Privacy Policy

Your gym decides what it records about its members. When a gym adds you as a member, the gym is responsible for that information and for having your permission to keep it. ekRack stores and processes it for the gym, following the gym's instructions.

ekRack is responsible for gym and staff accounts, for the information we collect when you visit our website or sign in, and for keeping everything secure.

If you are a member and want to see, correct or remove your information, the quickest way is to ask your gym. You can also write to us at hello@ekrack.com and we will help.

Gym accounts: the gym's name, web address, phone, email, physical address, logo, brand colours, opening hours and receipt details, and the owner's name, email and phone.

Staff accounts: name, email, phone, role, an optional photo, and when they were invited and joined. Passwords are stored only in a scrambled (hashed) form that cannot be read back.

Member records, as entered by the gym or by the member in the member app:

• name, phone, email, address, occupation, gender, date of birth and a photo
• health details the gym chooses to record, such as height, weight, blood group, fitness goal, experience and medical conditions or injuries
• an emergency contact and staff notes
• plans, fees, payments, receipts, discounts, refunds and dues
• check-ins: when and how each member checked in

Health details are optional. A gym should only record what its trainers need to keep the member safe.

Payments: ekRack records the payments a gym takes (amount, method, who collected it). We do not process card payments and never see card or bank account numbers.

Sign-ins and security: for each sign-in we keep the device and browser type, the IP address, an approximate location worked out from the IP address, and when the session was last active. We also record failed sign-in attempts. Gym owners see this for their own staff on the Security page so they can sign out a device they don't recognise.

Messages to us: anything you send us by email, phone or WhatsApp.

• to run ekRack for your gym: check-ins, passes, fees, receipts, reports and the member app
• to send emails a gym or member needs: invitations, password resets, and renewal reminders when a plan is about to end (a gym can switch reminders off in Settings)
• to keep accounts secure, spot misuse and investigate problems
• to answer your questions and set up your gym
• to bill a gym for its ekRack plan
• to meet our legal obligations

• We don't sell personal information, and we don't use it for advertising.
• We don't show one gym's information to another gym.
• We don't use advertising or analytics trackers. ekRack uses one cookie to keep you signed in, and your browser remembers small preferences such as whether the sidebar is collapsed.

Inside a gym, people see what their role needs:

• owners and managers see their gym's members, payments and reports
• front-desk staff and trainers see what they need for their work
• members see only their own information in the member app

Outside the gym, we use a small number of service providers to run ekRack:

• Cloudflare stores logos and photos in private storage. Images are only shown to people signed in to the right gym, through links that expire after a few minutes.
• Our email provider delivers invitations, password resets and renewal reminders.
• Our hosting provider runs the servers and database where ekRack's information is kept.

They may only use the information to provide their service to us. We may also share information if the law requires it, or to protect someone's safety.

Approximate sign-in locations (a city and country, never an exact address) are worked out on our own servers from the IP address, using a location database. The IP address is not sent to anyone to do this.

This product includes GeoLite data created by MaxMind, available from https://www.maxmind.com.

We keep a gym's information for as long as the gym uses ekRack. Archived members stay in the gym's records until the gym asks us to remove them, so their history and receipts remain available.

When a gym closes its account, we delete its information within 90 days, except records we must keep by law, such as billing records.

• every gym's information is kept separate, and each gym has its own address and sign-in
• passwords are hashed; staff and members can sign out other devices at any time
• photos and logos are in private storage, checked against the viewer's gym on every request
• connections to ekRack are encrypted

You can ask to:

• see the information held about you
• correct anything that is wrong
• have your information deleted, where nothing requires us or your gym to keep it
• stop receiving renewal reminder emails from your gym

Members can update their own profile and photo in the member app. For anything else, ask your gym or write to hello@ekrack.com. We answer within 30 days.

Gyms that register members under 18 are responsible for getting a parent's or guardian's permission first. A parent or guardian can make any of the requests above on the member's behalf.

If we change this policy, we update the date at the top. If a change affects how we use information we already hold, we tell gym owners by email before it takes effect.

Questions or requests about privacy: hello@ekrack.com, or call +977 986-9118472. ekRack, Kathmandu, Nepal. See also our Terms of Service.