Privacy Policy
How GymTally, a gym app for owners, staff and members, handles your information.
Last updated: 12 November 2026 · Duttatech Solutions (Tapas Dutta, proprietor), Raiganj, West Bengal, India
GymTally is a gym and fitness studio management app published by Duttatech Solutions (Tapas Dutta, proprietor), for Android and the web (app.gymtally.duttatech.in). Gym owners run their members, plans, bills, payments, check-ins, staff and reports in it; staff see what their role allows; members see their plan and dues, pay, book classes, sign the gym’s waiver and track their progress. This policy explains what information GymTally handles and how.
Who we are
The app is provided by Duttatech Solutions (Tapas Dutta, proprietor) (“we”, “us”). For any privacy question or request, contact support@duttatech.in. The same person is our grievance officer under India’s IT Rules.
Signing in
You sign in with your mobile phone number: we send a one-time code to it and you type the code into the app. We keep your phone number and the name you give us, and only a scrambled (hashed) copy of each code, which we delete after a day. Your phone number decides what you can open: gyms you own, gyms where the owner added you as staff, and gyms where you are a member. There are no passwords.
What a gym keeps in GymTally
A gym owner (and the staff they allow) enters and keeps the gym’s records:
- Members — name, phone number, member code, and optionally email, photo, gender, date of birth, address, emergency contact, health notes the member tells the gym, documents, plans, freezes, visits and dues.
- Check-ins — the time of each visit, whether it was made at the desk, by QR code or by the gym’s biometric or RFID device. A biometric device sends only who checked in and when; fingerprints and face images stay on the device and never reach GymTally.
- Bills and payments — plans and items sold, discounts, GST, how each bill was paid and amounts owed. When a member reports a UPI payment, its reference number and, if the member adds one, a screenshot of the payment receipt. Receipt screenshots are kept privately and shown only to the gym’s staff, never on a public link, and are deleted 90 days after staff confirm or reject the payment (the payment record itself stays).
- Waivers — the exact waiver text the member agreed to, the image of their finger signature, the name of the person who signed (a parent or guardian for a minor), and when and where it was signed.
- Fitness records — body measurements, progress photos, goals, personal records, workout and diet plans, workout logs and class bookings.
- Leads and referrals — the name and phone number of people who ask to join through the gym’s join page, or whom a member refers, and the gym’s follow-ups with them.
- Staff — name, phone, role, attendance, commission, advances and pay records.
- The gym’s own details — name, address, logo, GSTIN, UPI ID, plans, prices, stock, lockers and equipment.
For these records the gym is responsible for having its members’ consent; we store and process them on the gym’s behalf and use them only to run the app for that gym.
Members
When you use GymTally as a member, the gym you belong to can see your name and phone number and the plans, visits, bills, payments, waiver, bookings and progress it records for you. Your trainer sees what the gym owner allows.
Health Connect (Android)
If you choose to connect it, the member app reads from Health Connect on your phone: steps, workout (exercise) minutes, active calories burned, resting heart rate and weight. You give this permission in Health Connect and can take it back there at any time (Health Connect → App permissions → GymTally).
- GymTally only reads: it never writes to, changes or deletes anything in Health Connect.
- Only daily totals for the last two weeks are sent to our server, and only your own gym (the owner and your trainer) can see them, so they can follow your progress with you.
- This data is never sold, never used for advertising, never shared with anyone else, and never used to decide on credit, insurance or employment.
- Use of information received from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements.
Where it is stored
All of this is stored on our server in India (Hostinger, India data centre), over an encrypted HTTPS connection. Server backups are made daily and kept for 14 days.
Messages and payments
When a gym turns on automatic reminders or sends a broadcast, the member’s name, phone number and the message (for example a plan’s expiry date or an amount due) are sent through the messaging service the gym has set up: WhatsApp Business by Meta, or SMS by MSG91. Sign-in codes are sent the same way. A member can ask the gym to stop messages on a channel. When staff tap WhatsApp on a member’s page, WhatsApp opens on their own phone with the message typed in. We do not read your chats.
GymTally does not take payments. Members pay the gym’s own UPI ID through their own UPI app; we never see bank or card details.
Integrations set up by a gym
A gym can create API keys or webhooks to connect GymTally to its own website or software. Records the gym chooses are then sent to the address the gym gives; the gym is responsible for that system.
Device permissions
- Camera and photos — only when you take or pick a member photo, a progress photo, a logo or a payment receipt.
- Health Connect — only if a member chooses to share activity (see above).
- Internet — to reach your gym’s records on our server.
GymTally has no ads and does not use the advertising ID. This website sets no cookies and has no analytics.
Sharing & selling
We do not sell or rent any personal information and do not use it for advertising. We share it only with the services that run GymTally for us (our server host in India, and the WhatsApp or SMS provider for messages), with the systems a gym connects itself, or when Indian law requires it.
Security
Every connection is encrypted (HTTPS). Sign-in uses short-lived tokens; signing out ends the session. Each gym’s records are open only to its owner and the staff the owner added, and staff see only what their role allows. Payment receipts are stored outside the public web folder. Changes are recorded in an audit log the owner can see.
Children
GymTally is made for gym businesses and their members. A gym may record a member under 18 only with a parent’s or guardian’s consent, and the waiver for a minor is signed by the parent or guardian.
Retention & deletion
To delete your GymTally account, write to support@duttatech.in from any email address, giving the phone number you sign in with (we will confirm it is you with a one-time code). We delete your account within 30 days; if you own a gym, the gym is closed for everyone and its records are deleted, except as below. Bills and payment records stay with the gym that made them for as long as the gym has to keep its tax (GST) records. A gym’s member list belongs to that gym: ask the gym to remove you, or write to us. To stop sharing health data, remove GymTally’s permission in Health Connect and ask your gym or us to delete the daily totals already sent. Backups that may still contain deleted data are gone within 14 days.
Changes to this policy
If we change this policy we will update the date above and, for important changes, tell you in the app.
Contact
Duttatech Solutions (Tapas Dutta, proprietor), Raiganj, West Bengal, India · support@duttatech.in · +91 85058 21666