Privacy Policy
This Privacy Policy explains how BalRheo Technologies ("Company", "BalRheo", "we", "us", or "our") collects, uses, stores, processes, and protects your personal information when you use:
- The BalRheo Member App (for gym members and consumers);
- The BalRheo Staff App mobile application and web portals (for gym owners, branch administrators, and trainers);
- The BalRheo platform management console; and
- Our website located at https://balrheo.com (collectively, the "Services").
We are committed to processing your personal data in accordance with applicable laws, including the Digital Personal Data Protection Act, 2023 ("DPDPA") (India), the Information Technology Act, 2000 and rules framed thereunder, and international application store privacy standards.
1. Important Entity Roles (Data Fiduciary vs. Data Processor)
Under the Digital Personal Data Protection Act, 2023 (DPDPA):
BalRheo as a Data Fiduciary
When you register a personal member account, manage your credentials, log personal fitness progress, or contact customer support, BalRheo acts as the Data Fiduciary.
BalRheo as a Data Processor
When you join a specific gym franchise, organization, or branch using our platform, that independent gym organization acts as the Data Fiduciary regarding your gym admission, membership plan purchases, financial invoices, and on-premises physical facility attendance. BalRheo processes that data solely on behalf of the respective gym organization under contract.
2. Information We Collect
We adhere to strict data minimization. We only collect information strictly necessary to provide the Services.
A. Information You Provide to Us
- Account Credentials: Full name, mobile telephone number (E.164 format), password (stored exclusively as cryptographic Argon2id hashes), and optional email address.
- Profile Information: Date of birth, gender, height (in cm), and user-uploaded profile avatars.
- Health & Fitness Metrics (Voluntary): Body weight, body fat percentage, muscle mass, daily workout set logs (reps, weight, sets, cardio duration, distance), estimated and tested One-Rep Max (1RM) records, personal fitness goals, and notes.
- User-Generated Content & Feedback: Ratings and reviews submitted for personal trainers and gym branches, complaints filed through the service, and communication notes.
- Staff Business Data (For Gym Owners/Staff): Organization details, branch addresses, business hours, staff emergency contacts, shift designations, and basic payroll compensation records.
B. Automatically Collected Information & Device Permissions
- Camera Access: Requested on your mobile device solely to scan physical QR codes at gym check-in desks. We do not take, record, or store photographs through the QR scanner.
- Precise Location (GPS): When you execute a Member Self Check-in, your device GPS coordinates (latitude, longitude, horizontal accuracy) are transmitted over SSL. We do not track background location, and we do not store your GPS coordinates in our database. Location coordinates are evaluated ephemerally in server RAM solely to verify you are physically within the gym's geofence perimeter at check-in time, and are instantly discarded.
- Device Identifiers & Push Tokens: Device manufacturer, operating system version, and Firebase Cloud Messaging (FCM) device push tokens to deliver workout alerts, announcements, and account security notifications.
- Log & Technical Data: IP address, authentication timestamps, API request failure counters (used for rate-limiting and brute-force protection), and crash logs.
3. How We Use Your Information (Purpose Limitation)
We process your data strictly for the following operational purposes:
- Authentication & Identity Verification: Verifying phone numbers via SMS One-Time Passwords (OTP) and authenticating multi-gym memberships.
- Gym Check-in Verification & Fraud Prevention: Geofencing your check-in against the gym branch location to maintain accurate visit records and prevent attendance spoofing.
- Fitness Tracking & Analytics: Calculating personal body composition metrics (such as Body Mass Index / BMI), tracking workout consistency streaks, and charting monthly lifted volume.
- Member-Trainer Coordination: Allowing your assigned personal trainer or gym administrator to prepare and assign customized workout and diet plans upon your request.
- Gamification & Social Features: Administering gym leaderboard rankings, milestone badges, and social friend connections (via invite codes only).
- Platform Communications: Sending transactional push notifications, class schedule changes, membership renewal notices, and gym emergency closure alerts.
- Internal Platform Security: Monitoring abuse and fraudulent activity. We do not sell your personal data or share your profile with third-party advertising brokers.
4. Legal Basis for Processing (DPDPA 2023)
We process your personal data under the following legal grounds recognized by Indian law:
- Consent: You provide explicit consent when you register, upload an avatar, or log voluntary health metrics. You may withdraw consent at any time.
- Performance of a Contract: Processing is necessary to fulfill our service agreement (e.g., verifying gym entry, executing workout routines).
- Compliance with Legal Obligations: Processing required to comply with statutory accounting, taxation, and law enforcement directives under Indian law.
5. Health, Workout & Medical Disclaimer
BalRheo is a fitness logging and sports management platform. BalRheo is not a healthcare provider, medical clinic, or medical device.
Any calculations provided (including Body Mass Index, calorie targets, workout sets, and 1RM calculations) are automated estimates provided for recreational athletic guidance only.
You should consult a qualified physician or healthcare professional before beginning any diet plan, exercise routine, or high-intensity workout. Reliance on any workout or diet plan created by gym staff is undertaken voluntarily at your own discretion.
6. Data Sharing & Third-Party Processors
We do not sell, rent, or trade your personal information. We disclose data only to authorized service providers bound by strict confidentiality and security agreements:
| Service Provider / Category | Purpose | Data Handled |
|---|---|---|
| Cloud Hosting & Infrastructure | Database storage, backend API hosting, caching | Encrypted personal and operational data |
| Object Storage | Secure storage of uploaded avatars and gym files | Encrypted image and document files (pre-signed URLs) |
| Notification Services (Firebase FCM) | Delivery of mobile push notifications | Device push tokens, notification titles/bodies |
| SMS Gateways | SMS One-Time Password (OTP) verification | Mobile number and 6-digit verification codes |
| Gym Organizations / Franchises | Roster management, admission, class scheduling | Name, mobile, membership validity, attendance logs |
7. Data Retention & Anonymization
- Active Account Data: We retain your account credentials, workout history, and personal progress metrics for as long as your account remains active.
- Ephemeral Location Data: Verified within milliseconds in memory; retained for zero (0) seconds in persistent storage.
- Statutory Accounting Records: Transaction records, membership plan invoices, and tax records are retained for a minimum of seven (7) years to comply with statutory taxation, GST, and corporate governance requirements under Indian law.
- Deleted Accounts: When you request account deletion, your personal identity (name, email, mobile number, avatar) and health metrics are permanently purged or irreversibly anonymized.
8. Account Deletion & Your Rights
A. In-App Account Deletion
You can permanently delete your account directly inside the BalRheo Member App:
Open BalRheo Member App → Profile / Settings → Account & Security → Delete Account
B. Public Web Deletion Request
If you have uninstalled the app or cannot access your device, email our privacy desk directly at [email protected] with your registered mobile number for prompt data deletion.
9. Protection of Children & Minors (Strict 18+ Policy)
In strict accordance with Section 9 of the DPDPA 2023, our platform does not knowingly collect, track, or process personal data of individuals under eighteen (18) years of age, nor do we direct targeted promotional content to minors.
Eligibility Restriction: You must be at least 18 years of age to register an independent account on BalRheo.
10. Security Safeguards
Encryption in Transit
All traffic between mobile clients and our APIs is encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
Password Protection
Passwords are never stored in plaintext; they are hashed using compute-intensive Argon2id cryptographic algorithms.
11. Grievance Redressal & Contact Information
In compliance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, our grievance contact details are as follows:
Designation: Grievance Redressal Officer
Company: BalRheo Technologies
Support Desk: [email protected]
Grievance Desk: [email protected]
We acknowledge all complaints within 24 to 48 hours and resolve grievances within statutory timeframes prescribed under Indian law.
12. Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect technological, operational, or legal changes. Material modifications will be notified via in-app banner, push alert, or email prior to taking effect. Continued use of the Services constitutes acceptance of the updated terms.