Privacy Policy
What data GymX collects, why, who it’s shared with, and the choices you have — for gym owners, staff, members and visitors.
1. Who we are and who this policy covers
GymX is gym management software built and operated by Exodus Tech (“we”, “us”), India. This policy covers the GymX website, the gym admin workspace, the member app, QR check-in pages and payment pages.
GymX is used by three groups of people:
- Gym owners and staff who run a gym on GymX. For their own account and billing details, Exodus Tech decides how the data is used.
- Gym members and prospective members whose details a gym records in GymX. Here the gym decides what to collect and why, and Exodus Tech processes the data on the gym’s behalf and on its instructions. Questions about how a gym uses your data are best sent to that gym first; we will help it respond.
- Website visitors who browse our site or send an enquiry.
2. What we collect
- Account details: name, mobile / WhatsApp number, email, password (stored only as a one-way hash, never readable), profile photo if you add one, and optionally date of birth.
- Gym business details: business and branch names, addresses, logo, GSTIN if provided, plans and prices.
- Membership records: plans, start and end dates, amounts, discounts, payments received, balances, receipts, freezes, renewals and follow-up notes made by gym staff.
- Attendance: the date and time of each check-in, from a QR scan or a fingerprint device. Fingerprints are matched on the gym’s own device — GymX never receives or stores fingerprints or any biometric template, only the member’s ID number and the time.
- Training and workouts: personal-training packages, sessions and assigned workouts.
- Staff and finance: staff roles, salaries, payslips, expenses and trainer commissions recorded by the gym.
- Enquiries and leads: details people submit through a gym’s or our enquiry forms, and whether they agreed to receive WhatsApp or email updates.
- Messages: a log of WhatsApp messages and emails GymX sends (type, time, delivery status).
- Payments: for online payments we receive the payment ID, amount, method and status from Razorpay. We never see or store full card numbers, CVV or UPI PINs.
- Technical data: IP address, device and browser type, and security logs, used to keep accounts safe and prevent abuse.
3. How we use it
- To provide GymX: run memberships, payments, attendance, training, staff and reports for each gym.
- To send service messages a gym has enabled — payment receipts, renewal and balance reminders, trial reminders and the gym’s daily report email.
- To create gym accounts, run free trials, take subscription payments and send invoices and renewal reminders to gym owners.
- To keep accounts secure: sign-in limits, fraud and abuse prevention, password recovery.
- To provide support, fix problems and improve GymX.
- To meet legal, tax and accounting obligations.
4. WhatsApp, email and marketing
Membership-related WhatsApp messages (receipts, renewal and balance reminders) are part of the service the gym provides to its members. Marketing messages such as festival wishes and trial reminders are sent only to people who agreed to receive them. Reply STOP to trial reminders, or ask your gym to stop WhatsApp messages at any time.
We don’t sell your contact details or send you advertising from other companies.
7. How long we keep data
- Gym data is kept while the gym uses GymX, including after a free trial or plan ends so the gym can renew without losing anything.
- A gym owner can ask us to delete their business’s data. We’ll export it for them first if they want a copy.
- Payment, invoice and other financial records are kept for as long as Indian tax and accounting law requires, even if other data is deleted.
- Security logs are kept for a limited period and then removed.
8. How we protect it
- All traffic is encrypted with HTTPS / TLS.
- Passwords are stored only as strong one-way hashes; payment keys are encrypted.
- Each gym’s data is kept separate, and staff see only what their role allows.
- Sign-in attempts are rate-limited, and fingerprint devices can be locked to the gym’s own network.
9. Your rights
Under India’s Digital Personal Data Protection Act, 2023, you can ask to access your personal data, correct or update it, have it erased, withdraw consent you gave (for example, to marketing messages), and nominate someone to exercise these rights for you. Members can also contact their gym directly.
Email exodustech.team@gmail.com from the email or phone number on the account. We’ll respond within 30 days, and sooner where we can.
10. Children
GymX is meant for adults. If a gym registers a member under 18, the gym is responsible for getting a parent’s or guardian’s consent first. If you believe a child’s data was added without consent, contact us and we’ll work with the gym to remove it.
11. Grievance officer
For any privacy concern or complaint, contact our Grievance Officer at exodustech.team@gmail.com or +91 63798 76637. If you’re not satisfied with our response, you may complain to the Data Protection Board of India.
12. Changes to this policy
We may update this policy as GymX changes. The latest version is always on this page with its date. For significant changes we’ll also tell gym owners by email or in the app.
Questions about your data?
Write to us — we reply within 30 days, usually much sooner.
© 2026 GymX · Built and operated by Exodus Tech