Last updated: 3 October 2026
This Privacy Policy explains how CODING SPHERE (“Gymed”, “we”, “our”, or “us”) collects, uses, shares and protects your personal data when you use the Gymed mobile app, its Apple Watch companion app, and our website gymed.in (together, the “Services”).
By using the Services, you acknowledge that you have read this Privacy Policy. If you have questions, contact us at hey@codingsphere.co.
1. Who We Are
The Services are operated by CODING SPHERE, India. For personal data processed through the Services, we are the “data controller” (GDPR) and the “Data Fiduciary” (India’s Digital Personal Data Protection Act, 2023, the “DPDP Act”).
2. Information We Collect
a) Account information
You sign in to Gymed with Google Sign-In or Sign in with Apple, both handled by Google Firebase Authentication. We receive your name, your email address and a unique user ID. If you use Sign in with Apple and choose “Hide My Email”, we receive an Apple private relay email address instead of your real one. We never receive or store your Google or Apple password.
b) Profile and fitness information you provide
- Gender, age, height, current weight, weight history and target weight
- Diet preference, activity level and fitness level
- Workout plans you create or adopt, workout logs and sets (exercises, reps, weights, durations)
- Food, water and calorie logs
Some of this information relates to your health and fitness. We use it only to provide the Services, as described below.
c) AI Coach content (only if you choose to use the AI Coach)
The messages you send, plus any photos or files you attach, and the AI-generated replies and plans.
d) Usage and device information
We use Google Firebase Analytics to collect app usage events (for example, which screens and features you use), device information (such as device model, operating system version and app version), an app instance identifier, and basic diagnostic information. Our servers may also log technical data such as IP addresses for security and troubleshooting.
e) Communications
If you email us, we keep your email and our reply so that we can support you.
3. How We Use Your Information
We use your information to:
- Create, authenticate and manage your account
- Generate personalised workout and diet plans, and track your progress
- Provide the AI Coach, if you have enabled it
- Sync your workouts between your iPhone and Apple Watch
- Understand how the app is used so we can fix bugs and improve features, performance and security
- Respond to support requests and send important service notices
- Comply with legal obligations and enforce our Terms of Service
We do not use your data for advertising, we do not sell your personal data, and we do not track you across other companies’ apps or websites.
4. Legal Bases for Processing
Where the GDPR or a similar law applies, we rely on:
- Contract: to provide the Services you signed up for, including your profile, plans and logs
- Consent: for sending data to our AI provider through the AI Coach, and for any health-related data where consent is required. You can withdraw consent at any time.
- Legitimate interests: for analytics, security and improving the Services, balanced against your rights
- Legal obligation: where the law requires us to keep or disclose information
Under the DPDP Act, we process your personal data on the basis of your consent and for the legitimate uses the Act allows.
5. AI Coach and OpenAI
The AI Coach is powered by OpenAI. We send no data to OpenAI until you give explicit consent in the app. After you consent, we send OpenAI the information needed to respond to you: your messages, any photos or files you attach, and the relevant profile and fitness data (for example age, weight, goals, diet preference and workout history). OpenAI uses this to generate replies and plans.
- You can withdraw consent at any time in Profile → AI data sharing. After you withdraw it, the AI Coach features stop sending your data to OpenAI.
- We do not use AI Coach data for advertising.
- OpenAI processes this data under its API terms. According to OpenAI’s published API data usage policy, by default data sent through its API is not used to train OpenAI’s models. OpenAI may keep it for a limited period for abuse monitoring. OpenAI’s practices are governed by its own policies, which may change. See openai.com/policies for details.
- Your chat history and attachments are stored on our servers (Amazon S3 and our databases) so you can see past conversations. They stay there until you delete them or delete your account.
AI-generated content is for general fitness information only. It is not medical advice.
6. Device Permissions
- Camera and photo library: used only when you choose to attach an image to an AI Coach chat. We do not access your camera or photos at any other time.
- Apple Watch: the Gymed Watch app syncs your workout data with the Gymed iPhone app. Gymed does not read from or write to Apple Health (HealthKit).
You can change permissions at any time in your device settings.
7. How We Share Information
We share personal data only with service providers who process it for us under contract, and only as needed to run the Services:
| Provider | Purpose |
|---|---|
| Amazon Web Services (AWS), Mumbai region (ap-south-1) | Hosting, databases (Postgres, DynamoDB), file storage (S3), server functions (Lambda) |
| Google Firebase (Authentication, Firestore, Analytics) | Sign-in, app data storage, usage analytics |
| Apple | Sign in with Apple |
| OpenAI | AI Coach responses, only after you consent |
We may also disclose information if the law requires it, to protect the rights, safety or property of our users or of CODING SPHERE, or as part of a merger, acquisition or sale of assets. In that case, this Policy will continue to protect your data, or we will notify you.
We do not sell or rent your personal data, and we do not share it with advertisers or data brokers.
8. International Data Transfers
Your data is primarily stored in India (AWS Mumbai). Some of our providers, including Google Firebase and OpenAI, may process data in other countries, such as the United States. When we transfer data abroad, we rely on safeguards such as our providers’ contractual commitments, including Standard Contractual Clauses where applicable, and we comply with applicable Indian law on cross-border transfers.
9. Data Retention
- We keep your account, profile, plans, workout, weight and food logs, and AI chats for as long as your account is active.
- You can remove individual AI chats from your history in the app. Deleting your account permanently erases all of the data listed in section 10.
- Analytics data is kept according to Firebase’s retention settings and is not linked to your name or email.
- We keep limited records, such as transaction or payment records if any exist, support correspondence, or security logs, only for as long as the law requires or to resolve disputes. We then delete or anonymise them.
10. Deleting Your Account
You can permanently delete your account in the app at any time: Profile → Delete account.
This permanently deletes your account and the associated data: your profile, plans, workouts and sets, weight history, food and water logs, AI chats and attachments, and your Firebase login. If you signed in with Apple, we also revoke Gymed’s access to your Apple ID. If you created a plan that other users have added to their own accounts, they keep their copy of the plan, but your name is removed from it.
You can also ask us to delete your account by emailing hey@codingsphere.co from the email address linked to your account. Deletion cannot be undone. As explained in section 9, we may keep certain records where the law requires it.
11. Security
We protect your data with reasonable technical and organisational measures. These include encryption in transit (HTTPS/TLS), access controls, authenticated APIs and reputable cloud infrastructure. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the relevant authorities as the law requires.
12. Your Rights
Depending on where you live, including under the GDPR and India’s DPDP Act, you may have the right to:
- Access the personal data we hold about you
- Correct or update inaccurate or incomplete data. You can edit most of your data directly in the app.
- Delete your data (see section 10)
- Withdraw consent at any time, for example for AI data sharing. This does not affect processing that happened before you withdrew consent.
- Data portability: receive your data in a commonly used format
- Object to or restrict certain processing
- Nominate another person to exercise your rights if you die or become incapacitated (DPDP Act)
- Raise a grievance with us, and complain to your local data protection authority or, in India, to the Data Protection Board of India
To exercise any of these rights, email hey@codingsphere.co. We may need to verify your identity, and we will respond within the time required by applicable law. We will not discriminate against you for exercising your rights.
13. Children’s Privacy
Gymed is not directed at children under 13, or under the minimum age required by your local law. Under the DPDP Act, users under 18 may use Gymed only with verifiable consent from a parent or guardian. We do not knowingly collect personal data from children without the required consent. If you believe a child has given us personal data, contact us and we will delete it.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the new version on this page and update the “Last updated” date. If we make significant changes, we will notify you in the app or by email.
15. Contact Us and Grievance Officer
If you have questions, requests or complaints about this Privacy Policy or your data, contact:
CODING SPHERE
Email: hey@codingsphere.co
Website: gymed.in
This email address also reaches our Grievance Officer under the DPDP Act and the Information Technology Act, 2000.