Privacy Policy

Korefitt (“we”, “us”) operates a gym membership and booking platform for members in India, including this website, the member portal, and the Korefitt mobile apps for Android and iOS. This policy explains what personal information we collect, why we use it, and how you can exercise your rights under applicable Indian law (including the Digital Personal Data Protection Act, 2023, where it applies).

1. Who we are

Korefitt is the data fiduciary for personal data processed through the Service (web and mobile). For privacy, data access, and account deletion requests, email korefittadmin@gmail.com. For general membership or app support, contact support@korefitt.in or the address on our About page.

2. Information we collect

• Account data: name, email, password (stored hashed), phone, profile photo.
• Membership & bookings: plans, payments, attendance (including check-in via member QR codes scanned by authorised staff), freezing-day requests, class bookings and waitlist status.
• Health-related profile fields you choose to provide (e.g. height, weight, medical notes, emergency contact).
• Loyalty & engagement: programme preferences, badges or progress where your gym uses loyalty features, and related settings you choose in the app.
• Content you submit: testimonials, photos or videos for gallery or community features, and messages in enquiries or support.
• Staff / trainer operations: checklist and schedule data entered by authorised trainers or admins in connection with gym operations (may reference members or sessions).
• Enquiries: name, email, mobile, message, and technical metadata (IP address, browser) when you submit a contact form.
• Technical data: session/authentication tokens, device type, app version, and network requests needed to operate and secure the Service.

3. Why we use your data

• To create and manage your account and membership.
• To process payments and issue receipts.
• To schedule sessions, record attendance, membership freezing days, and related gym operations.
• To run loyalty, gallery, testimonial, and communication features configured by your gym.
• To respond to enquiries and improve our services.
• To meet legal, accounting, and security obligations.

We process this data because it is necessary to provide the service you request, to fulfil a contract (membership/booking), with your consent where required (e.g. enquiry/registration acknowledgement), or for legitimate business needs that do not override your rights.

4. Payment and messaging providers

Depending on gym settings, online payments may be processed by third-party gateways such as Stripe, CCAvenue, or Razorpay (card, UPI, net banking, wallets, and related methods). Contact actions may use WhatsApp or email. Those providers process data under their own terms and privacy policies. We do not store full card numbers on Korefitt servers.

5. Website cookies and local storage

On the website we use essential cookies and local storage for authentication (keeping you signed in) and to remember cookie-banner preferences. We do not currently use advertising or analytics cookies on the website. You can clear cookies in your browser; signing out removes access tokens from that browser session.

6. Mobile apps

The Korefitt apps connect to our API over HTTPS (typically https://korefitt.in/api/v1 in production). Important points:

• Sign-in tokens are stored in the device secure store (Android Keystore / iOS Keychain), not in ordinary app storage.
• Biometric unlock (Face ID, fingerprint, or equivalent) is optional. Biometric templates stay on your device; we do not receive or store biometric data on our servers.
• Camera access is requested only for authorised staff (e.g. admins) to scan member QR codes for attendance. Scanning is used to validate check-in; we do not use the camera for advertising or unrelated profiling.
• Non-sensitive preferences (such as theme or whether biometric unlock is enabled) may be stored locally on the device.
• Crash reports are sent to Google Firebase Crashlytics when the app crashes or hits an error: the error and stack trace, app version, device model, operating system version and your numeric account ID (no name, email or phone number). We use them only to find and fix problems.
• Push notifications are delivered through Google Firebase Cloud Messaging. With your permission, the app registers a device token that we link to your account, so we can notify you about your bookings, membership, freezing days and payments. You can turn notifications off at any time in your device settings; signing out removes the token.
• We do not sell your personal data. We do not use the mobile apps for third-party advertising or cross-app tracking, and we do not use Firebase Analytics.

7. How long we keep data

• Active accounts: for as long as your membership/account remains open.
• Payment and membership records: retained as needed for accounting and dispute resolution (typically several years).
• Enquiries: kept while useful for follow-up, then archived or deleted.
• Deactivated accounts: may be retained in limited form where required by law or to prevent fraud.

8. Your rights

Subject to applicable law, you may request to:

• Access a copy of personal data we hold about you.
• Correct inaccurate data (you can also update much of this in your profile).
• Withdraw consent where processing is based on consent (e.g. certain marketing contact).
• Request deletion or account closure, where we are not required to keep records.

To make a request, email korefittadmin@gmail.com with the subject “Privacy data request” and enough detail for us to verify your identity. You can also use Delete account in the mobile app Profile to start this process. We aim to respond within a reasonable period. Some records (e.g. payment history) may be kept where the law or legitimate business needs require it, as described above.

9. Security

We use industry-standard measures such as password hashing, encrypted transport (HTTPS where configured), and role-based access controls for staff. No online system is perfectly secure; please choose a strong password and keep it confidential.

10. Children

This service is intended for adults and gym members authorised by the facility. If you believe we have collected a child’s data inappropriately, contact us so we can delete it.

11. Changes

We may update this policy from time to time. The “Last updated” date at the top will change. Continued use of Korefitt after updates means you accept the revised policy where permitted by law.

12. Contact

Privacy / data / deletion:korefittadmin@gmail.com. General support:support@korefitt.in. Also see our Terms of Use.