Who we are
GymFlex is operated by GYMFX APP, registered in the Kingdom of Bahrain under Commercial Registration No. 201967-1. We are responsible for the personal data described in this policy.
What we collect
When you create an account: your name, phone number, email address, date of birth and gender.
When you use your membership: the partner gyms you visit and the time of each check-in.
When you contact support: the messages you send us.
Identity verification
Before your first visit, we verify your identity with your CPR through Didit, our verification provider. We store your CPR number encrypted. We keep the result of the check and the photo from your CPR so reception can recognise you.
Your photo at reception
When reception scans your pass, the gym sees your photo and name to confirm the pass is yours. Your photo is never part of the pass code itself.
How we use your data
To run your membership and check-ins, pay partner gyms for visits, prevent pass sharing and fraud, answer support requests and keep the records the law requires, such as VAT records. We do not sell your data.
Where your data is stored
Our servers are on Google Cloud, outside Bahrain. We transfer your data there under the safeguards required by Bahrain’s Personal Data Protection Law (Law No. 30 of 2018).
Payments
Payments are processed by Tap Payments. GymFlex never sees or stores your full card details.
Crash reports and tracking
If the app crashes, it sends an anonymous crash report so we can fix the problem. We do not use advertising trackers.
How long we keep it
We keep your data while your account is open. When you delete your account in the app, your personal data is deleted immediately. Payment and visit records are kept in anonymised form, for VAT and partner payouts.
Your rights
You can ask to see, correct or delete your data, or object to how we use it. Write to us at [email protected] and we will reply within the time the law requires.