Zym

Zym privacy policy

Effective 1 October 2026 · Updated 22 October 2026 · Also in मराठी and हिंदी — use the switch at the top.

Zym is an app gyms use to run their memberships, and members and trainers use to see their plans. It is made by Nexotri. This policy says what Zym collects, why, who else handles it, how long it is kept, and how you can see, correct or delete it.

1. Who is responsible

Zym is operated by Nexotri, Kolhapur, Maharashtra 416113, India (“we”).

  • For your Zym account — your sign-in, your profile and the app itself — we decide how your data is used, and we are responsible for it under India’s Digital Personal Data Protection Act, 2023 (the DPDP Act).
  • For the records your gym keeps in Zym about its members and staff — memberships, payments, attendance, plans — your gym decides what to record and why. We store and process those records for the gym, on its instructions. Questions about what your gym records are best asked at the gym first; we will help either way.

2. What we collect

Account and sign-in

  • Your name and mobile number. The number is how you sign in: you send a WhatsApp message with a one-time token, and WhatsApp tells us which number it came from.
  • Your email address — only if you sign in with email or Google, or your gym adds it.
  • If you choose “Sign in with Google”: your Google account’s ID, name and email.
  • The language you use the app in, your notification settings, and when you last signed in.

Profile details you or your gym choose to add

  • Gender, date of birth, address, occupation, blood group, a link to a photo, an emergency contact (name, phone and relation), and the date and notes of a health declaration.
  • A record of documents the gym notes, such as an ID proof or a signed waiver: its type, a link and, optionally, a number. Zym does not store the files themselves.

Membership, attendance and money (recorded by your gym)

  • Membership plans, start and end dates, holds and renewal reminders.
  • Invoices and the payments the gym records — amount, method (such as cash or UPI), reference and date. Zym does not take payments from members; your gym collects them and records them.
  • Check-ins at the gym, class bookings, and personal-training packages, bookings and sessions.

Fitness and health

  • Your fitness goal, experience level, activity level, diet preference, target weight and injuries.
  • Body measurements: weight, height, body fat, and chest, waist, hip, arm and thigh measurements.
  • Fitness assessments a trainer records: medical conditions, injuries, simple fitness tests (push-ups, squats, plank), resting heart rate, blood pressure, flexibility and notes.
  • Diet and workout plans written for you, and what you log against them.

This is sensitive. Only you, your gym’s owner and its trainers can see it — not other members.

If you run a gym

  • Your gym’s details (name, address, city, PIN code, location, contact phone and email, amenities), fee plans, notices and expenses.
  • Your staff and trainers: name, phone, role, salary or commission, attendance.
  • Enquiries from people interested in joining: name, phone, goal, budget and follow-up notes.
  • Your Zym plan: which plan, its status and end date, and each payment you make for it — the plan and period bought, the amount, the date, and Razorpay’s order and payment references.

From your phone and our servers

  • A push-notification token, so we can send the notifications you have switched on.
  • An app-update ID: a random ID the app makes on your phone and sends to Expo each time it checks for an update, so the right update reaches it. It identifies the installation, not you.
  • If you run a gym and pay for a plan in the app: Razorpay’s checkout, which runs inside the app only while you pay, reads the phone’s Android ID, its advertising ID (readable only on Android 12 and older), which UPI apps are installed, and the network state, and sends Razorpay checkout events and performance data. Razorpay uses them to check the payment for fraud, to offer your UPI apps as ways to pay, and to keep its checkout working. They go to Razorpay, not to us.
  • Notifications sent to you in the app, and a record of WhatsApp invites sent to your number (when, and by which gym).
  • Server logs: IP address, time and the address requested, used to keep the service secure and working.
  • An activity log inside each gym (who added a payment or changed a membership), so the owner can see what happened.

What we do not collect. We do not read your contacts, location, photos or files, and the only permission Zym asks you for is notifications. There are no ads. Apart from Razorpay’s checkout, which runs only when a gym owner pays, there is no analytics or tracking SDK in the app. We never sell personal data.

3. How we use it

  • To run Zym: sign you in, show you your membership and plans, and let your gym manage its members.
  • To send messages you would expect: your gym’s WhatsApp invite when it adds you, renewal and class reminders, and the notifications you have switched on.
  • To sell gym owners a Zym plan: taking the payment through Razorpay, and checking it for fraud.
  • To keep Zym secure: limiting repeated attempts, looking into misuse, and keeping backups.
  • To answer you when you write to us.

We use your data only for these purposes. Where we rely on your consent (optional notifications, for example), you can withdraw it at any time in the app’s settings or by writing to us.

4. Who else handles it

We use a few service providers, each only for the job listed and only with what that job needs:

  • Meta Platforms (WhatsApp Business Platform) — delivers the WhatsApp message you send to sign in, and the invites Zym sends from its WhatsApp number. That number is shared with other Nexotri services; a Nexotri server receives incoming messages and passes Zym’s sign-in messages to Zym.
  • Razorpay — processes the payments gym owners make for a Zym plan in the app. Card, UPI or bank details go to Razorpay, not to us; we receive the payment’s status and reference. Razorpay also receives the owner’s name, mobile number and email (filled into the checkout for them), their Zym account number and the plan bought, and the device data and checkout events its checkout collects (section 2).
  • Google — “Sign in with Google”, if you choose it, and Firebase Cloud Messaging, which delivers push notifications to Android phones.
  • Expo (650 Industries) — passes push notifications on to Firebase, and delivers app updates (for which it receives the app-update ID in section 2).
  • Oracle Cloud Infrastructure — hosts Zym’s servers and database, in India.
  • Our email provider — when we send you an email, such as a sign-in code or an account notice.

Some of these companies process data outside India. We share with them only what is needed to provide Zym, under their terms for business customers. We may also disclose information when the law requires it — to a court or a government authority with the power to ask for it, for example.

5. How long we keep it

  • Your account and what is recorded in it: for as long as you have a Zym account, or your gym keeps you on its books.
  • One-time sign-in tokens and codes: deleted after a day.
  • Routine database backups are pruned daily once more than 14 full days old; this is not an exact 14-day maximum. Restricted deployment-recovery snapshots expire after 30 days and are removed at the next daily cleanup. Deleted data may remain in these copies until cleanup.
  • Server logs: kept for a few weeks.
  • When you delete your account, your personal details are removed at once (section 6). Fee and payment records stay, with your name removed, because the gym needs them as financial records.
  • When a gym owner deletes their account, their gyms and everything recorded in them are deleted.
  • Records of what gym owners paid for Zym plans (plan, amount, date and Razorpay’s references): kept after the owner’s account is deleted, without their name, because they are our record of money received and the law requires accounting records to be kept.

6. Deleting your account

In the app: Profile → Delete account. Or write to us at info@nexotri.com. What is removed and what is kept is set out in full at nexotri.com/zym/delete-account.

7. Your rights

Under the DPDP Act you can:

  • ask for a summary of the personal data we hold about you and who we have shared it with;
  • have it corrected, completed or updated — most of it you can change yourself in the app, or ask your gym to;
  • have it erased (section 6);
  • withdraw consent you have given;
  • nominate someone to exercise these rights for you if you die or cannot act yourself;
  • complain to us and, if we do not resolve it, to the Data Protection Board of India.

Write to info@nexotri.com from the email on your account, or tell us the mobile number on it. We may confirm the request with you on that number before acting. Requests about your gym’s records may be passed to your gym, which decides about its own records.

8. Children

Zym is meant for adults. A gym that adds a member under 18 must have the consent of a parent or guardian to do so. We do not knowingly let children create their own accounts, and we do not track anyone for advertising or target ads at anyone.

9. Security

Connections to Zym are encrypted (HTTPS). A password, where an account has one, is stored only as a salted hash. Each person sees only what their role allows — a member their own records, a trainer their members, an owner their own gyms. The servers are in India and are backed up nightly. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board as the law requires.

10. Changes

If we change this policy, we will update the date at the top, and tell you in the app if the change matters to you.

11. Contact and grievances

Nexotri, Kolhapur, Maharashtra 416113, India
Email: info@nexotri.com
Grievance officer: Pooja Patil, Nexotri — info@nexotri.com

We acknowledge complaints within 24 hours and aim to resolve them within 15 days.