Master Privacy Policy

1.1 This Master Privacy Policy ('Policy') governs the collection, storage, processing, transfer, and protection of personal data by AETHRIVE Technologies Private Limited (acting as the 'Data Fiduciary' under Section 2(i) of the Digital Personal Data Protection Act, 2023).

1.2 This Policy applies to all natural persons who register, access, or interact with the GymBeam mobile application or web interfaces (acting as 'Data Principals' under Section 2(j) of the DPDPA 2023).

3.1 No Payment Card or PIN Data: The Company NEVER captures, stores, or processes credit card numbers, CVVs, card expiration dates, net banking passwords, or UPI security PINs. All payment transactions occur inside Razorpay's PCI-DSS Level 1 compliant infrastructure.

3.2 No Biometric Health Telemetry: The Platform DOES NOT collect health, medical, or biometric fitness telemetry, such as heart rate monitors, calorie expenditure, body fat percentages, body weight progression, workout logs, medical diagnoses, or physical therapy records.

3.3 No Background Tracking: The Platform NEVER tracks device location in the background. Location access is requested and executed strictly while the mobile app is actively in the foreground.

4.1 Lawful Basis: Personal data is processed on the basis of: (a) Clear, affirmative, informed, and itemized Consent provided by the Data Principal under Section 6 of the DPDPA 2023; and (b) Certain Legitimate Uses under Section 7 of the DPDPA 2023 (including the fulfillment of confirmed booking orders, compliance with judicial or statutory mandates, and debt/payment settlements).

4.2 Withdrawal of Consent: Data Principals may withdraw consent at any time by notifying our Data Protection Officer or initiating account deletion. Withdrawal shall take effect within statutory periods and shall not affect the lawfulness of processing conducted prior to withdrawal.

Personal data is processed strictly for the following purposes:

5.1 Facilitating gym discovery, calculating real-time walking/driving distance, and verifying facility availability.

5.2 Authenticating user login sessions, generating secure JWT tokens, and preventing unauthorized account takeover.

5.3 Creating payment orders, transmitting transaction receipts, verifying digital booking passes, and conducting accounting reconciliation.

5.4 Disbursing commercial session earnings and referral bonuses to verified gym operator bank accounts.

5.5 Providing real-time customer care and technical support through the in-app Supporter channel.

5.6 Preventing payment fraud, identity theft, platform abuse, and maintaining statutory audit trails under Indian tax laws.

Data is shared strictly on a need-to-know basis with audited third-party service providers operating under binding Data Processing Agreements:

7.1 ACCESS_FINE_LOCATION & ACCESS_COARSE_LOCATION (Foreground Only): Required to determine nearby gyms and calculate walking distance. If denied, the user may manually search by city or locality.

7.2 CAMERA: Required to capture profile avatars or upload facility images.

7.3 READ_EXTERNAL_STORAGE / Photo Picker: Required to select photos from the device gallery for avatars or gym photos.

7.4 POST_NOTIFICATIONS: Required to deliver real-time booking reminders, check-in alerts, and support chat messages.

7.5 Permission Removal Notice: Any historical references to audio recording permissions (RECORD_AUDIO) are completely inactive and are purged from production builds.

8.1 Storage Localization: In compliance with the Reserve Bank of India (RBI) directive on Storage of Payment System Data (RBI/2017-18/153 DPSS.CO.OD No. 2785/06.11.001/2017-18), payment transaction logs, settlement records, and banking identifiers are processed and stored on cloud infrastructure localized within the territory of the Republic of India.

8.2 Encryption: All data in transit is encrypted using Transport Layer Security (TLS 1.3) and Secure WebSockets (WSS). Sensitive database records are backed by managed cloud backups with AES-256 volume encryption.

8.3 Retention Periods: (a) Active Account Data: Retained throughout the duration of your active account registration. (b) Financial & Tax Records: Retained for 8 (eight) statutory financial years following the transaction year, as mandated under Section 128 of the Companies Act, 2013 and Section 44AA of the Income Tax Act, 1961. (c) Audit & Security Telemetry: Retained for a period of 180 (one hundred and eighty) days to satisfy CERT-In cybersecurity log retention mandates.

As a Data Principal under Indian law, you possess the following enforceable rights:

9.1 Right to Access Information: You have the right to obtain a summary of your personal data processed by the Company and the identities of third-party processors with whom it has been shared.

9.2 Right to Correction & Updation: You have the right to correct inaccurate, misleading, or incomplete personal data via in-app settings or by contacting the Grievance Officer.

9.3 Right to Erasure (Account Deletion): You have the right to request the complete erasure of your personal data, subject to statutory tax and financial retention obligations (see Document 6).

9.4 Right of Grievance Redressal: You have the right to lodge a complaint regarding data processing with our Data Protection Officer, and if unsatisfied, with the Data Protection Board of India.

9.5 Right to Nominate: You have the right to designate another individual who shall, in the event of your death or incapacity, exercise your rights as a Data Principal under Section 14 of the DPDPA 2023.

10.1 The Platform DOES NOT knowingly track, target, or process the personal data of children under the age of 18 years.

10.2 The Company DOES NOT engage in behavioral monitoring, targeted advertising, or profiling directed at children.

In accordance with Section 13 of the DPDPA 2023 and Rule 3(2) of the IT Rules 2021, the Company has designated a formal Grievance Officer and Data Protection Officer.

Name of Grievance Officer: Designated Data Protection & Grievance Redressal Officer

Corporate Entity: AETHRIVE Technologies Private Limited

Postal Address: Corporate Legal Division, AETHRIVE Group, India

Official Email: grievance-officer@aethrive.com | Alternate Privacy Contact: privacy@aethrive.com

Statutory SLA: Every complaint shall be acknowledged within 24 (twenty-four) hours and substantively resolved within 15 (fifteen) calendar days from receipt.