Member app privacy.

This notice covers the GymFront Members app only. The GymFront website has its own privacy notice.

Who is responsible for your information

Your gymis responsible for your membership information. It decides what it collects and why, and it is the “controller” under UK data protection law.

GymFront, built by TmT Software, runs the app and the systems behind it on your gym’s behalf. We are your gym’s “processor”: we only use your information to provide the service your gym has asked us to provide.

If you are a member at more than one gym that uses GymFront, each gym is responsible for its own membership.

What the app collects

• Sign-in details: your email address and password, handled by our sign-in provider. We never see your password.
• Your profile: your name and phone number, and any changes you make to them.
• Your emergency contact: the name and phone number you add.
• Account deletion requests: when you ask, and the optional reason you give.
• An account identifier that links the app to your membership.

The app does not use advertising or tracking, does not share your information with advertisers, and does not collect your location, contacts, photos or health data.

What your gym holds that the app shows you

Your gym holds your membership, billing and invoice records, and a record each time you enter through a door. The app displays these to you. It does not collect them.

How your information is used

• To sign you in and keep you signed in.
• To let you through the door at your gym.
• To show you your membership, invoices and entry history.
• To let your gym contact you about your membership.
• To carry out a deletion request.

The lawful basis is performance of your membership contract with your gym. Marketing messages are only sent if you have agreed to them, and you can stop them at any time using the unsubscribe link in any marketing email, or by asking your gym.

Who else processes it

We use carefully chosen providers, under contract, to run the service:

• Auth0 (Okta): sign-in.
• Microsoft Azure, UK South region: hosting and storage.
• Twilio SendGrid: sending email.
• Access PaySuite: collecting your Direct Debit payments on your gym’s behalf.
• Pay360: processing card payments your gym takes.

We do not sell your information.

Deleting your account

You can delete your account in the app: Account → Closing your account → Delete account. The full steps, including how to ask without the app, and what is deleted and what is kept, are on our account deletion page.

• Nothing is deleted straight away. You have 7 days to change your mind, and you can cancel from the same screen.
• After the 7 days, deletion is carried out by an automated job that runs nightly, so it can take a little longer than 7 days to complete.
• If you are in a minimum-term membership, deletion waits until that term has ended, because your gym still needs your details to provide the membership you signed up for. The app shows you the date.
• As soon as you ask, you stop receiving marketing, even if deletion is scheduled for later.
• When deletion happens, your name is replaced with “Archived Member”, your contact details, date of birth, address and emergency contact are erased, your door access is revoked and you can no longer sign in. Your entry history (visits, door entries and class bookings) is not removed at that moment; it is cleared automatically after 12 months.
• Payment records your gym is legally required to keep, for tax and accounting, are kept in a form that no longer identifies you by name or contact details.

How long information is kept

Your gym keeps your membership information while you are a member and for a limited time after:

• Membership, payment and agreement records: six years, usually, as the law requires. After that they are kept only in anonymised form.
• Door entries, visits and class bookings: 12 months.
• Marketing preferences: 24 months after your membership ends.
• Staff notes about you: 2 years after your membership ends, or 6 years for a note that forms part of an incident record.

The same periods apply when you delete your account; see what is deleted and what is kept.

Your rights

Under UK data protection law you can ask to:

• see the information held about you;
• correct anything that is wrong;
• have your information deleted;
• object to how it is used, including marketing; and
• receive your information in a portable format.

Contact your gym first, as they are responsible for your membership. To have your account deleted, see how to delete your account. You can also email info@gymfront.app and we will pass your request to your gym and help them respond.

If you are unhappy with how your information or a request has been handled, including a deletion that has been scheduled for a later date, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

If we change this notice in a way that matters, we will update the date above and tell you in the app.