Privacy Policy

Maison de Medusa
Effective 23 October 2026 · Version 2026-10-23

Maison de Medusa ("we", "us", "the studio") is a partnership firm that runs a Reformer Pilates studio and tea room at Sy No. 04, Katha 799, K R Puram Hobli, Whitefield Main Road, Bengaluru, Karnataka 560066, India.

This policy explains what personal data we collect, why, who we share it with, and the choices and rights you have. It covers:

• our website, maisondemedusa.com;
• our booking and payment pages, and your personal booking link;
• our onboarding and health-screening form;
• our studio and front desk;
• our member app, when it launches.

We are responsible for your personal data, as the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023. Our member app is built and published for us by Aurora Designs, a software firm acting on our instructions.

1. What we collect

Details you give us

• Identity and contact: name, mobile and WhatsApp number, email, date of birth, gender, residential area, occupation, and how you heard about us (including who referred you).
• Emergency contact: the name, relationship and mobile number of someone we can call in an emergency. Please only give us someone who knows you're sharing their details for this purpose.
• Health and fitness information:
  • your answers to our health-screening questions, for example injuries, recent surgery, heart or blood-pressure conditions, chronic or musculoskeletal conditions, symptoms during exercise, regular medication, pregnancy and postpartum status, and current pain;
  • any details you add to those answers;
  • whether you have a doctor's clearance;
  • dietary or allergy notes;
  • optional lifestyle details: height, weight, sleep, stress and time spent seated.
• Your Pilates preferences: experience, goals, preferred formats and timings, and anything you tell us about your comfort level.
• Consents and declarations: your acceptance of our studio policies, your typed signature, your photo and video choice, and your marketing preferences.
• Guardian details for members under 18 (see section 8).
• Bookings and membership: the classes, workshops and events you book, cancel or attend; your plan and its validity; sessions used; check-ins and no-shows; and notes you add to a booking request.
• Payments: amounts, order references and payment status. You enter your card, UPI or bank details directly with our payment provider, Razorpay. We do not see or store your full card number or UPI ID.

Details we collect automatically

• On our public website pages:
  • the Meta Pixel and its cookies (_fbp, _fbc);
  • the advertising click ID and campaign tags (UTM) that brought you to us;
  • your IP address and browser type;
  • which booking buttons you tapped.

  We also store a few small items in your browser so bookings and payments work, for example a payment in progress, or whether you have dismissed a banner.

• When you use our systems: records of bookings and changes, including the time and the IP address of the request, for security and accountability.

Details from others

• A friend who refers you, or a parent or guardian completing the form for a minor.
• Our staff, when they record your bookings and attendance, or add a short care note to help look after you in class.
• Tally and Luma, if you apply for or RSVP to an event using their forms. They collect your submission under their own terms and share it with us.

We use photos or videos of you only if you have consented. We do not ask you to upload a photo.

2. Why we use it

We process your data with the consent you give on our forms. This covers bookings, the health screening, and marketing where you opt in. We also process some data because the law allows it without a fresh consent: to keep invoices for tax law, and to contact an emergency number or clinician if something happens at the studio.

You can withdraw consent at any time (section 7). Withdrawing does not undo processing already done. If you withdraw the consent we need to book and teach you, we won't be able to take further bookings. You can switch off marketing without affecting your membership.

The tick on our trial, workshop and drop-in forms is your consent to this Privacy Policy and our Terms, including the advertising measurement described in section 5 that runs when you submit. Marketing messages are a separate, optional tick.

3. Your health information

Health information is the most sensitive data we hold.

• Your instructor receives, with each booking:
  • short flags, for example "Injury" or "Pregnant";
  • your comfort note;
  • any short care note our staff have added.

  For each class, instructors also receive the names and phone numbers of everyone booked into it, so they can run the session and reach people if needed. These briefings are sent by email.

• Front-desk staff see your health-screening answers, including the details you wrote, so they can look after you at the studio. Your full onboarding form, with your personal and lifestyle details, is available only to studio management.
• AI tools that help our team manage bookings and member records receive only the short flags, never the health details you wrote.
• We do not sell your health information or use it for advertising.

4. Who we share it with

We never sell your personal data. We share it only with the service providers who help us run the studio, and only for these purposes:

Our team may also message you on WhatsApp from the studio's number.

Some of these providers are outside India. We use them because they run our booking, email, advertising or AI tools, and we remain responsible for your data.

We may also disclose data if the law requires it, to protect someone's safety, or to an emergency contact or medical professional in an emergency at the studio.

5. Cookies, tracking and advertising

Our public website pages use the Meta Pixel, which sets cookies (_fbp, _fbc). When you submit a trial, workshop or drop-in booking, we also send Meta:

• your email, phone and name, scrambled (hashed);
• your IP address, browser type and those click IDs.

This server-side sending (Meta's Conversions API) currently happens whatever your cookie settings. Blocking cookies in your browser will not stop it.

The Pixel does not run on your personal booking link, the onboarding form, or this page and our Terms.

There is no cookie choice on our website yet. You can change your Meta ad settings, which affects how Meta uses some of this data for ads. It does not stop us sending the events above.

6. How long we keep it

Today we do not delete personal data automatically. We still hold it after you stop training or after an enquiry closes, and we keep payment and tax records for as long as the law requires (generally up to 8 years).

We are putting these limits in place:

• member, booking and health records: 3 years after your last visit;
• enquiries and trial sign-ups that don't become a membership: 2 years;
• security and system records: 3 years;
• our copies of AI assistant conversations about members: 12 months (the AI providers' own logs follow their policies).

Until then, you can ask us at any time to delete or anonymise your data (section 7), and we will tell you what the law requires us to keep, such as invoices.

7. Your rights

Email contact@maisondemedusa.com, or speak to us at the studio, to:

• find out what personal data we hold about you and how we use it;
• correct or update inaccurate or incomplete data;
• delete your data, or withdraw your consent;
• stop marketing messages, at any time;
• nominate someone to exercise these rights for you if you die or become unable to act.

Our team handles these requests; there is no self-service page yet. When you ask us to delete your data, we deactivate your account so it can't be used for bookings or marketing, then remove or anonymise what we can by hand. This isn't automatic yet, so some records may remain until the limits in section 6 are in place. We'll tell you what the law requires us to keep, such as tax invoices.

We may need to confirm your identity. We aim to respond within 30 days.

Withdraw consent or stop marketing: email contact@maisondemedusa.com with the subject "Withdraw consent" or "Stop marketing".

8. Children

Members under 18 may train only with a parent's or guardian's consent. The parent or guardian completes or approves the onboarding form for the minor, and can exercise the minor's rights under this policy. We do not target advertising at children.

The Meta Pixel does not run on the onboarding form or on personal booking links. If a parent or guardian uses our public trial, workshop or drop-in form, the measurement described in section 5 applies to that visit. If you'd rather avoid this for a minor, book with us directly at the studio or over WhatsApp.

9. Security

We protect your data with access controls, encrypted connections, staff permissions, and by hiding sensitive links in our records. No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

10. Questions, grievances and complaints

Our privacy and grievance contact:

Maison de Medusa
Sy No. 04, Katha 799, K R Puram Hobli, Whitefield Main Road, Bengaluru, Karnataka 560066
Email: contact@maisondemedusa.com
Phone / WhatsApp: +91 79963 02999

We aim to resolve complaints within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

11. Changes to this policy

When our practices change, we publish a new version with a new version number and effective date at the top. We keep earlier versions on file. If a change is significant, we will tell you before it takes effect.