Data protection and the DPDP Act
Data controls in the software and the responsibilities that need operational and legal review.
Last updated 7 October 2026
1. Fiduciary and Processor roles
Under the DPDP Act 2023, a gym subscribing to Kynvelo is the Data Fiduciary for its members and Kynvelo is the Data Processor. For Kynvelo Direct users with no gym affiliation, Kynvelo is the Data Fiduciary. The contractual allocation needs to be agreed with the gym; this page is not a certification of legal compliance.
2. Purpose limitation
Attendance data is processed to verify membership and detect drop-off risk. Payment data is processed to collect and reconcile fees. Training and nutrition data is processed to render it back to the member. None of it is repurposed for advertising or sold on.
3. Consent architecture
Consent for transactional communication is separate from consent for promotional communication, and both are recorded with a timestamp. Members can withdraw promotional consent without losing the service. Consent notices are presented in plain language at the point of collection.
4. Data principal rights
Members can download their data and correct their profile themselves in the app, and request erasure there; erasure is reviewed by the gym, which is the Fiduciary, and Kynvelo executes it as Processor. Paid receipts are retained without the member's name, as tax law requires. Grievances can be raised with our Grievance Officer, Ankit Shaw, at grievance@kynvelo.online, and unresolved grievances with the Data Protection Board of India.
5. Breach notification
Breach reporting is an operational responsibility of the service operator. The applicable process, contacts and legal deadlines need to be established before launch; the software does not send statutory breach notifications automatically.
6. Children's data
Kynvelo on its own, without a gym, is for adults: the app will not set up a solo account for anyone under 18. A member under 18 joins through their gym, and the gym, as the Data Fiduciary for its members, must get a parent's or guardian's consent before enrolling them. AI meal scan and AI plan checks are for adults only. We run no behavioural tracking and no advertising for anyone, children included.