This policy explains how we collect, store and use your data.
What we collect
Account: name, email, phone number, city and role. A phone number is required before a free trial or booking, and one phone number can be linked to only one account.
Bookings: records of sessions, credits and payments.
Payments: payments are processed through our partner, Razorpay. Your card or bank details never reach us.
Profile photo: mandatory for trainers; for clients, required before a free trial or booking, so that the trainer can recognise you. We use an AI service (Google Vertex AI) to check that the photo shows a real face.
About you (required for a free trial or booking): date of birth, gender, height, weight and fitness goal. We ask for these so that your trainer can plan your sessions safely and to suit you. You enter them yourself. Body measurements and weekly progress logs are also entered only by you.
Workout and progress logs: the weight and reps you log for each set during a session, and your daily progress (steps and weight). You can also add entries for the previous day. Your trainer can see these logs.
Diet log: the meals you write down. If you upload a meal photo, it is sent to an AI service (Google Vertex AI, Gemini) only to estimate calories and protein. The meal photo itself is not stored — only the estimate is saved with your diet log. A trainer with whom you have an active pack can see your diet log.
Health and body information is sensitive data (this includes the details above): only you and your own trainer can see it.
Emergency contact: name, phone number and relationship — used only for emergencies during a session; your trainer sees it only at that time.
Device: push notification token (if you turn on alerts) and login times (for security).
How you use the app: which screens you open, what you tap and how long you stay. We use this to fix problems, improve the app, and to detect copying or misuse of the Platform (see Terms §7E). On private screens (earnings, client details, plans, photos, diet, payment details) we also record when a screenshot is taken on a phone that reports it. Screens that show other people’s data — a trainer’s client list, a client’s sheet and assessment as seen by the trainer, and the admin console — carry a faint watermark with the viewer’s member code and the date, not a name or phone number. Your own screens have no visible watermark; they are protected quietly (text cannot be selected or printed, and the screen blurs when you switch away). Only HattaKatta’s own staff can see usage and screenshot records; they are kept for 90 days, then deleted. They are never sold or used for advertising.
Watch and health app data (only if you connect it): with your permission we read steps, heart rate (including resting heart rate), calories, workouts and sleep (how long you slept and when you fell asleep and woke up) from Apple Health (HealthKit) or Health Connect on your phone, whether it was recorded by your phone or your watch. We use it to show your progress, the effort of each session, your sleep, and a daily “readiness” suggestion (light, normal or hard training day) worked out from your sleep, resting heart rate and recent training load. Each type of data is asked for separately and you can say no to any of them. We only read; we never write to your health app. Your trainer sees a summary (including your sleep and readiness) only if you turn on sharing for that trainer, and you can turn it off at any time. This data is never used for advertising, never sold and never used to train AI. You can disconnect and delete it at any time from Profile → Privacy; synced data is deleted within 30 days of disconnecting, or straight away if you choose delete.
Nutrition (if you book a nutritionist): your diet log, your nutrition plan, and the health details you choose to give for it (such as allergies, medical conditions or medicines). You give separate consent for this when you book, and only you and the nutritionist you book can see it. Their access ends 30 days after your last consult with them, or at once if you withdraw consent from Profile. Your trainer sees your nutrition plan only if you turn on sharing.
Physiotherapy (if you book a physiotherapist): your intake form (where it hurts, since when, what you cannot do), any photo or video you choose to add, your daily pain logs and your rehab plan. You give separate consent for this on the intake form, and only you and the physiotherapist you book can see it. Their access ends 30 days after your last session with them, or at once if you withdraw consent from Profile. Withdrawing consent does not delete anything by itself: from Profile you can delete your intake form, photos and videos, and your pain logs at any time, and we delete the intake form and its media automatically 12 months after your last session. Your rehab plan is the physiotherapist’s treatment record: you can remove your own copy, but the physiotherapist keeps the plan for as long as your account exists. A short handoff note from your physiotherapist goes to your trainer only if you tap Share; you can stop sharing or delete the note at any time. Assessments and session notes your physiotherapist writes are their treatment record: you see a summary, you can ask for the full record (we share it within 7 days), and they are deleted 3 years after the date they were written, or when you delete your account. When you delete your account, all of this is removed together.
Assessment information: if you ask for an AI workout plan, the assessment photos, body measurements and goal you provide. Assessment photos are optional.
Photos — important
Assessment photos are cropped on your phone itself. The app asks you to keep your face out of the frame, and the photo is re-created so that any hidden location and date information is removed. Meal photos uploaded to the diet log are used only to make the estimate and are not stored. Assessment photos are kept in private storage — only you and your own trainer can see them, and the viewing link expires automatically after a short time. You can delete them at any time.
Use of AI
To create your plan, your assessment information (photos, body measurements and goal) is sent to an AI service (Google Vertex AI). We use a paid plan under which Google does not train its models on this data. For a nutrition plan, the details you give for it (goal, body details, veg or non-veg, budget, foods you avoid, allergies and any medical condition you choose to tell us) are sent to the same AI service in the same way, without your name or contact details. An AI-generated plan does not go directly to you — your trainer first reviews and edits it.
Google Vertex AI is also used to check that a profile photo shows a real face, and (Gemini) to estimate calories and protein from a meal photo that you upload to your diet log.
What we do not do
We do not sell your data. We do not share it with anyone for advertising.
Who can see your data
Your own trainer — only the information you have provided for them. Your diet log is visible to a trainer with whom you have an active pack.
Service providers: hosting/database (Supabase), payments (Razorpay), AI (Google).
Government authorities, where required by law.
How long we keep it
For as long as your account exists. If you delete your account or photos, we remove them, except for records that the law (for example, tax law) requires us to keep. To stop the same person claiming the welcome offer or free trials again with a new account, we keep a coded (hashed) form of your phone number and the date the offer or trial was used, for up to 2 years after you delete your account; it is not linked to your name, account or payments and is used for nothing else.
Your rights (DPDP Act 2023)
You can access, correct or delete your data — in the app through Profile → Edit, or by writing to us. You can withdraw your consent for health/body data and for offers at any time. Your account is deleted from within the app (Profile → Delete account). For any complaint about your data, contact the Grievance Officer — we respond within 48 hours.
Data security
Your data is stored in encrypted form on servers (Supabase, AWS Mumbai); each user can read only their own data (database-level rules). In the event of a data breach, we will notify affected users and the relevant authorities as required by law.
Children
The Platform is for users aged 18 and over; we do not knowingly collect data from anyone under 18.