Member data processing agreement

Last updated: October 25, 2026.

This agreement explains how your gym members' personal data is handled when you manage them in Gymyos. The gym owner accepts it on behalf of the gym when entering the panel, and it is in addition to the Terms for gyms. It follows Mexico's Federal Law on the Protection of Personal Data Held by Private Parties.

1. Who is responsible for what

There are two kinds of data, and each has its own controller:

• The data about the relationship between your gym and its members (who your member is, which membership they have, when they come in and what they pay you) is your gym's responsibility. Gymyos processes it on your behalf, as a processor, only to provide you the panel.
• Each person's Gymyos account and everything they log in the app (workouts, routines, body, photos, habits, challenges) is Gymyos's responsibility, under its Privacy notice. Your gym is not responsible for that data and does not see it.

Each member opens their own Gymyos account. Your gym doesn't create accounts: it registers as a member a person who already has an account, using their email.

2. What your gym sees and stores in Gymyos

• Member roster: each member's name and email, their memberships, passes or packs, the branch where they were sold and where they give access, start and end dates, balance and pauses.
• Entries: each entry with the app's QR code or 6-digit code, at which branch, at what time, whether it was accepted or why not, who scanned it at the front desk and, when recorded, the exit.
• Profile photo: the front desk sees it only on the day of the entry, to recognize the person, and only if they have a photo and agreed to show it. The next day it is no longer visible.
• Front desk payments: each sale with its receipt number, products, amount, payment method, who collected it, the daily cash drawer and refunds.
• Reports: only aggregated numbers on members, attendance and occupancy, without names or body data. With fewer than 5 people in the period they are not broken down, so no one can be identified.
• People who enter with GymyosPass: their name, their profile photo on the day of the entry, and the entry time.

3. What your gym does not see

• Your members' workouts, routines, weights, measurements, progress photos, habits, daily log, challenges and friends.
• Their health data, their card, or what they pay directly to Gymyos.

The exception is what the person chooses to share. If a trainer at your gym links with a person, they only see what that person selects when linking, and the person can see every access in «Who viewed my data» and withdraw permission at any time.

4. Who at your gym sees what

• The owner sees everything about their gym and is the only one who can download the full member roster in Excel.
• Branch managers and front desk staff see the member roster and entries, sell, and record entries. Pauses are recorded by the branch's front desk or manager.
• Opening a member's profile and downloading the roster is logged, and each member can see it in the file from «Download my data».

You decide who gets access to the panel, and you remove their permission when they stop working with you.

5. What Gymyos commits to as processor

• Process your members' data only to provide you the panel and following your instructions, which are the ones you give by using the panel. We don't use it for anything else, we don't sell it and we don't give it to other gyms.
• Keep it confidential. Only Gymyos staff who need it to provide support or protect the service can see it, and every access to another person's data is logged.
• Protect it with security measures: encrypted connections, role-based permissions, access logs, alerts on unusual access, mandatory two-step verification for those who administer Gymyos, and security backups from the last 7 days.
• Use only the sub-processors we need to provide the service: Stripe for online payments, the email provider that sends our messages, Cloudflare to carry gymyos.com traffic, and the phone notification services of Google, Apple, Mozilla and Microsoft. If we add another, we will update this agreement.
• Notify you without delay if there is a security breach affecting your members' data, with what happened, which data was affected and what we are doing about it.
• Help you respond to your members' requests for access, correction, cancellation or objection regarding the data you manage in Gymyos.
• Not transfer your members' data to anyone else, unless a law or an authority requires us to.

6. What your gym is responsible for as controller

• Having its own privacy notice and giving it to its members, stating that it uses Gymyos to manage its roster, entries and payments.
• Registering as members only people who actually are members and with whom it has a relationship that justifies it, such as a paid membership or a contract.
• Using the panel only for its relationship with its members. Don't use roster data for purposes your members don't know about.
• Giving panel access only to those who need it for their work, and making sure its staff keep the data confidential.
• Handling your members' requests about the data of their relationship with you. If you receive one about what the person logs in the app, forward it to [email protected].
• Letting us know at [email protected] if you learn of improper access to the panel.

7. When a member leaves or deletes their account

• If a member leaves your gym, their history of memberships, entries and payments stays in your panel as a record of what happened.
• If a member deletes their Gymyos account, their account and everything they logged are deleted. Your front desk payments are kept as a financial record, but without their name: they show as «Deleted account».

8. When your gym leaves Gymyos

• Before leaving, download your member roster and your reports. After the exit, your staff can no longer enter the panel.
• Gymyos stops processing your members' data on your behalf. We keep payment and rent records for as long as tax laws require and to resolve any disputes; the rest of the data about your relationship with your members we delete, or hand over to you if you ask us at [email protected].
• Your members' accounts belong to them and remain in Gymyos.

9. Changes to this agreement

If we change this agreement, we will publish the new version with its date and ask you to accept it when you enter the panel.

10. Governing law and contact

This agreement is governed by the laws of Mexico. For anything about your members' data, write to us at [email protected].