Privacy policy

1. Introduction

Trainaq ("Company", "we", "our", "us"), a brand of Mygymdesk Technologies Private Limited (CIN: U62013TS2026PTC213750), is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Trainaq, our coaching platform for fitness coaches, nutritionists and coaching teams and their clients ("Service").

This policy applies to our website (trainaq.com), our mobile applications — Trainaq Coach (for coaches and their teams) and Trainaq (for clients), available on the Apple App Store and Google Play Store — and all related services.

This Privacy Policy is published in compliance with the Information Technology Act, 2000 and the rules thereunder, the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025, and — for individuals in the European Union, European Economic Area, and United Kingdom — the EU/UK General Data Protection Regulation ("GDPR").

Where you provide consent as a lawful basis, that consent is given freely, is specific to the purposes described below, and can be withdrawn at any time (see Section 7). For many processing activities, however, we rely on lawful bases other than consent, as set out in Section 4A.

2. Our Role: Data Fiduciary / Controller and Data Processor

Trainaq serves two distinct roles, using the terminology of both the DPDP Act and the GDPR:

Data Fiduciary (DPDP) / Controller (GDPR): For data we collect directly from coaches, coaching businesses and their team members (account information, billing details, usage data), and for the sign-in account a client creates in the Trainaq app. We determine the purpose and means of processing this data.

Data Processor (DPDP and GDPR): For client data that coaches and their clients record in the Service for coaching (intake and check-in answers, body measurements, progress photos, workout, food and habit logs, health and fitness data, chat messages and media, session bookings, payment records). We process this data strictly on behalf of and on the documented instructions of the coaching business (which is the Data Fiduciary / Controller for its clients' data) and only to provide the Service.

If you are a client coached through Trainaq, please contact your coach regarding your data rights. The coaching business is responsible for establishing a lawful basis (including obtaining consent where required) and for responding to your data requests. We will assist and cooperate with the coaching business to fulfil any such requests. You can also delete your Trainaq account, and the personal data held with it, yourself in the Trainaq app (Section 7).

3. Information We Collect

a) Information You Provide (Coaches & Team Members)

• Account registration information: full name, email address, phone number
• Coaching business information: business name, country, address, time zone
• Payment and billing information (processed by our payment partners — we do not store full card numbers)
• If you collect client payments through Trainaq (Section 5B): the details needed to set up your payout account with our payment partner — for Razorpay Route in India, for example your legal name, PAN, business address and bank account; for Stripe Connect, the onboarding Stripe runs itself. These details are sent to the payment partner. We keep only your account identifier with them, its status, and the last four digits and IFSC of your bank account. If you connect your own Razorpay account, we keep the access tokens Razorpay issues, encrypted, and never show them to any user
• Communications with us via email or in-app chat
• Business address and tax identifier (e.g. GSTIN for Indian customers) collected for invoicing

b) Client Data (Recorded by Clients and Their Coaches)

• Client names, email addresses, phone numbers
• Intake and check-in answers, including goals, lifestyle and any health questions the coach chooses to ask
• Body measurements and fitness progress data (weight, body measurements, lifts and personal records) — this may constitute health-related data / a special category of data under the GDPR
• Progress photos and check-in photos
• Workout, food, water and habit logs, including meal photos used for the AI food photo feature (Section 5A)
• Health and fitness data from Apple Health (iPhone) or Health Connect (Android), only if the client connects it: steps, active energy, heart rate and resting heart rate, sleep, weight and workouts, as daily totals (Section 3A)
• Chat messages and media (photos, voice notes and videos) exchanged with the coach, in group chats and in broadcasts
• Session bookings, packages, payment records, receipts and invoices
• Any other information the coach chooses to record about their clients

c) Information Collected Automatically

• Device and app information (type, version, operating system)
• IP address
• Usage data: screens and pages viewed, features used, actions performed
• Cookies and similar technologies on our website (see Section 9)
• Error logs and performance data (collected via Sentry for debugging and Service improvement)
• Camera, microphone and photo library access (only when you choose to take or upload photos, meal photos, voice notes or videos)
• Push notification device tokens (if you opt in to push notifications), together with your notification settings and time zone

d) Information Collected by App Stores

When you download our apps from the Apple App Store or Google Play Store, those platforms may collect data as described in their respective privacy policies. We do not control and are not responsible for data collected by Apple or Google during app download or installation.

3A. Health and Fitness Data (Apple Health and Health Connect)

• The Trainaq app reads health data only after the client allows it, and only the types listed in Section 3(b), as daily totals. It does not write anything to Apple Health or Health Connect.
• We use this data only to show the client's progress to the client and to their coach, and to fill in the client's step and sleep habits.
• We never use health data for advertising or marketing, never sell it, and never share it with anyone except the sub-processors that run the Service for us (Section 5). It is not sent to any AI provider.
• A client can stop sharing at any time: in the Trainaq app, in iPhone Settings → Health → Data Access & Devices, or in Health Connect's app permissions. Data already synced stays with the client's coaching records until the client deletes their account (Section 7).

4. How We Use Your Information

We use your information for the following specific, limited purposes:

• Service Delivery: To provide, operate, and maintain the Service, including programs and workouts, nutrition and food logging, habits, check-ins, progress, chat, sessions and reports.
• Payment Processing: To process client payments to coaches and coaches' Trainaq plan payments, including recurring charges on a saved payment method where you have authorized them, and to generate invoices and receipts.
• Communication: To send transactional messages (billing, account updates), onboarding guidance, and product announcements via email.
• Push Notifications: To send chat messages, check-in and session reminders, workout updates, payment notices and habit reminders (only if you opt in to push notifications on your device; you choose which ones you receive and your quiet hours).
• Support: To respond to your requests, troubleshoot issues, and provide customer support.
• AI food photo: Where a client uses it, to estimate the foods and portions in a meal photo (Section 5A).
• Improvement: To analyse usage patterns and improve the Service, including with the product analytics described in Section 9 (using aggregated, anonymized data where possible).
• Security & Fraud Prevention: To detect, prevent, and address security issues, fraud, and abuse.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

We do NOT use your data or your clients' data for automated decision-making that produces legal or similarly significant effects. We do NOT use the records held in the Service — such as client names, contact details, logs, photos, payments or health data — for targeted advertising, and we do not give them to advertising partners. The AI food photo feature uses AI to estimate a meal; the client reviews every estimate before it is logged — see Section 5A. We do NOT sell, rent, or trade your personal data to any third party.

4A. Lawful Bases for Processing (GDPR)

Where the GDPR applies, we rely on the following lawful bases (Art. 6) for processing personal data of coaches and their team members:

For client data, the coaching business (as Controller) is responsible for establishing the lawful basis; for health data this is usually the client's explicit consent (Art. 9(2)(a)), which the client also gives in the app before any Apple Health or Health Connect data is read. We process such data only as Processor on the coaching business's instructions.

5. Data Sharing & Third-Party Processors / Sub-Processors

We share your data with the following categories of third-party service providers (sub-processors), strictly to provide the Service.

A current list of sub-processors is available on request. We will give you advance notice of any new sub-processor and a reasonable opportunity to object before that sub-processor begins processing your personal data.

We may also disclose your information: (a) when required by law, court order, or government authority; (b) to protect our rights, property, or safety; (c) in connection with a merger, acquisition, or sale of assets (with prior notice to you).

5A. AI Food Photo

Clients can log a meal by taking a photo of it. When they do, the photo and a fixed instruction are sent to our AI sub-processor, Google LLC (Gemini API, in the United States), which returns the foods it sees and estimated portions. We match those to our food database, and the client checks, edits or removes each item before anything is logged. Very high calorie estimates are flagged for the client to check.

• What is sent: the photo only, resized, with the same instruction for every request. No name, contact details, health data or other client data is sent.
• What we keep: the foods the client logs, and a usage record (which AI model answered, its cost and whether it succeeded) that contains no photo. We do not keep the photo after the estimate is returned.
• Control: a coach can switch the feature off for any client, and each client has a daily limit.
• Google processes the photo to return a response and does not use data submitted through its paid API to train its models. AI output can be wrong: it is an estimate for the client to review, never an automated decision about a person.

5B. Payments Between Clients and Coaches

Client payments for a coach's packages are processed by Razorpay (India) or Stripe (outside India) and settle to the coach: through Razorpay Route or Stripe Connect to the coach's own linked account, or straight to the coach's own Razorpay account if the coach connects one. Trainaq does not hold client funds. Where the coach collects through Trainaq, our platform fee is deducted before the money reaches the coach. Invoices for these payments are issued in the coaching business's name.

6. Data Storage & Security

• Your data is stored on Supabase's cloud infrastructure (primary region: Mumbai, India). We select hosting regions that provide reliable performance for our users.
• We use TLS 1.2+ encryption for all data in transit and encryption at rest.
• Sensitive credentials (such as payment gateway keys and connected-account tokens) are stored in encrypted form. We do not store full payment card numbers; these are tokenized by our payment partners.
• We implement Row-Level Security (RLS) policies in our database to ensure complete data isolation between coaching businesses — no coach can access another coaching business's data, and clients see only their own records.
• Progress photos, check-in photos and chat media are kept in private storage and shown only through short-lived links to the client and the coaches who may see them.
• We use role-based access controls and Supabase Auth for authentication.
• We conduct periodic security reviews of our application and infrastructure.

Despite our best efforts, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we take commercially reasonable measures to protect your data.

7. Your Rights

a) Rights under the DPDP Act, 2023 (Data Principal Rights)

• Right to Access: Request a summary of the personal data we process and the related processing activities.
• Right to Correction: Request correction of inaccurate or incomplete personal data. You can also update most information directly in the app.
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements. If you are a client, you can delete your account yourself in the Trainaq app (More → Delete account). This deletes your personal data: your profile, intake and check-in answers, measurements, progress and check-in photos, workout, food and habit logs, health and fitness data, your messages and media in group chats, and your chats with your coach. Your coach keeps only anonymous totals (for example how many workouts were completed), with nothing that identifies you. Payment and invoice records are kept where tax law requires, with your name removed. If you are a coach or team member, delete your account in Trainaq Coach (More → Delete account) or email support@mygymdesk.com; upon a valid request we delete data within 30 days from active systems and within 90 days from backups. When the owner of a coaching business deletes their account, the business and its running Trainaq plan are cancelled.
• Right to Grievance Redressal: Raise a complaint with our Grievance Officer (Section 14).
• Right to Nominate: Nominate an individual to exercise your rights in the event of death or incapacity, as per the DPDP Act.
• Children: A parent or lawful guardian may exercise these rights on behalf of a child.

b) Additional Rights under the GDPR (EU/UK individuals)

In addition to access, correction, and erasure above, if you are in the EU/EEA/UK you also have:

• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format (CSV/Excel), and have it transmitted to another controller where technically feasible.
• Right to Restriction of Processing: Request that we limit processing in certain circumstances.
• Right to Object: Object to processing based on legitimate interests, and object at any time to processing for direct marketing.
• Rights related to automated decision-making: We do not subject you to decisions based solely on automated processing that produce legal or similarly significant effects.
• Right to Withdraw Consent: Where we rely on consent, withdraw it at any time (as easily as it was given); withdrawal does not affect prior lawful processing. For health data, this includes switching off Apple Health or Health Connect access.
• Right to lodge a complaint with your local supervisory authority (and, in India, with the Data Protection Board of India).

To exercise any of these rights, contact support@mygymdesk.com. We will acknowledge your request within 7 days and complete the action within 30 days (for GDPR requests, within one month, extendable by two further months for complex requests with notice). If you are a client, you may also direct your request to your coach; we will support the coaching business in fulfilling it.

8. Data Breach Notification

In the event of a personal data breach that is likely to cause harm, we will:

• Notify affected coaching businesses without undue delay and within 72 hours of becoming aware of the breach.
• Provide details of the nature of the breach, categories and approximate number of records affected, and steps taken or proposed to mitigate the impact.
• Report the breach to the Data Protection Board of India as required under the DPDP Act, and — where the GDPR applies and the breach meets the threshold — support affected Controllers in notifying the relevant EU/UK supervisory authority within 72 hours.
• Cooperate with affected coaching businesses in notifying their clients where required.

9. Cookies & Tracking Technologies

• Essential: cookies and browser storage for sign-in (on our web billing page), security and your preferences (such as the pricing region you pick). These are always on; disabling them may affect functionality.
• Product analytics: on our homepage and public coach pages, PostHog records pages viewed and actions taken without cookies (nothing is stored in your browser) and without session recordings. In our apps, PostHog records screens viewed and actions taken against an account identifier, never names, emails or phone numbers, and without session recordings. PostHog honours your browser's Do Not Track setting.
• We do not use advertising cookies or advertising pixels on trainaq.com.

You can control cookies through your browser settings.

10. Children's Privacy

Trainaq Coach is a business tool intended for use by coaches and their team members who are at least 18 years of age. The Trainaq app is intended for clients who are at least 18 years of age.

A coach who chooses to coach a minor (under 18) through Trainaq is, as Data Fiduciary / Controller, responsible for ensuring that verifiable parental or guardian consent has been obtained before adding the minor's data to the Service, in compliance with the DPDP Act and, where applicable, the GDPR. Trainaq does not knowingly collect personal data directly from minors. We do not engage in behavioural monitoring or targeted advertising directed at children's data.

11. International Data Transfers

Your data is primarily stored in India (Supabase, Mumbai). Some sub-processors may process data outside India (for example, Cloudflare, Vercel, Stripe, Resend and Sentry infrastructure, PostHog in the EU, Expo, Apple and Google for push notifications, and our AI sub-processor Google in the United States).

• For personal data subject to the GDPR that is transferred outside the EU/EEA/UK (including to India, which does not currently benefit from an EU adequacy decision), we put in place an appropriate transfer mechanism such as the European Commission's Standard Contractual Clauses (SCCs) (and the UK International Data Transfer Addendum), together with supplementary measures where needed. A copy of the relevant safeguards is available on request.
• For personal data subject to the DPDP Act, transfers outside India are made in accordance with the Act and any restrictions notified by the Government of India.

12. Data Retention

• Active account: Retained for as long as your account is active and the Service is being provided.
• Client account deletion: A client's personal data is deleted when they delete their account (Section 7); the coach keeps only anonymous totals.
• After cancellation/termination of a coaching business: Retained for 30 days to allow export, then permanently deleted from active systems.
• Backups: Backup data may be retained for up to 90 days before permanent deletion.
• Legal obligations: Certain data (such as billing and invoicing records) may be retained as required by applicable tax and accounting laws (in India and, for international customers, their local requirements), with a deleted client's name removed.
• Anonymized data: Aggregated, anonymized data that cannot identify any individual may be retained indefinitely for analytical and product-improvement purposes.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes at least 15 days in advance via email and/or a prominent notice within the Service, and may require renewed acceptance on next login. The "Last Updated" date indicates the most recent revision.

14. Grievance Redressal / Data Protection Contact

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the following officer is designated as Grievance Officer / point of contact for data protection:

• Name: Biswanath Sarkar
• Email: biswa@mygymdesk.com
• Address: Mygymdesk Technologies Private Limited, Flat J705, Aparna Sarovar Zicon, Nallagandla, Serilingampally, Hyderabad - 500019, Telangana, India

The Grievance Officer will acknowledge your complaint within 7 (seven) days and resolve it within 30 (thirty) days. If unsatisfied, you may complain to the Data Protection Board of India under the DPDP Act, or (for EU/UK individuals) your local data protection supervisory authority.

EU/UK Representative: If and where required under GDPR Article 27 / UK GDPR, Trainaq will appoint an EU/UK representative and publish their contact details here.

15. Contact Us

For privacy-related questions or to exercise your data rights:

• Email: support@mygymdesk.com
• Grievance Officer: Biswanath Sarkar — biswa@mygymdesk.com
• Address: Mygymdesk Technologies Private Limited, Flat J705, Aparna Sarovar Zicon, Nallagandla, Serilingampally, Hyderabad - 500019, Telangana, India