Privacy Policy

Who we are

Fitnesta is operated by Bheema Network India (“we”, “us”). This policy explains how we handle personal information in the Fitnesta apps for iPhone and Android and on this website. You can contact us at support@fitnesta.com.

Bheema Network India, a sole proprietorship, Door no. 48, Plot no. 17, 12-B Cross Street, Krishna Nagar, Lawspet, Pondicherry - 605008.

It applies to members, personal trainers, business owners and staff, and to people whose information a business or personal trainer adds to Fitnesta, such as gym members, clients and enquiries.

The short version

• We collect what you give us, what the people you train with or belong to a gym with record about you, and technical information needed to run and secure the service.
• Some of it is sensitive: assessments can include health information, and progress photos and body measurements are personal.
• We use service providers to host, secure and operate the service, and map providers to show maps — on Android, Google Maps receives information under its own terms. We do not sell personal information, show third-party advertising or use advertising trackers.
• You decide whether people nearby can find you, whether usage analytics are linked to you, and which notifications and offers you get; you can delete your account. See Privacy choices.

Information we collect and why

What we collect depends on how you use Fitnesta. For each kind of information, here is what it is and why we use it.

Account and sign-in information

What: your name, username, email address, phone number, and how you sign in — email and password, a one-time code sent by SMS, Sign in with Apple, or Google Sign-In. We email a one-time code to confirm your address, to reset a forgotten password and to change your email address. Sign-in is run for us by our authentication provider, Supabase, which holds your sign-in details and signed-in sessions; passwords are stored only as a one-way hash, and we cannot read them. When you use Apple or Google, we receive an account identifier and, where the provider shares them, your email address and name. With Sign in with Apple we also keep a token from Apple, used only to withdraw that authorization when you delete your account. We also record when you accepted the Terms of Use and this policy (with the app version, device and network address it came from), the optional consents you gave or withdrew (such as offers and usage analytics), and the devices where you are signed in.

Why: to create your account, sign you in, confirm your email address and phone number, keep your account secure and prevent abuse.

Profile information

What: your profile photo, bio, date of birth, gender (optional), city and area, languages, fitness level, interests, goals, availability and training preferences, and the kind of workout partner you are looking for (for example an age range, genders and fitness levels).

Why: to show your profile to other people according to your settings, to confirm you are 18 or over, and to suggest workout partners, personal trainers, gyms, classes and communities.

Being found: when you sign up you choose whether people nearby can find you in Find Your People, search and partner matching; nobody is findable until they say yes. If you say no — or later turn it off in Settings → Privacy — you are left out of those lists, and people you are not connected to see only your name, username and photo on your profile.

Location

What: if you allow it, your device's location while you are using the app, and the city and area you enter. The app does not request location in the background.

Why: to find people, gyms, classes and events near you. Fitnesta does not show your precise location to other users; other people see your area and a distance range, never your exact coordinates. On Android, when Google Maps features are displayed or your location is shown on a map, Google Maps may receive location, map interaction and technical device information directly from the app under Google’s own privacy terms.

Personal Trainer and business information

What: for personal trainers, your professional profile, services, specialisations, certifications, availability and training locations. For businesses, the business and branch details, opening hours, facilities, photos, membership plans, classes, staff and their roles, and information submitted for verification.

Why: to publish your listings, let people book and contact you, review verification requests and run your workspace.

Fitness, health and progress information

What: information you or a personal trainer you work with record, including:

• Assessments — answers to intake and review questionnaires. These can include health screening questions, such as whether you have a heart condition, feel chest pain during activity, have a chronic medical condition, take prescribed medication, or have injuries or pain to work around.
• Body measurements — such as weight, body-fat percentage and waist, chest, arm, thigh, hip and neck measurements.
• Progress photos.
• Training records — assigned workouts and programmes, workout logs, perceived effort, notes, goals, and class attendance.

Why: so you and the personal trainers you work with can plan training and track progress. Progress photos are visible only to you and, if you choose to share them, the personal trainers you work with. We treat this information as sensitive: assessment and health screening answers, body measurements and progress photos are never sent to our analytics provider. A usage event about a logged workout can say how long it took and the effort you rated it.

Information businesses and personal trainers add about people

What: gyms, studios and personal trainers can keep records about their members, clients and enquiries, including people who do not have a Fitnesta account. These records can include name, phone number, email address, member code, membership plan, join and expiry dates, status, notes, tags, attendance, and dues and payments the business records as received. Businesses can add these records one at a time or by importing a CSV or Excel file.

Why: so the business or personal trainer can manage their members and clients, run classes, follow up on enquiries and send payment reminders. The business or personal trainer decides what to add and is responsible for having the right to add it and to contact those people. We process these records to provide the service to them. Uploaded import files are deleted automatically after a limited period.

A business or personal trainer cannot connect their record to your Fitnesta account on their own: you are asked in the app, and the record is linked only if you accept. You can unlink a gym membership later from that gym's page in the app, and end coaching from your personal trainer's page.

For a record a business or personal trainer keeps about you, they decide how it is used and we process it on their behalf. Ask them to see, correct or delete it. If they do not help, or you cannot reach them, contact our Grievance Officer (see Contact) and we will pass your request on and follow it up.

Posts, comments, messages and community content

What: posts (text, images and polls), comments, likes, saved posts and poll votes; communities, events and activities you create or join; reviews and ratings; connections, follows and blocks; and direct and group messages.

Why: to provide these features and show content to the people you choose. Messages are stored on our servers so they can be delivered to the people in the conversation and synced across your devices. Content, including messages, may be reviewed when someone reports it.

Bookings and enquiries

What: sessions, classes, events and activities you book or join, cancellations, and enquiries you send to personal trainers or businesses.

Why: to make the booking or enquiry and share it with the personal trainer or business involved.

Reports and safety

What: reports you make (the reason and any description), the content or account reported, and the moderation actions we take, including suspensions and bans.

Why: to review reports, enforce the Terms of Service and keep people safe.

Notifications, SMS and WhatsApp

What: push notification tokens with your device platform, app version, language and time zone; your notification settings; your phone number when we send a sign-in code by SMS; your email address when we send a code by email; and, for gym members, the phone number a business has recorded so it can send payment reminders over WhatsApp, with delivery status and any STOP or START replies.

Why: to deliver notifications and codes, send reminders a business has set up, and honour opt-outs.

Device, usage and diagnostic information

What: the IP address, device and browser details of requests to our servers and to this website; records of the devices where you are signed in; product usage events (for example which screen was opened or which feature was used, with the app version and platform — never free text you typed, contact details, exact location, sign-in credentials or health screening answers); error reports and performance traces; server and security logs; and, when the app crashes, a crash report containing the error and where in the app it happened, the app version, your device model and operating system version, and a random identifier for that installation of the app. A crash report does not include your name, account, phone number, messages or photos.

Why: to keep the service secure, detect abuse, fix problems and understand which features are used.

Usage analytics: usage analytics is on unless you switch it off in Settings → Consents. While it is on, usage is recorded only as anonymous counts — in our own systems (kept 12 months, used only to run and improve Fitnesta) and at our analytics provider, PostHog: no account, no session, no record identifiers and only the hour an event happened, and at PostHog each event under a new random identifier with no profile, so nothing either holds can be connected to you. Switch it off and, from the next event, nothing about how you use Fitnesta is recorded or sent to PostHog, and events still waiting on your device are discarded. Separately, you can choose in the same place to link analytics to your account: only if you turn that on are your events recorded, by us and by PostHog, with your account identifier and the identifiers of the records involved (such as a booking). You can turn that off at any time; we then stop linking your events, unlink the events we hold linked to your account, and ask PostHog to delete the events and profile it holds linked to your account. Turning it on again links only what happens afterwards. Before you have an account, only anonymous counts are recorded.

Support and account requests

What: the messages you send us and our replies, and, if you give one, the reason you deleted your account.

Why: to answer you and to act on requests such as account deletion.

Automated image checks

Images attached to posts are sent to Sightengine, which checks them automatically for nudity, weapons, alcohol, drugs and offensive content shortly after they are posted. A post whose image fails the check is hidden from other people. Anyone can also report content, and reports are reviewed by our moderators.

How information is shared

With other people on Fitnesta

• Your profile, posts and activity are shown to other people according to your privacy settings and the visibility you choose for each post.
• Personal Trainers and businesses you book with, enquire with or are a member or client of can see the information needed to serve you — for example your bookings and attendance.
• A personal trainer whose coaching request you accept can see, while they coach you, your name, photo, city and area, the phone number and email address on your account, the workouts you log, and the check-ins and assessments you send them — including health screening answers — and the measurements and progress photos you choose to share. When coaching ends they no longer see your account's contact details or your assessment answers; they keep only their own records.
• A gym whose membership request you accept can see your name and profile photo from your account on its member list, alongside its own record of your membership.
• People in a conversation can see the messages sent in it.

With service providers

We use service providers to run Fitnesta. They process information for us, for the purposes below:

• Supabase — hosts our database, stores uploaded files such as profile, post and progress photos, and runs sign-in: it holds your sign-in details and signed-in sessions.
• OVHcloud — runs our application servers and background jobs.
• Sightengine — checks images attached to posts for nudity, weapons, alcohol, drugs and offensive content.
• Better Stack — receives server error reports and performance traces, and crash reports from the app, so we can diagnose failures and performance problems.
• PostHog — receives product usage events from our servers: anonymous counts for everyone, and events linked to your account only if you opt in (see “Usage analytics” above).
• Vercel — hosts this website, and receives your IP address and request details when you visit it.
• Apple Push Notification service and Firebase Cloud Messaging (Google) — deliver push notifications to iPhone and Android devices.
• MSG91 — sends sign-in codes by SMS, and sends WhatsApp payment reminders on behalf of businesses and reports their delivery.
• Brevo — sends account emails, such as the codes that confirm your email address or reset your password.
• Apple and Google sign-in — if you choose Sign in with Apple or Google Sign-In, the provider confirms your identity to us.
• Google Workspace — hosts our support email.

With map providers

Fitnesta uses Apple Maps on iPhone and Google Maps on Android to display maps. These map providers may receive information needed to provide the map, such as the area being displayed and technical information about the device. On Android, Google Maps may also receive device location when location is shown on the map, map interaction information such as panning and zooming, IP address, device and SDK information, and diagnostic information. Google processes information it receives through Google Maps under its own privacy terms.

For legal and safety reasons

We may disclose information where we reasonably believe it is required by law or legal process, or needed to protect the safety, rights or property of our users, the public or Bheema Network India.

If the service changes hands

If the Fitnesta service is reorganised or transferred, information may be transferred as part of that, and this policy will continue to apply to it.

We do not sell personal information.

Where information is processed

Our service providers operate infrastructure in several countries. Your information may be stored and processed outside the country where you live, and we rely on those providers to protect it.

How long we keep information

We keep your account information while your account is open. How long we keep it after that depends on what it is.

When you delete your account

• Your account is disabled immediately: you are signed out everywhere, your profile leaves search and discovery, and the account cannot be signed in to again.
• 30 days later we permanently delete your account, profile and contact details, your sign-in details and devices, and the personal fitness information you recorded — such as workout logs, body measurements, check-ins and assessments you submitted.
• Not everything is deleted at 30 days. The records below are kept for the periods shown, with your name and contact details removed wherever they are not needed. Account deletion explains the details.

Records that are kept for longer

• Records a personal trainer or business created about you — such as their notes, the goals they set and your membership details — are kept while you are their client or member and for two years after that relationship ends. They belong to the personal trainer or business, who can delete them sooner. Deleting your account removes the link to you and the details that came from your account; it does not delete their own record.
• Attendance, class and booking history that is not needed for accounts is kept for two years after the class or session, once your account is deleted or your membership has ended.
• Payment and accounting records — payments, refunds, paid bookings, and a business’s record of what you were charged and paid — are kept for eight financial years. We keep only what is needed for accounts, tax, reconciliation and disputes, not your profile or fitness information.
• Reports and moderation records are kept for two years after the report is closed. A restriction that is still in force on a business is kept while it applies.
• The record of the terms you accepted and the consents you gave or withdrew is kept for three years after your account is erased. The device details and network address recorded with it are removed after 180 days.
• A record that a phone number opted out of WhatsApp reminders is kept until that number opts back in, including after the account is deleted, so that the opt-out keeps working.
• An empty placeholder for a deleted account — no name, contact details or profile — is kept for up to three years after the account is erased, or for as long as one of the records above still depends on it.

Information that expires on its own

• Notifications: 90 days.
• Product usage events stored in our own systems: 12 months from the event.
• IP address and device details recorded with security-relevant actions in the app: 180 days.
• The history of WhatsApp reminders sent to you: 180 days.
• Uploaded member import files and the temporary copies made while importing them: 30 days. Generated report and export files: 7 days.
• Sign-in codes are deleted when they expire. Signed-in sessions that have ended are deleted 60 days later.
• Notifications we receive from payment and app-store providers are reduced to the reference details needed for reconciliation within 30 days, and that reduced record is deleted after 180 days.

Service providers and backups

• When your account is erased, or you stop linking usage analytics to your account, we ask our analytics provider, PostHog, to delete the usage events and profile linked to you. PostHog carries out deletions on its own schedule, so this is not instant. We keep a minimal record that the deletion was requested and completed for one year.
• Server logs and error reports held by our logging provider are kept for a limited period under that provider’s retention settings.
• Database backups made by our hosting provider can contain deleted information until they expire on the provider's backup schedule. We keep a record of each deletion, and if we ever have to restore a backup we use it to delete those accounts again before the service is reopened.

We may keep specific information for longer where the law requires it or while a dispute, investigation or legal claim is open.

Your choices and rights

You can view and update most of your information in the app, change who can see your profile, control notifications and marketing, and delete your account. Privacy choiceslists every control.

Depending on where you live, you may have rights to access, correct or erase your personal information, to withdraw consent, and to complain. In India, if our Grievance Officer does not resolve your complaint, you can complain to the Data Protection Board of India. To make a request, email support@fitnesta.com. We may need to confirm that the account is yours before we act, and we will respond in line with applicable law.

In the app, Settings → Account → Your data summarises the information we hold about you, the gyms and trainers linked to you now, and the service providers that process it. There you can also name a nominee — someone who may exercise your rights if you die or become unable to. We keep only the nominee's name and the contact details you give, use them only for that purpose, and erase them when your account is erased; you can change or remove the nominee at any time.

If a business or personal trainer holds a record about you, you can also ask them directly, as they decide what that record contains.

Consent and withdrawing it

• Location: allow or deny it in your device settings at any time.
• Push notifications: turn them off in your device settings, or per category in the app.
• Offers from Fitnesta: off until you turn them on in Settings → Consents or Notifications; turn them off again in the same place at any time.
• Usage analytics: on unless you switch it off in Settings → Consents. Linking analytics to your account: off unless you turn it on there; turn it off at any time. Each change you make is recorded in your consent history.
• Being found by people nearby: you choose when you set up your member profile; change it at any time in Settings → Privacy.
• Coaching and gym membership links: accept or decline each request in the app; end a gym link from the gym's page.
• WhatsApp payment reminders: reply STOP to stop reminders from that business, STOP ALL to stop all reminders sent through Fitnesta, and START or START ALL to receive them again; or turn off WhatsApp for that business in Account settings under Notifications.
• Withdrawing consent does not affect processing that already took place.

Languages of this notice

In the app, the privacy notice and consent request shown before you agree, when you are asked to agree again after a change, and in Settings → Account → Privacy notice have a language selector. It lists English and each of the 22 languages in the Eighth Schedule to the Constitution of India. Your choice is remembered on that device.

• English: the full notice and consent request.
• Tamil: a translation of the notice and consent request. It has not yet been checked by a qualified translator, and the app says so above the text.
• The other 21 languages: no translation is available yet. The app shows the English text and lets you ask us by email for the notice in your language (grievance@fitnesta.com).

This Privacy Policy and the Terms of Service are published in English only. You can ask for help understanding any part of them through the contact details below.

Security

We take reasonable measures to protect personal information, including encrypted connections (HTTPS) between the app and our servers, one-way hashing of passwords, confirmation of your email address or phone number before an account is created, access controls that limit who can see each record, private storage for sensitive files, rate limiting, and the ability to see and sign out the devices where you are signed in. No service can guarantee complete security, so please use a strong password and tell us at support@fitnesta.com if you think your account has been compromised.

Children

Fitnesta is only for people aged 18 and over, and you must be 18 or over to create an account. The app is not directed at children. If we learn that an account belongs to someone under 18, we will close it and erase its information. If you believe a child has created an account, contact support@fitnesta.com.

The same applies to the records businesses and personal trainers keep in Fitnesta about people who have no account: they must not add anyone under 18, even with a parent's or guardian's agreement. If we learn that such a record is about a child, we will ask the business or trainer to delete it.

Changes to this policy

We will update this policy when our practices change, and change the date at the top of the page. If a change is significant, we will take reasonable steps to let you know, for example in the app.

Contact

Bheema Network India, operator of Fitnesta: support@fitnesta.com. Door no. 48, Plot no. 17, 12-B Cross Street, Krishna Nagar, Lawspet, Pondicherry - 605008.

Grievance Officer: Hemanth Arjun, grievance@fitnesta.com. We acknowledge a grievance promptly and resolve it within 20 days.