Privacy Policy

CPV FitLab ("CPV FitLab", "we", "us", "our") provides online personal fitness coaching, including customised workout and diet plans, progress tracking, and related coaching services, through our website and our client tracker application (together, the "Services"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it, in accordance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

CPV FitLab is the trade name under which CP Sharma operates as an individual proprietor; it is not a separately registered company. CP Sharma, as the individual proprietor, is the Data Fiduciary responsible for your personal data under the DPDP Act.

By using our Services, you agree to the collection and use of information as described in this Policy.

1. Information We Collect

We collect the following categories of personal data, only where relevant to providing you coaching services:

• Identity and contact information: name, email address, phone number.
• Health and fitness information: age, gender, height, weight, body measurements, medical conditions or injuries you disclose, dietary preferences, fitness goals, and workout and nutrition adherence data logged through the tracker.
• Progress photographs: photos you voluntarily upload to track physical progress over time.
• Communications: messages exchanged with your coach through the tracker or WhatsApp, including voice notes where used.
• Payment-related information: plan and payment status necessary to activate your coaching account. We do not collect or store your card, UPI, or bank details ourselves; payments are handled through third-party payment channels.
• Usage information: basic technical data such as login activity, needed to keep your account secure (for example, to enforce single-device login). We also use a third-party analytics and error-monitoring tool (PostHog) to see which features are used and to catch technical bugs in the tracker app; this only receives your account ID and role, never your name, email, phone number, or health data.

2. How We Use Your Information

• To create and manage your coaching account and deliver personalised workout and diet plans.
• To track your progress and let your coach review and adjust your plan.
• To communicate with you about your plan, check-ins, and account.
• To send service-related WhatsApp or email messages, such as reminders and check-in nudges.
• To improve our coaching methods and Services, using anonymised or aggregated data wherever possible.
• To comply with legal obligations.

We do not sell your personal data to third parties, and we do not use your individual health data for advertising.

Corporate clients: if you are enrolled through your employer's Corporate Wellness engagement with CPV FitLab, your employer does not automatically receive your individual health information, progress data, photos, or coaching communications. We only share such data with your employer if you separately and explicitly consent to that specific sharing, or where required by law. Your employer may receive non-identifying, aggregated program participation data (such as overall attendance or completion rates across the group) as agreed in the Corporate Wellness engagement terms.

3. Progress Photos

Progress photos are visible only to you and your coach within the tracker application, and are never shared publicly without your separate, explicit written consent (for example, if you agree to be featured as a client transformation story).

4. How We Store and Protect Your Information

Your data is stored using Google Firebase (Firestore and Firebase Authentication) and Cloudinary (for photos and media), both of which apply industry-standard security practices. Access to your data within CPV FitLab is limited to your coach and the systems needed to run the Services. We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse, though no method of transmission or storage over the internet is completely secure.

5. Legal Basis and Consent

We process your personal data on the basis of the consent you provide when you create your coaching account. When you sign up, you are asked to explicitly agree to this Privacy Policy and our Terms of Service, and a record of that consent (the date, time, and policy version you agreed to) is kept on your account. A confirmation of your consent is also sent to the email address you signed up with, so that you retain your own independent record of it.

6. Your Rights

Under the DPDP Act, you have the right to access the personal data we hold about you, the right to request its erasure, and the right to withdraw your consent to its processing. You may exercise these rights at any time by contacting us using the details in Section 9 below.

To request deletion of your account and data, you can raise a request directly from your Profile in the tracker app, or contact your coach through WhatsApp. Once a deletion request is verified, we will send you a copy of your stored data (including your progress photos, consent record, and progress history) and then permanently delete your identifiable personal data, including from our photo storage provider. We may retain a limited, anonymised summary of your program outcomes (with no name, contact details, or photos) for internal analysis of our coaching methods; this anonymised data can no longer be linked back to you.

You may also withdraw your consent at any time without requesting full account deletion. However, because delivering personalised coaching depends on the health, fitness, and progress data described in Section 1, withdrawing consent to that processing means we can no longer provide the Services to you, and will have the same practical effect as ending your coaching account. Withdrawal does not affect the lawfulness of anything we did with your data before you withdrew.

We aim to acknowledge and respond to any rights request within 30 days.

7. Data Retention

We retain your personal data for as long as your coaching account is active, and for a reasonable period afterwards for legitimate business and legal purposes (such as payment records), unless you request earlier deletion under Section 6. If you stop being an active client without formally requesting deletion, we retain your account data, progress history, and photos for up to 24 months from your last activity, after which we will delete or anonymise it; you can request earlier deletion at any time under Section 6.

8. Children's Privacy

Our Services are not directed at, and are not intended for use by, individuals under the age of 18. We do not knowingly collect personal data from minors.

9. Grievance Officer and Contact

For any questions about this Privacy Policy, or to exercise your data rights, please contact:

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be reflected by updating the "Last updated" date above, and where appropriate, by notifying active clients directly.