Member Data Notice

This is version v1 of the Member Data Notice — the version recorded against your consent when your Gym enrolled you.

Who this notice is from. "Your Gym" is the gym that enrolled you. This is your Gym's notice to you: KairoFit LLP wrote it as a template, and your Gym has adopted it as its own and fills in its details at the end.

1. Who is responsible for your data

• Your Gym decides what to record about you and why. In the words of the law it is the Data Fiduciary — the party answerable to you for your data. Its details are at the end of this notice.
• KairoFit LLP (LLP No. ADA-1569, Greenland Park Apartment, Narendrapur, South 24 Parganas – 700103, West Bengal, India) makes the KairoFit software your Gym uses. It stores and processes your data on your Gym's instructions, as your Gym's Data Processor. Its own privacy policy is at kairofit.in/privacy, and the rules your Gym has agreed with it about your data are in the KairoFit Terms of Service.
• You are the Data Principal — the person the data is about.

2. What your Gym records about you, and why

Your Gym does not record identity documents (Aadhaar, PAN, voter ID and so on), bank or card details, emergency contacts, fingerprints or any other biometric data in KairoFit, and does not track your location. The Gym's QR code contains no information about you.

3. How you give consent: the one-time code

When your Gym enrols you, staff enter your mobile number and KairoFit sends that number an SMS with a six-digit code and the Gym's name. Staff fill in your details and go through the consents in section 4 with you. By reading the code to the staff member, you confirm your details and give the consents shown.

What is recorded when you do: the date and time; that consent was given by reading a code at the Gym; which staff member recorded it; which Gym; each consent you gave; and this notice's version (v1). These records are kept exactly as written and are never changed — a later withdrawal is added as a new record — so both you and your Gym can see what was agreed and when. They are kept for the life of your record plus 3 years — in a minimal, access-restricted form once the rest of your record is gone — as evidence of what was agreed. The same code step is used when your Gym attaches you to a second gym, and when it later edits your name, email, address or photo.

4. The consents you give, and how to withdraw them

The enrolment form your Gym's staff use shows five consent lines. Two are required to be a member; three are optional.

• Store my details for gym membership — required. Your Gym keeps the details in section 2 to run your membership.
• Send login codes to my phone — required. One-time codes by SMS are how your identity is checked at enrolment and on edits, and how you sign into KairoFlex.
• Send me invoices on WhatsApp from KairoFit — optional. KairoFit LLP sends no WhatsApp messages today; a receipt you want on WhatsApp comes from your Gym's own phone (section 6). This consent matters only if KairoFit ever sends invoices on WhatsApp on your Gym's behalf.
• Email updates from my gyms — optional, and only if you gave an email address. It covers news and updates from your Gym, which nobody sends today. It does not control your receipts: if your record has an email address, the receipt or invoice for each payment is emailed to you regardless, because it is a document about a payment you made (section 6).
• Store my health conditions — optional; ticked only when you give health details. Without it, nothing about your health is saved.

To withdraw an optional consent: tell your Gym, or switch it off yourself in the KairoFlex app under Profile, then Permissions. Withdrawing is as simple as giving was — one message or one tap — and takes effect within 30 days. If you withdraw the health-data consent, your Gym asks KairoFit LLP to remove your health note, and it is removed within those 30 days.

To withdraw a required consent is to end your membership record: ask your Gym to archive you (stop using your data) or to erase what the law does not require it to keep (section 8). Without the login-code consent your Gym cannot verify changes to your record, and you cannot use KairoFlex.

5. Who can see your data

• Your Gym's owner, admins and staff see your name, number, email, address, photo, plan, fees and receipts, attendance and consent state. Staff never see your date of birth, gender or health note — in fact, once saved, these are not displayed on the member screen at all.
• KairoFit LLP, as your Gym's Data Processor, holds the data on servers in India; its authorised personnel may access it only for support, security or legal reasons.
• KairoFit LLP's providers, all under contract and all in India: Supabase (database and photo storage, Mumbai), DigitalOcean (servers, Bangalore) and MSG91 (delivers the one-time codes by SMS and the receipts and invoices by email). When a code is sent, your number, the code and the Gym's name go to MSG91; when a receipt is emailed, your email address and the document go to it. Nothing else leaves these systems. (KairoFit LLP's full provider list, including services that hold no personal data, is in its Privacy Policy.)
• Other members see nothing about you — unless you use KairoFlex (section 7).
• Nobody else. Your data is not sold, is not used for advertising, and is not compared or profiled across gyms.

6. Messages you will receive

• Receipts and invoices by email. When your Gym records or reverses a payment, KairoFit LLP emails the receipt or, if your Gym is GST-registered, the tax invoice, bill of supply or credit note to the email address on your record — on your Gym's behalf and in its name ("<your Gym> via KairoFit"); replying reaches your Gym's owner. Your Gym's owner, and any admins the owner chooses, receive a copy. No email address on your record means no email.
• Reminders — renewal, expiry, fees due, "we miss you" — and receipts shared on WhatsApp are sent by your Gym from its own phone number, on WhatsApp or SMS, one at a time. Your Gym is the sender; if you do not want them, tell your Gym.
• One-time codes come by SMS from KairoFit LLP, under its registered sender ID — at enrolment, when your details are edited, when you are attached to a gym, and when you sign into KairoFlex. Together with the emailed receipts above, they are the only messages KairoFit LLP sends you.

7. If you use the KairoFlex app

KairoFlex is KairoFit LLP's free app for members. It is optional, and it is for people aged 18 and over. If you sign up with the same mobile number, it opens the same record your Gym created: you see your memberships, plan dates and attendance, and you can check in by scanning your Gym's QR code.

• What your Gym sees: your check-ins, including the ones you scan yourself. Nothing is added to what it already holds.
• What your Gym never sees: your food diary, goals, weight and body details, custom foods — or even whether you use KairoFlex.
• What other members see: if you use KairoFlex, your first name, an attendance-based score and rank, and the photo your Gym uploaded appear on your Gym's leaderboards to other members of the same Gym who also use KairoFlex. There is no in-app switch to opt out yet; to be removed, email contact@kairofit.in with your mobile number and your Gym's name. If you never sign into KairoFlex, nothing about you is shown to other members.

For your KairoFlex account itself, KairoFit LLP is the Data Fiduciary: see the KairoFlex Privacy Policy and the KairoFlex Terms of Use.

8. How long your data is kept

Your Gym keeps your record while you are a member. Afterwards it archives rather than deletes, because receipts, invoices and payment records are statutory records it must keep: GST law requires a registered business to keep them for at least six years after the year's annual return, and income-tax law sets similar periods. You may ask your Gym to erase what the law does not require it to keep — your photo, email, address or health note, for example — and it should do so within 30 days. One-time code records are deleted 24 hours after the code expires; a record of each receipt emailed to you (sent, failed or skipped) is kept with the payment it belongs to; and KairoFit LLP's server logs are kept for up to one year. Your consent records are kept for the life of your record plus 3 years, in a minimal, access-restricted form once the rest is gone, as evidence of what you agreed (section 3).

9. Your rights and how to use them

You may ask your Gym, in person or through the contact at the end of this notice:

• for a summary of what it holds about you and whom it has been shared with;
• to correct your name, email, address or photo, confirmed by a code sent to your phone. Your mobile number cannot be changed on a record; to use a new number, ask your Gym to enrol you again;
• to erase your data, subject to the records the law requires your Gym to keep;
• to withdraw a consent (section 4);
• to record a nominee — a person who may exercise these rights for you if you die or become unable to.

Your Gym should answer within 30 days. If it does not, or you are not satisfied, raise it with your Gym's owner. If your complaint concerns KairoFit LLP's own processing — how the software stores or secures your data, or KairoFlex — write to KairoFit LLP's Grievance Officer, Jeet Adhikari, Designated Partner, at contact@kairofit.in, quoting your mobile number and your Gym's name; the Grievance Officer acknowledges within 48 hours and answers within 30 days. After that, today, you may approach the Adjudicating Officer under the Information Technology Act, 2000; once the Data Protection Board of India is constituted, you may complain to it in the manner the Central Government notifies.

This notice is in English. Ask your Gym, or email contact@kairofit.in, for it in another Indian language; KairoFit LLP provides it within 30 days.

10. If you are under 18

Your parent or legal guardian must give consent to your Gym before it records anything about you, and your Gym is responsible for obtaining and keeping that consent. KairoFlex is for people aged 18 and over: if you are under 18, your Gym serves you at the front desk and you should not sign up to KairoFlex.

11. What we ask of you

• Give accurate details, and tell your Gym when they change.
• The mobile number you give must be your own. It is where every code is sent, and it identifies you at every gym that uses KairoFit.
• Do not give a code to anyone other than the staff member enrolling you.

12. Your Gym's details

• Gym name: ____
• Address: ____
• Owner: ____
• Contact for data requests: ____
• Notice adopted on: ____