Privacy Policy

1. Introduction

This part describes how VMI collects, uses, and protects the data of users of the VMI Pro mobile application.

By using the app, you agree to the terms of this part of the Policy.

2. Data we collect

• Account data: name, phone number, email address, password (stored encrypted).
• Fitness activity data: records of gym visits, workouts, memberships, and schedules.
• Photos: profile picture and images you upload voluntarily.
• Location data: only with your permission — for features related to finding and visiting clubs.
• Technical data: device model, OS version, crash identifiers, and diagnostics.

3. How we use data

• Providing the app's core features: visit tracking, membership and schedule management.
• User identification and account security.
• User support and responding to inquiries.
• Improving app stability and quality (crash diagnostics).

4. Sharing with third parties

We do not sell personal data and do not share it with third parties for advertising. The app contains no ads.

• With the fitness club your account is linked to — to the extent needed for visit and membership tracking.
• With infrastructure providers (hosting, data storage) acting on our behalf.
• With public authorities — only where required by law.

5. Data storage and security

Data is transmitted over secure channels (TLS) and stored on servers with restricted access. Only authorized personnel who need it to operate the service can access personal data.

6. Account deletion and retention

You can delete your account and associated data in the app settings, or by sending a request to [email protected] from the phone number or email used at registration.

After account deletion, personal data is deleted or anonymized within 30 days, except where retention is required by law.

7. Your rights

• Request a copy of your personal data.
• Request correction of inaccurate data.
• Request deletion of your data.
• Withdraw consent to data processing (e.g., disable location access in device settings).

8. Children

The app is not intended for children under 13, and we do not knowingly collect their data.

1. Data we process

• Phone number — to sign in with an SMS code; it identifies your account.
• First and last name — optional, you enter them in your profile.
• Interface language and other app settings.
• Devices: platform (iOS or Android), app version and push token — to deliver notifications and let you know about updates.
• Club links: which clubs you belong to and your member ID in each club's CRM.
• Data from the club's CRM: your membership and its term, remaining visits, freezes, visit history and schedule, wallet balance and bonus points. It is stored in the club's CRM; the app requests it and shows it to you.
• The selfie you take for face check-in at the gym. It is sent to the club's CRM to be compared with the reference photo and is not kept by VMI longer than the check requires. We only keep a log of attempts — date, club, result and match score — without the image.
• Server logs: IP address, time and type of requests — for security and to prevent abuse, such as mass requests for SMS codes.

We do not collect location, contacts, microphone recordings or advertising identifiers. If you turn on the app lock, Face ID and fingerprints are checked by iOS or Android itself — neither the app nor VMI receives your device's biometric data.

2. Phone permissions

• Camera — for the face check-in selfie. The QR pass works without it.
• Notifications — for push messages. You can turn them off in your phone or app settings.
• Face ID or fingerprint — only if you turn on the app lock in your profile.

3. Why we process data

• Signing you in and protecting your account from others.
• Showing memberships, visits, wallet and bonus points from the clubs you attend.
• Gym entry by QR code or face — under your club's rules.
• Notifications from the service and your club, for example about your membership expiring.
• Answering support requests.
• Keeping the service secure: limits on SMS codes and sign-in attempts.

We do not sell personal data, show ads, or share data for advertising.

4. Legal basis

We process your account data based on your consent under the Law “On Personal Data” (ZRU-547). You give it on the sign-in screen when you tap “Get code” and accept the Terms of Use and this Policy.

VMI processes data from the club's CRM on the club's behalf. The club is responsible for collecting it lawfully and for obtaining your consent.

You can withdraw your consent at any time by deleting your account (see below) or by writing to [email protected].

5. VMI and your club: who is responsible for what

• VMI runs your app account: phone, name, settings, devices and club links. We are responsible for this data.
• Your club owns the data it holds about you as its member: your CRM profile, memberships, visits, payments, wallet and the reference photo for face check-in. The club's CRM runs on the Visit Manager platform, and VMI processes this data on the club's behalf. The club decides what to keep, for how long and who can see it.
• A club appears in the app once it sends an invitation to your phone number.

6. Who we share data with

• Your club — what it needs to serve you: check-in records, the selfie for face check-in, membership freeze requests.
• Eskiz (Uzbekistan) — your phone number and the text of the SMS with your sign-in code.
• Google Firebase Cloud Messaging (Google LLC) — your push token and the notification text, to deliver it to your phone. Google's servers may be located outside Uzbekistan.
• Our hosting provider — the company whose servers run the service, under a contract with us.
• Public authorities — only where and as required by law.

7. How we protect data

Data is only transmitted over a secure connection (HTTPS). Your sign-in keys are kept in the phone's secure system storage. Only staff who need access to run the service can access our servers and databases.

On iOS, sign-in data may stay in system storage even after you delete the app. To sign out completely, tap “Log out” in your profile before deleting the app.

8. Retention

• Account data — for as long as the account exists.
• Push token — until you sign out on that device or delete your account.
• Face check-in attempt log — for as long as the account exists.
• An SMS code is valid for 5 minutes; sign-in attempt counters are kept for no longer than 24 hours.
• Data in the club's CRM — under the club's rules.

9. Deleting your account

In the app: Profile → Delete account → confirm. Or write to [email protected] with the phone number of your account — we may ask you to confirm the number is yours.

Right after deletion we erase your name and settings, unlink all clubs and devices, delete notifications and your face check-in log, and end all sessions. Your phone number stays in a deactivated record so that signing in again with the same number does not create a duplicate account. If you want it deleted too, write to us and we will delete it unless the law requires us to keep it.

Memberships, visit history, payments and the reference photo are stored in the club's CRM and are not erased when you delete your account. To have them deleted, contact your club.

10. Your rights

• Find out what data we process about you and get a copy of it.
• Correct inaccurate data: your name in your profile, anything else through us or your club.
• Ask us to delete your data or stop processing it.
• Withdraw your consent to processing.
• Complain about our actions to the authorized state body for personal data protection or to a court.

Send requests about your account data to [email protected] — we will reply within 30 days. Send requests about CRM data to your club; if the club asks, we will help fulfil them.

11. Children

The app is not intended for children under 13, and we do not knowingly collect their data.