email, WhatsApp, web push); security; and complying with law. We do not sell personal data.

4. Consent & lawful use

Where the DPDP Act requires consent, your gym (as data fiduciary) is responsible for obtaining it for the purposes it pursues. Account creation, staff provisioning, and use of optional channels (e.g. WhatsApp or push) may involve consent or other lawful grounds as determined by your gym. Essential cookies that keep you signed in do not require a separate marketing opt-in — see our Cookie Policy.

5. How long we keep data

Retention follows your gym’s operational needs and legal obligations (for example, tax and accounting records). When a gym deletes or deactivates an account, or ends its subscription, we process deletion or retention according to our agreement with that gym and applicable law. Backups may persist for a limited period before purge.

6. Who we share data with

Data stays within your gym’s tenant workspace. We share personal data only with:

• Your gym — authorised staff who use the dashboard.
• Vyuha Systems — as processor, to host and support Fitness Kernel.
• Sub-processors — infrastructure and messaging providers that process data on our instructions, currently including Supabase (database/auth/storage), Resend (email), Twilio (WhatsApp, when enabled), and Groq (optional AI features, when enabled by your gym).

We do not use third-party advertising trackers on the product today.

7. Your rights (data principal)

Subject to the DPDP Act and other applicable law, you may request access, correction, erasure, or withdrawal of consent where consent is the basis of processing, and you may raise a grievance. Start with your gym’s front desk or admin. You may also contact our grievance point of contact: info@vyuhasystems.com. We will coordinate with the relevant gym where we act only as processor.

8. Security

We use industry-standard measures including encrypted transport (HTTPS), role-based access, tenant isolation, and access controls on administrative tools. No method of transmission or storage is 100% secure.

9. Children

Fitness Kernel is intended for gym operations. If a gym onboards a minor, the gym is responsible for obtaining verifiable parental/guardian consent as required by law.

10. Changes

We may update this policy. Material changes will be reflected by the “Last updated” date on this page.

11. Contact

Vyuha Systems · Fitness Kernel
Email: info@vyuhasystems.com