HyRep.fit is an app and website for personal trainers in India and the people they train. This policy says what personal data we hold, why, who sees it, how long we keep it and how you can have it corrected or deleted.
“HyRep.fit”, “we” and “us” mean the HyRep.fit service and its operator. HyRep.fit is operated from India. You can reach us through the channels under Contact and grievances. Our only web addresses are hyrep.fit, api.hyrep.fit and admin.hyrep.fit.
In brief
- We keep what is needed to run HyRep.fit: your mobile number and name, and the packs, sessions, payments, workouts and bodyweight recorded in it.
- We never sell personal data. We use no advertising, analytics or tracking service.
- A trainer adds a client and chooses whether that client gets WhatsApp updates. Reply STOP and they stop at once.
- Clients pay trainers directly by UPI. We never hold money and never see a card, bank account or UPI PIN.
- Our servers are in Singapore, so your data is processed outside India.
- You can delete your account in the app at any time, or ask us to do it.
- To see, correct or remove your data, write to us. We acknowledge within 48 hours and resolve within one month.
On this page
Who this covers
- Trainers who run their clients on HyRep.fit.
- Clients a trainer has added, whether or not you have signed in yourself.
- Members who use the app to train, with a trainer or on their own.
- People on the waitlist, and gym owners who register interest.
- Anyone who opens a pay page a trainer sent.
One mobile number is one account. An account can be both a trainer and a member.
Our role, and your trainer’s
- Records your trainer keeps about you. Your trainer decides to add you, and decides what to record: your name and number, your pack, sessions, payments, workouts and bodyweight. For those records your trainer decides the purpose. We store and process them on the trainer’s instructions.
- What we do ourselves. We are responsible for your own account, for the messages sent to you from our WhatsApp number, for sign-in, for the waitlist and for gym interest. For these we are the data fiduciary under the Digital Personal Data Protection Act, 2023.
Whichever applies, you can write to us. We will act on your request, or pass it to your trainer and tell you.
What we collect, why, and how long
If you have an account (trainer or member)
| What | Why | How long |
|---|---|---|
| Mobile number | To sign you in and to recognise you on a trainer’s client list | Until you delete your account |
| Name; email if you gave one | To show who you are. We do not send email today. | Until you delete your account |
| Sign-in records: a scrambled copy of each code, the times, and your sign-in on each phone | To sign you in safely and limit abuse | A code works for 10 minutes. A sign-in on a phone lasts up to 180 days. The records go when you delete your account. |
| Push token for each phone | To send you alerts | Until you sign out, the phone drops it, or you delete your account |
| Alerts shown in the app | To tell you what happened | Until you delete your account |
If you are a trainer, also
| What | Why | How long |
|---|---|---|
| Username, profile photo, bio, years of experience, specialties, certifications | Your profile, your pay pages and your public page | Until you change them or delete your account |
| UPI ID | To build the payment link your clients pay you through | Until you change it or delete your account |
| Prices, plans, working hours, policies, places you train at | To run your packs and schedule | Until you delete your account |
| Your clients’ records (next table) | To run your business in the app | Until you delete your account |
If a trainer has added you as a client
| What | Why | How long |
|---|---|---|
| Your name, your mobile number if the trainer has it, and where you train | So your trainer can keep your record and reach you | Until the trainer deletes their account |
| Packs, session dates and times, attendance, and the trainer’s notes to you | To count sessions against your pack | Until the trainer deletes their account |
| Payment records: amount, due or paid, method, and any reference the trainer types in | So your trainer can track what is paid | Until the trainer deletes their account |
| Workouts your trainer logs: exercises, sets, weights, bests | To show your training and send you summaries | Until the trainer deletes their account |
| Bodyweight your trainer logs | To show your progress | Until the trainer deletes their account |
| Whether WhatsApp updates are on for you, and since when | To decide whether a message may be sent | Until the trainer deletes their account. Cleared when you reply STOP. |
| Messages we sent you for your trainer | To send them and show whether they arrived | Until the trainer deletes their account |
A trainer cannot remove one client’s record on its own in the app today. The record goes when the trainer’s account is deleted. To have your record removed sooner, ask your trainer or write to us.
If you train in the app as a member, also
| What | Why | How long |
|---|---|---|
| Training profile: the year you started, your goal, your height | To set up your training | Until you change it or delete your account |
| Your routines, workouts and sets | To log and show your training | Until you delete your account |
| Badges and the totals behind them | To award and show badges | Until you delete your account |
| Your link to a trainer’s record, and your sharing choice | So you can see that record and choose what the trainer sees | Until you unlink or delete your account |
| Session approvals, codes, confirmations and disputes | To verify sessions | With the trainer’s record. Your own copy stays until you delete your account. |
| A secret for your session code, stored encrypted | To make and check your code | Until you unlink or delete your account |
If you joined the waitlist
| What | Why | How long |
|---|---|---|
| Mobile number; whether you ticked “WhatsApp me when my spot opens” | To let you in and tell you | Until you ask us to remove it, or delete the account you later open. There is no automatic expiry today. |
| If you chose to add them: name, city, email, Instagram handle, how you heard of us, and answers about your coaching or training | To decide who to let in first | The same |
If you registered interest for a gym
| What | Why | How long |
|---|---|---|
| Name, mobile number, email, gym name, city, number of outlets and members, your role, and whether you ticked WhatsApp updates | Only to contact you about HyRep.fit for Gyms | Until you ask us to remove it |
If you open a pay page
We store nothing about you for opening it. Your payment happens in your own UPI app.
What we do not collect
No location tracking. No contacts. No card or bank details. No progress photos, and no body measurements other than bodyweight and height. No advertising identifiers. We use no analytics, advertising or crash-reporting service.
Bodyweight, height and training history say something about your body. We treat them with care: a pay page and a trainer’s public page never show them.
Who can see what
- Your trainer sees the record they keep about you.
- Linking. If you sign in with a number a trainer has on their list, the app asks whether that is you. If you say yes, you see that trainer’s record of you: your pack, sessions, notes and workouts. If you say “Not me”, the record is hidden from you and the trainer is told the number may be wrong.
- Your own workouts and badges are private. Your trainer sees them only if you turn on “Share my own workouts” for that trainer. Turn it off, or unlink, and they are hidden at once.
- Unlinking. You keep a read-only copy of your sessions and workouts with that trainer. The trainer keeps their record.
- Verified sessions. When you approve, show a code or confirm, your trainer sees that the session is verified. If you dispute a session, your trainer sees the reason and any note you add.
- Pay pages (hyrep.fit/c/…) are private links, hidden from search engines. No account is needed. Anyone with the link sees the trainer’s name, photo, years coaching and specialties, the plan and the amount, and the payer’s first name. Keep the link to yourself.
- A trainer’s public page (hyrep.fit/t/username) shows the trainer’s first name and photo.
- The HyRep.fit team. Our admin site shows the waitlist and gym-interest entries, and can look up an account by its exact number to block or delete it. It does not show a trainer’s clients, sessions, payments or workouts. Access to production data is limited to the HyRep.fit team who need it.
We never sell personal data and never share it for advertising.
Messages
- WhatsApp, for your trainer. Session summaries, pay links, payment reminders and receipts, renewal offers and schedule changes come from HyRep.fit’s WhatsApp number on your trainer’s behalf. A trainer adds a client and chooses whether that client gets these updates. The trainer is responsible for having the client’s agreement.
- How to stop them. Reply STOP to any message, at any time, and messages to your number stop at once, from every trainer on HyRep.fit. Reply START to turn them back on.
- Other replies. If you reply with anything else, we pass the first part of your message to your trainer in the app.
- WhatsApp, from us. We send waitlist and gym updates only if you ticked the box. We send product updates to trainers, which a trainer can turn off in settings or by replying STOP.
- Sign-in. You sign in with your mobile number and a one-time code exchanged over WhatsApp. That proves the number is yours.
- Push notifications. Session approvals, reminders, disputes, payments and badges. You control them in your phone’s settings. Members have a separate Badges switch in the app.
- Email. We do not send email today.
Payments
HyRep.fit is not a payment service. Clients pay trainers directly by UPI, into the trainer’s own UPI ID. We build the payment link, send reminders and let the trainer record that a payment was made. We never hold your money and never see your card, bank account or UPI PIN.
Who we share data with
We share data only with the services that run HyRep.fit:
| Service | What for | What they handle |
|---|---|---|
| Railway (cloud hosting) | Runs our servers, database, backups and photo storage | Everything listed under “What we collect” |
| Meta (WhatsApp Business Platform) | Delivers WhatsApp messages and sign-in messages | Your number and the message text |
| Expo, Google (Firebase Cloud Messaging) and Apple | Deliver push notifications | A token for your phone and the notification text |
| Expo (app builds and updates) | Delivers app updates | Technical details of your app and phone |
| Cloudflare and Google | Domain name service; forwarding and the inbox for email you send us | Email you send us |
A notification can carry a client’s first name, an amount, or the first part of a client’s WhatsApp reply.
We may also disclose data when the law requires it, or to a successor if HyRep.fit is transferred, under the same commitments.
Where your data is kept
Our servers and database are in Singapore, not India. Meta, Expo, Google and Apple may process messages and notifications in other countries. By using HyRep.fit you understand that your data is processed outside India. We will follow any restriction the Government of India places on such transfers.
Deleting your account and data
In the app: Me → Delete account. Without the app: see how to delete your account, or write to us from your number. We confirm the number is yours and delete within 30 days.
When an account is deleted:
- Everything in it is deleted at once: profile, photos, clients and their packs, sessions, payments, workouts and progress, plans, places, routines, badges, alerts and sign-ins on every phone.
- If a trainer deletes, all their clients’ records are deleted and their pay pages stop working. Clients who had linked the app keep a read-only copy of their own sessions and workouts.
- If a member deletes, their account and their own training go. The record their trainer keeps about them stays with the trainer. To have that removed too, ask the trainer or write to us.
- Backups. Deleted data may remain in our backups for a limited period, up to 30 days.
- We keep a record that a deletion happened, with counts and no details of who. For 35 days we keep a scrambled code of the number, only so that restoring a backup cannot bring the account back.
- A deleted trainer’s username is held for 180 days so nobody else can take it and receive their old links. The same number can take it back within 35 days.
A trainer who runs a gym on HyRep.fit that other trainers belong to cannot delete the account in the app while they belong to it. Write to us first.
Our own short WhatsApp replies (sign-in, STOP and START confirmations) are deleted after 30 days. Delivery records for push notifications are deleted after 7 days.
Your rights
Under the Digital Personal Data Protection Act, 2023 you can:
- Ask what we hold about you and how it is used. There is no download button in the app. Write to us and we will send you a copy.
- Correct it. Trainers and members can edit their profiles in the app. For a record your trainer keeps, ask your trainer or write to us.
- Erase it, as described under Deleting your account and data.
- Withdraw consent, as described under Consent, and how to withdraw it.
- Nominate someone to use these rights for you if you die or cannot act. Write to us to record a nominee.
- Complain to our Grievance Officer, and after that to the Data Protection Board of India.
To protect you, we act only on a request once we have confirmed it comes from the person the mobile number belongs to. We acknowledge a request within 48 hours and resolve it within one month.
Consent, and how to withdraw it
| What | How to withdraw |
|---|---|
| WhatsApp messages sent for your trainer | Reply STOP, or ask your trainer to turn them off |
| Product updates (trainers) | Settings in the app, or reply STOP |
| Linking your account to a trainer’s record | Unlink in the app |
| Sharing your own workouts with a trainer | Turn the switch off |
| Push notifications | Your phone’s settings; the Badges switch |
| Holding your account at all | Delete your account |
| Being on the waitlist or the gym-interest list | Write to us |
Withdrawing does not undo what was done before. The service may stop working for you where it depends on that data.
Children
HyRep.fit is for people aged 18 and over. We do not knowingly keep data about anyone younger. A trainer must not add a client under 18. If you believe we hold a child’s data, write to us and we will delete it.
Contact and grievances
For privacy questions, requests and complaints, write to the Grievance Officer, HyRep.fit:
- [email protected]
- In the app
- Trainers: Me → Help on WhatsApp
Tell us the mobile number the request is about. We acknowledge every request and complaint within 48 hours and resolve it within one month.
If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
Security
- Everything travels encrypted (HTTPS).
- Sign-in codes and sign-in tokens are stored only in scrambled form. The secret behind your session code is encrypted on our servers.
- On your phone, your sign-in and saved screens are protected by the phone’s secure storage.
- Sign-in is by invitation, attempts are limited, and we can block an account that is being misused.
- Admin access is limited to named numbers on a separate site, with short sessions.
- Our server logs are written without phone numbers.
No system is perfectly secure. Keep your phone and your WhatsApp locked. If you get a sign-in message you did not ask for, reply “Not me” and every phone signed in with your number is signed out.
If there is a breach
If personal data is breached, we will tell the Data Protection Board of India and every affected person, as the law requires, without delay. We will say what happened, what it may mean for you and what you can do.
Cookies and storage
hyrep.fit sets no cookies and uses no trackers. The admin site uses cookies only to keep an admin signed in. The app stores your sign-in and a protected copy of recent screens on your phone, so it works with a weak signal.
Changes
We will post changes here and change the date at the top. If a change matters to how your data is used, we will tell you in the app or on WhatsApp before it takes effect.
See also the Terms of Use.