Your members’ data stays yours.

Your gym decides which members to add, what to record about them and what it is used for. In the words of the Nigeria Data Protection Act 2023, that makes your gym the data controller. Qynix Limited ("Qynix", "we") runs FitOS and handles that information on your behalf and on your instructions, which makes us the data processor.

In practice this means we work for you. We do not get to decide new uses for your members’ information, and we do not treat your member list as our own customer list.

FitOS keeps only what it needs to run your gym:

• About each member: name, phone number, and, if you or they choose to add them, email address, home address and birthday (day and month only, no year).
• Their membership: plan, start and expiry dates, status, freezes, bookings and referrals.
• Their activity: one check-in record per day, and purchases made at your bar.
• Their payments: the amount, date, status and reference of each payment. We never receive or store card numbers, PINs or bank login details.
• About you and your staff: names, phone numbers, email, and the bank account member payments are sent to. We do not ask for your NIN, BVN, business registration number or ID documents to sign up.

We do not collect members’ health or medical information, fingerprints or face scans, and FitOS has no place to record them.

We use your members’ information only to provide FitOS to you:

• Checking members in and showing you and your staff who came in.
• Taking and recording their payments to your gym.
• Sending the messages you have switched on, in your gym’s name: welcome details, renewal reminders, announcements, booking and freeze updates.
• Showing you reports about your own gym.
• Fixing problems and answering your support requests.

We will never:

• Sell, rent or trade your members’ information to anyone.
• Send your members advertising for Qynix, for another gym or for anyone else.
• Show your member list, or anything in it, to another gym.
• Use your members’ personal details to build products for other customers.

We do look at overall figures that identify nobody, such as how many check-ins FitOS handles in a day, to keep the service running well.

• You, the owner, can see everything about your own gym.
• Your staff have their own sign-in with what the front desk needs. They cannot change your settings or your payout account.
• Each member can see only their own profile, payments and visits. A member who refers a friend sees the friend’s first name only.
• Other gyms cannot see any of it. Every record in FitOS is tied to one gym, and the system refuses requests that reach across gyms.
• Qynix support staff can open your gym’s records when that is needed to set you up, help you or fix a fault, and for no other reason. Each time they do so through our support screens it is listed in your Settings, under “Qynix support access”, so you can see it for yourself. The field agent who onboarded you sees your gym’s name, plan, status and how many members it has, but not who they are.

We do not hand member information to third parties because they ask for it. We disclose it only where the law genuinely requires us to, for example under a valid court order, and where we are allowed to we will tell you first.

• Encrypted in transit. Everything between a phone or computer and FitOS travels over HTTPS, so it cannot be read on the way.
• Passwords are never stored as written. They are put through a one-way scrambling process, so nobody at Qynix can read a member’s or owner’s password.
• Card details never reach us. Payments are entered directly with Paystack, a licensed payment company.
• A closed-off database. The database is not reachable from the internet; only the FitOS software, running on the same protected server, can talk to it.
• A firewall and limited accounts. The server accepts only normal web traffic, and FitOS runs under a restricted account rather than with full control of the machine.
• Daily backups. A copy of the database is taken every night and kept for 14 days, so information can be restored after a fault or a mistake.
• No shared passwords left lying around. When a password is reset for someone, they must choose a new one of their own before they can do anything else.
• Optional two-step sign-in. Owners and staff can switch on a one-time code at sign-in from Settings.

No system connected to the internet can honestly be called unbreakable, and we will not tell you ours is. What we can promise is that we take sensible, standard precautions, keep improving them, and tell you plainly if something goes wrong.

A few specialist companies process information for us so that FitOS can work. They receive only what their job needs:

• Paystack processes payments. It receives the payer’s email or phone number and the amount.
• Termii delivers text messages. It receives the phone number and the message.
• Resend delivers emails. It receives the email address and the message.
• Hetzner provides the server FitOS runs on, in a data centre in Germany. This means member information is stored outside Nigeria, in a country with strict data protection law of its own.

We do not use advertising networks or sell access to any of this to data brokers.

Your members have the right to know what is held about them, to have it corrected, and to ask for it to be deleted. FitOS gives you the tools to honour that:

• A member can see their own details, payments and visits in the member app.
• You can correct a member’s details at any time from the Members page.
• A member can delete their own account from the member app. Their profile, sign-in and visits are removed; your gym keeps the record of what they paid, without their name on it.
• If a member asks you to remove them instead, contact us and we will delete their record for you.

If a member contacts Qynix directly about their information, we will pass the request to you rather than act behind your back, because the decision is yours as the controller.

• You can download your members, their payments and their check-ins from Settings at any time, as files any spreadsheet opens.
• Your information is not held hostage. There is no fee and no notice period for taking your data.
• When you ask us to close your gym’s account, we permanently delete your gym, its members and their history from the live system within 30 days.
• Copies inside our nightly backups disappear as those backups expire, at most 14 days later.
• We keep only what the law obliges us to keep, such as records of payments made to Qynix for your subscription.

If we discover that your members’ information has been accessed, lost or exposed when it should not have been, we will tell you without undue delay and no later than 72 hours after confirming it. We will tell you what happened, which information was involved, what we have done about it and what we suggest you do. We will also make any report to the Nigeria Data Protection Commission that the law requires of us.

Keeping members’ information safe is shared work. We ask that you:

• Let your members know you use FitOS to manage their membership.
• Record only what you need, and keep it accurate.
• Give each staff member their own sign-in rather than sharing yours, and remove access when someone leaves.
• Choose a strong password, and switch on two-step sign-in.
• Tell us straight away if you think someone has got into your account.

If anything here is unclear, or you want something in writing for your own records, write to info@qynix.ng or call +2349063559535. A real person will answer.

This page sits alongside our Privacy Policy and Terms of Service. If we change it in a way that affects you, we will tell gym owners before the change takes effect.