Privacy policy

Rysmic is gym management software made for India. This policy covers rysmic.com, the gym app at app.rysmic.com, the member app at me.rysmic.com, Rysmic AI, and the public gym pages at rysmic.com/g/<gym>. The demo at demo.rysmic.com runs on made-up data and keeps nothing about you.

“Rysmic”, “we” and “us” mean [LAWYER: the legal entity’s full name, registered office address and CIN]. “You” means whoever uses Rysmic: a gym owner, a member of a gym’s team (staff), or a member of a gym.

A member signs in to Rysmic itself, not to a gym. Your Rysmic account — your profile, body metrics, progress and logs — belongs to you and stays with you if you move to another gym on Rysmic.

Each gym keeps its own records of your membership with it — your plan, dues, payments, visits, class bookings, requests and your chat with the gym — because it has to keep its books. Those records stay with the gym if you leave it.

For your Rysmic account, Rysmic decides why and how your data is used (the Data Fiduciary). For a gym’s records about its members and team, the gym decides, and Rysmic handles that data on the gym’s behalf and on its instructions (as its Data Processor). [LAWYER: confirm these roles under the DPDP Act, and whether a separate data processing agreement with each gym is needed.]

About gym owners and their teams:

• Your name, email address, mobile number, photo if you add one, and your role at the gym.
• Your gym’s details: its name, branches, address, city, hours, photos, plans and prices, and its GST details if it gives them.
• A record of what was done in the app and by whom (for example, a payment recorded or a refund made), so the gym can trust its own books.

About members — your Rysmic account:

• Your email address or mobile number, your name, and your photo, date of birth and gender if you add them.
• Your body metrics and progress: weight, body fat, measurements and lifts that you or your coach log.
• Your logs: the meals and workouts you tick off, and a copy of each workout or diet plan a coach gave you, so it stays in your history.

About members — kept by your gym:

• Your membership: the gyms you belong to, your plans, dues, payments and receipts, check-ins, class bookings, ratings and feedback, requests (such as a freeze) and your chat with the gym.

When you use “Continue with Google”, Google tells us your name, email address and profile picture, and that Google has verified the email. We use them only to sign you in and to find the gym invite or team that email is on. We do not receive your Google password and we do not ask for access to your Gmail, Drive, contacts or anything else in your Google account.

From every device: the browser and device type, IP address, the time of each sign-in, and error reports when something breaks. Your sign-in is kept on your device (browser storage) so you stay signed in.

From the rysmic.com waitlist: the name, mobile number, email address, gym and city you give us.

• To run Rysmic for gyms: members, payments, attendance, classes, expenses, reminders, reports and the gym’s public page.
• To let members check in, book classes, pay, follow their plan, see their progress and talk to their gym.
• To sign you in, keep your account secure and stop misuse (for example, codes sent to numbers nobody invited).
• To answer the questions a gym asks Rysmic AI (see below).
• To tell you about your account and, for the waitlist, about Rysmic’s launch.
• To meet our legal duties, such as keeping tax records.

We do not sell your data and we do not show advertising. [LAWYER: the lawful basis for each purpose — consent, or a legitimate use under section 7 of the DPDP Act — and the consent wording at member sign-in.]

Your gym sees your membership with it. It sees your body metrics and progress only while you share them with it: sharing is on by default while your membership is live, you can turn it off for any gym at any time in Me → Your data and privacy, and turning it off takes effect at once. It ends when you leave the gym.

A gym never sees what you ate or each set you ticked — only counts, such as the days you logged.

At a gym, each team member sees only what their role allows (the owner sets the roles). One gym never sees another gym’s records. Other members never see yours.

The service providers listed below handle data only to run Rysmic, under contract, and not for their own purposes.

We may disclose data when the law requires it, for example to answer a lawful order from a court or government authority.

When someone at a gym asks Rysmic AI a question, the question and the gym figures needed to answer it are sent to an AI provider — OpenAI, Google Gemini (if OpenAI cannot answer) or Anthropic Claude — and the answer comes back to the app. Before anything leaves Rysmic, members’ names are replaced with stand-ins (pseudonymised), and they are put back only on our side.

A question asked by voice is recorded only while the mic is on and sent to Groq, which turns the speech into text; the text comes back to the app for the person to read before sending. Rysmic does not store the recording.

Rysmic AI never acts on its own: anything it proposes, such as sending reminders, waits for a person at the gym to approve it.

[FOUNDER: confirm both AI providers are used under paid terms that do not use our data to train their models, and how long each provider keeps a request.]

• Supabase

  Database, sign-in and file storage — where Rysmic’s records live

  Mumbai, India

• Render

  Rysmic’s API server (Rysmic AI, payments, exports, PDFs)

  Singapore

• Vercel

  Hosts the web pages of rysmic.com and the apps; cookie-free visit counts on rysmic.com

  Global network; server functions in Mumbai

• Resend

  Sends email: sign-in codes, invites and receipts

  United States [FOUNDER: confirm region]

• Google

  “Continue with Google” sign-in; the waitlist sheet

  Global

• Google Gemini, OpenAI, Anthropic

  Rysmic AI answers, with members’ names pseudonymised

  United States

• Groq

  Speech-to-text for questions asked to Rysmic AI by voice

  United States

• Sentry

  Error reports from the apps, set up to carry no personal data

  [FOUNDER: confirm region]

When a gym switches them on: an SMS provider and a WhatsApp Business provider deliver codes and reminders, and the payment provider the gym connects (for example Razorpay) handles online payments. Card and UPI details are entered with the payment provider, not with Rysmic. [FOUNDER: name each provider when it is chosen.]

Some providers process data outside India. [LAWYER: transfers outside India under section 16 of the DPDP Act, and the contract terms required of each provider.]

Your Rysmic account, body metrics, logs and coach plans: for as long as you have the account. When you delete it, they are erased at once.

A gym’s records: for as long as the gym uses Rysmic. A gym’s payment, receipt and invoice records are kept for as long as tax and accounting law requires. When a member deletes their account or a gym erases a member, those financial records are kept without the member’s name or contact details.

Team accounts: while the person is on a gym’s team. Waitlist entries: until launch, then deleted unless you became a customer.

Backups roll off on their own after a short period. [LAWYER: each retention period, including what the law makes a gym keep, what happens to a gym’s data after it stops using Rysmic, and how long backups last.]

Under the DPDP Act you can:

• Get a copy of your data: in the member app, Me → Your data and privacy → Download my data gives you everything Rysmic holds about you as one file.
• Correct or complete it: change your profile in Me, or ask your gym to correct your membership records.
• Erase it: Me → Your data and privacy → Delete my account. Gym owners and team members can write to us.
• Withdraw consent: turn sharing off for a gym, or delete your account. [LAWYER: withdrawal without deleting the account.]
• Nominate someone to act for you if you die or cannot act. [LAWYER: how a nomination is made.]
• Complain: write to us (below). If you are not satisfied with the answer, you can complain to the Data Protection Board of India.

Each download, deletion and change to sharing is recorded. For records a gym keeps about you, we pass your request to the gym, which decides. [LAWYER: response times.]

Rysmic is meant for adults. A member under 18 may use Rysmic only with the verifiable consent of a parent or lawful guardian, and a gym that adds a minor is responsible for getting that consent. We do not track children or show them advertising. [LAWYER: how verifiable parental consent is obtained under section 9 of the DPDP Act and its Rules.]

Everything travels over encrypted connections (HTTPS) and is stored encrypted by our providers. Every gym’s records are walled off from every other gym’s in the database itself, team members reach only what their role allows, and important actions are recorded. Sign-in uses one-time codes or Google — Rysmic keeps no passwords.

If a breach affects your data, we will tell you and the Data Protection Board of India as the law requires. [LAWYER: breach notification wording.]

The apps keep your sign-in, and settings such as the theme, in your browser’s storage so you stay signed in. rysmic.com counts visits with Vercel Analytics, which uses no cookies. We use no advertising or cross-site tracking cookies.

Rysmic’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We ask Google only for your name, email address and profile picture, use them only to sign you in, and never sell them or use them for advertising.

When this policy changes, we update the date and version at the top of this page. If a change affects members, the member app shows the new notice and asks you to agree before you go on.

Questions, requests and complaints: founder@rysmic.com. A person answers.

Grievance Officer: [LAWYER: name, designation and postal address of the Grievance Officer].