Phone numbers, health conditions, payment history, daily habits. Here's how we've earned that — and, at the bottom of this page, exactly where we're still improving.
In a multi-tenant system, the worst possible failure is one gym seeing another gym's data. We prevent that at the architecture level: every tenant-owned model is forced through an audited isolation layer, and that rule is checked automatically in our build pipeline — not left to a developer to remember. Cross-gym isolation has a test for every resource.
We capture consent in the member's language, on a versioned notice, and record it in an append-only ledger that cannot be quietly rewritten. Guardian consent is captured for members under 18. Health and medical notes are encrypted at rest. Every field is mapped to the purpose it was collected for. When a member asks to be forgotten, we run a real erasure routine that removes their personal data and keeps only what financial law requires. We deliberately do not collect Aadhaar numbers — only a masked government-ID document upload, when your gym needs one at all.
Invoice numbers are sequential and gap-free, enforced under database row-locking so concurrent billing at the front desk and the manager's screen can't create duplicates or gaps. Payment records can't be silently edited — corrections go through a logged approval workflow, so there's always a trail showing who changed what and why. Day-close reconciliation closes the loop on cash.
Five seeded roles, 57 granular permissions, and guardrails that stop anyone granting access they don't themselves hold. Trainers are policy-scoped to their own assigned members — enforced server-side, so editing a URL doesn't get them any further. When our staff need to assist inside your account, impersonation is logged server-side against the real person, even where the gym-facing view shows "System".
The audit trail is append-only and covers auth events, record-level change diffs, the full money lifecycle, exports and downloads, permission changes, and sensitive views — opening a member's medical notes is itself an audited event. Logs are retained for over a year. Adding a feature without audit coverage is treated as an unfinished feature.
Member photos, uploaded documents and ID scans live on private storage, never in a public folder. They can only be reached through an authorized route that checks staff authentication, gym scope and the relevant policy — and every access is audited. Shared membership passes use signed links that expire.
India's Digital Personal Data Protection Act, 2023 is law, and the DPDP Rules were notified in November 2025. Gyms are among the most data-sensitive small businesses there are. When we surveyed how gym software in this market is marketed, consent management, audit trails and financial internal controls weren't part of the conversation. We think they should be.
We'd rather tell you this plainly than claim a compliance badge we haven't earned. As these ship, this page will say so.
| Capability | Status | What that means for you today |
|---|---|---|
| Automated breach-notification workflow | Not shipped | If a breach occurred, notification would be handled manually by us and by you. There is no built-in workflow that generates and tracks the notifications for you. |
| Per-gym data-retention configuration | Not shipped | Retention follows platform-wide defaults. You cannot yet set your own retention periods per data category from your own settings. |
| GST-format tax invoices (CGST/SGST split, SAC code) | In progress | Invoice numbering is already gap-free and sequential. The printed invoice does not yet carry the full statutory GST tax-invoice formatting. |
| Third-party security certification (SOC 2 / ISO 27001) | Not held | We hold no external audit certification. We describe our controls concretely on this page instead of pointing at a badge, and we won't imply otherwise. |
| Payment-card handling (PCI DSS) | Out of scope by design | GymOS never touches card data because it does not process payments. You record that a card payment happened; the card details are never entered into GymOS. |
Ask it directly. If the answer is "we don't do that yet", that's the answer you'll get.