Energise Studio operates two gyms inside business parks in Noida, Uttar Pradesh, India. We are the data controller for the information described here. Reach us at contact@energise.studio.
You do not create an account yourself. Our staff create your member record when you join at the gym. The app signs you in to a record that already exists — you enter your mobile number and we send a six-digit code over WhatsApp.
Your name, mobile number and member code. Optionally an alternate number, email address, postal address, date of birth, gender, photograph, and the company you work for. If you want an invoice addressed to your employer, your GSTIN and billing name.
If you give one, we store that person's name and number so we can reach them if something happens to you on the floor. Please tell them we hold it — they have not dealt with us directly.
Your trainer records this, not you. It can include body weight, height, body-fat and muscle percentage, BMI, waist, chest, hip, arm, thigh, calf and shoulder measurements, resting heart rate and blood pressure, your blood group, and free-text medical notes covering conditions, injuries or medication you have told us about. Your training goal is stored, which may be a rehabilitation goal, and so is your dietary preference and any food allergies. Your workout and diet plans, the sets and weights you log yourself, and your trainer's session notes are all kept.
Blood pressure, resting heart rate, medical notes and allergies are health data. A dietary preference such as vegetarian or Jain can indicate a religious belief. We hold these only because they change how we train and feed you safely.
Every check-in and check-out, the branch, the duration, and how you checked in — QR scan, front-desk entry, or a fingerprint turnstile at the door. Your visit streak and totals. Slot bookings.
We never receive your fingerprint. Where a turnstile is used, the match happens inside the vendor's device and it tells us only that member X passed through at a given time. No fingerprint or face template is stored in our systems.
Your plan, invoices, and payments. Payments are taken on a Paytm card machine — we record the amount, the mode and the reference printed on the slip. We never see or store your full card number.
The IP address and browser or device description for each sign-in, kept with the session. If you allow notifications, a push token and your device's name — which on many phones includes your own name, because that is what the phone reports.
We keep enquiry records — name, number, what you were interested in, our follow-up notes and, if you came from an advert, the campaign you clicked.
One qualification, so this is not misleading: if you send us a photograph taken on a phone, the image file may carry the GPS coordinates the camera embedded. We do not read or use them, but they are inside the file until we strip them.
Every member of our team can look up any member at their own gym, including health notes. We keep the team small and deliberately so. Only owners and administrators can see both gyms, and only they can see payroll and financial reporting.
We message you over WhatsApp — sign-in codes, receipts, reminders. The message and your number pass through Meta's WhatsApp service, and their terms apply to that leg. You can turn marketing messages off in your profile; codes and receipts you asked for still come.
Where your company has a tie-up with us, its invoice shows your member code, plan and dates, so whoever approves the bill can see you have a membership and when it runs. Where a company buys entry tokens instead, its invoice shows only a total count with no names. Employers have no login and cannot see your health data, your measurements or your attendance times.
Push notifications are delivered through Expo, Apple and Google, which receive the notification text and your device token. Email, when enabled, goes through our mail provider. Our servers are in a data centre operated by our hosting provider.
Being straight with you: the app has no button that deletes your account or downloads your data. If you ask us to delete or send you your information, a person does it by hand. Email contact@energise.studio and we will act on it within 30 days.
When a membership ends we mark the record inactive rather than erasing it — your invoices and payment history have to be kept for tax and accounting purposes, and Indian tax rules require us to retain invoice records for several years. Attendance, health measurements and message history are kept for as long as your record exists, unless you ask us to remove them.
Sign-in codes expire after five minutes. Expired sign-in sessions are deleted automatically every night.
You can ask us to correct anything, to stop messaging you, to delete what we are not legally required to keep, or for a copy of what we hold. You can also complain to us first and, if we do not resolve it, to the relevant authority.
The apps talk to our servers over HTTPS. Passwords are stored hashed, never in readable form. Sign-in sessions expire and rotate, and reusing an old session token signs every device out. On your phone, the app keeps its sign-in token in the operating system's secure keychain. Access is limited by role, and changes staff make to member records are logged.
No system is perfect. If a breach affects you, we will tell you and the authorities as required.
Our gyms serve working adults and our memberships are for people aged 18 and over. We do not knowingly hold data about children. If you believe we have, tell us and we will remove it.
If we change this policy materially we will say so in the app. Questions, corrections, deletion requests and complaints all go to contact@energise.studio.