Privacy
Policy

This policy covers Premium Fitness, 3rd Floor, 321 Kandy Road, Dalugama, Kelaniya, and applies to our members, trial and day-pass visitors, and anyone who uses this website or the member booking app.

We are the controller of the personal data described here. If you want to reach us about anything on this page, the contact details are at the bottom.

You give us

• Identity and contact details — your name, mobile number and, if you choose to give one, an email address.
• Health information you volunteer — injuries, conditions or medication you tell your coach about, so they can train you safely.
• Your goals and training notes — what you want to achieve, and your coach's notes on your programme.

We generate as you use the gym

• Bookings and attendance — the sessions you book, cancel, attend or miss, and which coach you trained with.
• Package and payment records — which plan you bought, when it runs and whether it is paid. We do not store card numbers.
• Account security data — a hashed version of your password (never the password itself) and the one-time codes we send you.
• Message log — a record of the SMS messages we have sent you, so we can prove a confirmation went out.

We do not buy data about you from anyone, and we do not run advertising trackers.

• To run your membership — bookings, quotas, your coach, your schedule.
• To let you log in securely and to reset your password.
• To send you SMS about your own sessions (see below).
• To train you safely, using the health information you have shared.
• To take payment and keep the accounting records the law requires.
• To keep the gym safe and to enforce our terms.

We rely on our contract with you for most of this, on your consent for the health details you volunteer, and on our legitimate interest in running a safe gym for the rest.

Your mobile number is central to how the gym works, so it is worth being specific about what lands on your phone.

• A one-time code when you first log in, and whenever you reset your password.
• A confirmation when your coach accepts a session you requested.
• An alert when a session of yours is cancelled or declined.

That is the whole list. We do not send marketing blasts, and we never sell or rent your number to anyone.

Your data stays inside the gym apart from the few suppliers we need to run it:

• Your coach sees your name, contact number, sessions and any health notes relevant to training you. Other coaches do not.
• Gym staff and management see membership and payment records so they can run the business.
• Our SMS provider receives your number and the message text, purely to deliver it.
• Our hosting provider stores the database the app runs on.
• Professional advisers and authorities, where the law requires it.

We do not sell your personal data. We have never done so and have no plans to.

We occasionally photograph the gym for our website and social media, and members are sometimes visible in those shots. If you would rather not appear, tell any staff member — before or after the fact — and we will keep you out of future shoots and remove existing photos of you.

Members filming their own training must not capture other people without their agreement, and never in changing areas.

The public pages carry no advertising trackers and no third-party analytics. Fonts, scripts and images are served from our own domain rather than an external network, so simply reading this page does not hand your visit to anyone else.

When you log in we set a session cookie. It exists to keep you signed in and to protect forms against cross-site request forgery. It is not used to profile you.

• While you are a member, plus a reasonable period afterwards in case you come back.
• Financial records for as long as tax and accounting law requires.
• One-time codes expire within minutes and are cleared soon after.

When we no longer need something, we delete it or strip it of anything that identifies you.

• Passwords are stored as one-way hashes — nobody at the gym can read yours.
• Access to member records is limited by role, so staff only reach what their job needs.
• The site is served over an encrypted connection.

No system is perfectly secure. If a breach ever affects your data, we will tell you promptly and explain what happened.

It is your data. You can ask us to:

• Show you a copy of what we hold about you.
• Correct anything that is wrong or out of date.
• Delete data we no longer have a reason to keep.
• Stop using your health information, though this may limit how safely we can coach you.
• Hand your data to you in a portable format.

Ask at the counter or email us and we will respond within 30 days. There is no charge.

We do not knowingly register anyone under 16 without a parent or guardian present. For members aged 16 and 17 we hold the consent of a parent or guardian alongside their record.

If we change how we handle your data we will update this page and change the date at the top. Where a change is significant, we will tell you directly.

For anything about your data — questions, corrections, complaints — call 076 037 8191, email hello@premiumfitness.lk, or speak to the manager at the gym.