What we collect, and why.

Prism is the operator of prismgym.com and the maker of the Prism gym software: the staff app, the member app, the kiosk, signage, studio TV and the on-site camera box. This policy covers two situations: when you visit this website, and when a gym that uses Prism holds data about you in the product. Questions and requests go to hello@prismgym.com.

1. This website

Walkthrough request. When you book a walkthrough we receive what you type: your name, gym name, e-mail, phone, country, city, role, business type, number of locations and members, the software you use today, how you heard about us, and any notes. With it we keep the page you landed on, the referring site, any campaign tags in the link, your browser language, the approximate location our hosting provider derives from your connection, and your IP address. We use this to reply to you and to understand which channels bring gyms to us. The request is stored in Prism’s own customer database and e-mailed to the team; it is never sold or shared with advertisers.

Bot check. The form uses Cloudflare Turnstile to tell people from bots. Turnstile processes browser signals under Cloudflare’s privacy policy; it does not show a puzzle unless it has to.

Manual search. What you type into the manual’s search box is logged with the number of results, the approximate location derived from your connection and your IP address, so we can see which chapters are missing. Do not type personal details into the search box.

Analytics. We use Vercel Web Analytics and Speed Insights. They are cookieless and give us aggregate page views, countries, referrers, device types and load times. They do not identify you.

Storage in your browser. Your light/dark theme choice is kept in local storage. The landing-page and campaign details above are kept in session storage for the length of your visit and sent only if you submit the form. There are no advertising cookies and no third-party trackers.

2. The Prism product

When you are a member or a member of staff at a gym that runs Prism, that gym is the controller of your data and decides what to collect. Prism processes it on the gym’s behalf and under the gym’s instructions. Ask your gym first; we help them answer. Depending on which features your gym has switched on, the product can hold:

• Identity and contact details, membership plan, payments, wallet balance and receipts.
• Attendance: check-ins at doors, kiosks and terminals, class and personal-training bookings.
• A profile photo and, where you have agreed, a face template used by door terminals and the kiosk.
• Health and fitness data you choose to record or connect: measurements, progress photos, personal records, food diary, sleep from a wearable, heart rate during classes, and Prism Checkup results. Checkup camera frames are processed on the kiosk and discarded.
• Device identifiers and Bluetooth signals used to open doors from your phone, and push-notification tokens.
• Messages you exchange with gym staff in the app.
• For staff: shift clock-ins (optionally geofenced), the selfie taken before sensitive actions, permissions, pay settings and the audit trail of actions taken in the staff app.

Cameras. Where a gym installs the Prism camera box, video is recorded and analysed on a computer inside the gym. Alerts and still images go to the gym’s staff. Face recognition on camera footage is off unless the gym enables it and records consent. Where an AI model reviews an incident image, faces are blurred first. Camera retention is set by the gym.

AI features. Some features draft text (replies to members, follow-ups, social posts) with an AI model under the gym’s control, from the gym’s own data. Nothing goes out to a member without a person at the gym approving it, unless the gym switches on automatic sending.

3. Where data is kept and who sees it

Prism runs on Vercel (website, hosting) and Supabase (database, sign-in, file storage). Each gym’s data is isolated at the database row level; files are private and served through short-lived signed links; the audit log is append-only. Staff at your gym see what their permissions allow. Prism staff access a gym’s data only to support that gym. Where a gym turns on Telegram, WhatsApp or SMS features, messages pass through those providers under their own terms. Write to us for the data region of your gym’s account.

4. Retention and deletion

Data is kept while the gym’s account is active and for as long as the gym’s legal and accounting duties require. Erasure requests are honoured with a 30-day grace period, after which personal data is removed while the gym’s financial records stay intact in anonymised form. Website walkthrough requests are kept for as long as we are in conversation with you, then deleted.

5. Your rights

You can ask for a copy of your data, have it corrected, have it exported, or have it erased. Members and staff should ask their gym; the product has export and erasure built in. If you cannot reach the gym, or your request is about this website, e-mail hello@prismgym.com and we will answer within 30 days. If you are in the EU or UK you also have the right to complain to your data-protection authority.

6. Children

This website is not aimed at children. Gyms that admit junior members are responsible for obtaining a parent or guardian’s consent before creating an account for someone under the age set by local law.

7. Changes

We will post changes to this page and update the effective date above. Material changes that affect members are also announced to the gyms that use Prism so they can inform their members.