PRIVACY POLICY
Effective Date:Aug 2026
Last Updated:Aug 2026
1.PREAMBLE
This Privacy Policy ("Privacy Policy" or "Policy") is adopted and published by the entities operating under the Fitreat brand, collectively referred to herein as the "Fitreat Group", which includes Fitreat Couple Private Limited, a company incorporated under the provisions of the Companies Act, 2013, having its registered office at 08/67-1, Plot No. 66, Malabar Premium Villas, Perinthalmanna, Malappuram, Kerala – 679322, India, Fitreat LLC (Dubai), the Fitreat Partnership Firm, together with their respective affiliates, subsidiaries, associated enterprises, successors, permitted assigns and every other entity authorised to conduct business under the Fitreat brand (collectively referred to as the "Fitreat Group", "Company", "Fitreat", "we", "our" or "us", as the context may require).
This Privacy Policy governs the collection, receipt, storage, recording, organisation, structuring, adaptation, retrieval, consultation, use, disclosure, sharing, transmission, transfer, analysis, retention, anonymisation, deletion and every other form of processing of Personal Data undertaken by or on behalf of the applicable entity forming part of the Fitreat Group in connection with the operation of its websites, mobile applications, digital platforms, communication channels and the provision of its products and services.
The entity forming part of the Fitreat Group that acts as the data controller or otherwise determines the purposes and means of processing Personal Data in relation to a particular User shall ordinarily be the contracting entity identified in the relevant invoice, subscription confirmation, payment receipt, programme confirmation or other commercial communication issued to the User. Different entities within the Fitreat Group may perform technology, payment processing, customer support, coaching, analytics, compliance, administrative and other operational functions involving the processing of Personal Data for legitimate business purposes and in accordance with this Privacy Policy and applicable law.Fitreat is a technology-enabled health, nutrition and fitness platform that provides customised fitness coaching, nutrition planning, habit management, wellness programmes, behavioural coaching, transformation programmes and allied digital health services through its website, mobile applications, wearable device integrations and associated communication channels. The effective delivery of such services necessarily requires the Company to process certain categories of Personal Data, including information relating to the identity, health, nutrition, physical condition, lifestyle, behavioural patterns and fitness objectives of its users.
The Company recognises that the privacy of every individual constitutes an important legal and ethical obligation. Information entrusted to the Company by its users is handled with due regard to the principles of legality, transparency, fairness, accountability and security. The Company is committed to ensuring that Personal Data is processed only for legitimate purposes, only to the extent reasonably necessary for such purposes and only in a manner that protects the dignity, autonomy and privacy of every individual.
This Privacy Policy has been formulated to explain, in a transparent and comprehensive manner, the Company's practices concerning the collection and processing of Personal Data, the purposes for which such information is utilised, the circumstances in which it may be shared with authorised persons, the safeguards adopted by the Company for securing such information, the duration for which such information may be retained and the legal rights available to every user concerning their Personal Data.
This Privacy Policy forms an integral part of the contractual relationship between the Company and every user of the Platform and shall be read together with the Terms and Conditions, Refund Policy, Medical Disclaimer, Cookie Policy and every other policy or legal document published by the Company from time to time.
2.APPLICABILITY
This Privacy Policy applies to every individual who accesses, browses, downloads, installs, registers with, subscribes to or otherwise uses any service, product, programme, feature or functionality made available by the Company, irrespective of whether such individual ultimately creates a registered account or completes a commercial transaction.
The provisions of this Privacy Policy shall govern the processing of Personal Data relating to prospective customers, registered users, paid subscribers, participants in fitness or nutrition programmes, visitors to the Company's website, individualscommunicating through customer support channels, persons interacting through social media platforms, participants in promotional campaigns, webinar attendees, challenge participants, referral programme participants and every other person whose Personal Data comes into the possession of the Company in connection with its business activities.
This Privacy Policy extends to Personal Data collected through every platform, interface and communication medium operated, authorised or controlled by the Company, including without limitation the Company's official website, mobile applications, wearable device applications, application programming interfaces (APIs), customer relationship management systems, online consultation platforms, WhatsApp Business accounts, electronic mail, telephonic communication, video consultation platforms, payment interfaces, customer support systems, social media pages and such other digital or physical channels as may be introduced by the Company from time to time.
The provisions of this Privacy Policy shall continue to apply notwithstanding the suspension, termination or expiration of the relationship between the User and the Company for so long as the Company lawfully retains any Personal Data in accordance with applicable law, contractual obligations or legitimate business requirements.
3. OBJECT OF THIS PRIVACY POLICY
The principal object of this Privacy Policy is to establish a transparent legal framework governing the manner in which the Company collects, processes, stores, protects, discloses, transfers and otherwise deals with Personal Data in connection with the provision of its Services.
The Company acknowledges that users entrust it with information that is personal, confidential and, in many instances, highly sensitive in nature. Such information may include details relating to a user's physical condition, nutritional habits, medical history, lifestyle, body measurements, transformation journey, exercise routine, dietary preferences and other information that deserves enhanced legal protection and responsible handling.
This Privacy Policy is intended to ensure that every user is fully informed regarding the categories of Personal Data collected by the Company, the legal basis upon which such information is processed, the purposes for which it is utilised, the safeguards adopted for its protection, the circumstances under which it may be disclosed toauthorised third parties, the period for which such information is retained and the remedies available to users under applicable law.
Nothing contained in this Privacy Policy shall be interpreted as restricting any statutory right available to a user under applicable data protection legislation. In the event of any inconsistency between the provisions of this Privacy Policy and any mandatory provision of applicable law, the latter shall prevail to the extent of such inconsistency.
4. LEGAL BASIS
This Privacy Policy has been prepared in accordance with the provisions of the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, the rules, regulations, notifications and guidelines issued thereunder, together with all other applicable laws governing privacy, electronic commerce, cybersecurity, digital transactions and the protection of personal information in India.
Where the Services are accessed by users located outside the territorial jurisdiction of India, the Company shall endeavour to comply with such additional legal obligations concerning privacy and data protection as may be applicable to the extent required by the laws governing the relevant jurisdiction. Nothing contained herein shall be construed as limiting any rights or obligations imposed by mandatory provisions of foreign law wherever such laws are applicable to the Company's processing activities.
The Company reserves the right to amend this Privacy Policy whenever required to ensure continued compliance with legislative amendments, judicial pronouncements, regulatory directions, technological developments or changes in its business operations.
5. ACCEPTANCE OF THIS PRIVACY POLICY
By accessing, browsing, downloading, installing, registering for, subscribing to or otherwise using the Platform, the User acknowledges that they have carefully read, fully understood and voluntarily accepted every provision contained in this Privacy Policy.
The User further acknowledges that certain categories of Personal Data are essential for the Company to provide personalised fitness coaching, nutritional guidance, habit management, wellness monitoring, programme recommendations, customer support, subscription management, payment processing and other services available through the Platform. Accordingly, the User expressly authorises the Company to collect,process, store, analyse, transmit and otherwise deal with such Personal Data in accordance with this Privacy Policy and applicable law.
Wherever consent is required under applicable legislation, such consent shall be obtained by the Company through lawful means before processing the relevant categories of Personal Data. The User may withdraw such consent in accordance with applicable law; however, such withdrawal shall not affect the legality of any processing undertaken prior to the receipt of the withdrawal request and may result in the restriction, suspension or discontinuation of certain services that necessarily depend upon the processing of such information.
If a User does not agree with any provision of this Privacy Policy, such User shall immediately discontinue the use of the Platform. Continued access to or use of the Platform after the publication of any revised Privacy Policy shall constitute acceptance of such revised Privacy Policy to the extent permitted under applicable law.
6. GUIDING PRINCIPLES OF DATA PROCESSING
The Company is committed to ensuring that every activity involving the processing of Personal Data is undertaken in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, storage limitation, accuracy, integrity, confidentiality and accountability.
The Company shall collect only such Personal Data as is reasonably necessary for the purposes expressly disclosed to the User or otherwise authorised by applicable law. Personal Data shall not be processed in a manner incompatible with the purposes for which it was originally collected unless such further processing is authorised by law or by the User's valid consent.
The Company shall adopt appropriate technical, administrative and organisational safeguards to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access or any other form of unlawful processing. All personnel authorised to process Personal Data shall remain bound by contractual and statutory obligations of confidentiality.
The Company shall periodically review its internal data governance practices to ensure that Personal Data continues to be processed in a lawful, secure and proportionate manner having regard to technological developments, regulatory requirements and evolving industry standards.
7. COLLECTION OF PERSONAL DATA
The Company collects Personal Data solely for lawful purposes connected with the provision of its Services, the performance of contractual obligations, compliance with applicable legal requirements, protection of legitimate business interests and enhancement of the overall user experience. The nature and extent of the Personal Data collected shall vary depending upon the manner in which the User interacts with the Platform, the Services subscribed to by the User, the permissions granted by the User and the features utilised during the course of such interaction.
The Company shall endeavour to collect only such Personal Data as is reasonably necessary for the purposes disclosed under this Privacy Policy. The Company shall not knowingly collect information that is excessive, irrelevant or unrelated to the provision of its Services unless such collection is expressly authorised by the User or mandated by applicable law.
Personal Data may be collected directly from the User, automatically through the operation of the Platform, from authorised third-party service providers, from wearable devices and health integrations connected by the User, or from any other lawful source consistent with the provisions of applicable law.
The Company may continue to receive updated information from integrated services, connected devices and authorised third-party providers for so long as such integration remains active or until the User withdraws the relevant permission in accordance with applicable law.
8. INFORMATION PROVIDED DIRECTLY BY THE USER
The Company may collect Personal Data voluntarily furnished by the User while accessing or using the Platform. Such information is generally provided during account creation, subscription to programmes, booking consultations, participating in wellness challenges, communicating with coaches or customer support representatives, making payments, completing questionnaires, updating profile information or otherwise interacting with any feature of the Platform.
The Personal Data voluntarily provided by the User may include the User's full name, residential address, correspondence address, electronic mail address, mobile telephone number, gender, date of birth, age, profile photograph, emergency contact details, occupation, preferred language, country of residence and such other identity or contact information as may be required for providing the Services.The Company may further collect information relating to the User's fitness objectives, body composition, current weight, target weight, height, body measurements, exercise experience, physical activity levels, dietary habits, food preferences, allergies, food intolerances, nutritional restrictions, meal schedules, hydration patterns, sleeping habits, stress levels, lifestyle choices and behavioural patterns in order to design personalised health and fitness programmes.
Where required for the effective provision of specialised programmes, the Company may request information relating to pregnancy, postpartum recovery, diabetes, thyroid disorders, hypertension, cardiovascular conditions, hormonal disorders including PCOS or PCOD, previous surgeries, musculoskeletal injuries, chronic illnesses, medication history, laboratory reports, physician recommendations and other health-related information voluntarily disclosed by the User.
The Company may also collect progress photographs, body transformation photographs, videos, audio recordings, written testimonials, consultation notes, questionnaire responses, food logs, workout records and such additional information as may be voluntarily submitted by the User during the course of using the Services.
The User acknowledges that the accuracy, completeness and reliability of personalised recommendations generated by the Platform substantially depend upon the correctness of the information provided by the User. Accordingly, the User undertakes to ensure that all information furnished to the Company is accurate, complete and kept reasonably up to date throughout the duration of the User's engagement with the Platform.
9. INFORMATION COLLECTED AUTOMATICALLY
When the User accesses or interacts with the Platform, certain categories of technical information may be collected automatically through the operation of the Company's systems and associated technologies. Such information is collected primarily for ensuring the efficient functioning, security, optimisation and continuous improvement of the Platform.
The Company may automatically collect information relating to the User's Internet Protocol (IP) address, browser type, browser version, operating system, device manufacturer, device model, processor information, unique device identifiers, application version, language preferences, mobile network information, time zone settings, internet service provider, referral URLs, session identifiers and other technical characteristics associated with the User's device.The Company may additionally collect information concerning the manner in which the User interacts with the Platform, including login history, duration of sessions, pages viewed, buttons clicked, navigation paths, searches performed, features utilised, programme completion rates, workout completion history, frequency of application usage, error reports, crash logs, diagnostic information and similar analytical information required for improving the quality, functionality and stability of the Platform.
Such information may be collected using cookies, software development kits (SDKs), application programming interfaces (APIs), server logs, web beacons, pixels, local storage technologies and similar technologies commonly employed for operating digital platforms. The collection of such information enables the Company to identify technical issues, prevent fraudulent activities, improve system performance and enhance user experience.
10. HEALTH, FITNESS AND WELLNESS INFORMATION
The Services offered by the Company involve the provision of personalised nutrition, fitness coaching and wellness guidance. Accordingly, the Company may collect and process health-related information voluntarily disclosed by the User to the extent reasonably necessary for designing, monitoring and modifying personalised programmes.
Such information may include the User's age, height, weight, body fat percentage, muscle mass, body mass index, metabolic information, calorie intake, macronutrient consumption, micronutrient intake, hydration records, sleep duration, exercise frequency, workout intensity, physical limitations, mobility assessments, fitness assessments, body measurements, medical history, injury history, surgical history, medication details, allergies, dietary restrictions, hormonal conditions, reproductive health information, pregnancy status, postpartum recovery status and such additional health information as may be voluntarily furnished by the User.
The Company recognises that health-related information constitutes highly confidential Personal Data requiring enhanced protection. Accordingly, such information shall be processed only for legitimate purposes connected with theprovision of the Services, subject to appropriate security safeguards and applicable legal requirements.
Nothing contained in this Privacy Policy shall be interpreted as requiring a User to disclose any medical information that the User does not wish to disclose. However, the User acknowledges that withholding material health information may affect the suitability, safety or effectiveness of recommendations generated through the Platform, and the Company shall not be responsible for any consequences arising from incomplete, inaccurate or misleading information furnished by the User.
11. INFORMATION RECEIVED FROM WEARABLE DEVICES AND THIRD-PARTY INTEGRATIONS
Subject to the User's express authorisation, the Company may receive Personal Data from wearable devices, health applications and other third-party services integrated with the Platform. Such integrations are intended to facilitate the automated monitoring of physical activity and to improve the accuracy of personalised health recommendations.
Where authorised by the User, the Company may receive information relating to daily step counts, calories burned, heart rate, sleep patterns, walking distance, running activities, cycling records, workout duration, exercise intensity, body composition metrics and other health-related information generated by compatible wearable devices or health platforms.
The Company may integrate with services including, but not limited to, Apple Health, Google Health Connect, Google Fit, wearable smartwatches and other authorised health platforms introduced from time to time. Such integrations shall remain subject to the privacy policies, security practices and terms governing the respective third-party service providers.
The Company neither controls nor assumes responsibility for the privacy practices adopted by third-party integration partners. Users are therefore encouraged to review the privacy policies applicable to such third-party services before granting any permissions for data sharing.
12. LOCATION INFORMATION
Certain features of the Platform may require access to the User's geographical location for purposes including activity tracking, route mapping, fitness analytics, challenge participation, regional service availability, fraud prevention and system security.Where such functionality is utilised, the Company may collect precise or approximate location information through GPS signals, wireless networks, Bluetooth technologies, mobile towers or other location-determination technologies supported by the User's device.
Location information shall only be collected where the User has granted the necessary permissions through the operating system of the relevant device or through the Platform. The User may withdraw such permission at any time through the settings of the relevant device, although doing so may limit the availability or functionality of certain Services.
The Company shall not continuously monitor the User's geographical location except where such monitoring is reasonably necessary for a feature expressly activated by the User or otherwise permitted under applicable law.
13. PURPOSE OF PROCESSING PERSONAL DATA
The Company processes Personal Data only for lawful, fair and legitimate purposes directly connected with the provision, administration, improvement and protection of the Services offered through the Platform. The Company shall not process Personal Data in a manner incompatible with the purposes for which such information was originally collected unless such further processing is expressly authorised by the User or otherwise permitted under applicable law.
Personal Data collected by the Company is primarily utilised for creating and maintaining user accounts, verifying the identity of users, providing personalised fitness and nutrition programmes, facilitating consultations with nutritionists and fitness coaches, monitoring user progress, generating customised recommendations, administering subscriptions, processing payments, responding to customer enquiries, providing technical support, improving platform performance, maintaining system security and fulfilling contractual obligations undertaken by the Company.
The Company may further process Personal Data for conducting internal research, statistical analysis, service optimisation, product development, quality assurance, fraud detection, cybersecurity monitoring, legal compliance, dispute resolution, enforcement of contractual rights, audit requirements, business continuity planning and such other purposes as may be reasonably incidental to the operation of the Platform.
Where the Company intends to process Personal Data for any purpose materially different from the purpose originally disclosed to the User, the Company shall obtainsuch consent or provide such notice as may be required under applicable law before undertaking such processing.
14. PERSONALISED FITNESS, NUTRITION AND WELLNESS SERVICES
One of the principal objectives of collecting Personal Data is to enable the Company to provide personalised health, fitness and nutritional guidance suited to the individual requirements of each User. The Company analyses the information voluntarily provided by the User together with information generated during the use of the Platform in order to develop customised recommendations intended to support the User's stated health and fitness objectives.
Such recommendations may include customised meal plans, calorie targets, macronutrient distribution, nutritional guidance, workout routines, exercise schedules, mobility programmes, hydration goals, behavioural coaching, wellness reminders, progress assessments, recovery recommendations and similar services designed to enhance the User's overall health and wellness journey.
The recommendations generated by the Platform are based upon the information available to the Company at the relevant time. The quality, relevance and effectiveness of such recommendations necessarily depend upon the completeness and accuracy of the information furnished by the User. The Company does not warrant that every recommendation generated through the Platform will be suitable for every individual or that any particular outcome will necessarily be achieved.
Where specialised programmes are offered for specific medical or physiological conditions, including but not limited to pregnancy, postpartum recovery, diabetes, obesity, thyroid disorders, hypertension, hormonal disorders or other health conditions, the Company may process additional health-related information voluntarily disclosed by the User for the limited purpose of tailoring such programmes to the User's declared requirements.
15. ARTIFICIAL INTELLIGENCE AND AUTOMATED RECOMMENDATIONS
The Platform may utilise artificial intelligence technologies, machine learning models, algorithmic analysis, predictive analytics and automated decision-support systems to assist in generating fitness recommendations, nutritional suggestions, behaviouralinsights, progress reports, wellness reminders and other personalised outputs intended to improve the User experience.
The User acknowledges that artificial intelligence systems function by analysing information available to them and generating recommendations based upon statistical models, behavioural patterns, historical trends and algorithmic processing. Such recommendations are intended solely to assist Users and authorised coaches in making informed decisions and shall not be construed as professional medical advice, diagnosis, prescription or treatment.
The Company shall endeavour to ensure that automated recommendations are generated responsibly and are periodically reviewed and improved. Nevertheless, no artificial intelligence system is capable of accounting for every physiological, medical or environmental variable affecting an individual. Accordingly, Users are advised to exercise independent judgment and seek appropriate medical advice wherever necessary before relying upon recommendations generated through the Platform.
The Company reserves the right to continuously modify, improve, suspend or replace its artificial intelligence systems in order to improve accuracy, safety, efficiency and overall service quality.
16. COMMUNICATION WITH USERS
The Company may use Personal Data to communicate with Users regarding matters relating to their accounts, subscriptions, programmes, consultations, payments, platform functionality, customer support requests, security notifications, legal notices and other matters reasonably connected with the Services.
Such communications may be made through electronic mail, mobile applications, push notifications, SMS, WhatsApp Business, telephone calls, video consultations, in-application messaging systems or any other communication channel authorised by the User or reasonably necessary for providing the Services.
The Company may further communicate reminders concerning scheduled consultations, meal timings, hydration goals, workout schedules, programme milestones, subscription renewals, payment confirmations, progress tracking, challenge participation, health assessments and other notifications intended to assist Users in effectively utilising the Platform.Where promotional or marketing communications require the User's consent under applicable law, such communications shall be sent only after obtaining the necessary consent. Users may withdraw their consent for promotional communications at any time by utilising the opt-out mechanisms made available by the Company or by contacting the Company directly.
Withdrawal of consent for marketing communications shall not affect communications that are necessary for administering the User's account, performing contractual obligations or complying with legal requirements.
17. DISCLOSURE OF PERSONAL DATA
The Company treats Personal Data as confidential and shall not sell, lease, commercially exploit or otherwise disclose Personal Data to third parties except in accordance with this Privacy Policy, with the User's consent or as required by applicable law.
Where disclosure becomes necessary for the provision of the Services, the Company may share Personal Data with authorised employees, nutritionists, fitness coaches, customer support executives, technical personnel, quality assurance teams, compliance officers and other authorised representatives strictly on a need-to-know basis and solely for the performance of their respective duties.
The Company may further disclose Personal Data to trusted third-party service providers engaged for cloud hosting, payment processing, customer relationship management, communication services, analytics, cybersecurity, technical maintenance, data storage, audit, legal advisory, regulatory compliance and other legitimate business purposes. Every such service provider shall be contractually obligated to maintain appropriate standards of confidentiality and data security and shall be prohibited from processing Personal Data for any purpose inconsistent with the Company's instructions.
The Company may also disclose Personal Data where such disclosure is necessary for complying with statutory obligations, responding to lawful requests issued by courts, governmental authorities, law enforcement agencies or regulatory bodies, protecting the rights or safety of the Company or its Users, investigating fraudulent or unlawful activities, enforcing contractual rights or defending legal proceedings.
In the event of a merger, acquisition, corporate restructuring, sale of business, amalgamation, insolvency proceedings or transfer of substantially all of theCompany's assets, Personal Data may be transferred to the acquiring or successor entity, provided that such entity agrees to process the Personal Data in accordance with standards substantially similar to those set out in this Privacy Policy and applicable law.
18. PAYMENT INFORMATION
The Company may collect information relating to payments made by Users for subscriptions, consultations, coaching programmes, digital products and other services offered through the Platform.
The Company does not ordinarily store complete debit card numbers, credit card numbers, card verification values (CVV), internet banking credentials, Unified Payments Interface (UPI) personal identification numbers or other confidential payment authentication credentials. Such information is processed directly by authorised payment gateway providers engaged by the Company in accordance with applicable payment industry standards.
The Company may retain transaction identifiers, payment confirmations, billing information, invoices, subscription records, payment status, refund records and such other information as may be reasonably necessary for accounting, taxation, audit, dispute resolution, fraud prevention and legal compliance.
Users acknowledge that electronic payment transactions may additionally be governed by the privacy policies and contractual terms of the relevant banking institutions, payment gateways and financial service providers involved in processing such transactions.
19. ANALYTICS AND SERVICE IMPROVEMENT
The Company may analyse Personal Data, usage information, aggregated statistics, anonymised datasets and technical information for the purpose of understanding user behaviour, improving platform functionality, developing new features, enhancing user experience, identifying technical issues and evaluating the effectiveness of fitness programmes offered through the Platform.
Wherever reasonably practicable, such analytical activities shall utilise anonymised or aggregated information that does not directly identify individual Users. The Companyshall not intentionally re-identify anonymised information except where authorised by law or necessary for legitimate security or compliance purposes.
The Company may use analytical insights to improve programme effectiveness, optimise coaching methodologies, develop new digital health solutions, strengthen cybersecurity measures, evaluate platform performance and support evidence-based business decisions.
20. COOKIES AND SIMILAR TECHNOLOGIES
The Company may utilise cookies, web beacons, software development kits (SDKs), local storage objects, pixels, application programming interfaces, device identifiers and other similar technologies to facilitate the efficient functioning of the Platform, improve user experience, analyse usage patterns, personalise content, remember user preferences, maintain login sessions and strengthen the security of the Services.
Cookies are small text files stored on a User's device that enable the Platform to recognise the User during subsequent visits and to retain certain preferences and settings. The Company may utilise both session cookies, which expire automatically upon termination of a browsing session, and persistent cookies, which remain stored on the User's device until deleted or until they expire in accordance with their predetermined duration.
The Company may also permit certain authorised third-party service providers engaged for analytics, performance monitoring, crash reporting, customer support or marketing activities to utilise cookies or similar technologies to the extent necessary for providing their respective services to the Company. Such third parties shall process information only in accordance with contractual obligations imposed by the Company and applicable law.
Users may modify their browser or device settings to disable or restrict cookies. However, the User acknowledges that disabling cookies or similar technologies may adversely affect certain features, functionality or performance of the Platform and may prevent certain Services from operating as intended.
21. DATA RETENTION
The Company shall retain Personal Data only for such period as may be reasonably necessary for fulfilling the purposes for which such information was collected, complying with contractual obligations, satisfying legal or regulatory requirements, resolving disputes, enforcing contractual rights, preventing fraud and protecting the legitimate interests of the Company and its Users.Personal Data relating to active user accounts shall ordinarily be retained for the duration of the User's relationship with the Company. Upon closure, suspension or deletion of an account, the Company may continue to retain certain categories of information for such period as may be necessary for complying with statutory obligations, maintaining financial records, responding to legal claims, investigating fraudulent activities, resolving disputes or complying with lawful directions issued by competent authorities.
Where the applicable retention period prescribed by law has expired and the Personal Data is no longer required for any lawful purpose, the Company shall securely delete, anonymise or irreversibly destroy such information using commercially reasonable methods appropriate to the nature of the information concerned.
The Company reserves the right to retain anonymised or aggregated information that no longer identifies an individual User for statistical analysis, research, service improvement, product development and other legitimate business purposes.
22. SECURITY OF PERSONAL DATA
The Company recognises the importance of maintaining the confidentiality, integrity and availability of Personal Data entrusted to it and has implemented reasonable technical, administrative and organisational safeguards designed to protect such information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access or any other form of unlawful processing.
Without limiting the generality of the foregoing, the Company may implement encryption technologies, secure socket layer protocols, transport layer security mechanisms, firewalls, intrusion detection systems, access control mechanisms, authentication procedures, audit logging, vulnerability assessments, penetration testing, backup procedures and disaster recovery mechanisms appropriate to the nature of the Services provided by the Company.
Access to Personal Data shall be restricted only to those employees, consultants, nutritionists, fitness coaches, technical personnel and authorised representatives whose access is reasonably necessary for the performance of their official duties. Such persons shall remain subject to contractual and statutory obligations of confidentiality and may access Personal Data only to the extent necessary for carrying out their authorised responsibilities.Notwithstanding the precautions adopted by the Company, no electronic storage system, communication network or internet transmission can be guaranteed to be completely secure. Consequently, while the Company shall endeavour to protect Personal Data using commercially reasonable security practices, it cannot guarantee absolute security against every conceivable cyber threat, technological failure or unlawful act committed by third parties.
Users are encouraged to maintain the confidentiality of their account credentials, utilise strong passwords, promptly report any suspected unauthorised access and refrain from sharing login credentials with any other person.
23. USER RIGHTS
Subject to applicable law, every User shall be entitled to exercise such rights concerning their Personal Data as may be recognised under the Digital Personal Data Protection Act, 2023 and other applicable legislation.
The User may request confirmation regarding whether the Company processes Personal Data relating to the User and may seek access to such information in accordance with the procedures prescribed by applicable law. Where any Personal Data maintained by the Company is inaccurate, incomplete, misleading or outdated, the User may request that such information be corrected, updated or completed.
Subject to applicable legal requirements, the User may also request the deletion or erasure of Personal Data that is no longer required for the purposes for which it was collected, where the continued retention of such information is not otherwise required by law or necessary for the establishment, exercise or defence of legal claims.
Where processing is based upon the User's consent, the User may withdraw such consent at any time in the manner prescribed by the Company or applicable law. Withdrawal of consent shall not affect the legality of any processing undertaken prior to such withdrawal and may result in the discontinuation of certain Services that necessarily depend upon the processing of the relevant Personal Data.
The Company shall endeavour to respond to requests made under this Clause within the period prescribed by applicable law. Before acting upon any such request, the Company may require reasonable verification of the identity of the person making the request in order to prevent unauthorised disclosure of Personal Data.
24. INTERNATIONAL TRANSFER OF PERSONAL DATA
The Company primarily stores and processes Personal Data using infrastructure located within India. However, certain technology providers, cloud infrastructure providers, communication platforms, analytics providers, payment service providers or other authorised service providers engaged by the Company may process or store information on servers located outside the territorial boundaries of India.
Where Personal Data is transferred across national borders, the Company shall take reasonable steps to ensure that such transfer is carried out in accordance with applicable law and subject to contractual, technical and organisational safeguards designed to provide an appropriate level of protection for such Personal Data.
By using the Platform, the User acknowledges that the provision of certain Services may necessarily involve the transfer, storage or processing of Personal Data through infrastructure operated by authorised service providers located in different jurisdictions. The Company shall endeavour to ensure that such service providers maintain appropriate standards of privacy and data security consistent with applicable legal requirements.
25. CHILDREN'S PRIVACY
The Platform is intended primarily for use by adults and is not designed or marketed for independent use by children except where expressly permitted under applicable law.
The Company does not knowingly collect Personal Data from children in violation of applicable legal requirements. Where the Company becomes aware that Personal Data relating to a child has been collected without the consent or authorisation required by applicable law, the Company shall take reasonable steps to suspend the relevant account and securely delete such information within a reasonable period, unless continued retention is required by law.
Parents or legal guardians who believe that a child has provided Personal Data to the Company in contravention of applicable law may contact the Company for appropriate remedial action. The Company reserves the right to seek reasonable documentary proof before acting upon any such request.
26. DATA BREACH NOTIFICATION
The Company maintains procedures for identifying, investigating, containing and responding to actual or suspected incidents involving the unauthorised access, disclosure, loss, destruction or compromise of Personal Data.
Where the Company determines that a Personal Data breach has occurred and applicable law requires notification, the Company shall take reasonable steps to notify the appropriate governmental or regulatory authorities and, where required, the affected Users within such time and in such manner as may be prescribed under applicable law.
The Company shall also undertake appropriate remedial measures designed to mitigate the effects of the incident, strengthen existing security controls and reduce the likelihood of similar incidents occurring in the future.
27. GRIEVANCE REDRESSAL
The Company is committed to addressing concerns relating to privacy and the processing of Personal Data in a fair, transparent and timely manner.
Any User who has questions regarding this Privacy Policy or who wishes to exercise any statutory right relating to Personal Data may submit a written request to the Company's designated Grievance Officer using the contact details published on the Platform or otherwise notified by the Company from time to time.
Upon receipt of a grievance, the Company shall acknowledge the same within a reasonable period and shall endeavour to investigate and resolve the grievance in accordance with the timelines prescribed under applicable law. Where the User is dissatisfied with the outcome of the grievance redressal process, the User may pursue such remedies as may be available under applicable law before the competent authority or forum.
28. AMENDMENTS TO THIS PRIVACY POLICY
The Company reserves the absolute right to modify, revise, supplement or replace this Privacy Policy at any time to reflect changes in applicable law, judicial decisions,regulatory directions, technological developments, industry practices or changes in the Company's business operations.
Any revised Privacy Policy shall become effective from the date specified therein unless otherwise stated. Where required by applicable law or where the amendments materially affect the rights of Users, the Company shall make reasonable efforts to notify Users through the Platform, electronic mail or other appropriate communication channels before such amendments become effective.
Continued use of the Platform after the effective date of the revised Privacy Policy shall constitute acceptance of the amended Privacy Policy to the extent permitted by applicable law.
29. GOVERNING LAW AND JURISDICTION
This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of India.
Subject to any dispute resolution mechanism provided under the Terms and Conditions or applicable law, the courts having territorial jurisdiction over Kochi, Kerala, and where applicable the competent courts and tribunals in the State of Kerala, shall have exclusive jurisdiction to entertain and adjudicate all disputes arising out of or relating to this Privacy Policy, the processing of Personal Data or the use of the Platform.
30. CONTACT INFORMATION
Any communication relating to this Privacy Policy, the processing of Personal Data, requests for the exercise of statutory rights, grievances, notices or other privacy-related matters may be addressed to the Company through the contact details published on its official website.
Until separate privacy and grievance contact addresses are notified by the Company, all privacy-related correspondence may be directed to the Company's registered office, or through the official contact details published on the Platform. The Company reserves the right to update the designated contact information from time to time, and such updated details shall be deemed to form part of this Privacy Policy without requiring any formal amendment.
.
