1.About this policy
This Privacy Policy explains how Byteplex Technologies Private Limited (“Byteplex”, “we”, “us”) collects, uses, shares and protects personal data through GymLink. It applies to:
- our website, gymlinklabs.com;
- the GymLink web dashboard used by gyms;
- the GymLink app for gym owners and staff; and
- the GymLink member app.
Together, these are the “Services”. If you have questions about this policy, contact us using the details in section 16.
2.Privacy at a glance
- Your gym decides what member information goes into GymLink; we process it on the gym’s behalf.
- We collect only what we need to run GymLink and keep it secure.
- We do not sell personal data, and our apps show no third-party ads.
- Members, gym owners and staff can delete their account in our apps at any time, and anyone can ask us to access, correct or delete their data (sections 10 and 11).
- For any privacy question or complaint, write to info@gymlinklabs.com.
3.Who we are
GymLink is a gym-management platform owned and operated by Byteplex Technologies Private Limited, a company incorporated in India.
- Corporate Identification Number (CIN): U62099UP2026PTC251553
- Registered office: 544/1026, Brorahusain Bari, Thakurganj, Lucknow, Uttar Pradesh 226003, India
- Website: gymlinklabs.com
GymLink helps gyms manage memberships, renewals, attendance, staff, personal training and offers. The member app lets gym members view and manage their membership with their gym.
4.Gyms, members and GymLink: who is responsible
Who is responsible for your data depends on how you use GymLink.
- Gym owners and staff. We are responsible for your account data, as its Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
- Gym members. Your gym decides what information about you to record in GymLink and how to use it, so your gym is the Data Fiduciary for that information. We act as its Data Processor: we process it only to provide the Services to your gym, on its instructions and as this policy describes. When you use the member app, we are also responsible for your app sign-in and the device data described in section 5.3.
- Website visitors. We are responsible for the data we collect through gymlinklabs.com.
Gyms must give their members any notice the law requires, and obtain any required consent, before adding members to GymLink. Your gym’s own privacy practices also apply to you. For questions about how your gym uses your data, contact your gym; we will help it respond, and you can also contact us directly.
5.Information we collect
What we collect depends on whether you run a gym, work at one, or are a member.
5.1Gym owners and staff
- Account details: name, mobile number, email address, role (owner, receptionist or trainer) and sign-in details, including your Google account’s name and email if you sign in with Google.
- Gym details: the gym’s legal and brand name, type, address and year established; each branch’s address, map location, capacity, opening hours, workout types, and its manager’s name and mobile number; membership plans, prices, offers and coupons; and the GST details the gym uses on its members’ invoices.
- Staff and trainer details: the name, mobile number, email address, gender, role and branch of each staff member the owner adds, the owner’s notes about them, and each trainer’s rates and commission, used to price personal training. A staff member’s mobile number, and email if given, are confirmed with a one-time code sent to them before they are added.
- Verification details: the gym’s GST details (GSTIN, legal name and registered address) and its bank account details (account holder, bank, account number and IFSC). We use them to verify the gym before it goes live and to bill it correctly. The account number is encrypted, and only the owner and GymLink’s verification team can see these details. We do not collect Aadhaar.
- Free-trial checks: when a gym asks for a free trial, the IP address the request came from, and one-way codes made from the owner’s account, mobile number and email and the gym’s bank account, GSTIN (and the PAN within it), name and address. We compare the codes with earlier trials to stop the same people claiming more than one. A request that matches an earlier trial is refused automatically, with a message saying so; a person reviews every other request.
- Subscription and billing: your GymLink plan, subscription period, invoices and payment status. Online payments are processed by Razorpay; we do not receive or store your full card number, UPI PIN or net-banking password.
- Support messages: the information you share when you contact us.
Bank account details are sensitive personal data under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and so are a member’s height and weight (below). We collect them only for the purposes in this policy, with consent, and protect them as section 12 describes.
5.2Gym members
Most member information is added by your gym, in the gym app, on the web dashboard or by importing a spreadsheet. Depending on what your gym records, this includes:
- Identity and contact details: name, mobile number, email address, gender, date of birth, address and emergency contact details. If you share an emergency contact’s details, please let that person know.
- Body measurements: your weight and height, if you or your gym record them. These are optional, and your gym should record them only with your consent.
- Membership details: plan, start and end dates, renewals, the fees and payments your gym records, and any discounts or coupons applied.
- Attendance: the dates and times of your gym visits.
- Personal training: your trainer, your training package (sessions or days), how much of it you have used, and its validity.
- Notes: notes your gym writes about you, such as the reason for pausing your membership.
- Messages from your gym: reminders and offers your gym prepares or sends using GymLink.
If you use the member app, we also collect your sign-in details and any information you add or update in the app. If you sign in with Google, we keep only the ID Google gives your account: your Google name and email stay with Google’s sign-in service, and your gym never sees them.
5.3Information collected automatically
- Logs and diagnostics: IP address, the type of browser or app, the date and time of requests, and errors. We use these to keep the Services secure and working.
- Bot check: when you ask for a sign-in code by SMS, Cloudflare Turnstile checks that a person, not a script, is asking. It uses your IP address and technical details of your browser or phone.
- Cookies: our website and web dashboard use essential cookies or similar technologies to sign you in and keep your session secure. To measure page speed and errors, New Relic stores a random session identifier in your browser. We do not use advertising cookies, and we do not track you across other websites.
5.4App permissions
Our apps ask for a device permission only when a feature needs it. You can refuse or turn off any permission in your phone’s settings, though the related feature may then stop working.
| Permission | Why we ask |
|---|---|
| Camera (member app) | To scan your gym’s check-in QR code |
The gym app for owners and staff asks for no device permissions.
5.5Website enquiries
When you ask about GymLink through our website, we collect your name, your gym’s name, your mobile number and email address, and roughly how many members your gym has. We use them to reply and to tell you about GymLink, and keep our notes of the conversation with them.
6.How we use information
We use personal data only to run and improve GymLink and to meet our legal duties:
- Provide the Services: set up accounts; let gyms manage memberships, renewals, attendance, staff, personal training, offers and reports; and let members view their membership.
- Communicate: send sign-in codes (OTPs) by SMS, and service messages such as renewal reminders, receipts and account alerts by email.
- Support: answer questions and fix problems.
- Billing: manage gym subscriptions and invoices.
- Verification: check a gym’s GST and bank details before it goes live, and review free-trial requests.
- Security: verify identity, prevent fraud and misuse, and protect accounts.
- Improvement: find and fix errors and measure how fast the Services run, using aggregated or de-identified data where possible.
- Legal compliance: meet tax, accounting and other legal obligations, and respond to lawful requests.
- Enquiries and updates: reply to questions sent through our website, and tell gym owners and enquirers about GymLink and its new features. You can opt out at any time by telling us.
We do not use member data to market our own products to members. Gyms may use GymLink to send members offers about their own services; to stop these, tell your gym.
Our legal basis. We process personal data with your consent, where you have voluntarily provided it for a specific purpose (such as creating an account), or where the law otherwise permits or requires it. We process member data on the instructions of the gym that added it. When you first sign in, each of our apps shows a short notice of what we collect and why, and asks you to agree. We record that you agreed, to which version of the notice, and when, and we ask again if the notice changes.
8.Where your data is stored
We store GymLink data on servers in Singapore, run by our cloud hosting provider, so your data is transferred outside India. Some providers listed in section 7 may also process data in other countries. We transfer data outside India only as Indian law permits, and our providers must protect it to standards consistent with this policy.
9.How long we keep data
We keep personal data only as long as we need it for the purposes in this policy, or as long as the law requires.
| Data | How long we keep it |
|---|---|
| Gym owner and staff accounts | Until the account is deleted: immediately when it is deleted in the gym app, or by email as soon as we have verified the request. A gym whose plan has ended keeps its data, so it can come back, until its owner deletes the account |
| Member data | While the gym uses GymLink. A member the gym removes stays in its history; their name and contact details go when they delete their account, and everything goes when the gym closes |
| GST and bank details | While the gym's account exists. Deleted when the gym closes |
| Deleted accounts and records | Deleted from live systems immediately. Copies in our encrypted backups expire within 30 days |
| Website enquiries | Until you ask us to delete them |
| Your agreement to the privacy notice | Until the account is deleted |
| Invoices, billing and tax records | For the period Indian tax and company law requires (up to 8 years) |
| Free-trial records | The IP addresses for 1 year and the one-way codes described above for 3 years, including after the account is deleted. The trial request itself stays as the gym’s trial history, without the IP address |
| Server and security logs | 30 days, for security and legal compliance, including after an account is deleted |
| Aggregated or de-identified data | May be kept longer, because it no longer identifies anyone |
10.Account deletion
You can delete your GymLink account, and the personal data linked to it, at any time. Members do it in the GymLink - Member App member app, and gym owners, receptionists and trainers in the GymLink - Gym Management App app. Anyone who can’t use an app can ask us by email. Both apps are published by Byteplex Technologies Private Limited, which operates GymLink.
Members: in the GymLink - Member App app
- 1Open the app and sign in with your mobile number or Google account.
- 2Go to Profile → Delete my account.
- 3Read what will be deleted, type “delete”, and tap Delete my account.
Your account is deleted the moment you confirm, and you are signed out on every device. If your account is also used to run or work at a gym, the member app asks you to use the gym app instead, because only that app shows what deleting means for the gym.
Gym owners and staff: in the GymLink - Gym Management App app
- 1Open the app and sign in with your mobile number or Google account.
- 2Tap your picture at the top of any screen to open Settings, then tap Delete my account. If your gym isn’t live yet, or its GymLink plan has ended, Delete my account is at the bottom of the screen you see instead.
- 3Read what will be deleted. An owner also sees each gym that will close, and what that ends.
- 4Type “delete” and tap the delete button.
Your account is deleted the moment you confirm, and you are signed out on every device. A receptionist or trainer is removed from their gym’s staff, and the gym owner is told by email. Deleting a gym owner’s account also closes every gym they own.
Before you can delete
The app checks these first and tells you what is left and when:
- 1Gym owners: no member at any of your gyms can still have an active or paused membership, including a renewal that starts later. Deleting closes your gyms, so nobody can still be owed time there. Remove those members (open each one in Members, in the app or on the web, and choose Remove from gym), or wait until their memberships end. A member you remove no longer counts; any refund you owe them is between you and them.
- 2Trainers: the personal-training packs you train must have ended, because no one else can take them over. The app shows the date the last one ends.
- 3Open payments: a GymLink payment link still open for your gym is cancelled first. If a payment is going through at that moment, try again in a few minutes.
If you own a gym, download what you need before you delete: your sales and invoices are deleted with the gym, and GST law asks you to keep your invoices. Deleting also ends any GymLink plan you have already paid for, without a refund, as our Terms say.
By email, if you can’t use an app
Write to info@gymlinklabs.com with the subject “Account deletion request”. Include your name, your gym’s name, and the email address or mobile number registered with GymLink, so that we can verify your identity. We delete the account as soon as we have verified the request, and in any case within 30 days. The same conditions apply as in the app, and we tell you if one of them stops us.
Opens your email app with the subject and the details we need already filled in.
What we delete
| Whose account | What is deleted |
|---|---|
| Everyone | Your name, mobile number and email; your profile (date of birth, gender, height, weight, emergency contact and address); your sign-in on every device, including Google sign-in; any sign-in or verification codes; your agreement to the privacy notice; and your check-in history |
| Members | You are removed from the member list of every gym you belonged to. Personal-training sessions you had left are forfeited, and the gym’s notes about you are deleted |
| Receptionists and trainers | You are removed from the staff of every gym you worked at, your access ends, and the gym’s notes about you are deleted |
| Gym owners | Every gym you own closes, and all of its data is deleted: its members’ records, staff records, sales and payments, member invoices, attendance, plans, offers, branches and check-in QR codes, and its GST and bank details |
Deletion is permanent. Your account and personal data cannot be recovered, and you can no longer sign in with that account. If you sign up again with the same number, you start a new account with no history.
What we keep, and why
We keep only what a gym needs for its own books, what the law requires, and what we need to prevent fraud:
| What we keep | Why | For how long |
|---|---|---|
| A gym’s records of payments it received from a member, and of the sessions and sales a staff member handled, with the person’s name and contact details removed | They are the gym’s business records | While the gym uses GymLink |
| Daily attendance counts, without names | The gym’s attendance reports | While the gym uses GymLink |
| The invoices we issued to a gym and its GymLink payment records, including the payment details Razorpay sends us. An invoice shows the gym’s legal name, address and GSTIN, which for a sole proprietor is their own name | Indian tax and company law | Up to 8 years |
| Free-trial records: the trial request, the IP addresses the gym was registered and the trial requested from, and one-way codes made from the owner’s account, mobile number and email, and the gym’s bank account, GSTIN (and the PAN within it), name and address | To stop the same people claiming another free trial. The codes can’t be turned back into those details | IP addresses: 1 year. The one-way codes: 3 years |
| A note that the account was deleted: its account ID and the time, nothing else | So that we can delete it again if we ever restore a backup | Until all older backups have expired |
| Server and security logs, which may include an IP address and an account ID | Security, investigating misuse, and lawful requests from authorities | 30 days |
| Copies in our encrypted backups | Recovery from a failure | They expire within 30 days. If we ever restore one, we delete your data again before it is used |
Emails and text messages already sent stay with whoever received them, including the gym that was told about your deletion. Our email and SMS providers keep their own delivery records under their policies. We do not use the information we keep for any other purpose.
Deleting some of your data without deleting your account
Members can change or clear their own details in the member app, under Profile → My details. For anything else, such as a gym’s record of you, ask your gym, or email info@gymlinklabs.com and we will work with your gym to delete it. We may keep what the table above lists.
Leaving a gym without deleting your account
Members can ask their gym to remove them from its member list, and staff can ask the gym owner to switch off their access. That ends your link with that gym only. To delete your GymLink account, use one of the ways above.
11.Your rights
Under Indian law, including the DPDP Act, you can access, correct or erase your personal data (see section 10), withdraw your consent, and nominate someone to act for you. To use these rights, email info@gymlinklabs.com. We may first confirm your identity, we respond within 30 days, and for member data we may involve your gym.
You can withdraw your consent at any time, as easily as you gave it: deleting your account does this (section 10), or you can email us. Withdrawing consent does not affect processing already done, and we may keep what the law requires (section 9).
If you are not satisfied, contact our Grievance Officer (section 16) or complain to the Data Protection Board of India. You can ask us to stop marketing emails at any time; we still send essential messages such as sign-in codes and account alerts.
12.How we protect your data
We follow reasonable security practices, as Indian law including the Information Technology Act, 2000 requires: data travels over encrypted connections (HTTPS/TLS), access is limited to authorised people and each gym sees only its own records, bank account numbers are encrypted at rest, and we monitor our systems and take regular backups. No system is completely secure; if a personal data breach affects you, we will inform you and the relevant authorities as the law requires.
13.Children
Our apps are meant for users aged 18 and over. If a gym enrols a member under 18, the gym must first obtain verifiable consent from a parent or lawful guardian. If you believe we hold a child’s data without that consent, contact us and we will delete it.
14.Third-party services and links
Our Services may link to or open third-party services, such as WhatsApp or a payment page. Those services have their own privacy policies, and we are not responsible for their practices. Please read their policies before you share information with them.
15.Changes to this policy
We may update this policy when GymLink or the law changes. We will post the new version on this page with a new “Last updated” date. For significant changes, we will also notify you in the app or by email before they take effect.
16.Contact us and Grievance Officer
For privacy questions, requests or complaints, contact us:
- Company
- Byteplex Technologies Private Limited (operator of GymLink)
- Registered office
- 544/1026, Brorahusain Bari, Thakurganj, Lucknow, Uttar Pradesh 226003, India
- info@gymlinklabs.com
- Website
- gymlinklabs.com
Grievance Officer
- Name
- Usha Devi
- Designation
- Director
- info@gymlinklabs.com
We acknowledge complaints promptly and resolve them within 30 days of receipt.