Privacy Policy

1. Who We Are

DB Fitness (“DBFitness”, “we”, “us”) runs the DBFitness app and dbfitness.app. We decide how and why your personal data is processed, which makes us the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the controller under the EU and UK General Data Protection Regulation (“GDPR”). Trainers on DBFitness are independent; for the coaching they provide to you, they are responsible for how they use what you share with them. Contact us at support@dbfitness.app.

2. Information We Collect

We collect only what we need to run the DBFitness app and website:

• Account and contact details: name, email, and an optional phone number. Your password is stored only as a salted hash; if you sign in with Google we store your Google account identifier.
• Health and fitness profile: age, gender, height, weight and weigh-in history, BMI, body fat, resting heart rate, blood pressure, medical conditions, injuries and fitness goals, as you choose to enter them.
• Daily health readings: steps, sleep, heart rate, heart rate variability, blood oxygen and blood pressure, imported from Health Connect or entered by you. Your Readiness score and muscle recovery map are calculated from these and your workouts.
• Activity and nutrition logs: workouts and sets, outdoor activities (steps, duration, distance, pace, calories), food diary, water, supplement intake, fasting windows, routines and diet charts.
• Outdoor routes: when you record a walk, run, ride or hike, the GPS route, distance, speed, pace, elevation gain and splits. Roughly the first and last 200 metres are removed before the route is saved, so it does not reveal where you start or finish (for example, your home).
• Voice food logs: what you say is turned into text by your phone's speech recognition service; we receive only the text, not the audio.
• Messages: messages you exchange with your trainer or client.
• Photos: profile and trainer photos, post-workout photos, and meal photos you scan for nutrition.
• Location for gym search: your device's precise location, only at the moment you search for nearby gyms. We do not store it. Gyms you mark as favourites are saved to your account.
• Trainer interactions: trainer subscriptions, session bookings and their meeting links, assigned plans, and ratings or reviews you write.
• Payments: processed by Razorpay (and, for earlier payments, Stripe). To take a payment we share your name, email and, if you added one, your phone number with them. We receive the payment status, what it was for (app membership, trainer plan or trainer session), the amount and subscription details (start, renewal and cancellation dates, and the autopay mandate status); we never see or store your card, UPI or bank details.
• Device and diagnostics: a push notification token for your device, the app version, your device time zone, bug reports and suggestions you send, and technical error reports that help us fix crashes.

Health data is sensitive. Under the GDPR it is “special category” data, and we process it only with your explicit consent, which you give when you enter it or allow a health permission.

3. App Permissions

Every permission is optional and requested only when you use the feature that needs it. You can turn any of them off in your phone's settings; only that feature stops working.

• Location (while using the app)

  Finds gyms near you, and records the route of a walk, run, ride or hike you start. Gym searches send your location to Google and are not stored by us. During a route recording, a notification shows while location is in use (including with the screen off); recording stops when you finish or discard the session. We never track your location in the background otherwise.

• Physical activity / Motion

  Counts your steps for the daily step total and for outdoor sessions.

• Health Connect (Android, read only)

  Imports steps, sleep, heart rate, resting heart rate, heart rate variability, blood oxygen and blood pressure when you choose to fetch them, to show your daily health summary and Readiness score.

• Microphone and speech recognition

  Lets you log food by voice. Only active while you hold the voice-log screen open.

• Camera

  Scans meals and barcodes for nutrition, and takes post-workout photos you choose to share.

• Photos

  Lets you pick an existing photo for food scanning, your profile or a post.

• Notifications

  Meal and supplement reminders, new messages from your trainer or client, and subscription renewal alerts.

Health Connect: DBFitness only reads data from Health Connect and never writes to it. Our use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements. We do not use it for advertising and do not sell it.

Offline use: if you log something without an internet connection, it is kept on your phone and uploaded automatically when you are back online.

4. How We Use Your Data and Why

• Running the app: logging workouts, food and outdoor sessions, showing your progress, delivering messages and notifications, and booking and joining trainer sessions.
• Personalisation: calculating calorie and water targets, your Readiness score and muscle recovery from your profile, readings and workouts, and pre-filling workouts from your history.
• Trainer coaching: if you subscribe to a trainer, they see the information they need to coach you (see section 6).
• Payments: managing your subscription, renewals and cancellations.
• Security: protecting your account, for example by pausing sign-in after repeated wrong passwords.
• Service improvement: fixing bugs and improving features using the feedback and error reports you send.

Legal basis

• DPDP Act: we process your personal data on the basis of the consent you give when you create an account and accept this policy, and when you turn on a feature or permission. We use it only for the purposes listed above. Where the law allows, we may also process data for certain legitimate uses, such as complying with a legal obligation.
• GDPR: contract (to provide the app and any subscription you buy); explicit consent (health data, location routes, voice logs and optional permissions); legitimate interests (security, fraud prevention and fixing bugs); and legal obligation (tax and accounting records).

We do not sell your data, show you third-party ads, or make decisions about you based solely on automated processing that have legal or similarly significant effects. Readiness scores and AI answers are guidance only.

5. AI Features

Some features use AI models provided through Microsoft's Azure OpenAI Service:

• AI Coach chat: to answer you, your question is sent together with your goal, recent food diary, workouts, routines and active diet chart.
• Your trainer's AI Coach: if you subscribe to a trainer, they can ask the AI Coach about you. It then uses the same summary of your goal, food diary, workouts, routines and diet chart to answer them, never your medical details.
• Food scanning, voice logging and custom recipes: the meal photo, the text of your voice log or the recipe you submit is sent to estimate its nutrition.

This data is processed only to generate your answer. We do not use your personal data to train AI models, and our AI provider does not use it to train its models. AI answers are general guidance, not medical advice.

6. Sharing and Disclosure

We do not sell your personal data. We share it only as follows:

• Your trainer: when you subscribe to a trainer's plan, they see your name, goal, progress summary, recent workouts, session bookings, the plans they assign you, and the messages you send them. Your email, phone number, medical details, health readings and outdoor routes are not shown to trainers or other users.
• Other users: posts and photos you share to the community feed, with your name and profile photo, are visible to other DBFitness users. If you take part in the leaderboard, your name and weekly points are shown; you can opt out in your settings.
• Service providers that process data on our behalf, under contract and only on our instructions:
  • Microsoft Azure: hosting, database, file storage, AI processing and email.
  • Razorpay (India): payments, monthly autopay subscriptions and refunds.
  • Stripe: earlier payments and subscriptions.
  • Google: Google Sign-In (if you use it), Google Places (receives your location when you search for gyms), Google Maps on Android (shows your saved route on a map), and Firebase Cloud Messaging (delivers notifications on Android).
  • Apple: Apple Maps and Apple Push Notification service on iPhone.
  • Expo (650 Industries): app updates and sending push notifications, including a short message preview.
  • Your phone's speech recognition service (Google on Android, Apple on iPhone): turns your voice log into text.
• Apps you open from DBFitness: getting directions or opening a route in Google Maps, and joining a video session through the meeting link your trainer added (Google Meet, Zoom or Microsoft Teams). Those services' own privacy policies apply once you use them.
• Affiliate links: when you tap a supplement link, the retailer may place a cookie to track the referral for commission purposes.
• Legal compliance: we may disclose information if required by law or to protect the safety of our users.

7. Where Your Data Is Stored

Our database and file storage are hosted by Microsoft Azure in India (Central India region). Some service providers listed above (such as Stripe, Google, Apple and Expo; Razorpay processes data in India) may process data in other countries, including the United States. Under the DPDP Act, we transfer data only to countries not restricted by the Government of India. For users in the EU, EEA and UK, transfers outside those regions are protected by the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful transfer mechanism offered by the provider.

8. Data Security

• All data is encrypted in transit (HTTPS) and encrypted at rest in our cloud database and storage.
• Passwords are stored as salted hashes, must meet strong-password rules, and sign-in is paused for 15 minutes after 5 wrong attempts.
• Access is limited by account: you see your own data, trainers see only their own clients, and outdoor routes, health readings, weigh-ins and messages are visible only to you (and, for messages, the other person in the conversation).
• If a personal data breach affects you, we will inform you and the Data Protection Board of India, and, where the GDPR applies, the relevant supervisory authority, as the law requires.

9. Data Retention

• Account and profile: including weigh-in history, kept while your account is active.
• Short-lived logs: workouts, outdoor activities and their routes, feed posts with their likes and comments, and food diary entries with daily health readings are automatically deleted 30 days after they were last changed.
• Messages: kept until you delete your account, so you and your trainer can refer back to them.
• Plans and saved items: routines, diet charts, supplement plans and favourite gyms are kept until you delete them or your account.
• Gym-search location and voice audio: not retained by us.
• Push tokens: removed when you sign out or delete your account, or when your device stops accepting notifications.
• Backups: kept for up to 7 days, after which deleted data no longer exists in them.

10. Your Rights

Under the DPDP Act (India), you have the right to:

• Get a summary of the personal data we process about you, how we process it, and who we share it with.
• Correct, complete or update your data. Most of it you can edit yourself in Profile.
• Have your data erased — see Deleting Your Account.
• Withdraw your consent at any time, as easily as you gave it — for example by turning off a permission or deleting your account. Withdrawal does not affect processing already done, and may limit the related feature.
• Nominate another person to exercise your rights if you die or become incapable of doing so.
• Have your grievance addressed by us (see section 13).

Under the GDPR (EU, EEA and UK), you also have the right to:

• Access a copy of your personal data.
• Rectify inaccurate data and erase your data (“right to be forgotten”).
• Restrict processing, or object to processing based on our legitimate interests.
• Data portability: receive the data you gave us in a commonly used, machine-readable format.
• Withdraw consent at any time, without affecting earlier lawful processing.
• Lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, email support@dbfitness.app from your account's email address. We may ask you to confirm your identity, and we respond within 30 days. Exercising your rights is free.

11. Children

DBFitness is meant for adults. Under the DPDP Act, anyone under 18 is a child, and we process a child's data only with verifiable consent from a parent or lawful guardian, as set out in our Terms of Use. We do not track children's behaviour or target advertising at them. If you believe a child has given us data without that consent, contact us and we will delete it.

12. Deleting Your Account

You can delete your account and associated data at any time:

• In the app: Profile → Delete account. Deletion is immediate.
• On the website: sign in and use the Delete Account page. Deletion is immediate.
• Without signing in: submit a request on the Delete Account page or email support@dbfitness.app. We may contact you to confirm the request, and complete it within 30 days.

Deletion removes your profile (including your phone number and weigh-in history), health and fitness data, activity and food logs, outdoor routes, messages, posts, routines, diet charts, supplement plans, favourite gyms, trainer connections and session bookings, push tokens and uploaded photos, and cancels any active subscription. Payment records (amount, purpose, date and status) are retained by us and by our payment processors, Razorpay and Stripe, as required by tax and accounting law; app feedback you sent is kept without your name or email. The Delete Account page lists exactly what is deleted and what is kept.

13. Grievances and Complaints

For any question, request or complaint about your personal data, contact our Grievance Officer at support@dbfitness.app with the subject “Privacy”. We acknowledge grievances promptly and resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process. If you are in the EU, EEA or UK, you may also complain to your local data protection supervisory authority at any time.

14. Changes to This Policy

We will update this page when our practices change and revise the “Last Updated” date above. For significant changes, we will let you know in the app or by email and, where required, ask for your consent again.

15. Governing Law

These terms and policies are governed by the laws of India. Any disputes shall be subject to the exclusive jurisdiction of the courts in Kolkata, West Bengal. This does not take away any rights you have under the data protection laws of the country where you live.