Privacy Policy

1. Who we are

YourTrainer is owned and operated by Omnifitlife Pvt Ltd, a company registered in Bengaluru, Karnataka, India. In this policy, "YourTrainer", "we", "us", and "our" refer to Omnifitlife Pvt Ltd. "You" means the individual using our mobile app (iOS), website (yourtrainer.in), or coaching services.

We are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") for the personal data we process about you.

2. What we collect, and why

We only collect what we genuinely need to coach you well. Categories below map to real product features — we will not collect any of these for purposes we do not list.

You give us directly

• Identity: name, email, phone number, date of birth, gender.
• Goals & lifestyle: your fitness goal, training history, daily schedule, dietary preferences, allergies.
• Health context: declared medical conditions (PCOS, thyroid, diabetes, hypertension, injuries, post-surgery status). This is special-category data under DPDP and Apple's sensitive-data guidelines and is treated with the strictest controls in section 5 below.
• Body measurements: weight, height, body fat %, chest / waist / hips / arms / thighs in cm, and progress photos you upload.
• Logged content: the meals you log (with calories, macros), the workouts you complete, your mood / stress / sleep check-ins, your habit ticks, and your gratitude / mantra / breathing entries.
• Chats and voice notes: the messages, images, and voice notes you exchange with your assigned coach, nutritionist, or our support team. End-to-end stored on our infrastructure (not E2E-encrypted to a private key — your coach can read them, which is the point).

Health & activity data from Apple Health (only with your explicit permission)

• Step count, active calories.
• Heart rate, resting heart rate, heart rate variability (HRV), respiratory rate.
• Sleep stages and duration.
• Mindful minutes.
• Workout history (sessions you log inside Apple Fitness or other apps).
• Wrist temperature delta (Series 8+ Apple Watch only, when available).

You can revoke any of these at any time from Settings → Privacy & Security → Health → YourTrainer on your iPhone. We never write back to Apple Health without your explicit consent (writes are limited to workouts you complete inside our app so your activity rings stay accurate).

Collected automatically

• Device & diagnostics: device model, OS version, app version, crash logs (via Sentry, see section 7).
• Push token: the Apple Push Notification Service token your device generates so we can send you chat replies and class reminders. Used only to deliver notifications.
• Website analytics: our website uses standard server logs (IP, browser, referrer). No third-party tracking pixels are loaded without your consent.

3. How we use your information

• Match you to a coach and nutritionist, and let them build a plan that fits your goals, schedule, and health context.
• Show your coach what you actually did (workouts logged, meals logged, recovery data) so the plan can adapt week by week.
• Compute your recovery score, leaderboard rank, and progress charts.
• Send you the messages you opted in to: class reminders, plan updates, weekly check-ins.
• Process payments and issue invoices for the programmes you buy.
• Improve the product — fix bugs, profile slow screens, identify which features actually help people transform.
• Comply with legal obligations (income tax, GST, anti-money-laundering, lawful requests from Indian authorities).

We do not sell, rent, or share your personal data with advertisers, data brokers, or analytics platforms that monetise user data. We do not use your health data to target ads.

4. Who we share your data with

We share only what is necessary, only with parties bound by confidentiality and data protection terms:

• Your assigned coach and nutritionist — they read your logs, chats, and health context as part of providing the service.
• Supabase (PostgreSQL hosting): our application database, hosted in the Mumbai (ap-south-1) region. Data stays in India.
• LiveKit: infrastructure that powers our live video coaching calls. Video and audio are routed in real time and not recorded by us unless we tell you at the start of the call.
• Razorpay: payment processing. They see card / UPI details directly — we never store full card numbers.
• Sentry: crash and error reporting. Sentry receives a hashed user id and the technical stack trace so we can fix issues, never your health data or chat content.
• Apple Push Notification Service: delivers push notifications to your device. Apple sees only the encrypted payload and the device token.
• Indian government or courts: only when legally compelled, and only the specific data they require.

5. Special-category health data

Your health data (medical conditions, body measurements, HRV, sleep, mindful minutes, progress photos) is treated as the most sensitive class of data we hold. We:

• Encrypt it at rest (database) and in transit (HTTPS / WSS).
• Restrict access to your assigned coach, your assigned nutritionist, and a small ops team that needs it to make the app work.
• Never sell, license, or share it with insurers, employers, advertisers, or research partners without your specific, written consent.
• Do not train any AI model on your individual health data without your specific, written consent.

6. Where your data is stored

All personal data is stored on Supabase servers in the Mumbai (ap-south-1) region of Amazon Web Services, inside India. We do not transfer your personal data outside India for storage. Sentry processes crash logs in transit; the payload is non-personal stack traces.

7. Your rights under DPDP Act 2023

You have the right to:

• Access the personal data we hold about you and obtain a copy in a portable format.
• Correction of inaccurate or out-of-date data — edit your profile in-app, or email us.
• Erasure (right to be forgotten). Delete your account from Settings → Delete Account in the mobile app — your profile, logs, photos, and chats are removed within 7 days of the request. You can also email us to request the same.
• Withdraw consent for marketing communications or Apple Health access at any time. Withdrawing core data consent will require us to stop providing the service.
• Grievance redressal by contacting our Grievance Officer below. We respond within 7 working days.
• Nominate a person to exercise these rights on your behalf in the event of your death or incapacity.

8. How long we keep your data

• Active accounts: as long as you remain a member.
• Deleted accounts: hard-deleted within 7 days of you tapping Delete Account. Backups roll off within 30 days.
• Payment records: retained for 7 years to comply with Indian income tax and GST law.
• Chats and voice notes: deleted alongside the account.

9. How we protect your data

We use Supabase Row Level Security so that members, trainers, and admins can only read the rows the database explicitly permits them to. All connections use HTTPS / WSS with TLS 1.2 or higher. Sensitive credentials never leave server-side environment variables. No system is 100% secure — if a breach affects your data we will notify you within 72 hours per DPDP Act requirements.

10. Children under 18

YourTrainer is intended for users 16 years and older. If you are under 18 you must have a parent or guardian's consent before signing up. We do not knowingly process data of users under 16.

11. Changes to this policy

We will update this policy when product changes meaningfully affect how we handle your data. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced in-app or via email at least 7 days before they take effect.

12. Contact us

For privacy questions, data requests, or to raise a grievance, contact our Grievance Officer: