OneGym Privacy Policy

1. Who we are

OneGym is owned and operated by One Path Business Solutions ("OnePath", "we", "us" or "our"), 8-1-21/146, Level 1, Mirza Arcade, Shaikpet Road, Surya Nagar, Toli Chowki, Hyderabad, Telangana 500008, India.

2. Our role

• Website visitors and gym account owners. We decide how this data is used, so we act as the data fiduciary (or controller).
• Member, trainer and staff data that a gym stores in OneGym. The gym decides what to collect and why, so the gym is the data fiduciary. We process that data only on the gym's instructions, as a data processor. Members should send privacy requests to their gym first.

Biometric data and health related details get extra protection, explained in the OneGym Biometric and Member Data Notice.

3. Information we collect

Information you give us

• Sign ups, demo and sales requests: name, gym name, email, phone number, number of branches and your message.
• Account details: owner and staff names, emails, phone numbers, roles and passwords (stored only in hashed form).
• Billing details: business name, billing address, tax or GST number and plan. Subscription payments are handled by our payment partners. We do not store full card numbers.

Information gyms store in OneGym

• Member profiles: name, photo, phone and WhatsApp number, email, date of birth, gender, address, emergency contact, membership plan, start and expiry dates and assigned trainer.
• Attendance and access: check in and check out times, branch visited and gate access events.
• Biometric templates, where the gym uses fingerprint or face recognition devices for entry.
• Health and fitness details the gym chooses to record, such as height, weight, fitness goals, injuries or medical conditions relevant to training.
• Billing records: invoices, payment status, amounts, currency and renewal history.
• Class and trainer schedules, and messages sent through WhatsApp automation.

Information collected automatically

IP address, browser and device type, operating system, pages viewed, actions taken, timestamps and error logs. See our Cookie Policy.

Information from connected services

Access logs from biometric and gate devices, payment status from integrated payment gateways, and delivery status for WhatsApp messages.

4. How we use information

• To run the Service: member management, check ins, gate access, invoicing, payments, renewals, class and trainer scheduling, analytics and multi branch reports, as the gym configures them.
• To send messages the gym sets up, such as renewal reminders, invoices and broadcasts, by WhatsApp, email or SMS.
• To run AI assistant features that suggest schedules, trainer assignments and engagement nudges, only within the gym's own data.
• To verify identity, secure accounts and prevent fraud.
• To provide support, bill gyms and keep financial records.
• To improve the Service using aggregated or de-identified usage data.
• To send product news to gym owners, with an unsubscribe link in every email.
• To meet legal obligations.

We do not sell personal data. We never sell or share member health or biometric data, and we do not use it for advertising.

5. Legal basis

In India we process personal data under the Digital Personal Data Protection Act, 2023, on the basis of consent or a legitimate use permitted by that Act. Gyms are responsible for giving members notice and obtaining consent, especially for biometric and health details. Where the GDPR, UK GDPR or other local laws apply, we rely on performance of a contract, legitimate interests, legal obligations and explicit consent for sensitive data.

6. How we share information

• Service providers for hosting, storage, WhatsApp, email and SMS delivery, payment processing, analytics and support, under written contracts.
• Payment gateways used by the gym to collect membership fees.
• Device makers or integrators only to the extent needed to connect a gym's biometric hardware.
• People inside the gym, according to roles. Trainers see only their assigned members.
• Authorities, when the law or a valid order requires it.
• A buyer or successor in a merger, acquisition or sale of assets, under this Policy.

A current list of our sub-processors is available on request.

7. International transfers

Data may be stored in India or in other countries where our cloud providers run data centres. We use contractual and technical safeguards when data leaves your country.

8. How long we keep data

• Gym data is kept while the subscription is active.
• Biometric templates are deleted when a member leaves the gym or withdraws consent, or when the gym's subscription ends.
• After cancellation or expiry, the gym has 90 days to export its data. We then delete or anonymise it.
• Trial accounts that do not upgrade are deleted 30 days after the trial ends.
• Backups are cleared within 30 days of deletion from live systems.
• Our invoices and payment records are kept as long as tax and accounting laws require.

9. Security

We use encryption in transit, encryption at rest through our hosting providers, role based access, audit logs and regular backups. Biometric templates are stored in encrypted form and are not linked to raw fingerprint or face images. No system is fully secure. If a personal data breach affects gym data, we will inform the gym without undue delay and notify authorities where the law requires.

10. Your rights

Depending on where you live, you may have the right to access, correct, complete or erase your personal data, withdraw consent, nominate someone to act for you, object to or restrict processing, ask for a portable copy and complain to a data protection authority. Email info@onepathsolutions.com. Members should contact their gym first, and we will help the gym respond.

11. Children

Our website is for adults. If a gym registers members under 18, the gym must obtain verifiable consent from a parent or guardian before adding their data, and must not use biometric access for them without that consent.

12. Changes to this Policy

We will post any update here with a new effective date, and notify gym owners by email or in the app about important changes.

13. Contact

• One Path Business Solutions
• Email: info@onepathsolutions.com
• Phone: +91 96523 01382
• Address: One Path Business Solutions, 8-1-21/146, Level 1, Mirza Arcade, Shaikpet Road, Surya Nagar, Toli Chowki, Hyderabad, Telangana 500008, India

We aim to acknowledge complaints within 2 business days and resolve them within 30 days.