Privacy Policy

We collect the following categories of data to provide and improve our services:

• Identity Data: Name, age, sex, and profile photograph.
• Contact Data: Phone number (used for authentication via OTP) and password (stored only as a secure hash).
• Health & Fitness Data: Height, weight, fitness goals, and any medical conditions or dietary restrictions you voluntarily provide. This is sensitive personal data and is used solely to personalise workout and diet plans and tracking features.
• Activity Data: Workout logs (exercises, sets, reps, weights, duration), food and calorie logs, water intake, weight history, and diet plan interactions.
• Photos & Media: Profile photo only. Photos you capture or select are uploaded to our secure cloud storage.
• Device & Technical Data: Operating system platform (iOS/Android), app version, and push notification tokens (Expo push tokens) used to deliver notifications to your device.
• Diagnostics Data: When something fails in the app, an error report goes to our error-monitoring provider, Sentry. It holds the device model, operating system, app version, IP address, the screens used just before, and the request and response involved — which can include your health, fitness and activity data — with passwords, one-time passwords and session tokens removed. It is used only to find and fix faults.

• To create and manage your user profile and account.
• To verify your identity via OTP during login.
• To deliver workout and diet plans your gym has generated and assigned to you.
• To power workout tracking, food and calorie logging, and weight history inside the app.
• To send push notifications about your plans and fitness activity.
• To communicate important service updates and respond to support requests.

The app requests the following device permissions, each used for a specific purpose:

• Camera: Used solely when you choose to take a profile photo. Camera footage is not recorded or stored beyond the photo you confirm.
• Photo Library: Used only when you choose to upload a profile photo.
• Notifications: Used to deliver plan-ready alerts and fitness reminders. You can disable notifications at any time in your device settings.

We share limited profile information (name, photo, body metrics, and fitness profile details you provide) with the gym or gyms where you hold an active membership seat, so they can deliver personalised plans and support your fitness journey. We do not sell your data to any third parties.

We use the following third-party service providers to operate the app, who are bound by data processing agreements and may process data on servers located outside India:

• Google Cloud (Mumbai, India) — secure cloud storage for profile photos and the servers this service runs on. Your data stays in the Indian region.
• Google Vertex AI — generates workout and diet plans from intake answers on your gym’s instructions. Data sent to Vertex AI is not used to train Google’s public models.
• MongoDB Atlas — the database.
• Expo Push Notification Service — delivers push notifications to your device.
• Fast2SMS — sends one-time passwords by SMS during login and, where your gym has enabled it, your plan link by WhatsApp.
• Sentry — receives error reports from the app so we can find and fix faults. A report can include the data involved in the request that failed.

Some of these process data on servers outside India. That is permitted under section 16 of the DPDP Act 2023. We will stop using any processor that becomes restricted by the Central Government.

The app offers AI-generated workout and diet plans. When your gym generates a plan for you, information you have provided — such as fitness goals, experience level, body metrics, dietary preferences, and any medical or dietary restrictions you voluntarily disclose — is processed by our AI service provider to produce a personalised plan. Each plan is reviewed by your gym before being assigned to you.

We do not sell your inputs and we do not use them for advertising. AI-generated plans are provided for general fitness guidance only and are not medical advice. Please see our Terms of Service for the full medical disclaimer and your responsibilities when using these plans.

The Connec8 Plans Member app does not collect your GPS location, does not use any third-party analytics or advertising SDKs, and does not track your activity outside of the app. We do not collect contacts, biometric data, government identifiers, or payment details through the member app.

We implement appropriate technical and organisational security measures to protect your data against unauthorised access, alteration, disclosure, or destruction. All data transmitted between the app and our servers is encrypted in transit using HTTPS/TLS. Your password is stored only as a bcrypt hash, never as reversible text. The sign-in token on your phone is held in the app’s own private storage, which the operating system keeps separate from every other app, and it is destroyed when you sign out or delete your account. Access to your data within our organisation is restricted to employees and partners with a legitimate business need.

We retain your personal data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 90 days, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Aggregated and anonymised data that cannot be used to identify you may be retained indefinitely.

Under sections 11 to 14 of the DPDP Act 2023 you have the right to:

• Access and receive a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data through your in-app profile or by asking your gym.
• Request deletion of your account and associated data, except where a law requires us to keep it.
• Withdraw consent for optional data collection at any time, as easily as you gave it.
• Opt out of non-essential push notifications through your device settings.
• Complain — to our Grievance Officer first, and then to the Data Protection Board of India if we have not resolved it.

Delete your account yourself from Profile → Delete Account in the app. What that does, and what survives it, is set out on our account deletion page.

You can delete your account and all associated personal data at any time:

• In-app: Open the app, go to Profile → Delete Account.
• Via web: Visit our account deletion page and submit the deletion request form.
• Via email: Send a deletion request from your registered phone number or email to support@gymconnec8.com.

Deleting from inside the app takes effect at once: your food, activity and weight history, any foods you added yourself, and your profile photo are erased, your password and every session are destroyed, and your app access ends at every gym. A request made by email is actioned within 30 days. The plans your gym generated, and your name and number attached to them, stay with the gym as its own record - see our account deletion page for exactly what survives and why.

The Connec8 Plans Member app is intended for users aged 18 and above. In accordance with applicable Indian data protection law (including the Digital Personal Data Protection Act, 2023), we do not knowingly collect personal data from children under the age of 18 without verifiable parental consent. If you believe we have collected data from a child without such consent, please contact us and we will promptly delete it.

We may update this privacy policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. The "Last updated" date at the top of this page indicates when the policy was last revised. Material changes will be communicated through the app or via email.

If you have any questions about this Privacy Policy or wish to exercise any of your rights, please contact us:

Entity: M/S Connec8

Email: support@gymconnec8.com

Phone: +91 9752769420

Address: House No 22, Panchwati Colony, Airport road, Bairagarh, Huzur, Bhopal Madhya Pradesh - 462030

Grievance Officer — under section 13 of the DPDP Act 2023 and Rule 5(9) of the SPDI Rules 2011:

Name: Harshit Gandhi

Designation: Manager

Email: support@gymconnec8.com

Acknowledged within 48 hours, resolved within 30 days.