FitSplit Privacy Policy

Last updated: July 6, 2026

This Privacy Policy explains how FitSplit collects, uses, shares, stores, and protects personal data when you use the FitSplit gym-management platform.

FitSplit is owned and operated by Blume Labs ("Blume Labs", "FitSplit", "we", "us", "our"), with its registered address at [REGISTERED ADDRESS]. Contact: fitsplit.in@gmail.com.

1. Scope

This policy applies to:

• gym members;
• gym owners, trainers, and staff;
• platform administrators;
• people who contact FitSplit through the website or app;
• gym customers that use FitSplit to manage their business.

This policy covers FitSplit's web app, PWA, public pages, authentication flows, notifications, and support communications.

2. Who is responsible for your data

For most member and staff data inside a gym workspace, the gym decides why and how the data is used. In that context, the gym is generally the controller/data fiduciary/business, and FitSplit is the processor/service provider/vendor acting on the gym's instructions.

For data FitSplit uses for its own purposes, FitSplit is the controller/data fiduciary/business. Examples include platform security, service operations, legal compliance, support, product analytics, abuse prevention, and direct communications with prospective gym customers.

If you are a member, your gym may be the best first contact for membership, coaching, attendance, payment, and account-management questions. You can also contact FitSplit at fitsplit.in@gmail.com.

3. Personal data we collect

We collect the following categories of data depending on your role and the features used.

Account and identity data

• name and display name;
• username;
• phone number;
• email address or synthetic authentication email;
• role, staff type, gym association, and account status;
• authentication identifiers;
• password or PIN authentication data in protected form;
• login attempt, lockout, session, and security records.

Gym and staff data

• gym name, logo, location, map link, contact details, social links, and geofence settings;
• staff names, phone numbers, roles, and assigned-member relationships;
• gym notices and workspace settings.

Health, fitness, and wellness data

FitSplit may process health-related and fitness data, including:

• workout programs, exercise assignments, sets, reps, weight, rest, skipped/modified days, and training history;
• body weight, body fat percentage, height, age, goals, and progress trends;
• macro and nutrition targets/logs, calories, water, protein, carbs, and fats;
• injury notes, pain points, coach notes, limitations, and related observations;
• muscle volume, radar charts, progress charts, and personal-training records.

Some of this data may be treated as sensitive personal data, special category data, or sensitive personal information under applicable law.

Attendance and location data

• check-in and check-out records;
• gym geofence status;
• approximate location coordinates provided by your device for attendance verification where enabled;
• timestamps and related device/browser context.

FitSplit does not collect background location continuously. Location is used for attendance verification when the user initiates a check-in/check-out or otherwise uses a location-enabled attendance feature.

Membership and billing records

• membership packages;
• package duration and status;
• membership start and end dates;
• payment requests;
• owner approval/rejection records;
• membership expiry notices.

FitSplit does not currently process card payments inside the app.

Device, usage, and technical data

• session cookies and role-routing cookies;
• browser/device information;
• PWA/service-worker and offline-sync data;
• Firebase Cloud Messaging push token where you opt in;
• error, diagnostic, and security logs;
• IP address and request metadata received by hosting and infrastructure providers.

Communications

• contact form submissions;
• support emails;
• account deletion requests;
• notifications and activity records.

4. How we collect data

We collect data:

• directly from you when you log in, update a profile, use workouts, submit logs, check in, upload media, or contact us;
• from your gym, owner, trainer, or staff when they create or manage your account, membership, training plan, or notes;
• automatically from your browser, device, cookies, hosting, Firebase, and security systems;
• from third-party infrastructure providers that help operate the Service.

5. How we use data

We use data to:

• create, authenticate, secure, and manage accounts;
• route users to the correct role and gym workspace;
• provide workout, progress, attendance, PT, membership, billing-record, notification, and dashboard features;
• allow owners and trainers to coach, manage, and support members;
• sync offline workout logs;
• deliver web push notifications where enabled;
• maintain security, access control, tenant isolation, rate limiting, and abuse prevention;
• troubleshoot, test, monitor, and improve the Service;
• respond to support, legal, privacy, and deletion requests;
• comply with legal obligations and enforce our terms;
• maintain records needed for audits, disputes, fraud prevention, and business administration.

6. Legal bases and consent

Depending on where you live, we rely on one or more legal bases:

• performance of a contract or taking steps before entering a contract;
• your consent, including explicit consent for health and fitness data where required;
• legitimate interests, such as security, service improvement, fraud prevention, support, and business operations;
• legal obligation;
• vital interests or public interest only where applicable and legally permitted.

For India users, FitSplit and/or the relevant gym may process digital personal data based on consent or other lawful grounds available under applicable law. Consent requests should be accompanied by clear notice of the personal data collected, the purpose of processing, and how to exercise rights and grievances.

For EU/UK users, health-related data may be special category data. Where required, we rely on explicit consent for processing health and fitness data, including injury notes, body metrics, macro logs, and coaching notes. You may withdraw consent at any time, but withdrawal may limit or disable health/fitness features.

7. Cookies and similar technologies

We use strictly necessary cookies and local storage technologies to keep the Service working, including authentication/session cookies, role-routing cookies, terms-consent state, PWA/offline data, and security-related storage.

We do not use advertising cookies in the current app. See the Cookie Policy for more detail.

8. Push notifications

If you opt in to browser or device push notifications, FitSplit stores a Firebase Cloud Messaging token for your account. Notifications may include membership expiry, program assignment, PT booking/rescheduling/completion, exercise request status, admin contact messages, and other service alerts.

You can disable push notifications through your browser, device, or app settings. Service messages may still appear inside the app.

9. Who can see your data

Access depends on role and gym membership:

• members can access their own data;
• gym owners can access member, staff, training, attendance, membership, and operational data for their gym;
• trainers can access member data permitted by gym visibility settings and training assignments;
• platform administrators can access data needed to operate and support FitSplit;
• service providers can process data only as needed to provide infrastructure, storage, hosting, messaging, diagnostics, and related services.

FitSplit uses tenant isolation and role-based access controls to separate gym workspaces.

10. Sharing and disclosure

We may share data with:

• your gym, owners, trainers, and staff, according to role permissions;
• infrastructure and service providers listed in the Subprocessor List;
• professional advisers, insurers, and auditors where needed;
• law enforcement, courts, regulators, or government authorities where required by law;
• parties involved in a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate protections;
• other parties with your consent or at your direction.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

11. International transfers

FitSplit is operated from India and uses cloud infrastructure that may process data in India and other locations depending on provider configuration, support, security, and service operations. The app is configured around Google Firebase/Cloud services with primary regional operations in asia-south1 where applicable.

Where required, we use appropriate safeguards for cross-border transfers, such as provider data-processing terms, standard contractual clauses, contractual protections, access controls, and technical safeguards.

12. Retention

We keep personal data for as long as needed to provide the Service, operate gym records, comply with legal obligations, resolve disputes, secure the platform, and enforce agreements.

Current app behavior includes:

• active account data retained while the account or gym workspace is active;
• deleted records archived before hard deletion where supported;
• archive retention of 60 days unless a longer period is required by law or needed for legitimate dispute, fraud, security, or compliance reasons;
• account deletion requests routed to the gym owner/admin for action where the gym controls the account.

Some information may remain in backups, logs, audit records, or legal records for a limited period.

13. Security

We use administrative, technical, and organizational safeguards designed to protect personal data, including:

• HTTPS and secure transport;
• Firebase Authentication and session cookies;
• role-based access controls;
• Firestore and Storage security rules;
• gym-scoped tenant separation;
• login lockout and rate-limiting protections;
• hashed or protected credentials;
• restricted privileged server actions and cloud functions;
• archive and deletion workflows;
• monitoring and diagnostics.

No system is perfectly secure. Please contact fitsplit.in@gmail.com if you believe your account or data has been compromised.

14. Your rights

Depending on where you live, you may have rights to:

• access your data;
• correct inaccurate data;
• delete data;
• restrict or object to processing;
• withdraw consent;
• receive a portable copy of data;
• opt out of sale or sharing where applicable;
• nominate another person to exercise rights where applicable;
• complain to a regulator or data protection authority;
• use a grievance process.

Members may have in-app export and deletion request tools where available. You may also email fitsplit.in@gmail.com.

See the Data Rights and Grievance Notice for details.

15. California privacy notice

If the CCPA/CPRA applies, this section supplements the rest of the policy.

Categories of personal information collected may include identifiers, customer records, protected classification data where provided, commercial information, internet or network activity, geolocation data, audio/visual content if uploaded by users, professional/employment-related information for gym staff, sensitive personal information, and inferences from fitness/progress activity.

Purposes include providing the Service, security, support, analytics, legal compliance, account management, gym operations, fitness tracking, and communications.

We do not sell personal information and do not share personal information for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics beyond providing the Service and related security/support functions.

California residents may request access, deletion, correction, portability, and information about disclosure practices, and may not be discriminated against for exercising rights.

16. EU/UK privacy notice

If GDPR or UK GDPR applies, FitSplit may act as controller for platform purposes and processor for gym-controlled member/staff data.

You may have rights to access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority.

Where processing is based on legitimate interests, you may object. Where processing is based on consent, you may withdraw consent at any time without affecting processing before withdrawal.

17. Children and minors

FitSplit is not directed to children. We do not knowingly collect personal data from children under 16 without appropriate authorization. Gyms must not create accounts for minors unless they have the required parent/guardian consent and legal basis.

If you believe a child has provided data without required consent, contact fitsplit.in@gmail.com.

18. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date and provide additional notice for material changes where appropriate.

19. Contact and grievance officer

Owner and operator: Blume Labs (https://blumelabs.in/)

Address: [REGISTERED ADDRESS]

Email: fitsplit.in@gmail.com

Grievance Officer: [GRIEVANCE OFFICER NAME]

Grievance Officer email: fitsplit.in@gmail.com

Grievance Officer postal address: [GRIEVANCE OFFICER POSTAL ADDRESS]