Privacy Policy & Your Rights

Last updated 29 October 2026

The Superhuman Club, Nagpur ("the Club", "we") operates this booking website, the Members portal, the staff desk and the Club System for The Superhuman Club, Nagpur. This policy explains what personal data we collect, why, who sees it, how long we keep it, and the rights you have — written to meet the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and its rules. We are the data fiduciary for your data; you are the data principal.

What we collect, and why

Data	Why we need it
Name, mobile number, email	To create your account, confirm bookings, send references, codes, receipts and invoices, and reach you about your sessions. Email and mobile are mandatory for every booking.
Bookings, packs, credits, memberships, sessions logged, check-ins, moves and cancellations	To run your account, your session bank and the floor calendar; to apply the rules on holds, misses and renewals.
Payment status, Razorpay order and payment IDs, invoice records, payment method (never card or bank numbers)	To confirm payment, raise GST invoices, process refunds and keep the accounts the law requires.
Health declarations, Day 0 baseline, body-composition and programme data, consents (including clinical consent where offered)	To decide safely what you can do on the floor and to coach you. Given by you at induction and in your programme; kept at the facility and in the Club System.
Household partner and referral details (the other person's mobile number)	To apply the partner discount and the referral thank-you. Give another person's number only with their agreement.
Device and usage data: IP address, browser, pages visited, the visitor counter, cookies and local storage	To keep the site secure, remember your sign-in on your device, and measure how the site is used.
Advertising identifiers (Meta Pixel cookies, click IDs) and hashed contact details	To measure whether our advertising leads to bookings (see "Advertising" below). You can opt out.
Staff: identity, bank, PAN, documents, salary (staff only)	Employment and payroll; encrypted in the staff vault, visible only to HR, Admin and Accounts.

Legal basis

We process your data on your consent, given when you book, sign up or sign a declaration, and for the legitimate uses the DPDP Act allows — performing the service you asked for, complying with law (tax, accounting, safety) and responding to a medical emergency. We do not use your data for anything unrelated to the Club's services without asking you first.

Who we share it with

• Razorpay — to take payments, run Access subscriptions and process refunds. Card, UPI and bank details go to Razorpay directly and are never stored by us.
• Google — Google Calendar (the unit's floor calendar holds your booking as an event with your first name and circuit) and Google Workspace mail for sending email.
• WhatsApp Business Platform / our messaging provider — for codes, confirmations and reminders to the WhatsApp number you gave.
• Meta Platforms — if you reached us through an advertisement, the Meta Pixel on this site and our server send Meta a hashed (SHA-256) form of your email and mobile, the booking reference and the amount, so that Meta can count the booking against the ad. Meta cannot read the hash back. See "Advertising".
• Our hosting and database providers (Render, and its managed Postgres) — the servers this website and the Club System run on. Backups are encrypted.
• Our accountants and auditors — invoice registers and GST reports, which carry names and amounts, not health data.
• Other Superhuman Club units and HQ — the HQ dashboard sees totals only; no client name, number or health record leaves this unit.
• Authorities — where the law requires it.

We do not sell personal data, and we do not share health data with advertisers or any third party other than a physician supervising a Signature clinical protocol you have consented to.

Advertising and cookies

This site uses the Meta Pixel and Meta's Conversions API to measure bookings that come from our advertisements. Your browser also keeps a small amount of local storage so the site remembers your sign-in and the booking you are in the middle of. To opt out of advertising measurement: use your browser's cookie controls or a tracker blocker, adjust your ad preferences in your Meta account, or email us and we will exclude your mobile and email from server-side events. Opting out does not affect your bookings.

How long we keep it

• Booking, payment and invoice records: for as long as GST and company law require — currently up to 8 years after the financial year they belong to.
• Your account, credits and session history: while your account is active and for 3 years after your last booking or membership, so that packs, referrals and disputes can be honoured; then deleted or anonymised.
• Health declarations and programme data: while you are a member or guest and for 3 years after, unless the law requires longer, then destroyed.
• One-time codes: minutes. Server logs: up to 90 days. Advertising events: per Meta's retention, which we do not control.

Your rights

Under the DPDP Act you can, free of charge:

• Access — ask for a summary of the personal data we hold about you, what we do with it and who we have shared it with. My sessions already shows your bookings, credits and history.
• Correct and update — have inaccurate or incomplete data corrected; your name, email and mobile can be updated at the desk.
• Erase — ask us to delete your data. We will do so unless we must keep it for a legal purpose (for example invoices for the tax period, or a safety record), in which case we tell you what we keep and why.
• Withdraw consent — at any time, as easily as you gave it; we then stop that processing going forward. Withdrawing consent to health declarations means we cannot let you use heat or cold stations or train on the coached floor.
• Opt out of marketing — reply STOP to any marketing message or email us.
• Grievance redressal — complain to our grievance officer below; we acknowledge within 48 hours and aim to resolve within 30 days.
• Nominate — name a person who may exercise these rights for you if you die or become incapacitated.
• Escalate — if you are not satisfied with our answer, you may complain to the Data Protection Board of India.

To use any of these rights, email muscleheadon@gmail.com from your registered email, or WhatsApp +91 90825 15616 from your registered mobile, with "Data request" and what you want. We may ask you to confirm the one-time code sent to your mobile before acting. We answer within 30 days.

Children

Our services are for adults. A person under 18 may be registered only by a parent or guardian, with their consent, and we do not run advertising measurement or marketing on a child's data.

Security

Every booking, refund, comp and price change is written to an audit log with who did it. Access to client data is by role (desk, manager, admin, accounts, HR) and every staff login is personal. Staff documents and bank details are encrypted at rest. Payment pages are Razorpay's; this site is served over HTTPS only. If a breach affects your data we will tell you and the Data Protection Board as the law requires.

Changes

We may update this policy; the date at the top is the current version. Material changes are announced on this site and, for members, by email.

Grievance officer

Naveen Chandra Kulkarni, Designated Partner, The Superhuman Club, Nagpur — muscleheadon@gmail.com · +91 90825 15616 · Nagpur, Maharashtra