Privacy Policy.

01. Who We Are

This Privacy Policy applies to The Dream Fit Academy, operating under the brand name Train With Kushal (TWK), accessible at www.kushalfitness.in.

We are a Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023. We determine the purpose and means of processing your personal data in connection with the services offered on this website.

02. Information We Collect

We collect personal data that you voluntarily provide, data generated automatically when you use our website, and data received from payment processors and marketing platforms. The categories of data we collect are:

03. How We Use Your Information

We process your personal data only for specific, stated purposes. We do not use your data for automated decision-making that has legal or similarly significant effects on you without your knowledge.

We will not use your personal data for any purpose materially different from those listed above without providing prior notice and, where required, obtaining your consent.

04. Payment Processing via Razorpay

What This Means for Your Payment Data

• Card data security: We do not store, transmit, or process your credit card number, debit card number, CVV, or full bank account details on our servers. This data is entered directly into Razorpay's PCI-DSS compliant checkout environment.
• Tokenisation: Razorpay uses built-in tokenisation that replaces raw card data at the point of collection, as required under RBI Master Directions (RBI/DPSS/2025-26/141, dated September 15, 2025).
• Data localization: All payment transaction data is stored within India in compliance with RBI data localization requirements. Any foreign copies are purged within 24 hours of transaction processing.
• Transaction data we receive: We receive only transaction confirmation details (Transaction ID, amount, plan selected, payment status, Razorpay Customer ID) sufficient to fulfil your subscription.
• Subscription mandates: When you subscribe to a recurring plan, you authorise a UPI Autopay or e-mandate. This authorisation is managed entirely by Razorpay. You may cancel your mandate at any time through your bank or UPI application.

Razorpay's Privacy Policy

For full details of how Razorpay handles your data, please review Razorpay's Privacy Policy at https://razorpay.com/privacy/. Razorpay's Buyer Privacy Notice, applicable to you as an end-customer, is available at https://razorpay.com/buyer-privacy-notice/.

Refund & Cancellation

Our Refund & Cancellation Policy is published separately at www.kushalfitness.in/refund-policy. All refund disputes involving payment transactions processed through Razorpay are subject to Razorpay's chargeback and dispute resolution process.

05. Sensitive Personal Data (Health & Fitness Information)

Health and fitness information that you voluntarily provide — including details of medical conditions such as PCOS/PMOS, thyroid disorders, insulin resistance, hormonal imbalances, or other health conditions — constitutes Sensitive Personal Data or Information (SPDI) under the Information Technology (SPDI) Rules, 2011 and Sensitive Personal Data under the DPDPA, 2023.

How We Handle Sensitive Data

• Explicit consent: We process your health and fitness information only upon your explicit consent, provided either through our onboarding intake form or as part of your coaching relationship with us.
• Purpose limitation: Health data is used solely to personalise coaching advice, programme recommendations, and nutritional guidance for you. It is never used for advertising, profiling, or shared with third parties for commercial purposes.
• Access restriction: Health information is accessible only to Kushal Dhillon (founder and head coach) and authorised TWK team members who require it to provide your services.
• No health data in community posts: We do not publish, share, or display your individual health information in the community without your explicit prior consent. Transformation results shared publicly are done only with your written approval.
• Not medical advice: Information provided by us is for fitness and wellness education only. It does not constitute medical diagnosis, treatment, or advice. You should consult a qualified healthcare professional for medical decisions.

06. Sharing of Information with Third Parties

We do not sell, rent, or trade your personal data to any third party for commercial purposes. We share your data only in the following limited circumstances:

When sharing data with third parties outside India (e.g. Skool.com, Meta), we ensure contractual safeguards are in place consistent with applicable data protection law. Third parties listed above are required to handle your data according to their own privacy policies, which we recommend you review.

Relevant third-party policies: Meta Privacy Policy  ·  Skool Privacy Policy  ·  Razorpay Privacy Policy

07. Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected, or as required by applicable law.

After the applicable retention period, data is securely deleted or anonymised. You may request early deletion of your personal data subject to legal retention obligations — see Section 8 (Your Rights) for how to make this request.

08. Your Rights under DPDPA 2023 & IT Rules 2011

As a Data Principal under the Digital Personal Data Protection Act, 2023, and as updated by the DPDPA Rules, 2025, you have the following rights regarding your personal data:

Right to Access

You have the right to obtain a summary of the personal data we hold about you and information about how it is being processed. You may also obtain the identity of third parties with whom we have shared your data.

Right to Correction & Erasure

You have the right to request correction of inaccurate or misleading personal data. You also have the right to request erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations.

Right to Nominate

You may nominate an individual who shall exercise your data rights in the event of your death or incapacity, as provided under Section 14 of the DPDPA, 2023.

Right to Withdraw Consent

Where processing is based on your consent (including health data and marketing communications), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

Right to Grievance Redressal

You have the right to raise a grievance with our Grievance Officer (see Section 13) and to escalate to the Data Protection Board of India if your grievance is not resolved satisfactorily within the prescribed timeline.

Right to Opt Out of Marketing

You may opt out of marketing communications at any time by: (a) clicking "Unsubscribe" in any marketing email; (b) replying "STOP" to any SMS; (c) contacting us at the details in Section 13. Opting out does not affect service communications related to your active subscription.

09. Cookies, Tracking & Meta Pixel

Cookies We Use

Our website uses cookies and similar technologies to operate correctly, analyse usage, and support our advertising. The categories of cookies we use are:

Meta Pixel & Conversions API

We use the Meta Pixel (formerly Facebook Pixel) and Meta Conversions API (CAPI) on our website. These tools are provided by Meta Platforms Ireland Limited (for users in India, data is processed under Meta's terms). They allow us to:

• Measure the effectiveness of our advertising on Facebook and Instagram
• Build Custom Audiences and Lookalike Audiences for ad targeting
• Track conversion events (page views, subscription initiations, completed subscriptions)
• Optimise our ad delivery to reach people most likely to be interested in our services

The Meta Pixel uses cookies and the Conversions API uses server-side event matching. Data transmitted includes hashed identifiers (email, phone), device information, and event data. Raw card data and sensitive health information are never transmitted to Meta.

You can opt out of Meta's use of your data for advertising by visiting Meta Ad Settings or through aboutads.info.

Managing Cookies

You can manage or disable cookies at any time through your browser settings. Note that disabling cookies may affect the functionality of parts of our website. Instructions for managing cookies in major browsers: Chrome · Firefox · Safari.

10. Data Security

We implement reasonable security practices as required under Rule 8 of the Information Technology (SPDI) Rules, 2011. Our security measures include:

• Payment security: All payment data is processed through Razorpay's PCI DSS Level 1 certified infrastructure. We implement tokenisation for card data as required under RBI Master Directions. We do not store payment credentials on our systems.
• Data transmission: Our website uses HTTPS (TLS encryption) for all data in transit. You should ensure the lock icon is visible in your browser before entering any personal information.
• Access controls: Personal data is accessible only to authorised personnel on a need-to-know basis, protected by authentication controls.
• Health data isolation: Sensitive health and fitness data is stored separately and subject to stricter access controls than general personal data.
• Third-party security: We require our data processors (Razorpay, Skool, hosting providers) to maintain security standards consistent with applicable law and industry practice.

Despite our best efforts, no method of data transmission or storage is completely secure. We cannot guarantee absolute security but are committed to implementing measures that appropriately protect your data against foreseeable risks.

11. Children's Privacy

Our fitness coaching services and community membership are intended for individuals 18 years of age and older. We do not knowingly collect, use, or disclose personal data from persons under the age of 18 without verifiable parental or guardian consent.

The Build Your Best Body programme, while targeting young adults (16–27), requires that users under 18 obtain parental consent before subscribing or sharing any personal data with us. If you are a parent or guardian and believe your child under 18 has provided personal data to us without your consent, please contact our Grievance Officer immediately at the details in Section 13 and we will take steps to delete such data.

12. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, applicable law, or regulatory requirements. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Post a notice on our website homepage for at least 30 days after the change
• Where required by law or where the changes affect your rights materially, seek your renewed consent
• Notify active subscribers via email or WhatsApp for significant changes

We recommend reviewing this policy periodically. Your continued use of our website or services after the effective date of any changes constitutes acceptance of the updated policy for changes that do not require consent, and explicit re-consent where required.

Archived versions of this policy are available on request from our Grievance Officer.

13. Grievance Officer & Contact Details

In accordance with the Information Technology (SPDI) Rules, 2011 (Rule 5(9)) and the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer to address any concerns, complaints, or requests related to your personal data and your rights under this policy.

Data Protection Board of India (Escalation)

If your grievance is not resolved to your satisfaction within 30 days of contacting our Grievance Officer, you have the right to approach the Data Protection Board of India for further redress, as established under Section 18 of the Digital Personal Data Protection Act, 2023.