PRIVACY POLICY

Witness The Fitness Private Limited (WTF Gyms)
Effective Date: March 25, 2026 | Version 2.0

This policy applies across all WTF products and platforms including:

1. 1. Introduction

   Witness The Fitness Private Limited ("WTF," "we," "our," or "us"), a company incorporated under the Companies Act, 2013, with its registered office at 3rd Floor, Amco Tower, Sector 9, Noida, Uttar Pradesh – 201301, India, is committed to protecting the privacy and security of the personal data of every individual who interacts with our platforms, applications, and services.

   This Privacy Policy ('Policy') explains in plain language what personal data we collect, why we collect it, how we use and protect it, with whom we share it, and what rights you have over it. It applies to all services offered under the WTF brand, including those listed in the table above.

   By accessing or using any WTF platform or service, you acknowledge that you have read, understood, and agreed to this Policy. If you do not agree, please discontinue use of the relevant service.

   This Policy is compliant with:

   • The Digital Personal Data Protection Act, 2023 (DPDP Act) of India
   • Google Play Store User Data Policy and Prominent Disclosure & Consent Requirements
   • Apple App Store Privacy Guidelines
   • The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

2. 2. Definitions

   For the purposes of this Policy:

   • "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
   • "Sensitive Personal Data" includes passwords, financial information, health and medical data, biometric data, and precise location data.
   • "Data Principal" means the individual to whom the personal data relates.
   • "Data Fiduciary" means WTF, which determines the purpose and means of processing personal data.
   • "Processing" means any operation performed on personal data, including collection, storage, use, retrieval, sharing, or deletion.
   • "WTF Guru App" means the trainer-facing Android application (com.wtf.trainer) used by WTF gym staff and trainers.
   • "WTF Member App" means the member-facing mobile application (com.wtf.member) used by gym members.

3. 3. What Data We Collect

   3.1 Identity & Contact Information

   Collected when you register, purchase a membership, or contact us:

   • Full name, date of birth, gender
   • Email address, mobile number
   • Residential address (for billing and communication)
   • Government-issued ID where required for legal compliance

   3.2 Health & Fitness Data

   HEALTH DATA NOTICE: We collect and process health and fitness data through the WTF Member App and WTF Guru App. This data is classified as Sensitive Personal Data and is handled with the highest level of care.

   Health and fitness data collected includes:

   • Body metrics: height, weight, body mass index (BMI), body fat percentage
   • Fitness assessments: strength benchmarks, cardiovascular fitness scores, flexibility measurements
   • Workout history: exercises performed, sets, repetitions, weights used, duration, and calories burned
   • Fitness goals and personal training targets as entered by the user or their assigned trainer
   • Medical notes and health conditions voluntarily disclosed to enable appropriate training modifications
   • Progress photos where voluntarily uploaded by the member
   • Nutrition and dietary preferences where voluntarily entered

   Purpose of collecting health data:

   • To enable trainers to design safe, personalized fitness plans for members
   • To track member progress against their health and fitness goals
   • To enable the member to view their own progress history within the app
   • For aggregate, anonymized analytics to improve WTF's services — no individual is identifiable from these analytics

   Health data is accessible only to: (a) the individual member, (b) their assigned WTF trainer, and (c) authorized WTF management for quality and safety oversight. Health data is never sold or shared with third-party advertisers, insurers, or any external organization without your explicit consent.

   3.3 Precise Location Data (Background Location)

   BACKGROUND LOCATION NOTICE (WTF Guru App): The WTF Guru App for trainers and front-desk staff collects your precise GPS location continuously, including when the app is running in the background or not actively in use. An in-app disclosure and your affirmative consent is required before this permission is activated. See Section 3.3 for full details.

   The WTF Guru App (trainer app, com.wtf.trainer) collects:

   • Precise GPS-based location in both foreground and background
   • Continuous tracking during working hours to verify presence within gym premises
   • Timestamps of location events for operational records

   Purpose of background location tracking:

   • To determine whether a staff member is within the designated gym premises during their shift
   • To notify senior management if a staff member moves outside a predefined geofenced radius during working hours — ensuring member safety, staff accountability, and smooth gym operations
   • For internal WTF operational compliance only

   Important disclosures regarding background location:

   • This data is collected and used even when the WTF Guru App is not actively in use on screen.
   • Location data is not shared with any third parties and is used solely within WTF Gyms' internal systems.
   • Access is restricted to authorized senior management personnel only.
   • Staff members are informed of this requirement prior to being assigned the WTF Guru App.
   • Trainers and staff members will be presented with a prominent, mandatory in-app disclosure and must tap to consent before the background location permission is requested on their device.

   The WTF Member App (com.wtf.member) may request location access in the foreground only — for features such as finding nearby WTF gym locations. This data is not collected in the background for members.

   3.4 Biometric (Facial) Data

   We may collect biometric data — specifically facial images — for the purpose of enabling secure access control to WTF gym premises via facial recognition-enabled biometric devices.

   • Facial data is collected only with explicit, informed consent.
   • It is used exclusively for biometric authentication to manage physical entry to gym facilities.
   • Facial data is never shared with, sold to, or disclosed to any third party under any circumstances.
   • It is stored on secured internal servers with industry-standard encryption and access controls.
   • Upon an individual's departure from WTF (membership expiry, resignation, etc.), their facial data is permanently deleted as part of standard offboarding.

   3.5 Financial & Transaction Data

   Collected when you purchase a membership, course, supplement, or any WTF product or service:

   • Transaction amounts and dates
   • Membership plan type and duration
   • Payment method type (UPI, card, net banking) — we do not store full card numbers or CVV
   • Billing address
   • GST and invoice details where applicable

   Payment processing is handled by PCI-DSS-compliant third-party payment gateways. WTF does not store raw financial credentials.

   3.6 Device & Technical Data

   • IP address, device type, operating system, browser type
   • App version, crash reports, and diagnostic logs
   • Session duration and pages visited (anonymized analytics)
   • Push notification tokens for sending alerts and updates

   3.7 Communications Data

   • WhatsApp and in-app messages between trainers and members (for service delivery only)
   • Support tickets and correspondence with WTF staff
   • Survey and feedback responses

   3.8 Data We Do NOT Collect

   • We do not collect data from minors under 18 years of age without verified parental consent.
   • We do not collect audio or video recordings from your device's microphone or camera beyond what is explicitly required for a feature you actively initiate (e.g., a live workout session you join).
   • We do not collect your contacts, call logs, or SMS data.

4. 4. How We Use Your Data

   Purpose	Data Used
   Account creation and authentication	Identity, contact, device data
   Providing gym membership services	Identity, health, financial data
   Trainer-assigned fitness planning	Health & fitness data
   Staff location compliance monitoring	Precise background location (Guru App only)
   Gym access via biometrics	Facial biometric data
   Processing payments and issuing invoices	Financial and identity data
   Customer support and service communications	Contact and communications data
   Marketing (with consent)	Contact data, preferences
   App analytics and service improvement	Anonymized device and usage data
   Legal compliance and fraud prevention	As required by applicable law
   Academy course delivery	Identity, financial, progress data

5. 5. Legal Basis for Processing

   WTF processes your personal data on the following legal grounds:

   • Consent: For sensitive personal data (health data, biometrics, background location) and for marketing communications. You may withdraw consent at any time — see Section 10.
   • Contractual Necessity: To deliver the membership, training, or service you have signed up for.
   • Legitimate Interests: For internal analytics, fraud prevention, and operational security — only where such interests are not overridden by your fundamental rights.
   • Legal Obligation: Where required to comply with applicable Indian laws, court orders, or regulatory requirements.

6. 6. Sharing Your Data

   We do not sell your personal data. We may share data only in the following limited circumstances:

   • Service Providers: Third-party vendors who assist us in operating our services (e.g., payment gateways, cloud hosting on AWS, communication platforms). All such providers are contractually obligated to process data only on our instructions and to maintain appropriate security.
   • WTF Group Entities: Authorized personnel across WTF verticals (WTF Academy, WTF Amplify, WTF Supplements, etc.) strictly on a need-to-know basis for service delivery.
   • Legal & Regulatory Authorities: Where required by applicable law, court order, or valid governmental request.
   • Business Transfers: In the event of a merger, acquisition, or asset sale, with adequate notice provided to users.

   We will never share your health data, biometric data, or precise location data with advertisers, data brokers, or any third party for commercial purposes.

7. 7. Data Retention

   Data Type	Retention Period
   Account & membership data	Duration of active membership + 3 years
   Health & fitness records	Duration of active membership + 1 year, then permanently deleted
   Background location logs (Guru App)	90 days rolling, then permanently deleted
   Biometric (facial) data	Until termination of access rights, then permanently deleted
   Financial & transaction records	7 years (as required under Indian tax law)
   Marketing communication preferences	Until opt-out or account deletion
   Anonymized analytics data	Indefinitely (no individual is identifiable)

8. 8. Data Security

   We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, alteration, or destruction:

   • All data is transmitted using TLS 1.2 or higher encryption.
   • Our backend infrastructure is hosted on AWS (Amazon Web Services) with industry-standard access controls, firewall configurations, and monitoring.
   • Sensitive personal data (health records, biometrics, financial data) is stored in encrypted form at rest.
   • Access to personal data is restricted to authorized WTF personnel on a strict need-to-know basis.
   • We conduct periodic security reviews and internal audits of data handling practices.

   Despite our best efforts, no system is entirely immune to security incidents. In the event of a data breach affecting your rights, we will notify the relevant regulatory authorities and affected individuals in accordance with applicable law.

9. 9. Your Rights

   Subject to applicable Indian law, you have the following rights over your personal data:

   • Right to Access: Request a summary of the personal data we hold about you.
   • Right to Correction: Request correction of inaccurate or incomplete personal data.
   • Right to Erasure: Request deletion of your personal data, subject to legal retention requirements.
   • Right to Withdraw Consent: Withdraw consent for processing at any time where consent is the legal basis. Withdrawal will not affect the lawfulness of processing carried out prior to withdrawal.
   • Right to Grievance Redressal: Lodge a complaint with our Data Protection Officer if you believe your data has been mishandled.
   • Account Deletion: You may request deletion of your WTF account — including all associated personal data — from within the relevant app or by emailing support@wtfgyms.com. Health records, biometric data, and location logs will be permanently deleted upon account closure, subject to the retention periods specified in Section 7.

   To exercise any of these rights, contact us at support@wtfgyms.com with the subject line "Data Rights Request." We will respond within 30 days.

10. 10. Consent, Opt-Out, and Marketing Preferences

    Where we process your data based on consent, you may withdraw that consent at any time without detriment to the core services you have paid for:

    • Marketing Communications (email, SMS, WhatsApp): Unsubscribe via the link in any message, or email support@wtfgyms.com.
    • Push Notifications: Disable via your device's notification settings for the relevant WTF app.
    • Background Location (WTF Guru App): This feature is a core operational requirement for employment. Please contact WTF management to discuss any concerns.
    • Biometric Data: Contact us to inquire about alternative access methods.

    Opting out of marketing will not affect service-related communications such as renewal reminders, payment confirmations, or safety alerts.

11. 11. Cookies and Tracking Technologies

    We use the following types of cookies on wtfgyms.com:

    • Strictly Necessary Cookies: Required for the website to function. Cannot be disabled.
    • Analytics Cookies: Used to understand how visitors interact with our website (e.g., pages visited, time on site). Data is aggregated and anonymized.
    • Functional Cookies: Remember your preferences and login state for a better experience.
    • Marketing Cookies: Used to show you relevant WTF promotions — only with your consent.

    You can manage your cookie preferences through our cookie consent banner or your browser settings. Disabling certain cookies may impact your experience on the website.

12. 12. Children's Privacy

    WTF services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors without verified parental or guardian consent. If you believe a minor's data has been submitted to us without proper consent, please contact us immediately at support@wtfgyms.com and we will take prompt action to delete the relevant data.

13. 13. Links to Third-Party Websites and Services

    Our platforms may contain links to third-party websites, payment gateways, or social media platforms. This Policy does not apply to those external sites. We encourage you to review the privacy policies of any third-party sites before sharing your personal information with them. WTF is not responsible for the privacy practices of external websites.

14. 14. Anti-Spam Policy

    WTF is committed to responsible communication practices:

    • We will never send unsolicited bulk communications to individuals who have not opted in.
    • Every marketing communication includes a clear and functional unsubscribe mechanism.
    • We maintain all opt-out requests within 10 business days.
    • We do not sell or rent your contact information to external marketers.

15. 15. Changes to This Policy

    We may update this Privacy Policy from time to time to reflect changes in our services, applicable law, or data processing practices. For material changes:

    • We will update the "Effective Date" at the top of this Policy.
    • Where required by law or where the change significantly affects your rights, we will notify you via email, in-app notification, or a prominent notice on the relevant platform.
    • Continued use of our services after the effective date of a revised Policy constitutes acceptance of the updated terms.

    We encourage you to review this Policy periodically. Previous versions are available upon request.

16. 16. Contact Us & Grievance Redressal

    If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact our Data Protection Point of Contact:

    Contact Detail	Information
    Company	Witness The Fitness Private Limited (WTF Gyms)
    Email	support@wtfgyms.com
    Phone	+91 9090639005
    Registered Address	3rd Floor, Amco Tower, Sector 9, Noida, Uttar Pradesh – 201301, India
    Website	www.wtfgyms.com/privacy
    Response Time	Within 30 days of receipt of your request

    If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once it is operational under the DPDP Act, 2023, or approach any other regulatory authority with jurisdiction over your matter.

This Privacy Policy was last updated on March 25, 2026 | Version 2.0 | Witness The Fitness Private Limited