Privacy Policy

1Who we are

QuantumOFit is operated by QuantumOFit Technologies Private Limited (CIN U62013GJ2025PTC167969), a company registered in India. Our registered office is at 1210 Pragati IT Park, Build-B, Mota Varachha, Surat, Gujarat 394101, India. In this policy, "QuantumOFit", "we" and "us" mean this company.

You can reach us about anything in this policy at hello@quantumofit.com.

2Gyms, members and us

QuantumOFit is software that gyms, studios and fitness businesses use to run their business. Who is responsible for your data depends on how you use it.

• If you are a member of a gym that uses QuantumOFit, your gym decides what information about you is recorded and why. Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), your gym is the Data Fiduciary for your data, and QuantumOFit processes it on your gym’s behalf as its Data Processor. For most questions about your data, contact your gym first. We will help your gym answer you.
• If you own, manage or work at a gym that signs up for QuantumOFit, or you visit our website or contact us, QuantumOFit is the Data Fiduciary for the account and contact information we collect from you.

3What we collect

Information a gym records about its members

Your gym, its staff, or you through the member app, may record:

• Identity and contact details: name, email address, phone number, date of birth and address.
• Membership records: your plan, start and expiry dates, renewals, and attendance and check-ins.
• Payment records: what was paid, when and by which method, and the invoices and receipts issued. Members pay their gym directly. QuantumOFit records those payments, but we never collect or process a member’s payment and never see a member’s card or bank details.
• Personal training: packages, sessions and schedules.
• Classes, if your gym runs them: your bookings, waitlist places, class passes and class attendance.
• Health and fitness information: body measurements such as weight, height, BMI and body composition, health metrics, injury and medical notes entered by a trainer or by you, and workout programmes and logs.
• Reports of faulty equipment that you file.
• For people who enquire at a gym: the name, contact details and notes of the conversation the gym chooses to record.

Information about gym owners and staff

• Account details: name, email address, phone number, role and login credentials. Passwords are stored only as a secure hash, never in readable form.
• Staff and payroll records the gym enters: salary, commission terms, payslips and a tax deduction percentage. We do not store bank account numbers, PAN or Aadhaar numbers.

Information from the mobile app

• A push notification token and your device platform (Android or iOS), so that notifications reach your phone.
• Your login token, which is kept in your device’s secure storage.

If your gym runs classes on QuantumOFit, the app can use your phone’s camera to scan the check-in QR code at the studio when you arrive for a class. The app asks for camera access only when you open that scanner. You can refuse it, or turn it off later in your phone’s settings, and the rest of the app works without it. The app does not take photos or record video or audio, and nothing from the camera is saved on your phone or sent to us. Only the short check-in code read from the QR code is sent to us, to mark you present for the class.

The mobile app does not access your location, photos, microphone or contacts. It does not collect an advertising ID, shows no ads, and contains no third-party analytics or tracking tools.

Biometric attendance

If your gym connects a fingerprint or face attendance device, QuantumOFit receives attendance events from that device (who checked in and when) and the ID number the device uses for you. Your fingerprint or face data stays on the gym’s device. We do not receive or store it.

Information from our website

• The contact form: your gym’s name, phone number, email address, city and anything else you choose to tell us. The form is delivered to us through Formspree.
• A small counter in your browser’s local storage recording how many times you have sent the form, used only to show an anti-spam question after repeated submissions.
• Aggregated, cookieless statistics about visits and page performance, through Vercel Web Analytics and Speed Insights. These do not use cookies and do not identify you personally.
• Fonts loaded from Google Fonts, which means your browser requests them from Google.

Subscription billing

When a gym pays QuantumOFit for its subscription, the payment is handled by Razorpay. We receive confirmation of the payment. We do not store card or bank details.

4How we use it

• To provide QuantumOFit to the gym that holds the data: memberships, billing records, attendance, personal training, training programmes, payroll records, equipment upkeep and reports.
• To send the messages the service exists for: push notifications such as reminders and announcements, and transactional emails such as receipts, invoices and login details. We do not send SMS or WhatsApp messages.
• To help a gym move its existing records into QuantumOFit.
• To keep the service secure, prevent misuse and fix problems.
• To answer enquiries and support requests.
• To bill gyms for their subscription and to meet our legal, tax and accounting obligations.

We do not sell personal data, we do not use it for advertising, and we do not build profiles about you for anyone else.

5Why we are allowed to process it

For member data, we act on the instructions of your gym, which relies on your consent or another ground permitted by the DPDP Act. For our own account holders and website visitors, we rely on your consent when you sign up or contact us, and on the legitimate uses the DPDP Act permits, such as complying with the law. Where we rely on consent, you can withdraw it at any time, as easily as you gave it. Withdrawing consent does not affect processing that already took place.

6Artificial intelligence

Quantum Leap, our onboarding tool, uses an AI model to understand the layout of a spreadsheet when a gym imports its existing records. Before anything is sent, names, phone numbers and email addresses in the sample rows are masked: every digit becomes 9 and every letter becomes X or x. Only the column headers and a few masked sample rows are sent. When the tool drafts plan names, or asks for help with the few rows it cannot place by itself, it sends no personal details at all. The model is run by a third-party provider, reached through OpenRouter.

When a gym adds a piece of equipment we do not recognise, only the name of that equipment is sent to the same kind of model, to suggest what type of equipment it is.

Kinetics, which drafts training programmes, runs entirely on our own servers using rules and scoring. No personal data leaves our systems for it.

7Who we share it with

We share personal data only with the gym it belongs to, with the service providers below who process it on our instructions, and with authorities where the law requires us to.

• Google Cloud: hosting, including our application servers in the Mumbai region and Firebase Hosting.
• Expo’s push notification service, Firebase Cloud Messaging and the Apple Push Notification service: delivering push notifications.
• Our email delivery provider: sending receipts, invoices and login details.
• Razorpay: payments a gym makes to QuantumOFit for its subscription. Never member payments.
• OpenRouter and the AI model provider it routes to: only the masked samples and equipment names described above.
• Formspree: delivering our website’s contact form.
• Vercel: hosting this website and its cookieless analytics.

Inside a gym, access is based on role: each person sees only what their role needs. A receptionist, for example, does not see payroll.

8Where your data is processed

Our application servers run on Google Cloud in India, in the Mumbai region. Some of the service providers listed above may process data outside India. Any such transfer is made in line with the DPDP Act, which permits transfers except to countries the Government of India restricts.

9How we protect it

• All data travels over encrypted HTTPS connections.
• Role-based access limits what each person at a gym can see or change.
• Passwords are stored only as secure hashes, and login tokens on phones are kept in the device’s secure storage.
• Access to our production systems is limited to the people who need it to run the service.

No system is perfectly secure. If a personal data breach affects you, we will inform you, your gym where relevant, and the Data Protection Board of India, as the DPDP Act requires.

10How long we keep it

• Gym and member data: for as long as the gym uses QuantumOFit. When a gym closes its account, or asks us to delete data, we delete it, except records the law requires to be kept.
• Invoices, receipts, payment records and payroll records: for as long as Indian tax and accounting law requires, generally up to eight years, and then deleted.
• Website enquiries: for as long as we need to respond and follow up, and then deleted.
• Deleted data can remain in routine backups for a limited period, until those backups are overwritten.

11Your rights

Under the DPDP Act you have the right to:

• Get a summary of the personal data held about you and how it is processed.
• Have inaccurate or incomplete data corrected, completed or updated.
• Have your data erased when it is no longer needed, unless the law requires it to be kept.
• Withdraw your consent.
• Nominate someone to exercise these rights for you in the event of your death or incapacity.
• Have your complaints heard by our Grievance Officer.

If you are a gym member, please ask your gym first. You can also email us at hello@quantumofit.com and we will pass your request to your gym and help them respond. To delete your account, follow the steps on our account deletion page at www.quantumofit.com/delete-account.

12Children

QuantumOFit is not meant for children to sign up on their own. Where a gym registers a member under 18, the gym must obtain verifiable consent from the child’s parent or guardian before recording their data, as the DPDP Act requires. We do not use children’s data for tracking, behavioural monitoring or targeted advertising.

13Grievance Officer

If you have a question or complaint about how your personal data is handled, contact our Grievance Officer:

• Grievance Officer, QuantumOFit Technologies Private Limited
• Email: hello@quantumofit.com
• Address: 1210 Pragati IT Park, Build-B, Mota Varachha, Surat, Gujarat 394101, India

We acknowledge every complaint within 72 hours and aim to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

14Changes to this policy

If we change this policy, we will publish the new version here with a new effective date. If a change significantly affects how we use your data, we will also tell you by email or in the app before it takes effect.