Legal
Last updated: September 6, 2026
This Privacy Policy explains how Oxyye ("Oxyye", "we", "us") collects, uses, shares and protects personal data when you use our website and our gym-management platform (the "Service"). It is written to meet India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it. If you are outside India, the same commitments apply to you.
Oxyye plays two roles. For the gym owners, trainers and staff who create accounts with us, Oxyye is the data fiduciary: we decide how and why that data is used. For the members a gym records in Oxyye, the gym is the data fiduciary and Oxyye is its data processor: we handle that data only on the gym's instructions, under the data-processing terms in our Terms of Service.
Your gym collected your details and chose to keep them in Oxyye. Your gym is responsible for telling you why it collects your data, for getting your consent where the law needs it, and for answering your requests. To see, correct or delete your data, or to withdraw consent, ask your gym first. If your gym does not respond within 30 days, write to us at privacy@oxyye.com and we will help. We never use a gym's member data for our own marketing, and we never sell it.
We collect only what each purpose below needs. We do not ask for caste, religion, health conditions or other sensitive categories, and we ask gyms not to store them in free-text fields.
Under the DPDP Act we process personal data either with your consent or for a legitimate use the Act recognises. Specifically:
Where we rely on consent, we ask for it in plain words at the point we collect the data, and you can withdraw it as easily as you gave it. Marketing emails carry an unsubscribe link. For everything else, email privacy@oxyye.com or use the account-deletion request in Settings → Danger zone. Withdrawing consent stops future processing; it does not undo processing that already happened lawfully, and it may mean we can no longer provide parts of the Service.
We share personal data only with the providers below, each bound by contract to use it solely to deliver its part of the Service:
We may also disclose data when the law requires it, to protect the rights and safety of Oxyye, our customers or the public, or as part of a merger or sale of the business, in which case this policy will continue to apply to your data. We never sell personal data.
Our providers run data centres in India, Singapore and the United States. The DPDP Act permits transfers outside India except to countries the Government restricts; we do not transfer data to any such country and will move to Indian regions if the law comes to require it. Wherever the data sits, the safeguards on our Security page apply.
If an account is unused for 3 years we will email you, and if we hear nothing within 30 days we will delete it.
Under the DPDP Act you may:
To use any of these, email privacy@oxyye.com from the address on your account. We reply within 7 days and complete the request within 30 days. Gym members should contact their gym first (see section 1). Requests are free; we may ask you to verify your identity before acting.
Our grievance officer under the DPDP Act and the Information Technology Rules is Manav Narula, reachable at privacy@oxyye.com. Please put "Privacy" in the subject line. We acknowledge every grievance within 7 days and resolve it within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.
If a personal data breach affects you, we will notify the Data Protection Board of India and the affected users without undue delay, in the form the DPDP Rules require, telling you what happened, what data was involved, what we have done about it, and what you can do. Our safeguards, and how we test them, are on our Security page.
Oxyye accounts are for gym businesses and their adult staff. Gyms sometimes enrol members under 18. In that case the gym, as data fiduciary, must obtain verifiable parental consent as the DPDP Act requires. Oxyye does not profile, track or advertise to minors, and does not use their data for any purpose other than providing the Service to their gym.
The Service uses cookies that are needed to keep you signed in and secure. Our public website also uses Google Analytics with IP anonymisation to understand which pages are read; this runs only on marketing pages and never inside the logged-in product. We do not use advertising cookies. You can block cookies in your browser; the logged-in Service will not work without the essential ones.
We may update this policy. Minor changes take effect when posted with a new "Last updated" date. For material changes we will email account holders at least 14 days in advance. Continued use after that date means you accept the updated policy.
Oxyye, India. Privacy questions: privacy@oxyye.com. Everything else: hello@oxyye.com.
Questions about this page? Email us at hello@oxyye.com.