Privacy Policy

1. Role and Definitions

Data Fiduciary:

Fitripass ("We", "Us", or "Our"), as defined under the DPDP Act, determines the purpose and means of processing your personal data.

Data Principal:

You ("User", "Traveller", or "Customer"), the individual whose personal data is collected and processed.

Partner Gyms:

Independent fitness centers, studios, and health clubs partnered with Fitripass to grant you access.

2. Personal Data We Collect

To provide seamless gym pass bookings across India, we collect only necessary digital personal data:

Identity & Contact Details:

Name, email address, phone number, state/city of residence, and government ID details (where required by partner gyms for security verification).

Booking & Travel Details:

Selected cities, partner gym locations, pass dates/times, and transaction history.

Location Data:

Approximate or precise location data (with your explicit permission) to suggest nearby partner gyms while traveling.

Payment Information:

Payment status and transaction reference numbers processed through PCI-DSS compliant payment gateways. (Note: Fitripass does not directly store credit/debit card details or UPI PINs).

Technical & Usage Data:

IP address, browser type, device identifiers, and platform navigation logs collected automatically via cookies or similar technologies.

3. Purpose of Processing and Lawful Basis

We collect and process your personal data solely for specific, lawful purposes based on your explicit consent:

Service Fulfillment:

Generating digital gym passes, verifying identity at partner gym reception desks, and managing bookings.

Account Management:

Creating and maintaining your user profile.

Communication:

Sending booking confirmations, OTPs, QR code passes, customer support updates, and service announcements via SMS, WhatsApp, or email.

Platform Security:

Preventing fraud, unauthorized access, and unauthorized pass transfers.

Legal & Regulatory Compliance:

Fulfilling obligations under Indian tax laws and applicable government regulations.

4. Sharing & Disclosure of Personal Data

We do not sell your personal data. We only share necessary personal data with third parties in the following scenarios:

Partner Gyms:

We share relevant booking details (e.g., your full name, pass validity, and pass code) with the specific fitness center you choose to visit so they can grant you entry.

Service Providers & Processors:

Secure third-party vendors who assist in payment processing (e.g., Razorpay, Cashfree), SMS/WhatsApp communication services, cloud hosting, and analytics.

Legal Obligations:

When required by law enforcement, regulatory authorities, or court orders under Indian law.

5. Your Rights as a Data Principal

Under the DPDP Act 2023, you hold the following statutory rights regarding your personal data:

Right to Access:

Request a summary of the personal data we hold about you and details of processing activities.

Right to Correction & Erasure:

Request correction of inaccurate or incomplete personal data or request deletion of your data once the purpose of processing has been fulfilled, subject to applicable legal requirements.

Right to Withdraw Consent:

Withdraw your consent for processing personal data at any time by updating your account settings or contacting us through our official support email. Please note that withdrawing consent may impact our ability to provide ongoing or future booking services.

Right to Grievance Redressal:

Raise questions, concerns, or complaints regarding the handling of your personal data through our grievance redressal mechanism.

Right to Nominate:

Nominate another individual to exercise your data privacy rights on your behalf in the event of your death or incapacity, as permitted under applicable law.

6. Data Security & Retention

Security Safeguards:

We implement appropriate administrative, technical, and physical safeguards, including encrypted communication, secure infrastructure, restricted system access, and industry-standard security practices to help protect your personal data against unauthorized access, disclosure, alteration, or misuse.

Data Retention:

Personal data is retained only for as long as necessary to fulfill the purposes described in this Privacy Policy or to comply with applicable legal, regulatory, tax, and accounting obligations. When the retention period expires, or where deletion is lawfully requested, the data will be securely deleted, anonymized, or otherwise disposed of in accordance with applicable laws.

7. Children's Privacy

Fitripass services are intended for individuals who are 18 years of age or older. We do not knowingly collect, use, or process the personal data of children without valid parental or guardian consent, where required under applicable laws. If we become aware that personal information of a minor has been collected without appropriate authorization, we will take reasonable steps to delete such information.