Privacy Policy

1. Who we are

Prime Fitness Aroor, JKP Arcade, Bypass Junction, near Mazhavil Manorama, Aroor P.O., Alappuzha, Kerala 688534. We decide what happens to the information described here, which under India's Digital Personal Data Protection Act 2023 makes us the data fiduciary for it.

2. What we collect, and when

Four different things happen depending on what you do, and they collect different amounts.

• If you only look at the website. Google Analytics records page views, how far down a page people scroll, and eight specific actions: tapping the phone number, tapping WhatsApp, tapping directions, tapping the email address, tapping the Instagram link, tapping the Facebook link, submitting the enquiry form, and playing a video. Each is recorded with the page it happened on, and a link tap also records the first 80 characters of the link's text. We do not run an advertising pixel and we do not build advertising profiles. Google Search Console tells us which search terms brought people here; it shows totals, never individuals.
• If you send the enquiry form. Name and phone number, which are required, and if you fill them in, email address, which plan you asked about, and a message. We also record which page the form was sent from.
• If you join the gym. Name, phone number, email address, date of birth, postal address, gender, blood group, an emergency contact and their relationship to you, a photograph if you agree to one, the answers on the health declaration, the membership and payment history, and a record of each entry to the gym made with the door terminal.
• If you create an account on the website or the app. Name, email address, phone number, and whether the account is a member or a staff account. If you sign in with Google, Google tells us the name and email address on that account and whether the address is verified. We never see the Google password. If you sign in by phone, we ask for the number and send a code to it.

We do not ask for an Aadhaar number, and we do not store one. Where we need to confirm who somebody is, we record that a document was checked, who checked it and when. We do not record the number on it or keep a copy.

3. Cookies

Two kinds, and no others. Essential cookies keep you signed in to the member area; without them it cannot work. Analytics cookies are set by Google Analytics and do what section 2 describes.

If we ever add advertising or tracking cookies, this page changes first and says so, and we will ask before switching them on.

4. Why we hold it

• To answer an enquiry.
• To run a membership, take payment, and keep the accounting records the law requires a business to keep.
• To operate entry to the gym.
• To keep members safe, which is what the health declaration is for.
• To contact members about their own membership.
• To understand which pages of the website people find useful.

Nothing else. We do not use any of it to build a profile of you, and we do not use member records for advertising.

5. Who else sees it

• Gym staff. To do their jobs, and no further than that. Everyone who works here is bound in writing to handle member information confidentially.
• Supabase. Our database and sign-in provider. Everything is stored in their Mumbai region, in India.
• Vercel. Hosts the website.
• DGymBook. The membership system the gym has run on until now. We are moving off it, and while we do, records from the door terminal still reach DGymBook as well as our own system. The member photographs we hold came from there.
• Google. Analytics and Search Console as described in section 2, and Google sign-in if you choose to use it.
• Meta. We read the statistics for our own Instagram and Facebook posts. That is read-only and about our posts, not about you.

We do not sell personal information, and we do not share it for anybody else's advertising. We will disclose it outside the gym only where the law requires it.

6. People under 18

Some of our members are under 18. A person under 18 cannot enter into a contract in India, so a membership for a young person is held by their parent or guardian, who must attend in person, whose identity we check, and who signs for it. We record that the check happened. We do not ask the young person to sign anything that claims to be a contract.

We will not track a member under 18, monitor their behaviour, or direct advertising at them. That is prohibited for anyone under 18 under section 9 of the Digital Personal Data Protection Act 2023, and it is not something a parent can permit on their behalf. It is a line we do not ask to cross.

A parent or guardian can ask us at any time to show them everything we hold about their child, correct it, delete what we are not required to keep, or withdraw a consent they gave. It is as easy to withdraw as it was to give.

We keep a young person's records for longer than an adult's, until their 21st birthday. That is deliberate. They can bring a claim about anything that happened here until three years after they turn 18, and destroying the records before then would remove the evidence that would answer it, for them as much as for us.

7. How long we keep it

• Payment and transaction records. Eight years from the end of the financial year they belong to, because tax law requires it.
• Member records, photographs, health declarations and entry records. Three years after a membership ends, then deleted.
• Records about a member who was under 18. Until their 21st birthday, for the reason in section 6.
• Enquiries. Two years from the date they were sent, then deleted, unless the person joined the gym, in which case they become part of the member record.
• CCTV. Thirty days, then overwritten.

Ask us and we will tell you exactly what we hold about you today.

8. How it is kept

Member photographs are held in private storage that cannot be reached by a public link; staff screens fetch them through links that expire after an hour. Access to member records requires a sign-in. Health information is seen only by gym staff.

No system is perfect, and we would rather say that than claim otherwise. If something does go wrong and personal information is exposed, we will tell the people affected and report it to the authorities we are required to report it to, within the time the law allows.

9. What you can ask us to do

• Show you everything we hold about you, and who we have shared it with.
• Correct anything that is wrong or out of date.
• Delete anything we are not required by law to keep.
• Stop using your information for something you agreed to earlier, such as marketing messages or the use of a photograph. Withdrawing is as easy as agreeing was.
• Nominate somebody to exercise these rights for you if you are unable to.

Speak to any member of staff at the gym, or write to primefitnessgymaroor@gmail.com. We do not charge for any of this.

These rights come from the Digital Personal Data Protection Act 2023. Health information is also covered by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, which is why we take written consent for the health declaration.

10. If you are not happy with how we handled it

Our grievance officer is Jayakumaran Pillai, at Prime Fitness, JKP Arcade, Bypass Junction, near Mazhavil Manorama, Aroor P.O., Alappuzha, Kerala 688534. Write to primefitnessgymaroor@gmail.com or call +91 85899 85342, and ask for him by name.

We will acknowledge a request and resolve it within one month.

If you are still not satisfied, you can complain to the Data Protection Board of India.

11. Language

This policy is published in English. A Malayalam version is available on request at the gym, and we will read it aloud to anyone who would rather hear it than read it. Ask any member of staff.

12. Changes to this policy

This is version 1.0, in effect from 20 September 2026. If we change it we will publish a new version with a new number and a new date, and where the change matters we will tell members directly rather than relying on this page being re-read.

If you have agreed to something under an earlier version, the version you agreed to is the one that applies to you until you accept a new one. We keep a record of which version each person saw.

13. Contact

Prime Fitness Aroor, JKP Arcade, Bypass Junction, near Mazhavil Manorama, Aroor P.O., Alappuzha, Kerala 688534.

primefitnessgymaroor@gmail.com · +91 85899 85342