Privacy Policy

Last updated 30 October 2026.

MyPR (“we”) is software that gyms use to manage their members, workout programs, diet plans and progress at mypr.fit. This policy explains what personal data we keep, why, for how long, and how to reach us.

Two kinds of data, two roles

Your account (gym owners and trainers who sign in): we decide how this data is used, so we are its Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act).
Your gym’s members: the gym collects this data and decides what to record, so the gym is its Data Fiduciary. We process it only on the gym’s behalf, to run MyPR for that gym, and never use it for anything else. The gym is responsible for telling its members, getting their consent (and a parent’s or guardian’s for anyone under 18), and answering their requests.

What we keep

Account: name, email, phone number, and, if you sign in with Google, your Google account’s name and email. Two-factor settings, stored encrypted.
Gym: name, address, logo, the URL you choose, and billing details (legal name, billing address, state, billing email, GSTIN).
Members (entered by the gym): name, phone, gender, date of birth, height, weight and weight history, goals, membership dates and plan, workout programs and logs, diet plans.
Billing: invoices and payment records (amount, method, reference).
Security records: sign-in sessions, the IP address of requests, and a log of important actions (for example a plan change or a member deleted), to keep accounts safe and resolve disputes.

We don’t sell personal data, show ads, or use analytics or advertising cookies. The only cookie is the one that keeps you signed in; your light or dark theme choice is stored in your own browser.

Why we keep it

To provide MyPR: sign-in, your gym’s pages, and the features you use.
To bill gyms for MyPR and keep the records tax law requires.
To send emails you need: sign-in codes, invitations, invoices and reminders.
To keep the service secure and to investigate misuse.

Who else handles it

We use a few service providers, only for running MyPR:

Cloudflare: hosting, databases and file storage. Our databases are served from Singapore.
Resend: sending email.
Google: only if you choose “Sign in with Google”.

Some of this processing happens outside India, as the DPDP Act allows. We share data with authorities only when Indian law requires it.

How long we keep it

Account and gym data: while the account or gym is active.
Member data: until the gym deletes the member (“Delete permanently” removes the member and their logs) or the gym closes its MyPR account.
After an account or gym is closed, we delete its data within 30 days, except what the law requires us to keep.
Invoices and payment records: 8 years, as Indian tax and accounting law requires.
Security records and the action log: up to 2 years.
Deleted data can remain in backups for up to 30 days before it is gone for good.

Your rights

Under the DPDP Act you can ask to see, correct, update or erase your personal data, and to nominate someone to act for you.

Gym owners and trainers: most details can be changed in Settings. For anything else, or to close your account, email us.
Gym members: please ask your gym first: it controls your data in MyPR and can correct or delete it. If your gym doesn’t respond, email us and we’ll pass your request to the gym and help it act.

We answer requests within 30 days.

Security

Connections are encrypted. Each gym sees only its own data. Admin access needs two-factor authentication, and important actions are logged.

Contact and grievances

For privacy questions, deletion requests or complaints, email mypr.fit@gmail.com. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Changes

If we change this policy in a way that matters, we’ll tell gym owners by email before it takes effect.