Privacy policy

What data do we collect?

We collect only what is needed to provide the service:

• Account data of gym owners and staff: name, email, mobile number, role and an encrypted password hash.
• Gym data: business name, address, GSTIN, logo, plans, prices and settings.
• Member data entered by a gym: name, mobile, email, gender, date of birth, photo, emergency contact, health notes the gym chooses to record, memberships, payments, attendance, class bookings, workout and diet plans and body measurements.
• Payment data: subscription and member payments are processed by Razorpay. We store order and payment references and amounts, never full card numbers or UPI PINs.
• Website data: messages you send through the contact form and basic server logs (IP address, browser, pages requested) used for security and troubleshooting.

How do we use the data?

To run the service (log-in, memberships, billing, check-in, reminders, reports), to send service emails and WhatsApp messages a gym has switched on, to bill subscriptions, to answer enquiries, to keep the service secure and to meet legal obligations such as tax records. We do not sell personal data and we do not use member data for advertising.

Who do we share data with?

Only with service providers that help us run NexFit, under confidentiality obligations:

• Razorpay, for subscription and member payments.
• Email and WhatsApp (Meta) messaging providers, for reminders and notifications a gym enables.
• Hosting and infrastructure providers that store the encrypted service data.
• Authorities, when required by law.

How is data protected?

Each gym’s data is isolated to its own account. Traffic is encrypted with HTTPS, passwords are stored as salted hashes, payment gateway secrets are encrypted at rest, access is role-based and sensitive actions are logged.

How long do we keep data?

Gym data is kept while the account exists. When a gym asks us to close its account we delete or anonymise its data within a reasonable period, except records we must keep by law (for example tax invoices).

What are your rights?

You can ask to access, correct or delete your personal data, and withdraw consent for optional messages, as provided under the Digital Personal Data Protection Act, 2023 and other applicable law. Gym members should contact their gym first, as the gym controls their records; we will help the gym respond. Contact us through the contact page for any privacy request.

The NexFit Android app

The NexFit app for Android opens the same secure NexFit service (https://nexfitpro.in) inside the app, so the data it handles is the data described in this policy.

• Camera: used only when you choose to scan a member QR code at check-in or take a member or profile photo. Photos are uploaded only to your gym’s NexFit account; the app never records in the background.
• Files: reports and receipts you export are saved to your phone’s Downloads/NexFit folder and stay on your phone.
• The app does not access your location, contacts, SMS or call logs, does not show ads and does not include advertising or third-party analytics SDKs.
• All data is sent over HTTPS (encrypted in transit).

How do I delete my account?

You can ask us to delete your NexFit account and its data at any time, from the app, the website or by message:

1. Gym owners: email info@qubha.com or WhatsApp +91 95974 36220 from your registered email or mobile number, with your gym name and the words “Delete my NexFit account”.
2. Staff: ask your gym owner to remove your login (Staff → Remove), or contact us as above.
3. Members: ask your gym to delete your member record, or contact us as above and we will pass the request to your gym.
4. We confirm the request, then delete the account and its personal data within 30 days.

Cookies and local storage

The website does not use advertising cookies. The app stores your sign-in session and theme preference in your browser’s local storage so you stay logged in and see the theme you chose.