This Privacy Policy explains how the platform (“we”, “us”, “our”) collects, uses, stores, and protects personal information when you use our gym management platform. By using the platform, you agree to the practices described in this policy. Gym owners are responsible for ensuring their members are informed of this policy and have provided appropriate consent for their data to be submitted to the platform.
Overview
Who we are
This Privacy Policy describes how the platform operator ('we', 'us', 'our') collects, uses, stores, and protects personal information submitted by gym owners, trainers, and gym members who use the platform. We are committed to handling your data lawfully, transparently, and in accordance with the Nigeria Data Protection Act 2023 (NDPA).
Scope
This policy applies to all data collected through the platform, including our web applications, APIs, and related services. It applies to gym owners who register a workspace, trainers assigned to a gym, and gym members who are enrolled by their gym.
Changes to this policy
We may update this policy from time to time. We will notify registered users of material changes via email at least 14 days before they take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
Data We Collect
Gym owner account data
When you register a gym, we collect: your name, email address, gym name, gym location (city), and optionally a gym logo image. We also collect your Firebase Authentication UID which serves as your account identifier.
Member data (submitted by gym owners)
Gym owners submit member records on behalf of their clients. This may include: full name, email address, phone number, date of birth, gender, home address, subscription plan, emergency contact details, medical notes, and attendance records. Gym owners are the data controllers for this information and are responsible for obtaining appropriate consent from their members.
Payment data
We record payment transactions including amounts, dates, plan names, and transaction references. We do not store full card numbers or bank account details. Payment processing is handled by Flutterwave, whose privacy policy applies to payment data collected during checkout.
Usage and technical data
We automatically collect technical data including browser type, device type, IP address, pages visited, and feature usage patterns. This data is used to maintain platform security, diagnose issues, and improve the platform. It is not sold to third parties.
Communications
If you contact us via the support form, email, or any other channel, we retain the content of your communication and your contact details to respond to and track your enquiry.
How We Use Your Data
Providing the service
We use your data to create and manage your account, operate your gym workspace, process payments, maintain subscription records, and send service-critical communications such as renewal reminders, payment confirmations, and account notices.
Platform improvement
We use anonymised, aggregated usage data to understand how the platform is used, identify areas for improvement, and develop new features. This data does not identify individual users.
Security and fraud prevention
We process account and technical data to detect and prevent unauthorised access, fraudulent transactions, and abuse of the platform.
Legal compliance
We may process and disclose your data where required to comply with applicable Nigerian law, a court order, or a request from a competent regulatory authority.
Legal Basis for Processing
Contract performance
Most processing of gym owner and trainer data is necessary to perform the contract between us — i.e. to provide the platform services you have signed up for.
Legitimate interests
We process usage and technical data based on our legitimate interest in operating a secure, functional, and improving platform — provided this interest is not overridden by your data protection rights.
Legal obligation
Certain data may be retained or disclosed to comply with Nigerian tax law, financial regulation, or other legal obligations applicable to us.
Consent (member data)
Gym owners who submit member personal data to the platform are responsible for ensuring they have a valid legal basis — typically consent — for doing so. The NDPA 2023 requires that data subjects be informed of how their data will be used.
Data Sharing
We do not sell your data
We do not sell, rent, or trade your personal information to any third party for marketing or commercial purposes.
Service providers
We share data with trusted third-party service providers who help us operate the platform, including: Firebase / Google Cloud (infrastructure and authentication), Flutterwave (payment processing), Cloudinary (image storage), and Vercel (application hosting). These providers are contractually bound to process data only as instructed by us.
Gym owners and their workspaces
Gym member data is visible only to the gym owner and any trainers they have explicitly assigned. No member's data is visible to any other gym on the platform.
Legal disclosure
We may disclose your data to law enforcement, courts, or government authorities where required by applicable law or where we believe disclosure is necessary to prevent harm or protect our legal rights.
Data Retention
Active accounts
We retain your data for as long as your account is active and for a reasonable period thereafter to handle support requests, disputes, and legal obligations.
After account termination
Following account deletion or termination, your data is retained for 90 days to allow data export and to handle any final disputes or legal claims. After 90 days, personal data is permanently deleted from our systems.
Payment records
Transaction records may be retained for up to 7 years to comply with Nigerian tax and financial record-keeping requirements, even after account deletion.
Your Rights
Right of access
You have the right to request a copy of the personal data we hold about you. We will respond within 30 days of a verified request.
Right to rectification
You may update most of your account information directly in your settings. For data you cannot update yourself, contact us and we will correct inaccurate data promptly.
Right to erasure
You may request deletion of your account and associated personal data. We will action erasure requests within 30 days, subject to our retention obligations for payment records.
Right to data portability
You may request an export of your gym data (member records, payment history, plans) in a machine-readable format. Contact us to arrange a data export.
Right to object
You may object to processing based on legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
How to exercise your rights
To exercise any of the above rights, contact us at the support email shown on this page. We may ask you to verify your identity before processing your request.
Security
Technical measures
We implement industry-standard security measures including encrypted data transmission (TLS), Firebase security rules enforcing per-gym data isolation, server-side authentication token verification, and environment-variable management for secret credentials.
Organisational measures
Access to production systems is restricted to authorised personnel only. We do not store plain-text passwords. Authentication is handled by Firebase Authentication, which provides industry-standard credential security.
Breach notification
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and the relevant authority within 72 hours of becoming aware, as required by the NDPA 2023.
Your responsibility
You are responsible for keeping your login credentials confidential and for the security of devices from which you access the platform. Please notify us immediately if you suspect unauthorised access to your account.
Contact & Complaints
Contact us
For any privacy-related queries, data subject requests, or complaints, please contact us at the support email address shown on this page. We aim to respond within 5 business days.
Regulatory complaints
If you are unsatisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the supervisory authority responsible for data protection in Nigeria.
Privacy Questions
For any questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern, please contact us.
Also review
Terms of Service →