KairoFlex Privacy Policy

1. Who we are and what this Policy covers

This Policy explains how KairoFit LLP (LLP Identification No. ADA-1569), registered office Greenland Park Apartment, Narendrapur, South 24 Parganas – 700103, West Bengal, India ("KairoFit LLP", "we", "us"), handles personal data in KairoFlex, our free mobile app for iOS and Android. It covers the app, the account behind it and the servers that serve it. It is version 1 of this Policy and takes effect on 26 October 2026.

Three words from the Digital Personal Data Protection Act, 2023 appear throughout. A Data Fiduciary is the person who decides why and how personal data is used. A Data Processor handles personal data on a Data Fiduciary's behalf and on its instructions. A Data Principal is the person the data is about — you. Section 2 explains which of us is which for each kind of data.

This Policy is for KairoFlex users. If you own or work at a gym that uses KairoFit, our Privacy Policy for KairoFit applies to your account. If a gym has registered you as a member, the Member Data Notice explains what the gym records about you at the front desk.

Questions, requests and complaints about your data go to contact@kairofit.in or to our Grievance Officer (help using the app: kairofit.in/support or support@kairofit.in):

• Jeet Adhikari, Designated Partner, KairoFit LLP
• Email: contact@kairofit.in
• Address: Greenland Park Apartment, Narendrapur, South 24 Parganas – 700103, West Bengal, India

We acknowledge every message within 48 hours, resolve complaints about the app or its content within 15 days, and answer requests about your personal data within 30 days. Always quote the mobile number registered on your account and, if you are a gym member, the name of your gym.

2. Two roles: your gym and us

KairoFit keeps one record per person, keyed to the mobile number, shared between the KairoFit software your gym uses and the KairoFlex app you use. Who is responsible for which data depends on where the data came from:

3. The data we hold about you

What we do not collect. KairoFlex has no analytics, advertising or crash-reporting software; it does not read advertising identifiers, your location, contacts, photo library or health-platform data; it registers for no push notifications; it keeps no weight history, only your current weight; and it never processes a payment. The camera only decodes your gym's QR code — no image is captured, stored or uploaded.

Basis today and from May 2027. Until 13 May 2027 the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 govern, and everything above is collected with your consent (Section 18). When the corresponding provisions of the Digital Personal Data Protection Act, 2023 commence, we will continue to rely on your consent for your account and health data, and on the Act's "legitimate use" provision only for service messages you necessarily receive, such as one-time codes.

4. Health and body data: sensitive personal data

Your goal, diet type, age, height, weight, active days per week, calorie and macro targets, every diary entry and every custom food describe your physical condition and diet. Under the rules in force today they are sensitive personal data, and we treat them that way now and after the 2023 Act commences.

• Collected only with your separate consent. The "Health details" consent at signup is a distinct consent for this data. Without it the tracker, goals and targets are unavailable.
• Used only to compute your targets and show your progress — your suggested calorie and macro target (Mifflin–St Jeor formula), your daily and monthly adherence and your streaks. Nothing else.
• Never used for advertising or marketing, and never sold. KairoFlex shows no advertisements, and we do not share this data with advertisers, data brokers or anyone else for their own use.
• Never shared with your gym or with other users. No screen in KairoFit shows a gym any diary, goal, body detail or custom food; leaderboards are built from attendance only.
• Never written to iCloud or Google Drive. The app has no cloud-sync feature; this data lives only on our servers in India and, while you use the app, in its memory on your device.
• Stored in India, in our database hosted by Supabase in the AWS Mumbai region (Section 9).
• Withdrawing consent. Turn off "Health & fitness data" on the Permissions screen in the app. The diary, goals and targets stop working at once. Withdrawing does not by itself erase what you already logged: delete diary entries yourself in the app, ask us to erase your health data (Section 13) or delete your account (Section 14).

5. Data your gym records and we show you

If a gym that uses KairoFit has registered your number, KairoFlex shows you: each gym you belong to (name, city, status and member-since date), your plan name, its start and end dates, its status and days to expiry, your attendance and the streaks, awards and leaderboard positions computed from it. Dues, payments, receipts, tax invoices and other GST documents are not shown in KairoFlex and no part of the app reads them; those stay at your gym's front desk. Your gym-recorded address, date of birth, gender and health notes are not shown in the app either.

Scanning your gym's QR code creates an attendance record in your gym's KairoFit account, marked as made from the app; staff see it exactly as a front-desk check-in. The check-in result shows only the scanned gym's name and city and, if you are blocked, your own plan name and end date. A check-in is also refused while your gym's own KairoFit subscription has lapsed; nothing about you is recorded in that case.

Your gym is the Data Fiduciary for all of this. To correct it, ask your gym. If you ask us, we will forward the request to your gym and tell you we have done so. The Member Data Notice sets out what a gym records, why, and the rights you have against it.

6. Technical data and device permissions

• Server logs. Our servers log each request's path, method, status code, timing and a request ID; the web server in front of them also logs the connecting IP address. Request bodies are never logged. Sign-in logs mask phone numbers.
• Tokens on your device. The app stores your refresh token and the gym you last selected in the operating system's secure storage. Signing out revokes the token on our side and clears it from the device.
• Camera. Requested only when you open the check-in scanner, to decode the QR code. No image is captured or uploaded.
• No other permissions. KairoFlex does not ask for location, contacts, photo library, microphone, notifications or health-platform access.
• No third-party SDKs that collect data. No analytics, advertising, attribution or crash-reporting library is in the app; fonts are bundled, not fetched. The app talks only to our servers and, if you use those buttons, Google's or Apple's sign-in services.

7. Consent: what you agree to and how to withdraw it

At signup the app asks for three consents, and today all three are required to create an account:

• Account details — your name and mobile number, so that the account is yours.
• Health details — your weight, goal and what you eat, so that the app can compute your daily target (Section 4).
• Login codes by SMS — one-time codes to your mobile number, the only way to sign in.

Each consent is recorded on our servers with its type, the fact that it was granted, the method ("member app"), the notice version (currently v1) and the time. You also accept the KairoFlex Terms of Use and confirm you have read this Policy when you create the account.

After signup, the Permissions screen (Profile → Permissions) shows four switches. What each does today:

• Health & fitness data — turning it off stops the diary, goals and targets immediately (Section 4). This is the one switch that changes what the app does.
• WhatsApp updates and Email notifications — record a preference only. KairoFlex sends no WhatsApp messages and no email of any kind today, so nothing reads these switches.
• SMS one-time codes — records a preference only. One-time codes are the only way to sign in, so they continue to be sent whenever you ask for one, regardless of this switch, for as long as your account exists.
• Personal data cannot be withdrawn on that screen, because the account cannot exist without it. Withdrawing it means deleting your account (Section 14).

Every switch you change adds a new, timestamped record; earlier records are never altered. When Consent Managers registered under the 2023 Act become available, we will say here whether you can also manage your consents through one.

8. Leaderboards: what other members see

If you have a live membership at a gym that uses KairoFit and you have signed in to KairoFlex at least once, you appear on that gym's leaderboards (overall, most consistent, most improved, early birds — monthly and yearly). Every other KairoFlex user who is a member of the same gym receives, for each person on the board:

• your first name (the first word of the name on your account);
• your profile photo, if your gym uploaded one, as a short-lived link (the app currently shows initials, but the photo is made available to it);
• your score and rank — distinct check-in days, streak weeks or month-over-month change, depending on the board — and your movement since the previous period;
• an internal account identifier the app uses to mark your own row.

They never see your surname, mobile number, email, plan, dues, body details, diary or custom foods, and members of other gyms see nothing. Check-ins recorded by your gym's staff count towards your score, not only QR check-ins. There is no opt-out switch in the app yet: to be removed, email contact@kairofit.in with "Leaderboard opt-out", your registered mobile number and your gym's name, and we will remove you and confirm within 30 days. No one under 18 may use KairoFlex, so no child should ever appear (Section 15).

9. Who receives your data

We never sell personal data and we do not share it with advertisers or data brokers. The companies below process data for us, under their published terms or our contracts with them, which require them to protect it to a standard no lower than ours:

Google sign-in. If you use it, Google's sign-in service gives us a token carrying your name, email address and Google account identifier; we keep the name and email and discard the identifier. KairoFlex's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: that information is used only to create your account, never for advertising, and never transferred to anyone except as this Policy describes.

Sign in with Apple. If you use it and choose to hide your email, Apple gives us a private relay address that forwards to your real address. You can stop that forwarding at any time in your Apple ID settings, after which we could not reach you at that address.

Cross-border transfers. All personal data at rest — your account, diary, goals, photos — is stored in India. The only data that leaves India is the sign-in token you send to Google or Apple when you choose those buttons, and job metadata sent to Inngest if that service is enabled. We transfer personal data outside India only as the Digital Personal Data Protection Act, 2023 permits and never to a country the Central Government has restricted.

Other disclosures. We disclose personal data only to: your gym, limited to the data Section 2 describes as the gym's own; a court, regulator or law-enforcement agency when the law requires it (we tell you unless the law forbids it); and a successor to the KairoFlex business if it is transferred, after notice to you. We do not use your data to train artificial-intelligence models.

10. How we protect your data

We take reasonable steps to keep your data safe. What is actually in place:

• All traffic between the app and our servers is encrypted with TLS.
• One-time codes are six digits, stored only as a bcrypt hash, expire after 5 minutes, are cancelled after five wrong attempts and can be used once.
• Sessions use short-lived access tokens (1 hour) and rotating refresh tokens (30 days) stored only as hashes; on your device they live in the operating system's secure storage.
• Our database is a managed service encrypted at rest; our servers accept only encrypted connections, run a firewall, key-only administrator access and automatic security updates.
• Access to gym data is limited by gym and by role; a gym's staff can see only that gym's records, and no gym can reach diary or goal data.
• Photos are held in private storage and served only through links that expire after 10 minutes.
• Consent records are append-only and can never be edited.
• Access to production systems is restricted to the people who run the service, and we review our practices regularly.

No system is perfectly secure, and we do not claim certification to any security standard. If you think your account has been misused, tell us at once at contact@kairofit.in.

11. If there is a data breach

If personal data we hold as Data Fiduciary — your account, diary, goals or body details — is lost, accessed or disclosed without authorisation, we tell you without delay by SMS to your registered mobile number (and by email if you gave one): what happened and when, what data was affected, the likely consequences, what we have done, what you can do, and whom to contact. Once the breach provisions of the Digital Personal Data Protection Act, 2023 apply, we will also notify the Data Protection Board of India without delay and file its detailed report within 72 hours. We report cyber-security incidents to CERT-In within the time its directions require. If the breach involves data your gym holds, we notify your gym within 24 hours of becoming aware and cooperate with its notifications to you.

12. How long we keep your data

If a law requires us to keep something longer, we keep only what that law requires, for only as long as it requires.

13. Your rights

You have these rights over the data KairoFit LLP holds as Data Fiduciary, under the rules in force today and under the Digital Personal Data Protection Act, 2023 as its provisions commence:

• Access — a summary of the personal data we hold about you, what we do with it, and the names of the Data Processors and, where applicable, other Data Fiduciaries we have shared it with.
• Correction and completion — of anything inaccurate or incomplete. Your name, email and photo cannot be edited in the app today: a gym member asks the gym to correct them at the front desk; anyone can ask us by email. Address, date of birth, gender and health notes exist only if your gym recorded them and are corrected through your gym.
• Erasure — of your health data while keeping your account, or of the whole account (Section 14), unless a law requires us to keep something.
• Withdrawal of consent — the Health & fitness switch in the app for health data; email for anything else, including the Account details consent, which means deleting the account.
• Grievance — to the Grievance Officer in Section 1.
• Nomination — of one adult who may exercise these rights if you die or become unable to act. The Terms of Use explain how.

How to exercise them. Email contact@kairofit.in, say what you want, and quote the mobile number registered on your account (and your gym's name if you are a member). We verify the request through that number, usually by sending a one-time code to it, and answer within 30 days (the law allows up to 90), free of charge. There is no rights-request screen in the app today. Requests about data your gym holds go to your gym; if they reach us we forward them and tell you (Section 5).

14. Deleting your account

You can ask us to delete your KairoFlex account at any time. Today the request is made by email and verified through your registered mobile number; we complete it within 30 days and confirm to you. Deletion removes your KairoFlex sign-in, diary, goals, custom foods and sign-in tokens, and — if no gym that uses KairoFit holds you as a member — your name, mobile number, email and member code. Records your gym holds as its own, including those identifiers, stay with your gym; your consent and acceptance records are kept for 3 years in a minimal, access-restricted form as evidence of what you agreed; and a minimal deletion log is kept for up to 1 year (Section 12). Steps, details and alternatives are at Delete your KairoFlex account. In-app deletion is being built and that page will say when it is available.

15. Children

KairoFlex is for adults. You must be 18 or older to create an account, and we do not knowingly process the personal data of anyone under 18. If you tell us, or we learn — for example from an age entered in the goals questionnaire — that an account belongs to someone under 18, we close the account and delete its KairoFlex data. Gym members under 18 are served by their gym at the front desk, under the parental or guardian consent the gym obtains; that consent does not extend to a KairoFlex account, and such members must not use the app. To report a child's account, email contact@kairofit.in.

16. Messages and notifications

The only messages KairoFlex sends are one-time codes by SMS to your registered mobile number, through MSG91 under TRAI's DLT framework, and only when you ask for one. They are service messages and cannot be switched off while the account exists. KairoFlex sends no push notifications, no marketing and no email of any kind today. If we ever introduce promotional messages, they will go only to people who separately and expressly opt in, and every one will carry a one-step unsubscribe.

17. Complaints and escalation

Write first to the Grievance Officer (Section 1); we acknowledge within 48 hours and answer a data request within 30 days. If you are not satisfied, you may take the matter further:

• Today, for a complaint about our handling of your sensitive personal data, to the Adjudicating Officer appointed under section 46 of the Information Technology Act, 2000, and for a consumer complaint to the consumer commission that has jurisdiction under the Consumer Protection Act, 2019.
• Once constituted and once the relevant provisions commence, to the Data Protection Board of India, in the manner notified by the Central Government.

Certain provisions of the Digital Personal Data Protection Act, 2023 come into force in phases up to May 2027; we will update this document as they do.

18. Sensitive personal data under today's rules

Until 13 May 2027, when the Digital Personal Data Protection Act, 2023 replaces them, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 apply to KairoFlex, and this Policy is our privacy policy under those rules and section 43A of the Information Technology Act, 2000. Under those rules your health and body data (Section 4) is sensitive personal data or information. We collect it only with your consent given in the app, only for the purpose stated, and only as much as that purpose needs; we tell you here who receives it and who collects and keeps it (KairoFit LLP, at the address in Section 1); we keep it no longer than needed; you may review and correct it at any time; and you may withdraw your consent in writing — by the switch in the app or by email — after which we may be unable to provide the tracker. Section 10 describes our security practices.

19. Language

This Policy and the consent screens in the app are in English. If you would like a summary of this Policy in Hindi, Bengali or another language listed in the Eighth Schedule to the Constitution of India, email contact@kairofit.in and we will provide one within 30 days.

20. Changes to this Policy

We may update this Policy. If a change affects what data we collect, why, who receives it or your rights, we notify you at least 30 days before it takes effect, by SMS to your registered mobile number or by email, and ask you to confirm you have read it; you may delete your account first if you disagree. Smaller changes are posted here with a new date and take effect 15 days later. Changes never apply retroactively. Every version carries its number and effective date, and we keep every earlier version so you can ask for the one you accepted.

• Version 1 — effective 26 October 2026 (this is the first KairoFlex Privacy Policy).

Related documents: KairoFlex Terms of Use · Delete your KairoFlex account · Member Data Notice · KairoFit Privacy Policy · KairoFit Terms of Service.