Privacy Policy
Version 1.0 · Effective 13 October 2026
This policy explains what personal data KSRAT collects, why, who sees it, how long we keep it, and your rights. It covers our website (ksrat.com), our app (app.ksrat.com), and coaching through KSRAT Online and KSRAT Studio.
1. Who we are
KSRAT is a fitness coaching business based in Delhi, India, with two divisions:
- KSRAT Online (remote 1:1 coaching) and the KSRAT app are run by Megellan Fernandes.
- KSRAT Studio (in-person training in Gulmohar Park, Delhi) is run jointly by Megellan Fernandes and Mehul Saini.
For your data, KSRAT is the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act), and the "controller" under UK/EU GDPR for clients there.
Privacy contact (Grievance Officer): Megellan Fernandes · ksratpts@gmail.com · Gulmohar Park, New Delhi
2. What we collect
| What | Examples | When |
|---|---|---|
| Contact details | Name, phone, email, city, country, time zone | Consultation request, sign-up |
| Profile | Date of birth, gender, occupation | Sign-up |
| Health information | Health screening (PAR-Q) answers, injuries, medical conditions, medications, medical clearance | Sign-up, and when you update it |
| Fitness data | Goals, body weight, measurements, training baseline, check-ins, attendance, coach notes | During coaching |
| Consent records | What you agreed to, your typed signature and date, emergency contact | Sign-up |
| Payment records | Plan, amount, currency, date, method, receipt number | When you pay |
| Account data | Username, password (stored only as a secure hash), sign-in times | When you use the app |
| Technical data | IP address, browser type, essential cookies | When you visit the site or app |
Health information is sensitive. We collect only what we need to coach you safely.
We do not collect card numbers or bank login details. You pay through your own UPI app, bank or transfer; we record only that the payment was made.
3. Why we use it
- To coach you safely: screen your health, design and adjust your programme, and track your progress.
- To run your membership: sessions, attendance, renewals, receipts and payment records.
- To talk to you: check-ins, scheduling and service messages by WhatsApp, phone or email.
- To keep the service secure: sign-in protection, fraud and bot checks, and backups.
- To meet the law: tax, accounting and legal record keeping.
- Marketing tips and offers: only if you opt in. You can opt out at any time.
We rely on your consent (given at sign-up) for health data, and on our need to deliver the service you bought, or a legal duty, for the rest.
Progress photos, testimonials and results are never used publicly without your separate written consent, which you can withdraw at any time for future use.
4. Who sees it
- Your coach and the KSRAT team members who need it (the owner, and the studio's shared front-desk account for scheduling and payments). Each person sees only what their role needs.
- Service providers who run our systems for us, under confidentiality:
| Provider | What it does | Data involved |
|---|---|---|
| Railway Corporation (USA) | Hosts the app and its database | Everything stored in the app |
| Netlify (USA) | Hosts the website | Technical data |
| Website fonts; "Continue with Google" sign-in if you choose it | IP address; name and email from Google | |
| Cloudflare | Bot check on sign-up and password reset, when switched on | Technical data |
| Email provider | Sends account and password emails | Name, email |
| WhatsApp (Meta) | Messages between you and your coach | What you send on WhatsApp |
- Authorities, only when the law requires it.
We never sell your data and we do not use advertising trackers.
5. Where it is stored
The app and its database are hosted by Railway on servers outside India. By using KSRAT you understand your data is transferred there. We use providers with recognised security standards, and we follow any restrictions the Indian government places on transfers. Everything is sent over encrypted (HTTPS) connections.
6. How we protect it
Access requires a personal sign-in. Passwords are stored only as secure hashes. Sign-ins expire automatically. Staff who leave lose access straight away. Every change to your record shows who made it. No system is perfectly secure, but we take reasonable steps and keep improving them.
7. How long we keep it
- While you are a member: for as long as you coach with us.
- After you leave: coaching and health records for 3 years (for continuity if you return, and for safety and legal claims), then deleted.
- Payment and tax records: 8 years, as Indian tax law requires.
- Consultation requests that don't become members: deleted within 12 months.
8. Your rights
You can ask us to:
- show you the data we hold about you, and give you a copy;
- correct or update anything inaccurate;
- delete your data, except records the law requires us to keep (such as tax records);
- withdraw consent at any time. This stops future use. It doesn't undo past use, and we may not be able to coach you safely without health data;
- nominate someone to act for you if you are unable to;
- raise a grievance with our Grievance Officer (section 1). We will respond within 30 days.
If you're not satisfied, you can complain to the Data Protection Board of India. UK and EU clients can also complain to their local data protection authority (for example, the UK ICO).
9. Age
KSRAT coaches adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn we have, we delete it.
10. Cookies
We use only essential cookies: one that keeps you signed in to the app, and one that remembers your settings. We use no advertising or analytics cookies.
11. Data breaches
If a breach affects your data, we will tell you and the Data Protection Board of India as the law requires, explain what happened, and tell you what we're doing about it.
12. Changes
If we change this policy, we'll update the version and date above. If the change matters to active members, we'll tell you directly.