Privacy Policy

1. Who we are

LumiFit (“LumiFit”, “we”, “us”) operates lumifit.in and app.lumifit.in, a business-to-business platform that gives independent gyms their own branded apps for members, owners and trainers, a retention engine and an owner console. You can reach us at contact@lumifit.in.

LumiFit plays two distinct roles, and your rights depend on which applies to you:

• For gym owners and staff: we are the data fiduciary for your account information.
• For gym members: your gym is the data fiduciary. LumiFit processes your information on your gym's behalf and under its instructions, as a data processor.

2. Data we collect

2.1 From gym owners and staff

• Account details: name, email address, phone number, gym name, city, time zone and opening hours.
• Sign-in credentials. Passwords are stored only as salted hashes produced by a modern memory-hard algorithm; we cannot read them.
• Billing details needed to invoice your gym.
• Credentials for any third-party service your gym chooses to connect (for example a delivery provider for notifications, or your own AI provider). These are stored encrypted and are never displayed back in full.
• Your gym's brand assets: logo, colour, name.

2.2 About gym members (processed on the gym's behalf)

• Identity and contact: name, phone number and, optionally, email and date of birth, as provided by the gym or the member. Phone numbers are encrypted at rest, and sign-in looks them up through a keyed index rather than the number itself.
• Membership: plan, start and expiry dates, payments the gym records, freeze requests.
• Activity: attendance (counted from proof of training, or marked by staff), workouts and logged sets, points, streaks, badges, challenge and league standings, class bookings, Form Coach set scores (numbers and cues only; see section 4), cardio sessions (steps, cadence, minutes and, where the member chooses GPS verification, a location fix taken at the start of the session to confirm it happened at the gym).
• Progress data the member chooses to record: body measurements, personal records, water and protein logs, progress photos and meal photos.
• Messages between a member and their trainer, feedback and community posts, in gyms that have those features on.
• Preferences: language, the member's usual training hour (declared or inferred from when they train), notification settings and the device subscriptions needed to deliver notifications.

2.3 From website visitors

• Information you submit through the demo request form on this site: name, gym, phone, city, member count, what you'd like, and anything you write. It is used to reply to you and for nothing else.
• Standard server logs (IP address, user agent, pages requested) retained briefly for security. We do not use advertising trackers or sell visitor data.

3. How we use data

• To run the apps: today's workout, the logger, progress, points and leagues, classes, chat, the owner console and the trainer app.
• To run the retention engine the gym configures: Churn Radar scores computed from the member's own activity, the absence and win-back messages, membership reminders, and the delivery history that tells the gym what arrived.
• To send notifications a member has enabled, from the gym's own app and icon, inside the gym's quiet hours and daily cap.
• To answer the member's questions in the in-app coach, draft workout plans and estimate macros from a meal photo, where the gym has the AI features on (section 5).
• To support, invoice and secure the platform, prevent abuse and fix faults.

We do not sell personal data, and we do not use member data for advertising. One gym's data is never shown to another: every gym is a separate tenant, and a request that names another gym's record is answered as if it did not exist.

4. Form Coach and the camera

Form Coach processes the camera entirely on the member's device, in the browser, using a pose model the app downloads once from our own servers. No camera frame, video or image is sent to LumiFit or anyone else. What leaves the device, and only when the member taps Save, is the set's summary: exercise, rep count, scores, grades and the cue. A member may share a saved set with their trainer and may withdraw that share.

5. AI features

The in-app coach, the AI workout generator and the meal-photo macro estimate send the member's question, plan request or meal photo to a managed cloud model to produce the answer. By default these models run in the Mumbai region (Amazon Web Services, Amazon Bedrock) and the content is processed to generate the response and not kept by us beyond it. A gym may instead connect its own AI provider; in that case the gym's agreement with that provider governs the processing. AI answers are general fitness guidance, not medical advice.

6. Progress photos

Progress photos are stored for the member who took them, in private storage that is never served from a public address. They are never shown to the gym owner. A trainer sees a member's photos only when the member chooses to share them, and the member can withdraw that share at any time.

7. Who we share data with

We use a small set of service providers (sub-processors) strictly to deliver the product:

• Amazon Web Services, Mumbai region (ap-south-1): hosting, storage, encrypted backups, and the managed AI models described in section 5.
• Browser and operating-system notification services operated by the maker of the member's device or browser, which carry notifications to the device.
• Providers a gym connects itself (for example a notification delivery provider or an AI provider), under the gym's own account and agreement with that provider.
• GitLab, which hosts this marketing website as static files.

Each provider receives only the minimum data needed for its function. We may also disclose information where required by law or to protect the rights and safety of our users.

8. Security

• Strict tenant isolation: every record carries its gym, and every query is scoped to the signed-in gym.
• Encryption in transit (HTTPS) everywhere; phone numbers and connected credentials encrypted at rest.
• Members sign in with their phone number and their own password, set from a one-time code issued by the gym. Sign-in attempts are rate-limited. Sessions last ninety days and can be ended from the gym's console (“Sign out of all devices”).
• Nightly encrypted backups kept for ninety days, with a weekly restore test. The server that writes backups has no permission to delete them.
• Every change to the platform runs an automated test suite before it is deployed, with automatic rollback if the new release fails its health checks.

The long version is on our Security page.

9. Data retention and deletion

• Gym data is retained for as long as the gym maintains an active account.
• On account closure, gym and member data is deleted from active systems within 30 days, except records we must keep for legal, tax or accounting purposes. Backups age out within 90 days after that.
• Gyms can request a copy of their data at any time, and can request deletion of individual member records.
• A member who leaves a gym can ask the gym to delete their record; we carry out the gym's instruction.

10. Your rights (DPDP Act, 2023)

We honour the rights of data principals under India's Digital Personal Data Protection Act, 2023, including the right to access, correct and erase personal data, and the right to grievance redressal. Gym members should direct requests to their gym first (as the data fiduciary); we support gyms in fulfilling them. You may also contact us directly at contact@lumifit.in. We acknowledge grievances within 7 days and aim to resolve them within 30.

11. Children

LumiFit is intended for use by adults. Where a gym enrols members under 18, the gym is responsible for obtaining verifiable parental or guardian consent as required by applicable law.

12. Changes to this policy

If we make material changes, we will notify gym owners by email and update the date at the top of this page. Continued use of the platform after changes take effect constitutes acceptance.

13. Contact

Questions, requests or complaints: contact@lumifit.in. See also our Terms of Service and Refund & Cancellation Policy.