Last updated October 2026
GymHearth (“we”, “us”) provides software that gyms use to run memberships, classes, check-in, payments and their public gym page. This policy explains how we handle personal data for gym owners and staff who use the dashboard and for members who use a gym’s page or member app.
1. Who is responsible
For member data, each gym is the data controller and GymHearth acts as its processor: we store and process the data on the gym’s behalf and following its instructions. For gym owner accounts and our own website, GymHearth is the controller.
2. Data we collect
- Account data: name, email address, profile photo and sign-in details (handled by our authentication provider).
- Membership data: plans, start and end dates, payment status, invoices and front-desk sales.
- Activity data: class bookings, waitlists, attendance, check-ins (time, location, method) and 1:1 session bookings.
- Progress data you choose to log, such as body weight, measurements, personal records and workouts. This is visible only to you.
- Contact preferences for email, SMS and WhatsApp notifications, and your phone number if you provide it.
- Payment data: card payments are processed by Stripe. We never see or store full card numbers.
- Technical data: device, browser and log information needed to keep the service secure and working.
3. How we use it
- To provide the service: memberships, bookings, check-in, notifications and the member app.
- To process payments and send receipts and renewal reminders.
- To show gym owners aggregated analytics (revenue, attendance, retention) about their own gym.
- To secure accounts, prevent fraud and comply with legal obligations.
- With your consent, to send product news. You can unsubscribe at any time.
4. Sharing
We do not sell personal data. We share it only with:
- The gym you joined (and its staff, according to their role).
- Service providers that help us run the platform — hosting and database, authentication, payments (Stripe), email (e.g. Resend) and SMS/WhatsApp (e.g. Twilio) — under data processing agreements.
- Authorities when required by law.
5. Retention
We keep data while your account or the gym’s account is active. Gyms decide how long member records are kept; when a gym closes its account we delete or anonymise its data within 90 days, except where we must keep records (for example invoices) by law.
6. Your rights
Depending on where you live you may have the right to access, correct, export or delete your data and to object to or restrict certain processing. Members should contact their gym first; you can also email us at hello@gymhearth.com and we’ll help route your request.
7. Security
Data is encrypted in transit, access is limited by role (owner, coach, member) and every gym’s data is kept separate from other gyms.
8. Children
The service is not directed at children under 16. Gyms that train minors are responsible for obtaining guardian consent.
9. Changes
We’ll post updates here and, for significant changes, notify account owners by email or in the dashboard.
10. Contact
Questions about privacy: hello@gymhearth.com.