Privacy Policy
This Privacy Policy is issued by Troolift Private Limited ("Company", "we", "us") and describes the processing of personal data through the Troolift mobile applications published on the Apple App Store and Google Play (the "App") and the website at troolift.com (the "Website", together with the App, the "Services"). It is issued in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and the rules made thereunder. By accessing or using the Services you acknowledge that you have read this Policy. Capitalised terms not defined here have the meaning given in the Terms and Conditions.
Scope
This Policy applies to personal data processed through the Services. It does not apply to the practices of any gymnasium, fitness studio or other establishment (each a "Gym") that licenses the Services, save to the extent that such processing is carried out by us on that Gym's behalf.
The Website does not employ cookies, web beacons, analytics software, advertising identifiers or any other tracking technology. No account may be created through the Website and no form on the Website transmits data to us; the enquiry field composes a message in the visitor's own electronic mail client, which the visitor may elect to send or discard.
Where the Website is used to send us an electronic mail, we process the address from which it is sent and its contents for the purpose of responding to the enquiry.
Definitions
"Data Principal", "Data Fiduciary", "Data Processor" and "personal data" bear the meanings assigned to them under section 2 of the DPDP Act.
"Member" means an individual enrolled at a Gym whose records are maintained through the Services. "Gym User" means a proprietor, administrator or trainer authorised by a Gym to access the Services.
Roles of the parties
In respect of personal data relating to Members, the Gym is the Data Fiduciary and determines the purposes and means of processing. We act as a Data Processor and process such personal data solely on the documented instructions of the Gym and to the extent necessary to make the Services available. We do not determine what a Gym records about a Member.
In respect of personal data relating to Gym Users and to visitors to the Website, we act as the Data Fiduciary.
A Member wishing to exercise any right in respect of personal data held by a Gym must address the request to that Gym in the first instance. We shall give effect to instructions received from the Gym in accordance with clause 15.
Categories of personal data
The following categories may be processed through the App. The categories actually recorded in respect of any Member are determined by the Gym and not by us.
| Category | Data elements |
|---|---|
| Identifiers | Name; mobile telephone number; electronic mail address; date of birth; gender; postal address; profile photograph |
| Emergency and guardian particulars | Name, telephone number and relationship of an emergency contact; where a Member is below eighteen years of age, the name and telephone number of a parent or lawful guardian |
| Health-related data | Medical conditions, allergies, injuries and related notes recorded by the Gym or its trainers; responses to fitness intake questionnaires |
| Physical measurements | Height; weight; body mass index; body fat, muscle, bone and water composition; visceral fat; metabolic age; waist and hip circumference |
| Photographic data | Progress photographs, where recorded |
| Training records | Workout plans; logged exercises, sets and repetitions; personal records; attendance; session history and ratings |
| Commercial records | Package purchased; commencement and expiry dates; amounts paid; mode of payment; outstanding sums |
| Authentication data | Mobile telephone number; a cryptographic hash of any personal identification number or password; whether biometric unlocking is enabled; time of last sign-in; failed sign-in counters |
| Technical data | Push notification token; application language preference; the time zone configured by the Gym |
We do not process precise geolocation data, contact lists, call or message logs, audio recordings, or advertising identifiers, and the App contains no advertising software development kit.
Purposes of processing
Personal data is processed for the following purposes and for no other purpose: (a) creation and administration of Member records and memberships; (b) recording of attendance; (c) preparation and delivery of training programmes and personal training sessions; (d) recording of physical measurements and training progress; (e) recording of sums paid and sums outstanding, and computation of trainer remuneration; (f) transmission of operational notifications, including session reminders, renewal notices and communications issued by the Gym; (g) authentication, prevention of unauthorised access and investigation of misuse; and (h) compliance with applicable law.
Personal data is not sold, licensed, rented or otherwise made available to any person for consideration. It is not used for advertising or for the construction of advertising profiles. It is not shared between Gyms.
Consent and its withdrawal
Where we act as Data Processor, the obligation to obtain and maintain the consent of the Member, and to give the notice required by section 5 of the DPDP Act, rests with the Gym as Data Fiduciary. Our agreement with each Gym requires it to do so.
Where we act as Data Fiduciary, processing is undertaken on the basis of consent given at the time of account creation, or on such other lawful basis as may be available under the DPDP Act.
Consent may be withdrawn at any time. A Member withdraws consent by addressing the Gym. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may prevent continued use of the Services.
Health-related data
Medical conditions, injuries, physical measurements and progress photographs constitute the most sensitive categories of personal data processed through the App and are treated accordingly.
Such data is accessible only to the Member concerned, to the trainer assigned to that Member, and to the proprietor or administrator of the Gym at which the Member is enrolled. It is not accessible to other Members, to other Gyms, or to any advertiser.
Progress photographs are recorded only where the Member or the Member's trainer elects to record them. Such photographs are not used for any promotional purpose by us.
Health-related data is not used for advertising, is not disclosed to any data broker, and is not used to train any general-purpose artificial intelligence model.
Children and persons with disability
The App is not directed to children. A user account may be created only by an individual who has attained eighteen years of age. The App is not listed in any children's category on either application store and contains no feature designed to appeal to children.
An individual below eighteen years of age may be enrolled as a Member of a Gym. In that event the record is created and maintained by the Gym, which is required to obtain verifiable consent from a parent or lawful guardian before doing so and to record the particulars of that parent or guardian. No user account is issued to such a Member, no device is registered to such a Member, and no notification is transmitted to such a Member.
We do not undertake tracking, behavioural monitoring or targeted advertising directed at children, and do not process the personal data of a child in any manner likely to cause a detrimental effect on the well-being of the child.
Where a Member is a person with disability who has a lawful guardian, consent is obtained from that guardian by the Gym.
Device permissions
The App requests the following permissions. Each is requested at the time the corresponding feature is first used, may be declined, and may be revoked thereafter through the operating system. Declining a permission disables only the feature that depends upon it.
| Permission | Purpose |
|---|---|
| Camera | Scanning of the quick-response code displayed at the Gym for the purpose of recording attendance |
| Photo library | Selection of a profile photograph and of progress photographs |
| Biometric authentication (Face ID / fingerprint) | Optional unlocking of the App. Biometric data is processed entirely by the operating system and is never transmitted to or stored by us |
| Push notifications | Transmission of session reminders, renewal notices and communications issued by the Gym |
Authentication tokens are held in the secure keystore provided by the operating system.
Disclosure to third parties
Personal data is made available to the following categories of recipient, in each case to the extent necessary for the purpose stated and under contractual obligations of confidentiality.
| Recipient | Data and purpose |
|---|---|
| Microsoft Corporation (Azure) | Hosting of the application servers, database and stored files; generation of draft training programmes by means of Azure AI Foundry, as described in clause 12 |
| Google LLC (Firebase Cloud Messaging) | Delivery of push notifications. Receives a device notification token |
| Payment gateway | Processing of subscription sums payable by a Gym to the Company. Receives the payment instrument particulars of the Gym |
Personal data is further disclosed where disclosure is required by law, by an order of a court or tribunal of competent jurisdiction, or by a lawful direction of a governmental authority, and where necessary to establish, exercise or defend a legal claim.
No personal data is disclosed to any advertising network, data broker or analytics provider.
Payment data
Sums paid by a Member to a Gym are not processed through the Services. Such sums are collected by the Gym through its own facilities, and the App records only the amount, the date and the mode of payment recorded by the Gym. We do not receive, process or store payment card numbers, card verification values, unified payments interface identifiers or bank account particulars of any Member.
Sums payable by a Gym to the Company in respect of a subscription are processed by a payment gateway. Payment instrument particulars are submitted directly to that gateway and are not retained by us.
Automated processing
The App provides a facility by which a trainer may generate a draft training programme by automated means. Where that facility is invoked, particulars comprising stated training objectives, experience level, reported injuries and recorded performance data are processed by means of Azure AI Foundry, a service of Microsoft Corporation, within the cloud tenancy controlled by the Company. Microsoft is contractually bound not to use such particulars to train any Microsoft or third-party model. Names, telephone numbers, electronic mail addresses, postal addresses and photographs are not transmitted.
A programme so generated is a draft requiring review by a qualified trainer before use. It does not constitute medical advice. No decision producing legal effects or similarly significant effects is taken by automated means alone.
Storage and security
Personal data is stored on infrastructure operated by Microsoft Azure. The measures applied include: transmission between the App and our servers over encrypted channels; storage of personal identification numbers and passwords as one-way cryptographic hashes, such that they cannot be read by any person including our personnel; expiry of one-time passwords after a short interval; locking of an account following repeated unsuccessful sign-in attempts; segregation of the data of each Gym at the database level, enforced on every query; access control by role, such that a trainer may access only those Members assigned to that trainer; and the maintenance of an audit record of alterations to Member and commercial records.
No method of transmission or storage is entirely secure, and no assurance is given that the measures described above will prevent every unauthorised access. Where a personal data breach occurs, we shall give intimation to each affected Gym and to the Data Protection Board of India in the form and manner required by the DPDP Act.
Retention
Personal data relating to Members is retained for so long as the Gym maintains a subscription to the Services, and thereafter for such period as is provided in our agreement with that Gym, unless erasure is sought earlier in accordance with clause 16.
Authentication artefacts, being one-time passwords and session tokens, are retained only for the short period necessary to operate the authentication mechanism and are thereafter deleted.
Records of sums received are retained for the period prescribed by applicable taxation and companies legislation, notwithstanding a request for erasure, in which event the record is disassociated from the identity of the Member in the manner described in clause 16.
Rights of Data Principals
A Data Principal has the right to obtain a summary of the personal data processed and of the processing activities undertaken; the right to correction, completion, updating and erasure of personal data; the right to nominate another individual to exercise these rights in the event of death or incapacity; and the right of grievance redressal, in each case in accordance with sections 11 to 14 of the DPDP Act.
A Member shall address a request to the Gym at which the Member is enrolled, the Gym being the Data Fiduciary in respect of that personal data. A Gym User shall address a request to us at the address in clause 19.
A request is acted upon within the period prescribed by applicable law. We may require information reasonably necessary to verify the identity of the person making the request before acting upon it.
Account and data deletion
A user may request deletion of the user account and of the personal data associated with it by transmitting a request from the registered electronic mail address or mobile telephone number to hello@troolift.com, stating the registered mobile telephone number and the name of the Gym concerned. A request may equally be made to the Gym, which will transmit it to us.
Upon verification of a deletion request, the account is closed and the following data elements are erased: name; mobile telephone number; electronic mail address; postal address; date of birth; health-related data; emergency contact particulars; and photographs.
The following are retained: records of sums received and of sums paid to trainers, which applicable taxation and companies legislation requires to be preserved; and records of attendance and of training sessions, in a form disassociated from the identity of the Member. Records so retained do not identify the Member.
A request is given effect within thirty days of verification. Confirmation is transmitted to the electronic mail address from which the request was received.
Platform providers
The App is distributed through the Apple App Store and Google Play. The operator of each store may process data concerning the download, installation and, where applicable, purchase of the App independently of us and in accordance with its own privacy policy, to which this Policy does not extend.
Data disclosures made by us in the Apple App Store privacy questionnaire and in the Google Play Data safety section correspond to the categories set out in clause 4 of this Policy.
Amendments
This Policy may be amended from time to time. The amended Policy takes effect upon publication at this address and the version and effective date recorded at the head of this Policy are updated accordingly. Where an amendment materially affects the processing of personal data, notice is given through the App or by electronic mail before the amendment takes effect.
Grievance redressal and contact
A grievance concerning the processing of personal data, or concerning the exercise of a right under clause 15, may be addressed to hello@troolift.com. Communications so addressed are directed to the person for the time being responsible for data protection matters within the Company.
A grievance is acknowledged and disposed of within the period prescribed under the DPDP Act and the rules made thereunder.
A Data Principal who is not satisfied with the disposal of a grievance may make a complaint to the Data Protection Board of India.