Privacy Policy

Effective date: 6 July 2026 · Data Fiduciary: Serenity Pilates by Sneha ("Serenity", "we", "us")

Serenity Pilates Studio respects your privacy. This policy explains what personal data we collect, why, how we protect it, and your rights. We handle personal data in accordance with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable laws. By using our services you consent to this policy.

1. Data We Collect

You provide:

  • Identity & contact: name, phone number, email, and (if applicable) address.
  • Health & wellness data (sensitive): health conditions, injuries, limitations, pregnancy status, and fitness goals you share so we can deliver sessions safely.
  • Membership & activity: packages purchased, bookings, attendance, and trainer notes about your sessions.
  • Payment information: transaction records and amounts. Card/UPI details are processed by our payment partners and are not stored by us.

Collected automatically (portal use):

  • Usage and device information and basic log data needed to operate and secure the portal.

2. How We Use Your Data

  • To register you, manage your packages, and operate bookings, attendance, and session balances.
  • To deliver sessions safely (trainers use relevant health/goal information).
  • To process payments, issue invoices, and maintain financial records.
  • To send service communications (confirmations, reminders, expiry/renewal and payment notices) via WhatsApp, SMS, and email.
  • To provide support, ensure security, prevent misuse, and meet legal/tax obligations.

We use your data only for these purposes and do not sell it.

3. Legal Basis & Consent

We process your data based on your consent and as necessary to provide the services you request and to comply with law. You may withdraw consent for non-essential processing at any time (Section 7); some data is required to provide the service and to meet legal obligations.

4. Sharing & Third-Party Processors

We do not sell your personal data. We share it only with service providers ("data processors") who help us run the studio, under appropriate confidentiality and security obligations. These typically include:

  • Cashfree — online payment processing.
  • Pine Labs — in-studio card/UPI payment processing.
  • WhatsApp / Meta, and SMS / email providers — to send service notifications.
  • Hosting / infrastructure and error-monitoring providers — to operate the portal.

We may also disclose data where required by law, regulation, or valid legal process.

5. Health & Sensitive Data

Health and wellness information is treated as sensitive. Access is limited to studio Admin and the trainer(s) delivering your sessions, on a need-to-know basis, solely to provide services safely. It is not used for marketing.

6. Data Security

We apply reasonable technical and organisational measures — including access controls, encryption in transit, audit logging of sensitive actions, and regular backups — to protect your data against unauthorised access, alteration, or loss. No system is perfectly secure, but we work to safeguard your information and to notify you and the authorities of a reportable breach as required by law.

7. Your Rights

Subject to the DPDP Act, you may:

  • Access the personal data we hold about you and request a summary of processing.
  • Correct or update inaccurate or incomplete data.
  • Request erasure of data we no longer need to retain.
  • Withdraw consent for non-essential processing and manage communication preferences.
  • Nominate another person to exercise your rights in case of death or incapacity.
  • Grieve — raise a complaint with our Grievance Officer (Section 11).

To exercise these rights, contact serenitypilateskerala@gmail.com. We aim to respond within 30 days. We may need to verify your identity, and some data may be retained where law requires.

8. Data Retention

We keep your data only as long as needed for the purposes above:

  • Active members: for the duration of your membership and reasonable follow-up.
  • Financial / tax records: retained for the period required by law.
  • Inactive accounts: archived after 24 months of inactivity, then deleted unless law requires longer.

When data is no longer required, we securely delete or anonymise it.

9. Cookies (Portal)

If you use our web portal, we use essential cookies to keep you signed in and operate the site, and may use limited analytics cookies to improve it. You can manage cookies in your browser; disabling essential cookies may affect functionality.

10. Children's Privacy

Our services are intended for adults. If we accept members under 18, a parent or guardian must provide consent, and we process a minor's data only with verifiable parental consent as required by the DPDP Act. We do not knowingly collect data from children without such consent and will delete it if discovered.

11. Data Transfers

Your data is primarily processed and stored in India. Where a service provider processes data outside India, we take steps consistent with applicable law to protect it.

12. Grievance Officer & Contact

For privacy questions, requests, or complaints:

Grievance Officer: Sneha Ajith Serenity Pilates by Sneha — Serenity Pilates Studio 2nd Floor, TC-23/114(6), PNRA C22, Peroor Nagar, Kowdiar, Thiruvananthapuram, Kerala 695003 Email: serenitypilateskerala@gmail.com · Phone/WhatsApp: +91 81370 59072 Support hours: 9:00 AM – 6:00 PM, Monday – Saturday

13. Changes to This Policy

We may update this policy from time to time. We will post the updated version and, where appropriate, notify you. The "Effective date" above shows the current version.