1. Introduction and Scope
1.1 This Privacy Policy (“Policy”) describes how Nutrimate Wellness Pvt. Ltd., a company incorporated under the Companies Act, 2013 (“Nutrimate”, “Company”, “we”, “us”, or “our”), being the operator of the FitVia platform (“FitVia” or the “Platform”), collects, receives, stores, processes, uses, discloses, transfers, retains, and otherwise deals with information relating to you when you access or use the Platform.
1.2 The Platform comprises the FitVia mobile application (on Android and iOS), any web-based application or dashboard, application programming interfaces, and all associated features, content, and services made available under the FitVia brand, whether white-labelled under the name or branding of an Establishment or otherwise.
1.3 This Policy is published in accordance with, and should be read together with, the applicable provisions of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and other applicable laws of India, each as amended from time to time.
1.4 This Policy forms an integral part of, and is incorporated by reference into, the Terms of Use set out in Part B. By accessing or using the Platform, you confirm that you have read, understood, and consented to this Policy. If you do not agree with this Policy, you must not access or use the Platform.
2. Definitions
2.1 “Establishment” means the gym, fitness centre, hospital, corporate, wellness organisation, or individual trainer that has subscribed to FitVia and that provides you access to the Platform as its member, client, employee, or associate.
2.2 “Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.
2.3 “Sensitive Personal Data” means personal information relating to health, physical condition, medical records and history, biometric information, and such other categories as prescribed under the SPDI Rules and applicable law.
2.4 “Data Fiduciary”, “Data Processor”, and “Data Principal” have the meanings assigned to them under the DPDP Act. You, as an individual user, are a Data Principal.
2.5 “Process” or “Processing” means any operation performed on Personal Data, including collection, recording, organisation, storage, use, disclosure, or erasure.
2.6 “User”, “you”, “your” means any natural person who accesses or uses the Platform, including a member, trainer, or administrator.
3. Roles and Responsibilities of the Parties
3.1 FitVia is a business-to-business platform. The allocation of data-protection responsibility depends on the type of data and the purpose of processing, as set out below.
3.2 Establishment as Data Fiduciary. In respect of member, membership, and fitness data collected and used to deliver the Establishment’s services to you, the Establishment determines the purpose and means of processing and therefore acts as the Data Fiduciary. The Establishment is responsible for obtaining any consent required from you and for its own use of your data.
3.3 Nutrimate as Data Processor. In respect of the data described in clause 3.2, Nutrimate processes such data on behalf of and under the instructions of the Establishment, and acts as a Data Processor.
3.4 Nutrimate as Data Fiduciary. In respect of data that Nutrimate independently determines the purpose and means of processing – including platform administration, security, fraud prevention, product analytics, service improvement, and legal compliance – Nutrimate acts as a Data Fiduciary.
3.5 Where you have questions about how your Establishment uses your data, you should contact the Establishment directly. For questions about platform-level processing by Nutrimate, you may contact the Grievance Officer named in clause 18.
4. Categories of Information We Collect
4.1 Identity and contact data: name, mobile number, email address, gender, date of birth, profile photograph, and emergency contact (where provided).
4.2 Physical and fitness data: height, weight, age, body measurements, fitness goals, activity levels, and progress metrics.
4.3 Health and wellness inputs: meals and nutrition logs, calorie intake, water intake, steps, workouts performed, supplement intake, and health scores derived from such inputs. Some of this may constitute Sensitive Personal Data.
4.4 Membership and programme data: your Establishment, assigned trainer, workout plans, nutrition plans, supplement recommendations, attendance, and related notes.
4.5 Device and technical data: device model, operating system and version, unique device and installation identifiers, application version, language and time-zone settings, mobile network information, and diagnostic, crash, and performance data.
4.6 Usage and behavioural data: features accessed, screens viewed, actions and events performed, session frequency and duration, in-app navigation, and interaction patterns.
4.7 Location data: approximate location inferred from IP address; and precise geolocation only where you expressly grant device-level permission, which you may withdraw at any time through your device settings.
4.8 Transaction data: where you purchase any paid feature or optional service, limited transaction records; full payment-instrument details are handled by third-party payment processors and are not stored by us.
4.9 Communications: messages, support requests, feedback, and correspondence you send to us or to your Establishment through the Platform.
5. Sources of Collection
5.1 Directly from you, when you register, complete your profile, log activity, communicate with us, or otherwise use the Platform.
5.2 Automatically, through the Platform and integrated software development kits and analytics tools, when you interact with the Platform (see clause 7).
5.3 From your Establishment and assigned trainers, who may enter or update plans, notes, and progress on your behalf.
5.4 From third-party service providers you choose to engage through the Platform, such as diagnostic partners for lab tests and payment processors, to the limited extent needed to provide those services.
6. Purposes and Legal Bases for Processing
6.1 We process your information for the following purposes:
(a) to create, operate, and maintain your account and the Platform;
(b) to enable your Establishment and trainers to assign, deliver, and monitor workout, nutrition, and supplement plans;
(c) to calculate health scores, streaks, progress, analytics, and personalised insights;
(d) to facilitate optional services you elect to use, such as lab-test bookings and supplement tracking;
(e) to operate, measure, debug, secure, and improve the Platform, including through analytics (see clause 7);
(f) to communicate service messages, reminders, notifications, and support responses;
(g) to detect, prevent, and address fraud, abuse, security incidents, and technical issues;
(h) to comply with applicable legal, regulatory, tax, and record-keeping obligations, and to establish, exercise, or defend legal claims.
6.2 We process Personal Data on one or more of the following legal bases, as applicable: your consent; the performance of a contract or service requested by you or your Establishment; compliance with a legal obligation; and our legitimate interests in operating and securing the Platform, provided such interests are not overridden by your rights.
6.3 Where processing is based on your consent, you may withdraw that consent at any time in accordance with clause 11, without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent necessary for core functionality may limit or prevent your use of the Platform.
7. Analytics, Cookies, and Tracking Technologies
7.1 We use first-party and third-party analytics, product-measurement, attribution, and crash-reporting tools and software development kits (including tools of the type provided by Mixpanel and similar event-analytics and diagnostics providers) to understand how the Platform is used and to improve its features, reliability, and performance.
7.2 These tools may collect and process: (a) events and actions taken within the Platform; (b) device, installation, and session identifiers; (c) application version and technical performance data; and (d) aggregated or pseudonymised behavioural data.
7.3 We configure such tools to collect only what is reasonably necessary for product analytics, security, and reliability. Each such provider processes data under its own terms and under data-processing arrangements with us that require appropriate confidentiality and security.
7.4 The Platform and its web components may use cookies, local storage, and similar identifiers to keep you signed in, remember preferences, and measure usage. Where required by law, we will seek your consent for non-essential tracking, and you may manage certain preferences through your device or browser settings.
7.5 We do not sell your Personal Data, and we do not use your health or fitness data for third-party advertising.
8. Sensitive Personal Data and Health Information
8.1 Certain information you provide – including fitness metrics, body measurements, and health-related logs – may constitute Sensitive Personal Data. We collect and process such data only with your consent or as otherwise permitted by law, and only to deliver the fitness and wellness features of the Platform.
8.2 We apply enhanced safeguards to Sensitive Personal Data, including access restrictions and encryption, as described in clause 12.
| NOT MEDICAL ADVICE |
| FitVia is a fitness and wellness tool. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Health scores, plans, and insights are for general fitness guidance only and must not be relied upon as a substitute for professional medical, dietary, or clinical advice. Always consult a qualified healthcare professional before making any health, dietary, exercise, supplement, or medical decision. |
9. Disclosure and Sharing of Information
9.1 We do not sell your Personal Data. We share information only as set out below, and always subject to appropriate safeguards.
9.2 With your Establishment and trainers, so they can provide, assign, and monitor services and plans for you.
9.3 With service providers and processors who support our operations – including cloud hosting, analytics, crash reporting, communications, and payment processing – under binding confidentiality and data-processing terms and only for the purposes we specify.
9.4 With optional-service partners (such as diagnostic and supplement partners) only when you choose to use those services, and only to the extent necessary to fulfil them.
9.5 For legal and safety reasons, where disclosure is required by law, regulation, court order, or governmental or regulatory request, or where reasonably necessary to protect the rights, property, or safety of any person, or to prevent fraud, security incidents, or harm.
9.6 In connection with a corporate transaction, such as a merger, acquisition, restructuring, financing, or sale of assets, in which case the recipient will be bound by terms no less protective than this Policy.
9.7 Every recipient of Personal Data from us is required to maintain confidentiality and security and to use the data only for the disclosed purpose.
10. Data Retention
10.1 We retain your Personal Data for as long as your account remains active and for as long as necessary to provide the Platform and the services requested by you and your Establishment.
10.2 We retain certain information after account deactivation, closure, or a deletion request only where, and for so long as, it is necessary to:
(a) comply with legal, statutory, tax, accounting, and regulatory obligations;
(b) maintain business, membership, and transaction records of the Establishment;
(c) establish, exercise, or defend legal claims and resolve disputes;
(d) enforce our agreements and protect against fraud, abuse, and security risks;
(e) retain security, audit, and access logs for a reasonable period.
10.3 When retention is no longer required for the purposes above, we will delete, anonymise, or irreversibly aggregate the relevant information. Anonymised or aggregated data that no longer identifies you may be retained and used indefinitely for analytics and service improvement.
11. Your Rights as a Data Principal
11.1 Subject to applicable law and reasonable verification of your identity, you may exercise the following rights:
(a) the right to access a summary of the Personal Data we process about you and the processing activities undertaken;
(b) the right to correction, completion, and updating of inaccurate or incomplete Personal Data;
(c) the right to erasure of your Personal Data, subject to clauses 10 and 13 and to our lawful retention obligations;
(d) the right to withdraw consent for processing based on consent, including certain optional analytics or integrations, with effect for the future;
(e) the right of grievance redressal through our Grievance Officer;
(f) the right to nominate another individual to exercise your rights in the event of your death or incapacity, as provided under the DPDP Act.
11.2 To exercise any right, contact the Grievance Officer named in clause 18. We will respond within the timelines required by applicable law. We may decline or limit a request where permitted or required by law, and will inform you of the reason.
11.3 If you are dissatisfied with our response, you may escalate your grievance to the Data Protection Board of India or other competent authority, as applicable.
12. Account Deactivation and Deletion
12.1 FitVia accounts are provisioned, administered, and controlled within the account environment of your Establishment. Accordingly, the Platform does not offer a member-initiated, self-service option to independently and immediately delete an account or its associated data from within the application.
12.2 This design reflects the business-to-business nature of the Platform, the Establishment’s role as record-keeper and Data Fiduciary, and legal and contractual record-retention requirements. It is not a denial of your statutory rights.
12.3 You may request deactivation, closure, or deletion of your account and Personal Data by either:
(a) submitting a request to your Establishment, which administers your membership and account; or
(b) submitting a request to our Grievance Officer using the details in clause 18.
12.4 Upon receiving a valid and verified request, we will, within the timelines required by applicable law: (a) disable your access to the Platform; and (b) delete or anonymise your Personal Data, except for information we are required or permitted to retain under clause 10 and applicable law. We will confirm to you the action taken.
| NOTE ON DELETION AND YOUR RIGHTS |
| The absence of a one-tap, self-service deletion button does not remove or diminish your rights under the Digital Personal Data Protection Act, 2023 or other applicable law. It means that deletion is handled through a verified request process, and that specific categories of data are lawfully retained for the limited purposes set out in clause 10 (for example, tax, legal, dispute-resolution, and security purposes). This is a lawful and common practice for business-to-business platforms that maintain records on behalf of an organisation. |
13. Data Security
13.1 We implement and maintain reasonable security practices and procedures proportionate to the nature of the data, including encryption of data in transit, access controls, authentication, network protections, and secure cloud hosting, consistent with the SPDI Rules and the DPDP Act.
13.2 Despite our measures, no method of electronic transmission or storage is fully secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials and for all activity under your account.
13.3 In the event of a Personal Data breach that is likely to affect you, we will notify the affected persons and the competent authority in the manner and within the timelines required by applicable law.
14. Children and Minors
14.1 The Platform is intended for individuals aged 18 years and above. Where an Establishment enrols a person below 18 years of age, the Establishment must first obtain verifiable consent from the parent or lawful guardian in accordance with the DPDP Act and remains responsible for that consent.
14.2 We do not knowingly collect Personal Data of a child without such verifiable parental consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If we become aware that a child’s data has been collected without required consent, we will take reasonable steps to delete it.
15. Data Storage and Cross-Border Transfers
15.1 Your information is stored on secure servers operated by us or by our cloud and service providers, which may be located in India or in other jurisdictions.
15.2 Where Personal Data is transferred outside India, such transfer is undertaken only to jurisdictions and recipients permitted under applicable law, and subject to safeguards designed to ensure a comparable level of protection consistent with this Policy and the DPDP Act.
16. Third-Party Links and Services
16.1 The Platform may contain links to, or integrations with, third-party websites, applications, or services that are not operated by us. This Policy does not apply to those third parties. We are not responsible for their content or privacy practices, and we encourage you to review their policies before using them.
17. Changes to This Policy
17.1 We may amend this Policy from time to time to reflect changes in law, technology, or our practices. We will publish the updated Policy on the Platform and update the “Last Updated” date. Where changes are material, we will provide additional notice through the Platform or other reasonable means.
17.2 Your continued use of the Platform after the effective date of any change constitutes your acceptance of the amended Policy.
18. Grievance Redressal and Contact
18.1 In accordance with the DPDP Act, the Information Technology Act, 2000, and the rules thereunder, you may contact our Grievance Officer for any privacy concern, complaint, or to exercise your rights. We will acknowledge and address grievances within the timelines prescribed by law.
| Grievance Officer Nutrimate Wellness Pvt. Ltd. Email: admin@nutrimate.in Postal address: Om Sai Bunglow, Vaijapur Road, Zilla Parishad Primary School, Kopargaon R, Singnapur Kopargaon, Ahilyanagar, Maharashtra, India Response time: within the period prescribed under applicable law |