Privacy Policy

Who we are

Fitness Bootcamp is operated by HimalayanGurus Fitness (OPC) Private Limited, a company incorporated in India. We run residential health transformation programs, fitness vacations, online coaching, digital courses and printed journals, and we publish free health calculators at www.fitnessbootcamp.in.

Under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, we are the Data Fiduciary for the personal data described here. You are the Data Principal. Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 we are the body corporate holding your sensitive personal data.

Who this policy covers

This policy applies to you if you are:

• a visitor to www.fitnessbootcamp.in, including anyone using our free calculators
• someone who has sent an enquiry or submitted an application form
• a participant in a residential program, fitness vacation or camp
• an online coaching client, or a buyer of a digital course or journal
• a doctor, clinic, coach, studio, corporate or referral partner working with us
• someone who contacts us through Instagram, WhatsApp or email

It does not cover organisations you deal with directly, including venues, hotels, transport operators, airlines, diagnostic laboratories, payment companies and social media platforms. Those organisations handle your data under their own policies.

Definitions

• Personal data. Any information about you from which you can be identified.
• Health and medical data. Information about your physical or mental health, body composition, blood markers, fitness, diet, injuries, medication and related measurements. Indian law treats this as sensitive personal data.
• Usage data. Information collected automatically when you visit the website, such as IP address, browser type and pages viewed.
• Cookies. Small files stored on your device that help the website work and help us measure how it is used.
• Processing. Anything we do with your data, including collecting, storing, using, sharing, anonymising and deleting it.
• Service. Everything we provide through our website, programs and related platforms.

How we ask for consent

Under the Digital Personal Data Protection Act, 2023, consent must be free, specific, informed, unconditional and given by a clear affirmative action. We do not treat continued use of the website as consent for anything beyond basic website operation.

We ask for consent in layers, and each layer is separate:

• Website and cookies. Through the cookie banner on our site. You may accept, manage or refuse non-essential cookies.
• Enquiries and applications. Through a tick box on the form, with a link to this policy beside it.
• Health and medical information. Through an explicit consent in your participant agreement, because this is sensitive personal data.
• Photography, testimonials and case studies. Through a separate media consent form that names exactly where the material may appear.
• Research and publication. Through a further separate research consent form.

Declining any layer beyond the first does not remove your place in a program, except where the missing information genuinely prevents us from coaching you safely. If that is the case we will tell you plainly rather than proceeding.

We keep a record of the consent you gave, what it covered and when it was given, so that both sides have the same understanding later.

Information you give us

When you enquire or apply

• name, email address, phone number, city and country
• age, sex and occupation
• your goals, your history with training, and what you want the program to change
• answers to our application questionnaire

When you join a program

• emergency contact details
• identity and travel details where a venue, permit authority or airline requires them
• dietary requirements, allergies and food preferences
• signed waiver, participant agreement and consent forms
• billing details and payment records

During the program

• body measurements, weight and body composition, including BIA and DEXA results
• training performance, session logs and assessment results
• daily check in notes and coaching conversations
• progress photographs and measurements taken by your coach

When you contact us

We keep a record of emails, WhatsApp messages, call notes, Instagram messages and support requests so that your coach has the full context of your case.

Health and medical information

Health information is the most sensitive category we hold, and we handle it separately from everything else.

What we may collect:

• blood reports and laboratory panels, including lipid, metabolic, thyroid, vitamin and inflammatory markers
• blood pressure and resting heart rate readings
• existing conditions, past surgeries, injuries, allergies and current medication
• body composition results from BIA and DEXA scans
• reports you upload or send to your coach
• information relevant to your safety at altitude or during physical exertion

Our commitments

• Health information is collected only with your explicit consent, and only for coaching, program design and your safety.
• Access is restricted to the coaching team working directly on your case.
• We do not share health information with insurers, employers, advertisers or data brokers.
• We never use health information for advertising, audience building, lookalike targeting or any other marketing purpose.
• We do not sell health information, and we operate no arrangement that would allow it.
• Providing health information is voluntary, but some of it is necessary for us to design a safe program. Where a gap creates real risk, we will tell you rather than guess.

What we are not

We are a coaching and training organisation. We are not a hospital, diagnostic centre or medical practice. Nothing we provide is a medical diagnosis, prescription or treatment. Where a finding sits outside our scope, we will say so and recommend that you consult a qualified physician.

Wearables and connected apps

Some clients choose to share data from a watch, ring, fitness app or training platform. This might include sleep, heart rate, heart rate variability, steps, GPS routes, recovery scores and training load.

• Sharing this data is always optional and always your decision.
• We only receive what you actively send us or what you authorise through a connection you set up.
• GPS routes can reveal your home and your regular training locations. If that concerns you, send summary data instead of full route files, or ask your coach to work without location data.
• You can disconnect a service or stop sharing at any time. Tell us, and we will delete the exported data we hold.

The platform itself continues to hold your data under its own privacy policy. Disconnecting from us does not delete anything on their side.

Free health calculators

Our free tools include the BMI calculator, body fat calculator, TDEE and BMR calculator, metabolic risk check, vegetarian protein calculator, altitude pace calculator, Ladakh Marathon taper calculator and HYROX finish time estimator.

• The values you enter, including waist measurement, blood pressure and blood panel numbers, are calculated in your browser to produce your result.
• We do not store those values against your name unless you choose to send them to us, for example by submitting an enquiry or sharing a result with a coach.
• If you use the share feature, the result card image is generated on your device. You decide whether to download it, send it or discard it.
• If you add your name to a result card, that name appears only on the image you generate. It is not sent to us.

These tools give general information based on published formulas and population level cutoffs. They are not a medical assessment and they are not a substitute for advice from a qualified doctor.

Cookies, pixels and analytics

When you visit our website, the following may be collected automatically:

• IP address, approximate location, browser type and version, device type and operating system
• pages viewed, time on page, scroll depth, and the link or advertisement that brought you to us
• diagnostic data such as errors and load times

The tools we use

Your control

You can accept, refuse or change your cookie choices using the cookie banner on our site, and you can delete cookies through your browser settings. You can manage advertising preferences inside your Facebook, Instagram and Google account settings. Some features of the site may not work correctly if necessary cookies are blocked.

Why we use your information

Our legal grounds

In India, we process personal data on two grounds:

• Your consent, for coaching, health data, photography, testimonials, research and marketing.
• Certain legitimate uses recognised by the Digital Personal Data Protection Act, 2023, including compliance with law, responding to a medical emergency or a threat to life, and the safety of people during a disruption to public order.

Where the General Data Protection Regulation or the UK GDPR applies to you, we rely on consent for health data, on contract for delivering a program you have booked, on legal obligation for accounting and tax records, and on legitimate interests for website security and basic service improvement.

Withdrawing consent stops the processing it covered from that point onward. It does not make earlier lawful processing unlawful, and it does not remove records we are legally required to keep.

Software and automated tools

We use software to help us read reports, generate charts, track trends across a program and prepare draft summaries. This is a working tool, not a decision maker.

• A qualified coach reviews every plan, report and recommendation before it reaches you.
• No decision that affects your health, your place in a program or your safety is made by software alone.
• Where we use third party software to process health information, we use configurations that do not permit that provider to train models on your data.

If you would prefer that your reports are handled without any automated assistance, tell your coach and we will work that way.

Photography and on-site privacy

Photography is a normal part of a residential program. It is also personal, so we handle it carefully and we ask separately rather than folding it into your booking.

Progress photographs

Progress photographs are a coaching tool. They stay private between you and your coaching team. They are never published, shared or used in any other way without a separate signed consent, and you may ask for them to be deleted at any time.

Group and location photography

We photograph sessions, meals, treks and group moments. If you prefer not to appear, tell any member of the team at any point during the program. We will keep you out of the frame and remove existing images on request. You do not need to give a reason.

Photography by other participants

Many of our participants travel solo, and privacy inside a batch matters. Participants are asked not to photograph or film another participant without that person's permission, and not to post images of another participant on social media without asking them first. If something has been posted about you without your permission, tell us and we will raise it directly with the person concerned.

Accommodation and private areas

We do not photograph or film in bedrooms, bathrooms, changing areas or any private space. Where a venue operates its own security cameras in common areas, those recordings belong to the venue and are governed by its policy.

Testimonials and social media

We publish photographs, video, written reviews and named case studies only where you have signed a media consent form that states where the material may appear.

• You may withdraw that permission at any time by writing to us.
• On withdrawal we will remove the material from our website, our advertising and the social accounts we control, and stop any campaign using it.
• Material that other people have already downloaded, reshared, screenshotted or republished is outside our control. We will say that honestly rather than promise a removal we cannot deliver.
• Search engines and social platforms may hold cached copies for a period after removal. We will request removal where a mechanism exists.

When you interact with us on social media

If you comment on our posts, send us a direct message, tag us or use a hashtag we run, that content sits on the platform and is governed by the platform's own terms and privacy policy, not ours. We may reply, and we may reshare public content that tags us. If you would rather we did not reshare something, tell us and we will take it down.

We do not publish another person's health information, results or before and after images in response to a public comment or review, even where doing so would help our case.

Research and publication

We may study outcomes from our programs to understand what produces lasting change, and to contribute to research and education in preventive health.

• Participation is entirely optional and requires a separate signed research consent form.
• Declining has no effect on your program, your coaching or your place in a batch.
• Data is anonymised before analysis unless you have specifically agreed to be identified.
• You may withdraw from research use at any time before publication.

We may publish aggregate figures, for example the average change in a biomarker across a group. Aggregate figures do not identify any individual.

Who we share data with

We share personal data only where it is necessary to run the program or the business. Each provider receives the minimum information needed for its role, and is required to protect it.

We may also disclose information where it is necessary to protect someone's life or safety during a program, for example when arranging a medical evacuation.

We do not sell personal, health or medical data. We do not rent or trade contact lists, and we do not share client data with other coaches, gyms or wellness businesses.

Payments

Program fees are paid through Razorpay, a licensed payment gateway regulated in India. Card numbers, UPI credentials and net banking details are entered on Razorpay's own systems. We never see or store your full card number, CVV, UPI PIN or banking password.

We retain the transaction reference, amount, date and invoice so that we can confirm your booking, process refunds where applicable, and meet our accounting obligations. Razorpay processes your payment data under its own privacy policy.

Transfers outside India

Our programs run in India, and your records are held in India and on cloud services operated by the providers named in section 16. Some of those providers store or process data on servers located outside India, including in the United States and the European Union.

Where data is transferred outside India, we take reasonable steps to ensure it receives a comparable level of protection, through the provider's contractual commitments and its own security standards. We do not transfer personal data to any country that the Government of India has restricted.

If you are outside India, your personal data will be transferred to and processed in India, which may have different data protection standards from your own country.

How long we keep data

When a retention period ends, we delete the record or anonymise it so that it can no longer be linked to you.

Security

We follow reasonable security practices and procedures appropriate to the sensitivity of the data we hold.

• Access to client records is limited to the coaches and staff who need it for your case.
• Accounts holding client data are protected by strong passwords and two factor authentication.
• Health documents are stored in access controlled cloud storage, not on personal devices or in personal chat threads.
• The website is served over an encrypted connection.
• Staff, coaches and contractors are bound by written confidentiality obligations.
• Access is removed promptly when a person stops working with us.
• Devices used for work are protected by screen locks and device encryption.

No system is completely secure and we will not claim otherwise. What we commit to is taking appropriate measures, reviewing them, and telling you promptly if something goes wrong.

If something goes wrong

If a breach affects your personal data, we will inform you without unnecessary delay. We will tell you what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

We will also notify the Data Protection Board of India within the timeframe set out in the Digital Personal Data Protection Rules, 2025, and cooperate fully with any inquiry.

Your rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access. Ask for a summary of the personal data we hold about you, how we process it, and who we have shared it with.
• Correction. Ask us to correct data that is inaccurate, and complete data that is incomplete.
• Erasure. Ask us to delete your personal data, except where law requires us to keep it.
• Withdraw consent. Withdraw permission for any processing based on consent, as easily as you gave it.
• Nominate. Nominate another person to exercise your rights if you die or become unable to act.
• Grievance redressal. Raise a complaint with our Grievance Officer, and escalate to the Data Protection Board of India if you are not satisfied.

To exercise any of these rights, write to the Grievance Officer in section 29. We will verify your identity before acting, and we will respond within 30 days.

There is no charge for exercising your rights. If a request is clearly repetitive or excessive, we will explain our position before taking any further step.

Rights outside India

If you are in the European Economic Area or the United Kingdom, you also hold the rights granted by the General Data Protection Regulation and the UK GDPR, including access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests or direct marketing.

You may lodge a complaint with your local supervisory authority. Write to us using the details in section 29 and we will handle your request under that framework.

If you are in a jurisdiction with its own data protection law, tell us and we will apply the rights it gives you.

Marketing and messaging

We use email and WhatsApp to answer enquiries, share program details and stay in contact with participants. WhatsApp messages are delivered through Meta's infrastructure and are subject to its encryption and policies.

• If you have asked us about a program, we may follow up about it.
• You can stop marketing messages at any time by replying to ask us to stop, or by writing to us. We act on the request rather than asking you to justify it.
• We will still send messages necessary for a program you have booked, such as joining instructions, payment confirmations and safety information.
• We do not send commercial messages to numbers registered under the national Do Not Disturb register unless you have given us consent directly.
• We never build an advertising audience, custom audience or lookalike audience using health information.

Age requirement

Our services are for adults. Our 4-Week Program accepts participants aged 25 and above. Our other programs and services are open to adults only.

We do not knowingly collect personal data from anyone under 18 years of age, we do not enrol anyone under 18, and we do not direct advertising at children or track them for advertising purposes. If we learn that we hold data belonging to a person under 18, we will delete it promptly.

If you believe a person under 18 has provided us with personal data, write to us and we will remove it.

Links to other websites

Our site links to other websites, including social platforms, payment pages and partner organisations. We are not responsible for their privacy practices, and we encourage you to read their policies before sharing anything with them.

What this policy is not

This policy covers privacy and data protection only. It does not set out our booking terms, our payment and refund terms, our cancellation rules, or the physical risks involved in a residential program at altitude. Those are covered in our Terms and Conditions, our Refund and Cancellation Policy, and the participant waiver and agreement you sign before joining.

Nothing in this policy is medical advice, and nothing in it creates a doctor and patient relationship.

Changes to this policy

We update this policy when our services change or when the law changes. The effective date at the top of this page always shows the current version.

Where a change materially affects how we handle your personal data, we will tell current participants directly rather than relying on you to notice the update. Where the law requires fresh consent, we will ask for it rather than assume it.

Grievance Officer

If you have a question about this policy, want to exercise a right, or wish to make a complaint, please contact our Grievance Officer. A real person reads every message.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

Governing law

This policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Any dispute relating to this policy is subject to the exclusive jurisdiction of the courts at Bengaluru, Karnataka, India.