Privacy Policy
Last updated: 6 August 2026
Effective from: 6 August 2026
1. Who we are
MEHMBR is a wellness studio discovery and booking platform operated by
Abhimanyu Kapoor Saraya, a sole proprietor trading as Kapsar, GSTIN 06IMHPK0555F1Z3, with its principal place of business at TG4 1B, Tower TG4, C/D Block Road, Sector 54, Gurugram, Haryana 122011, India.
In this policy, "MEHMBR", "we", "us" and "our" mean Kapsar. "You" means any person who uses the MEHMBR mobile application.
For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary in respect of personal data you provide to us, and you are the Data Principal.
2. What MEHMBR does, and what this means for your data
MEHMBR lets you discover wellness studios ("Studios"), view their classes and memberships, and make bookings. We are not the provider of any class, session or membership. Studios set their own prices, run their own classes, and collect payment from you directly. MEHMBR does not process, hold or receive payment for classes, credits or memberships.
This matters for your privacy because it means:
- When you buy credits or a membership, that transaction is between you and
the Studio. We record only that credits or sessions were granted to your account. We do not collect or store your card, UPI or bank details.
- When you book a class, we share the information the Studio needs to admit
you to that class. The Studio is an independent Data Fiduciary in respect of what it does with that information, and its own privacy practices apply.
3. Personal data we collect
3.1 Information you give us
| Data | Why we need it |
|---|---|
| Name | To identify you to Studios at check-in |
| Email address | Account creation, sign-in, account recovery, receipts and service communications |
| Profile photo (optional) | Displayed to Studios and, if you choose, other users |
| Emergency contact name and number (optional) | Given to a Studio if you have a medical emergency during a class |
| Reviews, ratings and written feedback | Published on the platform |
| Support correspondence | To answer your query and keep a record of it |
3.2 Information generated by your use of the platform
- Bookings, cancellations, attendance and waitlist entries
- Credits and memberships held with each Studio, and their usage
- Studios you follow, classes you save
- Notification preferences
- Approximate location, only when you grant permission, and only to sort
Studios by distance. We do not track your location in the background or store a location history.
3.3 Information collected automatically
- Device type, operating system version and app version
- Crash reports and diagnostic logs
- IP address and timestamps, retained in server access logs
3.4 Sensitive personal data
Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, certain data is "sensitive personal data or information" ("SPDI").
We do not ask for health information, and MEHMBR has no field for it. If a Studio asks you about injuries, conditions or physical limitations, that exchange is between you and the Studio and is not collected by us.
Your emergency contact details are optional. If you provide them, we store them solely to pass to a Studio in a medical emergency during a class you booked.
We do not collect financial information, biometric data, or any government identity number from users.
3.5 We do not knowingly collect children's data
MEHMBR is for people aged 18 and over. You must be 18 or older to create an account. We do not knowingly collect personal data from anyone under 18, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If we learn that an account belongs to someone under 18, we will delete it.
4. Why we process your data, and on what basis
Under the DPDP Act, we process your personal data on the basis of your consent and, where applicable, for the "certain legitimate uses" the Act permits.
| Purpose | Basis |
|---|---|
| Creating and maintaining your account | Consent |
| Verifying your identity when you sign in | Consent |
| Enabling bookings and sharing your name with the Studio you booked | Consent |
| Sending booking confirmations, reminders and cancellation notices | Consent |
| Showing your credit and membership balances | Consent |
| Publishing reviews you choose to write | Consent |
| Responding to your support requests and grievances | Consent; legitimate use |
| Detecting and preventing fraud, abuse and misuse | Legitimate use |
| Keeping accounting and tax records | Compliance with law |
| Improving the app, diagnosing crashes and measuring reliability | Consent |
We do not sell your personal data. We do not share it with advertisers. We do not use it for automated decision-making that produces legal effects for you.
5. Who we share your data with
Studios you interact with. When you book a class, request credits or request a membership, the relevant Studio receives your name, your booking details and, where you have provided it, your emergency contact. Studios see your attendance record for their own classes. Studios do not see your activity at other Studios.
Service providers who process data on our instructions. We use:
- Supabase — database, authentication and file storage, hosted in Mumbai, India
- Expo — application delivery and push notification routing
- Razorpay — payment processing, only if and when card and UPI payments are
enabled in the app. At present, payments are not processed through MEHMBR.
These providers are Data Processors. They act only on our instructions and are bound by contract to protect your data.
Where the law requires. We may disclose personal data where compelled by a court, tribunal or authority acting under law, or where necessary to establish, exercise or defend legal claims.
On a business transfer. If MEHMBR is sold or transferred, your data may transfer with it. We will notify you before this happens and your rights under this policy will continue to apply.
6. Where your data is stored
Your data is stored on servers located in Mumbai, India. Some of our service providers may process limited technical data outside India in the course of delivering their services. We do not transfer personal data to any country that the Central Government has restricted under Section 16 of the DPDP Act.
7. How long we keep your data
| Data | Retention |
|---|---|
| Personal and identifying data — name, email, phone, address, photo, bio, date of birth, gender, preferences, saved items, follows and emergency contacts | Deleted immediately when you delete your account |
| Reviews you have published | Retained, anonymised — no longer linked to your identity |
| Booking, credit and membership records, and payment and commission records | Anonymised on deletion and retained only as required to meet legal, tax and accounting obligations — up to 6 years under the CGST Act, 2017 — then deleted |
| Server access and security logs | 12 months |
| Support correspondence | 3 years |
Personal and identifying data is erased at the point you delete your account. What remains after that — bookings, credit and membership records, and payment records — is anonymised so it can no longer be linked to you, and kept only as long as tax and accounting law requires.
We retain these transactional records for up to 6 years because the law requires it. They relate to transactions between MEHMBR and Studios, and contain your data only where a booking is part of the underlying record.
8. Your rights
Under the DPDP Act you have the right to:
- Access a summary of the personal data we hold about you and how we
process it
- Correct data that is inaccurate, and complete or update data that
is incomplete or out of date
- Erase your personal data, unless we are required by law to retain it
- Nominate another person to exercise your rights if you die or become
incapacitated
- Withdraw consent at any time, as easily as you gave it. Withdrawal does
not affect processing carried out before withdrawal, and may mean you can no longer use parts of the platform
- Grievance redressal, described in section 10
To exercise any of these rights, use the account settings in the app or write to support@mehmbr.com. We will respond within 30 days.
You may also delete your account at any time from Settings in the app. Deletion removes your profile and disassociates your reviews. Records we are legally required to keep are retained for the periods in section 7 and are not used for any other purpose.
9. How we protect your data
We maintain reasonable security practices and procedures appropriate to the nature of the data we hold, including:
- Encryption of data in transit using TLS
- Encryption of data at rest on our database provider's infrastructure
- Row-level access controls, so a user or Studio can only reach data they are
entitled to see
- Password-based authentication, with passwords stored only as salted hashes, never in plain text
- Restricted administrative access, limited to the proprietor
- Regular review of access rules and dependencies
No system is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected Data Principal, in the form and manner the DPDP Act and its rules require.
10. Grievance redressal
If you have a complaint about how we handle your personal data, or about content on the platform, contact our Grievance Officer:
Grievance Officer: Abhimanyu Kapoor Saraya
Email: support@mehmbr.com
Address: TG4 1B, Tower TG4, C/D Block Road, Sector 54, Gurugram, Haryana 122011, India
We will acknowledge your complaint within 24 hours and resolve it within
15 days of receipt, in accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
If your complaint concerns a consumer issue, we will acknowledge within
48 hours and resolve within one month, in accordance with the Consumer Protection (E-Commerce) Rules, 2020.
If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act.
11. Changes to this policy
We may update this policy. If we make a material change, we will notify you in the app and by email before it takes effect, and where the law requires it, ask for your consent again. The date at the top shows when this version took effect. Previous versions are available on request.
12. Contact
Email: support@mehmbr.com
Post: Kapsar, TG4 1B, Tower TG4, C/D Block Road, Sector 54, Gurugram, Haryana 122011, India