Skip to content
FitKliq

Trust

Your data & the DPDP Act.

India’s Digital Personal Data Protection Act applies to any business that handles personal data digitally - which includes every gym with a member list. Here is what it asks of you, in plain language.

Read this as a starting point. It is general information about the law as we understand it, not legal advice about your gym. The Act and its Rules carry commencement dates and penalty figures that change as provisions are brought into force - check the current position, and talk to a lawyer before you rely on any of it.

Why it matters to a gym

A gym holds more sensitive data than most shops

Between the registration form, the payment register and the health questionnaire, a gym ends up holding names, phone numbers, addresses, dates of birth, photographs, payment history, health information and sometimes fingerprints.

Under the Act your gym is the Data Fiduciary - the business responsible for all of it. That responsibility does not move to your software vendor, and with FitKliq it could not, because we never receive the data in the first place.

  • Names, phones, addresses
  • Payment history
  • Health questions
  • Fingerprints

Your checklist

What the Act asks you to do

Eight duties, in the order they tend to come up.

  1. 01

    Tell members what you collect, and why

    A clear notice at registration - in plain language, not buried in a form. Members should know what you keep and what you use it for.

  2. 02

    Get real consent

    Free, specific, informed and unambiguous, with a genuine option to say no to anything that is not necessary. Keep a record of when it was given.

  3. 03

    Collect only what you need

    If a field does not serve a purpose you have told the member about, do not collect it. A gym rarely needs a passport number.

  4. 04

    Get verifiable parental consent for under-18s

    Members under 18 need a verifiable guardian consent, and you must not track them or target advertising at them.

  5. 05

    Keep it secure

    Reasonable security safeguards - passwords, limited staff access, locked computers, and not sharing the spreadsheet with everyone who asks.

  6. 06

    Honour member requests

    Let a member see, correct, complete or erase their data, and give them a way to complain that actually reaches someone.

  7. 07

    Delete what you no longer need

    When a member has long gone and no legal reason to keep their data remains, it should go. Set a retention period and stick to it.

  8. 08

    Report breaches

    If member data is exposed, you must notify the Data Protection Board and the affected members, within the timelines the Rules set.

Penalties are significant. The Act sets out financial penalties in a schedule, with the largest tier attached to failing to take reasonable security safeguards. Treat the figures you may have read as maximums for serious cases rather than a price list, and confirm the current numbers before quoting them to anyone.

How FitKliq helps

  • Your data stays in your own Google account - FitKliq never holds a copy.
  • Medical answers are kept in a separate restricted sheet, not the main member list.
  • Consent is captured and timestamped at registration, with editable consent text.
  • Guardian consent is recorded for members under 18.
  • Export, correct or erase an individual member in a few clicks.
  • A retention setting, so old records do not pile up forever.
  • Staff logins with roles, passwords and an audit log of who changed what.
  • Settings locked to the owner; fingerprint templates never leave the device.

What stays your responsibility

Software gives you tools. How you use them is a decision only you can make.

  • Who you give staff accounts to, and what role each gets.
  • Who your gym’s Google account is shared with, and who holds the password.
  • Physical security of the computers at your desk.
  • Training your staff on what they may and may not do with member data.
  • The consent text you actually show members.
  • Answering member requests and complaints within the timelines.

Quick start

Seven things to do this week

Print this, work down it, and you will be ahead of most gyms in the country.

  1. 1Use a dedicated Google account for the gym, with 2-Step Verification on.
  2. 2Review the consent text in Settings so it describes what you really do.
  3. 3Set a retention period for ex-members.
  4. 4Fill in your grievance contact so members can reach someone.
  5. 5Share the Sheet view-only, and never share the restricted sheet.
  6. 6Give each staff member their own login with the smallest role that works.
  7. 7Deactivate lost or replaced devices the same day.
What access you give usOur privacy policy

This page is general information, not legal advice. If a member of your gym wants to see or delete their records, they should contact you, not us - we do not hold their data. Our grievance officer handles complaints about your own FitKliq account.