Legal
Privacy Policy
Last updated 23 October 2026
Sweatum is a gym management service operated by Sweatum (“we”, “us”). Gyms use it to manage their members, trainers, attendance, training, diet and billing. This policy explains what information we collect when you use the Sweatum website and mobile app, why, and the choices you have.
Who is responsible for your data. Your gym decides what information it collects from you and why (it is the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023). Sweatum processes that information on the gym’s behalf and keeps it secure. For gym owners who sign up directly, we are responsible for the account details you give us.
Information we collect
We only collect what the service needs. In the app this is:
| What | Why |
|---|---|
| Name, email address, phone number, password (stored hashed) | To create your account, sign you in and let your gym contact you. |
| Your role (gym owner, trainer or member) and the gym you belong to | To show you the right features and keep each gym's data separate. |
| ID document photos (e.g. Aadhaar, PAN) and profile details: address, emergency contact, medical notes | Your gym's KYC and safety requirements. Only you and your gym owner can view your ID; it is never shared further. |
| Location when you tap Mark Present | To confirm you are at the gym. Only the distance to the gym is kept — never your coordinates or a location history. |
| Attendance, workouts, exercise logs, goals, body measurements, diet targets and food logs | The core service: tracking your training and progress for you and your trainer. |
| Membership plans, payments and bills (including GST details) | To bill you and keep your gym's financial records. |
| Chat messages with your gym's trainers, members and owner | To deliver the in-app chat. |
| Complaints you raise about equipment or the gym | So the gym can act on them and tell you the outcome. |
| Device and usage information: app version, IP address, time of sign-in | Security (sign-in limits, ending stolen sessions) and keeping the service running. |
We do not collect information from your contacts, photos (other than the ID you choose to upload), or microphone, and we do not track your location in the background.
How we use it
- To run the service: accounts, attendance, training plans, diet, billing, chat and notifications.
- To keep it secure: verifying your email, limiting sign-in attempts, ending sessions when a password changes, and keeping an activity log for your gym.
- To send you service emails: verification, login details, password resets, bills and notices about your gym. We do not send marketing emails.
- To fix problems and improve the service, using aggregated information that does not identify you.
We do not sell your information and we do not show advertising.
Who can see your information
- Your gym. The gym owner can see members’ and trainers’ details, attendance, payments and ID documents. Your trainer can see your training, diet and progress, and chat with you. Other members cannot see your information.
- Service providers that host and run Sweatum: database hosting (Neon), application hosting, and an email delivery service (Webenor Omni) used to send the emails above. They process data only on our instructions.
- Legal requirements. We may disclose information if the law requires it, for example tax records, or to protect the safety of our users.
We never share ID documents with anyone other than your gym owner, and we do not transfer your information to other gyms.
How long we keep it
- Account and training information: while your account is active.
- Bills, payments and related financial records: as long as Indian tax law requires (currently up to eight years), even after an account is deleted. They then show “Deleted member” instead of your name.
- ID documents: deleted immediately when you delete your account, or when your gym owner removes them.
- Security and activity logs: up to one year.
Deleting your account
You can delete your account yourself at any time: in the app, open Profile → Delete account; on the website, go to /delete-account. Deletion removes your name, email, phone, password, ID documents, profile, goals, progress, food logs and notifications, and ends every sign-in. Bills and payment records are kept as described above. A gym owner who deletes their account closes the gym; its trainers and members are told the gym no longer exists.
Your rights
You can ask to see, correct or delete the information we hold about you, or withdraw consent, by using the controls in the app or by writing to [email protected]. Requests about information your gym collected may be passed to the gym to answer. We respond within 30 days.
Security
Information is encrypted in transit (HTTPS) and at rest. Passwords are stored hashed, email service keys are stored encrypted, and ID documents are served only through permission-checked requests. Each gym’s data is kept separate from every other gym’s. No system is perfectly secure; if we learn of a breach affecting you, we will tell you and the authorities as the law requires.
Children
Sweatum is for adults. Gyms must not register members under 18 without a parent or guardian’s consent.
Changes to this policy
If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect. The date at the top shows the current version.
Contact
Sweatum · [email protected]