Product Requirements Document: GymStack Platform

Version: 1.0
Last Updated: April 2026
Status: Living Document

Product Vision

“Give every neighborhood gym the tech backbone of a Cult.fit.”

India has approximately 96,000 gyms, and 70-80% of them run entirely on paper registers, WhatsApp groups, and cash collection. Meanwhile, Cult.fit offers AI-powered personalization, 1,200+ workout videos, wearable integration, and a seamless member app — but only for its own 600+ centers. The remaining 95,000+ gyms are left in the digital dark ages.

GymStack is a white-labeled, India-first gym management SaaS platform that bridges this gap at 1/100th the cost of building it in-house. Three interconnected apps, one unified cloud platform — making it possible for a neighborhood gym in Patna to offer the same digital experience as a premium chain in Mumbai.

Target Users:

• Primary: Independent gym owners (single location, 150-400 members, Rs 2-5 lakh/month revenue)
• Secondary: Small chain owners (2-10 branches, 500-3,000 members)
• Tertiary: Gym trainers (10-25 PT clients each)
• End User: Gym members (22-34 age group, digital-first expectations)

Success Metrics:

• Gym monthly retention: >90% (>75% annual)
• Member check-in frequency: >3x/week average
• Fee recovery rate: 15-20% improvement in renewal collection
• NPS (gym owners): >50
• Time from signup to first value: <24 hours

Platform Architecture Overview

Three interconnected apps share a single multi-tenant cloud backend. Every gym gets isolated data via PostgreSQL Row-Level Security, but all share the same codebase, deployment pipeline, and feature set.

                         ┌───────────────────────────────┐
                         │       GYMSTACK CLOUD           │
                         │    (Multi-Tenant SaaS)         │
                         │                               │
                         │  PostgreSQL (RLS per gym_id)  │
                         │  Redis (cache + sessions)     │
                         │  BullMQ (jobs + reminders)    │
                         │  S3 (media + photos)          │
                         └──────────────┬────────────────┘
                                        │
                    ┌───────────────────┼───────────────────┐
                    │                   │                   │
           ┌────────▼────────┐ ┌────────▼────────┐ ┌───────▼─────────┐
           │  ADMIN/OWNER    │ │    TRAINER       │ │    MEMBER        │
           │  (Web + Mobile) │ │   (Mobile-First) │ │    (Mobile)      │
           │                 │ │                  │ │                  │
           │ Gym management  │ │ Client dashboard │ │ My Workout       │
           │ Billing & MIS   │ │ Workout builder  │ │ My Diet          │
           │ Multi-branch    │ │ Diet builder     │ │ QR Check-in      │
           │ Staff mgmt      │ │ Session mgmt     │ │ My Progress      │
           │ Lead CRM        │ │ Progress track   │ │ Class booking    │
           │ Analytics       │ │ Remote coaching  │ │ Community        │
           │ Check-in system │ │ Earnings tracker │ │ Payments         │
           │ Communication   │ │                  │ │ My Trainer       │
           │ Inventory/POS   │ │                  │ │                  │
           │ Class mgmt      │ │                  │ │                  │
           └─────────────────┘ └─────────────────┘ └─────────────────┘
                    │                   │                   │
                    └───────────────────┼───────────────────┘
                                        │
                    ┌───────────────────┼───────────────────┐
                    │                   │                   │
             ┌──────▼──────┐    ┌───────▼──────┐   ┌───────▼──────┐
             │  Razorpay   │    │  WhatsApp    │   │  Biometric   │
             │  (Payments) │    │  Business    │   │  Devices     │
             │  UPI autopay│    │  2-way bot   │   │  MQTT bridge │
             └─────────────┘    └──────────────┘   └──────────────┘

Data Flow: Every API request carries a JWT token containing the gym_id. The backend middleware sets app.current_gym in the PostgreSQL session, and Row-Level Security policies automatically filter all queries to that gym’s data. This means a trainer in Gym A can never accidentally (or intentionally) see data from Gym B — the isolation is enforced at the database level, not just the application level.

Admin/Owner App (Web + Mobile)

The Admin app is the command center for gym operations. The web dashboard (Next.js + Tailwind CSS) is the primary interface for data-heavy tasks like analytics and MIS reports, while the mobile companion (Flutter) enables on-the-go management for owners who spend most of their time on the gym floor.

Module 1: Member Management

Why it matters: The member database is the foundation of every gym operation. Today, most gym owners maintain this in paper registers or Excel sheets, making it impossible to search, filter, or act on member data at scale. A gym with 300 members literally cannot tell you how many are expiring this week without manually counting.

Key Features:

• Member Profiles: Full profile with photo, contact details, emergency contact, medical history (allergies, injuries, conditions), body measurements (height, weight, BMI, body fat %), fitness goals, and membership history. Every interaction is logged — check-ins, payments, plan changes, trainer sessions.

• Plan & Status Tracking: Each member has a current plan (Silver/Gold/Platinum or custom tiers), start date, expiry date, and status (Active, Expiring Soon, Expired, Frozen, Cancelled). The system auto-calculates “days remaining” and flags members entering the expiry window (configurable: 7, 15, or 30 days before).

• Family Memberships: Link family members under a single account. One payment covers multiple members. Discount rules configurable per gym (e.g., 10% off for second family member, 15% for third).

• Bulk Import: CSV/Excel import tool for migrating existing member databases. The system maps columns intelligently (it recognizes “Phone”, “Mobile”, “Contact No.” as the same field). Duplicate detection by phone number prevents double entries.

• Smart Filters & Segments: Filter members by status, plan type, join date, last check-in, trainer, payment status, or any combination. Save filters as “segments” for reuse (e.g., “Gold members who haven’t checked in for 7+ days”). Segments can be targeted with bulk communications.

• Member Timeline: A chronological view of every interaction — when they joined, every check-in, every payment, plan upgrades, trainer assignments, notes added by staff. This creates institutional memory that survives staff turnover.

User Flow — Adding a New Member:

1. Front desk taps “Add Member” (or scans a QR code from an inquiry form)
2. Enters phone number — system checks for existing profile (returning member detection)
3. Fills basic details: name, photo (camera capture), DOB, gender, emergency contact
4. Selects membership plan from gym’s configured options
5. Sets start date and calculates expiry automatically
6. Assigns a trainer (optional)
7. Generates a payment link or marks as “paid” (cash/UPI)
8. Member receives WhatsApp welcome message with: gym info, trainer details, check-in QR code, and link to download the member app
9. Profile is immediately visible to the assigned trainer in the Trainer app

Module 2: Billing & Payments

Why it matters: Fee collection is the #1 pain point for Indian gym owners. Hours every week are spent on WhatsApp and phone calls chasing renewals. Members who owe money often avoid the gym entirely, creating a vicious cycle of non-payment and dropout. Automated billing breaks this cycle.

Key Features:

• Razorpay Integration: Native integration with Razorpay for UPI, debit/credit cards, netbanking, and wallets. Members can pay from the member app, from a WhatsApp payment link, or at the front desk via QR code.

• UPI Autopay (Recurring Billing): Members can set up UPI autopay mandates for monthly/quarterly/annual renewals. Razorpay’s e-mandate system handles the recurring charge automatically. The gym owner wakes up to money in their account, not a list of people to chase.

• Auto-Reminders: Configurable reminder sequences triggered before and after expiry:

  • 7 days before expiry: WhatsApp message with renewal link
  • 3 days before expiry: Follow-up WhatsApp + push notification
  • Expiry day: “Your membership has expired” notification
  • 3 days after expiry: Personal follow-up reminder
  • 7 days after expiry: Special offer or callback request

  Each reminder includes a direct payment link. The gym owner configures the sequence once; it runs forever.

• GST-Compliant Invoicing: Every payment automatically generates a GST invoice with the correct HSN/SAC code (SAC 99971 for gym/fitness services, taxed at 18% GST; reduced to 5% from Sep 2025). Invoices include gym GSTIN, member details, breakup of base amount + GST, and a unique invoice number. Invoices are sent via WhatsApp and stored in the member’s payment history.

• Partial Payments & EMI Tracking: Many Indian gyms accept partial payments (“pay Rs 5,000 now, Rs 5,000 next month”). The system tracks partial payments, shows outstanding balances, and reminds members about remaining dues. For annual plans (Rs 14K-35K), EMI options via Razorpay are available.

• Payment Dashboard: Real-time view of today’s collections, pending payments, overdue amounts, and weekly/monthly trends. One number the owner checks every morning: “How much money came in today?”

• Offline Payment Recording: For cash and direct UPI payments (outside Razorpay), the front desk can record the payment manually with receipt number. This ensures the member database reflects all payments regardless of collection method.

User Flow — Automated Renewal:

1. System identifies members expiring in the next 7 days (daily cron job at 8 AM)
2. Sends WhatsApp message: “Hi Amit, your Gold membership at Pro Fitness expires on April 8. Renew now and continue your fitness journey! [Pay Rs 2,500 ->]”
3. Member taps the link, redirected to Razorpay payment page (pre-filled with amount and plan)
4. Payment completes — webhook from Razorpay triggers: membership extension, GST invoice generation, WhatsApp confirmation, and member app notification
5. If no payment by day 3, follow-up reminder is sent automatically
6. If no payment by day 7, the member is flagged for manual follow-up by staff

Module 3: Check-in System

Why it matters: Check-in data is the single best predictor of member retention. A member who goes from 4x/week to 1x/week is about to quit — but gym owners using paper registers can’t detect this pattern. Digital check-in transforms attendance from a compliance task into a retention intelligence system.

Key Features:

• QR Code Scanning: Each member gets a unique QR code (displayed in the member app or printed as a card). Front desk scans it using the Admin app’s camera, or members scan a gym-side QR code to self-check-in. Check-in takes under 2 seconds.

• Biometric Bridge (Phase 2): For gyms with existing fingerprint scanners (Mantra MFS100, Secugen Hamster Pro — common in Indian gyms), GymStack provides an MQTT bridge that connects the biometric device to the cloud. When a fingerprint is scanned, the device publishes to an MQTT topic; the bridge translates this into a GymStack check-in API call.

• Attendance Analytics: Dashboard showing daily/weekly/monthly check-in counts, peak hour heatmaps (which hours are busiest), average visits per member, and per-member attendance trends. The “Attendance Risk” widget highlights members whose visit frequency has dropped by 50% or more in the last 2 weeks.

• Peak Hour Reports: Hourly breakdown of check-ins helps owners manage capacity, schedule cleaning/maintenance during off-peak hours, and price peak vs. off-peak slots differently.

• Streak Counter: Members see their check-in streak in the member app (e.g., “12-day streak!”). Streak notifications are sent via WhatsApp when milestones are hit (7 days, 30 days, 100 days). Gamification of attendance is a proven retention tool.

• Auto-Checkout: If no explicit checkout, the system auto-checks out after a configurable duration (default: 2 hours). This prevents “phantom occupancy” in capacity reports.

User Flow — Member Check-in:

1. Member walks into the gym and opens the Member app
2. Taps “Check In” — a unique QR code is displayed with a 30-second expiry timer
3. Front desk scans the QR code using the Admin app (or dedicated tablet at entrance)
4. Check-in is recorded with timestamp. Member sees “Checked in! Enjoy your workout”
5. If the member has a workout plan assigned for today, it appears immediately: “Today’s workout: Chest & Triceps (assigned by Shubham)”
6. At the end of the session, member can optionally log workout completion data
7. Owner’s dashboard updates in real-time: current occupancy, today’s check-in count

Module 4: Trainer Management

Why it matters: Trainers are the primary retention lever in Indian gyms — members who work with a personal trainer have 2-3x higher retention rates. But trainer management in most gyms is entirely informal: verbal client assignments, no performance tracking, and when a trainer leaves, all client knowledge walks out the door with them.

Key Features:

• Trainer Profiles: Each trainer has a profile with photo, qualifications/certifications, specializations (weight loss, bodybuilding, functional training, yoga), years of experience, and client reviews. This profile is visible to members in the Member app, adding professionalism and trust.

• Certification Tracking: Upload and track trainer certifications with expiry dates. The system sends reminders 30 days before a certification expires. Required certifications can be configured per gym (e.g., CPR certification mandatory for all trainers).

• Schedule Management: Weekly schedule with time slots. Members can see trainer availability and book PT sessions directly. Trainers can mark themselves as available/unavailable. Leave management for planned absences.

• Client Assignment: Assign members to trainers with defined relationship types: personal training (1-on-1), batch/group training, or floor supervision. Each trainer has a client capacity limit (configurable, typically 15-25 for PT, 40-60 for floor). The system prevents over-assignment.

• Performance Metrics: Track and display per-trainer metrics:

  • Client retention rate (what % of their PT clients renew)
  • Average client check-in frequency
  • Session completion rate (scheduled vs. attended)
  • Client progress scores (average body composition improvement)
  • Client satisfaction (optional ratings after each session)

  These metrics are visible to the gym owner, enabling data-driven decisions about trainer compensation, bonuses, and client routing.

• Institutional Knowledge Preservation: Because all workout plans, diet plans, session notes, and client progress data are stored in GymStack (not in the trainer’s personal WhatsApp), the gym retains this knowledge when a trainer leaves. A new trainer can pick up exactly where the previous one left off.

User Flow — Assigning a Trainer:

1. Owner opens a member profile and taps “Assign Trainer”
2. System shows available trainers filtered by: specialization match (member’s goal vs. trainer’s expertise), current client load, and schedule compatibility
3. Owner selects trainer and defines relationship type (PT 1-on-1, batch)
4. Trainer receives notification in the Trainer app: “New client assigned: Amit (Goal: Weight Loss, Plan: Gold)”
5. Trainer reviews member’s profile, medical history, and body measurements
6. Trainer creates an initial workout plan and diet plan (see Trainer App modules)
7. Member receives notification: “Shubham has been assigned as your trainer. View profile.”

Module 5: Lead CRM

Why it matters: Most gyms lose 60-70% of walk-in inquiries because there is no structured follow-up process. A person walks in, asks about prices, says “I’ll think about it,” and is never contacted again. A basic CRM with automated WhatsApp follow-ups can convert 15-20% more inquiries into paying members.

Key Features:

• Walk-in Tracking: Front desk logs every walk-in with: name, phone, interest (gym membership, PT, group class), source (walk-in, Instagram, Google, referral, JustDial), and notes from the conversation. Takes under 30 seconds.

• Inquiry Management: Each inquiry becomes a “lead” with a status pipeline: New -> Contacted -> Interested -> Trial Booked -> Trial Completed -> Negotiating -> Converted / Lost. Staff can update status and add notes at each stage.

• Automated WhatsApp Follow-up Sequences: When a lead is captured, an automated follow-up sequence begins:

  • Immediate: “Thanks for visiting Pro Fitness! Here’s what we offer: [plan details link]”
  • Day 1: “Hi [name], any questions about our plans? Happy to help! Reply to chat.”
  • Day 3: “Book a free trial session this week. Tap to book: [link]”
  • Day 7: “Special offer for new members this month: [offer details]”
  • Day 14: Final follow-up with a limited-time discount

  Sequences are configurable. The gym owner writes the templates once; the system personalizes and sends them forever.

• Lead Scoring: Each lead gets a score (0-100) based on: source quality (referral = high, JustDial = medium), engagement (opened messages, replied, booked trial), demographics (age, locality), and timing (how recently they inquired). Higher scores get prioritized for personal follow-up.

• Conversion Funnel Dashboard: Visual funnel showing: Walk-ins this month -> Contacted -> Trials booked -> Trials completed -> Converted. With conversion rates at each stage and comparison to previous months. This tells the owner exactly where leads are dropping off.

• Trial Management: Book trial sessions for leads, assign a trainer for the trial, and track outcome. After the trial, an automated follow-up asks for feedback and offers enrollment.

User Flow — Walk-in to Member:

1. A person walks into the gym and asks about membership
2. Front desk opens the Lead CRM and taps “New Lead”
3. Enters name, phone, and interest. Marks source as “Walk-in”
4. The lead immediately receives a WhatsApp message with plan options and pricing
5. Over the next 7 days, the automated sequence sends follow-up messages
6. The lead replies “I want to try” — the WhatsApp chatbot (Phase 2) recognizes intent and offers available trial slots
7. Lead books a trial, gets assigned to a trainer, visits for the trial session
8. After the trial, the system sends: “Enjoyed your session? Join today and get [offer]”
9. Lead pays via the link — converted to a member. CRM marks the conversion and records source attribution for ROI analysis.

Module 6: Multi-Branch Dashboard

Why it matters: Small chain owners (2-10 branches) are the highest-value customers (Rs 3,000-8,000/month willingness to pay). Their #1 pain point is “I can’t be at all branches. I need one dashboard to see everything.” Without centralized visibility, each branch operates as a silo — different pricing, different processes, different quality.

Key Features:

• Centralized Overview: Single dashboard showing all branches with key metrics: active members, today’s check-ins, today’s collections, expiring members, and staff on duty. Color-coded health indicators (green/yellow/red) for each branch based on configurable thresholds.

• Per-Branch P&L: Revenue and expense tracking per branch. Monthly P&L statements showing membership revenue, PT revenue, merchandise revenue, trainer costs, rent allocation, and net profit. Compare branches side-by-side.

• Standardized Packages: Define membership plans at the organization level and push to all branches. Or allow branch-level customization within defined ranges (e.g., Gold plan is Rs 2,000-2,500/month — each branch sets their price within that range).

• Role-Based Access Control: Define roles with granular permissions:

  • Owner: Full access across all branches
  • Branch Manager: Full access to their branch only
  • Front Desk: Member management, check-in, payments (no financial reports)
  • Trainer: Only their assigned clients and schedule
  • Accountant: Financial reports only (no member personal data)

• Cross-Branch Member Mobility: Optionally allow members to check in at any branch (common for chain gyms). The member’s home branch gets credited; the visited branch records the walk-in.

• Standardized Operations: Audit trail showing which staff performed which actions at which branch. Ensure operational consistency with shared SOPs, workout templates, and communication templates across branches.

Module 7: Analytics & MIS

Why it matters: The typical Indian gym owner makes decisions based on gut feeling because they have zero data visibility. “How many members did we lose last month?” is answered with “I think maybe 10-15?” Analytics transforms this into precise, actionable intelligence.

Key Features:

• Revenue Trends: Daily, weekly, monthly, and yearly revenue charts. Breakdown by: plan type, payment method, new vs. renewal, branch (if multi-branch). Month-over-month and year-over-year comparisons. “Revenue per member” trend line identifies whether ARPU is growing or shrinking.

• Retention & Churn Analysis:

  • Monthly retention rate (% of members active at start of month who are still active at end)
  • Cohort analysis: Of members who joined in January, how many are still active in March? April? This reveals the “churn cliff” — the point where most members drop off.
  • Churn reasons (when captured during exit/expiry): price, relocation, not seeing results, trainer issues, facility issues, etc.
  • “At-risk members” list: members with declining check-in frequency or approaching expiry without renewal signal.

• Trainer Utilization: Per-trainer metrics: number of clients, sessions conducted, client retention, revenue generated. Identify under-utilized trainers (capacity available) and over-loaded trainers (at risk of burnout/quality drop).

• Member Engagement Scores: Each member gets a composite engagement score (0-100) based on: check-in frequency, workout plan completion, app usage, payment timeliness, and social interactions (community posts, challenges). Scores are used for churn prediction and targeted interventions.

• Exportable Reports: All reports are exportable as PDF and CSV. Monthly MIS report auto-generated and emailed/WhatsApped to the owner on the 1st of every month. Includes: revenue summary, member count changes, top 5 at-risk members, trainer performance snapshot, and lead conversion funnel.

• Real-Time Dashboard: Live metrics on a wall-mounted screen (or dedicated tablet at the front desk): current occupancy, today’s check-ins, today’s collections, members checking in right now. Updates via WebSocket every 5 seconds.

Module 8: Inventory & POS

Why it matters: Many gyms sell supplements, protein shakes, merchandise (gloves, belts, t-shirts), and water bottles as ancillary revenue. This is currently tracked in a separate notebook or not tracked at all. Integrating POS into the same system gives a complete picture of per-member revenue and simplifies accounting.

Key Features:

• Product Catalog: Add products with: name, category (supplements, merchandise, beverages), SKU, price, GST rate (5% or 18% depending on category), and stock quantity. Product images optional.

• Simple POS Interface: Quick sale flow: select product, select member (optional — walk-in sales allowed), select payment method, generate invoice. Under 10 seconds per transaction.

• Stock Tracking: Track stock levels with low-stock alerts. Purchase entry for restocking. Basic inventory valuation (cost price vs. selling price).

• Member Purchase History: Every purchase linked to a member profile shows total ancillary spending per member. Useful for identifying high-value members and cross-sell opportunities.

• Revenue Attribution: Supplement/merchandise revenue tracked separately in financial reports. Helps owners understand the profitability of their retail operation.

Module 9: Communication Hub

Why it matters: Communication in Indian gyms happens through personal WhatsApp accounts, which means no consistency, no automation, and no tracking. When the front desk person changes, all conversation history is lost. A centralized communication system ensures professional, consistent, and automated outreach.

Key Features:

• WhatsApp Broadcasts: Send messages to member segments (all active members, Gold plan members, members with birthdays this week, etc.). Messages are sent via WhatsApp Business API — they appear from the gym’s verified business number, not a personal account. Templates must be pre-approved by Meta (GymStack provides a library of pre-approved templates).

• Push Notifications: In-app notifications for: workout plan updates, class schedule changes, payment confirmations, new messages from trainer, community activity. Configurable per member (they can mute categories they don’t want).

• Birthday & Festival Automation: Automatically send birthday wishes via WhatsApp on the member’s birthday. Festival greetings on major holidays (Diwali, Holi, Eid, Christmas, New Year). Optional: birthday discount coupon (e.g., “Happy Birthday Amit! Here’s 10% off your renewal this month”).

• Announcement System: Post gym-wide announcements (holiday closure, new batch timings, new trainer introduction) that appear in: the member app feed, WhatsApp broadcast, and push notification — all from a single compose interface.

• Template Library: Pre-built message templates for common scenarios: welcome message, renewal reminder, expiry notice, birthday wish, festival greeting, trial invitation, referral request. Gym can customize the text and add their brand voice.

Module 10: Class/Batch Management

Why it matters: Many Indian gyms operate batch-based programs (morning yoga batch, evening Zumba batch, CrossFit batch) alongside open gym hours. Managing batch schedules, capacity, and bookings manually leads to overcrowding in popular batches and empty spots in others.

Key Features:

• Schedule Management: Create recurring class schedules: class type (Yoga, Zumba, CrossFit, HIIT, Spinning, etc.), instructor, time slot, room/area, capacity limit. Weekly recurring with override capability for specific dates.

• Capacity Management: Set maximum capacity per class. Real-time occupancy tracking. Prevent overbooking.

• Member Booking: Members book classes from the Member app up to 7 days in advance (configurable). They see available slots, current booking count, and can book with one tap. Booking confirmation sent via push notification and WhatsApp.

• Waitlists: When a class is full, members can join a waitlist. If someone cancels, the next person on the waitlist is automatically offered the slot via push notification. If they don’t confirm within 30 minutes (configurable), the slot moves to the next person.

• No-Show Tracking: If a member books but doesn’t check in to the class, it’s recorded as a no-show. Repeat no-shows (configurable: 3 in a month) result in booking restrictions to prevent members from hoarding slots.

• Attendance Analytics: Per-class attendance rates, most popular classes/time slots, instructor popularity comparison. Helps owners decide which classes to add, remove, or reschedule.

Trainer App (Mobile-First)

The Trainer app is designed for use on the gym floor, between sets, and during brief breaks. Every interaction is optimized for completion in under 30 seconds with one hand on a phone. Trainers in India typically have moderate smartphone literacy (comfortable with WhatsApp and Instagram) but low patience for complex interfaces.

Module 1: Client Dashboard

Why it matters: Trainers currently manage client information across WhatsApp chats, paper notebooks, and memory. A unified dashboard replaces all three with a single screen that shows everything at a glance.

Key Features:

• All Clients View: List of all assigned clients with key status indicators: last check-in date, current workout plan name, diet plan status, upcoming session, and a color-coded engagement indicator (green = active, yellow = declining, red = at risk).

• Quick Stats: Total active clients, sessions this week, new clients this month. Tappable for details.

• Client Search & Filter: Search by name, filter by status (active, inactive, new), plan type (PT, batch, floor), or engagement level.

• Quick Actions: Long-press on a client to: send WhatsApp message, view workout plan, view diet plan, log a note, or mark attendance. All actions take under 2 taps.

• New Client Notification: When a gym owner assigns a new client, the trainer gets a push notification with the client’s profile summary: name, age, goals, medical notes, current body measurements. The trainer can review and accept/flag concerns before the first session.

Module 2: Workout Plan Builder

Why it matters: Trainers in India typically give verbal workout instructions or hand-write plans on paper. Members forget the exercises by the next day. When a trainer manages 20+ clients, they inevitably reuse the same generic plan for everyone. A digital plan builder with templates and an exercise library enables personalized programming at scale.

Key Features:

• Exercise Library (200+ Exercises): Each exercise includes: name (English + Hindi), target muscle groups, equipment required, difficulty level (beginner/intermediate/advanced), written instructions, and image/animation showing proper form. Exercises are searchable by muscle group, equipment, or name. Gym owners can add custom exercises specific to their equipment.

• Template System: Pre-built workout templates for common goals: fat loss (beginner), muscle building (intermediate), strength training (advanced), functional fitness, home workout, etc. Templates are starting points — trainers customize them per client. Trainers can also save their own custom templates for reuse.

• Drag-and-Drop Plan Creation: Build a weekly plan by dragging exercises into day slots. For each exercise, specify: sets, reps (or duration for timed exercises), rest period, weight (if applicable), and notes (“go slow on the eccentric,” “squeeze at the top”). Group exercises into supersets or circuits.

• Progressive Overload Tracking: The system tracks what weight/reps the member did last time for each exercise. When creating the next week’s plan, the trainer sees last week’s numbers and can increment systematically (e.g., +2.5kg or +2 reps). This is the foundation of effective training — and it’s impossible to do manually across 20 clients.

• Assign to Clients: Once a plan is built, assign it to one or multiple clients (useful for batch training). The plan appears in the member’s app immediately. The member gets a notification: “Shubham has assigned you a new workout plan: Push/Pull/Legs Split.”

• Plan Scheduling: Plans can be set with start and end dates, creating a periodized program. For example: Weeks 1-4 (Hypertrophy), Weeks 5-8 (Strength), Weeks 9-12 (Cut). The app automatically transitions to the next phase.

Module 3: Diet Plan Builder

Why it matters: Diet is 70-80% of fitness results, yet most Indian gym trainers either don’t provide diet plans or send the same generic plan to everyone via WhatsApp text. A structured diet plan builder with Indian cuisine options is a major differentiator that directly impacts member results and retention.

Key Features:

• Meal Plan Templates: Pre-built templates for common goals: weight loss (1,500 cal), muscle gain (2,500 cal), maintenance (2,000 cal), vegetarian, non-vegetarian, eggetarian. Each template includes 5-6 meals per day (Indian meal timing: early morning, breakfast, mid-morning, lunch, evening snack, dinner).

• Macro Calculator: Enter client’s weight, height, age, activity level, and goal. The system calculates daily calorie target and macro split (protein/carbs/fats). Adjustable by trainer (e.g., higher protein for muscle building).

• Regional Cuisine Options (Indian Diet Focus): This is a critical differentiator. The food database is India-first:

  • North Indian: Roti, paratha, dal, paneer, rajma, chole, chicken curry, egg bhurji, poha, upma
  • South Indian: Idli, dosa, sambar, rice, rasam, appam, fish curry
  • Common: Oats, fruits, dry fruits, milk, curd, sprouts, sweet potato, chicken breast
  • Supplements: Whey protein, BCAA, creatine (with brand suggestions common in India)

  Each food item has: calories, protein, carbs, fats, and fiber per serving. Serving sizes in Indian measurements (1 roti, 1 katori dal, 1 glass milk).

• Assign to Clients: Assign a diet plan to a client. The plan appears in their Member app with daily meals, nutritional breakdown, and a meal check-off system. The member checks off each meal as they eat it; the trainer sees completion percentage.

• Dietary Restrictions: Tag clients with: vegetarian, vegan, Jain (no root vegetables), lactose intolerant, gluten free, no beef, no pork. The system filters out incompatible foods when building plans.

• AI Diet Generation (Phase 3): LLM-powered diet plan generation. The trainer inputs client details and preferences; the AI generates a complete weekly meal plan with Indian cuisine, correct macros, and variety. The trainer reviews and edits before assigning. This dramatically reduces the time from “new client” to “diet plan assigned.”

Module 4: Session Management

Why it matters: PT sessions are the highest-margin revenue for trainers and gyms. But scheduling is currently done via WhatsApp messages, leading to missed sessions, double-bookings, and no attendance records. Structured session management improves both trainer productivity and client accountability.

Key Features:

• Calendar View: Weekly and daily calendar showing all scheduled sessions. Color-coded by client or session type (PT, batch, assessment). Drag to reschedule. Tap to view session details.

• Upcoming Sessions: A “Today’s Sessions” view listing: time, client name, session type, and notes from last session (“Amit felt knee pain during squats — modify today”). This replaces the trainer’s mental model of “who am I training next?”

• Session Notes: After each session, the trainer can add quick notes: exercises completed, weights used, client feedback, modifications made. These notes appear in the client’s timeline and are visible to the gym owner. Takes under 60 seconds with pre-filled templates.

• Attendance Marking: Mark client as “attended,” “no-show,” or “cancelled” for each session. No-shows are tracked — clients with frequent no-shows can be flagged for a conversation about commitment.

• Booking by Members: Members can book available PT sessions from the Member app. The trainer’s available slots are shown; the member picks one and books. Both sides get confirmation. Cancellation requires 4+ hours notice (configurable).

Module 5: Client Progress Tracking

Why it matters: “Am I making progress?” is the question every gym member asks. Most trainers answer with subjective observations (“you look better”). Structured progress tracking with data and photos provides objective proof that builds motivation and prevents dropout.

Key Features:

• Body Measurements: Track: weight, body fat %, muscle mass, chest, waist, hips, arms, thighs, calves. Measurements are dated and graphed over time. The trainer logs measurements during monthly assessments.

• Progress Photos: Before/during/after photos stored in-app. Front, side, and back poses. Photos are date-stamped and can be compared side-by-side (swipe between dates). Members can take photos themselves or the trainer takes them during assessment sessions. Stored in S3 with encryption; accessible only to the member and their trainer.

• Strength Logs: Track personal records (PRs) for key lifts: bench press, squat, deadlift, overhead press, and any custom exercises. Graph showing strength progression over weeks/months.

• Graphs & Visualization: Auto-generated charts showing trends in weight, body fat %, measurements, and strength. Members see these in their app; trainers see them in the Trainer app. Visual progress is one of the strongest motivators for continued gym attendance.

• Monthly Assessment Reports: Auto-generated monthly progress report combining: measurement changes, strength improvements, attendance consistency, and workout completion rate. Can be shared via WhatsApp (as an image or PDF) for the member to share with friends/family — organic marketing.

Module 6: Remote Coaching

Why it matters: Trainers currently communicate with clients through WhatsApp, which mixes fitness guidance with personal chats, payment discussions, and random forwards. A dedicated in-app communication channel keeps fitness conversations organized and professional.

Key Features:

• In-App Messaging: Direct messaging between trainer and their assigned clients. Text messages with support for images, videos, and voice notes. All messages are stored in GymStack (not WhatsApp) — the gym retains access even if the trainer leaves.

• Video/Photo Sharing: Trainer can send exercise demonstration videos, form correction images, or motivational content. Members can send videos of their form for remote review.

• Voice Notes: Quick voice messages for situations where typing is impractical (trainer is on the gym floor, member is at home cooking). Voice notes auto-transcribe (Phase 2) for searchability.

• Quick Check-ins: Pre-built quick messages: “How was today’s workout?”, “Did you follow today’s diet?”, “Any soreness or pain?”. Tap to send; the member replies with a quick response or emoji. Maintains engagement on non-gym days.

• Content Sharing: Trainer can share articles, videos, or tips from the GymStack content library to specific clients or all clients. “Watch this video on proper squat form before your next session.”

Module 7: Earnings Tracker

Why it matters: Most Indian gym trainers are paid based on PT sessions conducted, but tracking is manual and disputes are common. A transparent earnings tracker builds trust and helps trainers see the direct financial benefit of taking on more clients and completing more sessions.

Key Features:

• PT Sessions Logged: Automatic count of completed PT sessions (from session management module). Broken down by: this week, this month, and historical.

• Earnings Calculation: Based on the trainer’s configured rate (e.g., Rs 300/session for 1-on-1, Rs 150/session for batch). Monthly earnings calculated automatically: sessions x rate. Bonus/incentive rules can be configured (e.g., Rs 500 bonus for every new PT client who completes 12 sessions).

• Payment Status: Track payments from the gym to the trainer. Mark as: earned (sessions completed), pending (not yet paid by gym), and paid (settled). Monthly settlement history.

• Revenue Attribution: Show the trainer how much revenue they generate for the gym. “Your clients generated Rs 1.2 lakh in membership renewals and Rs 45,000 in PT revenue this month.” This helps trainers advocate for raises with data.

Member App (Mobile)

The Member app is what transforms a generic gym membership into a branded digital fitness experience. It’s the primary touchpoint for the 70% of Indian gym-goers who prefer guided workouts. The app should feel like a mini personal trainer in their pocket — not a gym billing portal.

Module 1: My Workout

Why it matters: The #1 reason beginners quit the gym is feeling lost. They don’t know what exercises to do, how many sets and reps, what weight to use, or how to progress. A clear, daily workout plan in their pocket eliminates this entirely.

Key Features:

• Today’s Workout Plan: When the member opens the app, the first screen shows today’s workout. If it’s a rest day, it says so with a motivational message. The workout shows: exercise name, target muscles, sets x reps, rest time, and weight (based on last session’s log). Order matches the planned sequence.

• Exercise Details with Instructions: Tap any exercise to see: written instructions (step-by-step), target muscles highlighted on a body diagram, common mistakes to avoid, and a photo or animation showing proper form. Content is available in English and Hindi (Phase 2).

• Log Sets/Reps/Weight: After completing each set, the member taps to log: actual reps completed and weight used. The interface is designed for gym-floor use — large tap targets, minimal typing (increment/decrement buttons), and one-hand operation. If the member exceeds their target, a “New PR!” celebration appears.

• Workout Timer: Built-in rest timer between sets. Configurable per exercise (default: 60 seconds for hypertrophy, 180 seconds for strength). Vibration alert when rest is over.

• Workout History: View past workouts with: exercises performed, weights used, and total volume (sets x reps x weight). Compare today’s performance to last time for the same workout.

• Exercise Swap: If a machine is occupied, the member can tap “Swap” to see alternative exercises targeting the same muscle group with available equipment.

Module 2: My Diet

Why it matters: “What should I eat?” is the most common question members ask their trainers, often multiple times a week via WhatsApp. A diet plan in the app eliminates repetitive queries and ensures the member has guidance every single meal.

Key Features:

• Today’s Meal Plan: Shows all meals for the day: early morning (6 AM), breakfast (8 AM), mid-morning snack (11 AM), lunch (1 PM), evening snack (5 PM), dinner (8 PM). Each meal shows: food items, portions (in Indian measurements), and macros (calories, protein, carbs, fat).

• Nutritional Info: Tap any food item to see detailed nutritional breakdown. Daily totals shown at the top: total calories consumed vs. target, with a progress bar for each macro.

• Meal Check-Off: Tap to mark each meal as “eaten” or “skipped.” Completion percentage visible to both the member and trainer. If a meal is skipped, the app suggests an alternative of similar macros that can be eaten later.

• Weekly View: See the entire week’s meal plan to prep groceries. A “Grocery List” feature (Phase 2) auto-generates a shopping list based on the week’s meals.

• Water Intake Tracker: Log glasses of water throughout the day. Target: 3-4 liters for active gym-goers. Gentle reminders every 2 hours if behind target.

Module 3: Check-in

Why it matters: Digital check-in replaces the paper register and creates a data trail that powers attendance analytics, streak gamification, and retention predictions.

Key Features:

• QR Code Display: Member’s unique QR code displayed full-screen with a single tap. Brightness auto-increases for easy scanning. QR code refreshes every 30 seconds for security (rolling token).

• Check-in History: Calendar view showing check-in dates (green dots) and missed days (no dot). Monthly view shows attendance pattern at a glance. Tap a date to see: check-in time, checkout time (if recorded), and duration.

• Streak Counter: Current streak prominently displayed (e.g., “12 days”). Longest streak ever achieved shown as a personal record. Milestones at 7, 30, 60, 90, and 365 days with special badges. Streak-break notification: “Your 15-day streak ended. Start a new one today!”

• Social Sharing: After check-in, option to share to Instagram Stories or WhatsApp Status: “Day 45 at Pro Fitness. Leg day done.” This provides organic marketing for the gym.

Module 4: My Progress

Why it matters: Visible progress is the strongest motivator for continued gym attendance. But most members have no way to see their progress objectively — they rely on the mirror and the weighing scale, both of which are unreliable indicators. A structured progress dashboard provides the proof that keeps members coming.

Key Features:

• Weight & Measurement Graphs: Interactive graphs showing weight, body fat %, and key measurements over time. Pinch to zoom into specific date ranges. Trend line shows overall direction even through daily fluctuations.

• Progress Photos Timeline: Scrollable timeline of progress photos. Side-by-side comparison tool: select any two dates and swipe between photos. This is the most emotionally impactful feature — seeing a 3-month transformation in photos is powerful.

• Strength Progression: Graphs for key lifts showing weight progression over weeks/months. PR history with dates. “You’ve increased your bench press by 15kg in 3 months” type insights.

• Badges & Achievements: Unlock badges for milestones: First Check-in, 7-Day Streak, 30-Day Streak, First PR, 10kg Lost, 100 Workouts Completed, etc. Displayed on profile and shareable.

• Monthly Report: Auto-generated monthly summary: weight change, measurement changes, workouts completed, attendance rate, strength PRs. Designed for WhatsApp sharing — members organically promote the gym when they share their results.

Module 5: Class Booking

Why it matters: For gyms running batch-based programs (yoga, Zumba, CrossFit), member booking prevents overcrowding, enables capacity planning, and creates commitment — a member who has booked is more likely to show up than one who “might come.”

Key Features:

• View Schedule: Weekly class schedule with: class name, instructor, time, location/room, and available slots. Filter by class type or instructor.

• Book Classes: One-tap booking for available classes. Confirmation sent via push notification. Booking shows in the member’s calendar and the instructor’s session view.

• Waitlist: If a class is full, join the waitlist with one tap. Notification sent when a slot opens. Auto-assignment after confirmation timeout.

• Cancellation: Cancel a booking up to 4 hours before class (configurable). Late cancellations and no-shows tracked.

• Class Ratings: After attending a class, rate it (1-5 stars) and leave optional feedback. Ratings visible to gym owner for quality management.

Module 6: Payments

Why it matters: Membership payments in India are a friction-filled process — the member must visit the gym, pay cash or UPI to a personal number, and hope the receipt is recorded. In-app payments reduce friction to zero: pay anytime, from anywhere, with a proper receipt.

Key Features:

• Membership Status: Current plan, expiry date, days remaining, displayed prominently. Status bar changes color as expiry approaches (green -> yellow -> red).

• Pay via UPI/Cards: Tap to pay for renewal or outstanding dues. Razorpay checkout within the app supporting UPI, debit/credit cards, netbanking, and wallets. UPI autopay setup for recurring payments.

• Payment History: Complete history of all payments: date, amount, plan, payment method, and GST invoice. Tap any payment to download/share the invoice.

• Invoices: GST-compliant invoices auto-generated for every payment. Downloadable as PDF. Shareable via WhatsApp. Includes gym GSTIN, member details, HSN/SAC code, and GST breakup.

• Upcoming Payments: If on EMI or partial payment plan, shows upcoming payment dates and amounts. Reminder notifications before due dates.

Module 7: Community

Why it matters: The social aspect of fitness is a major retention driver. Members who feel part of a community are 3-5x less likely to quit. Most independent gyms lack any digital community — the “community” is the WhatsApp group where members get bombarded with forwards and spam.

Key Features:

• Gym Feed: Instagram-style feed within the app. Members can post: workout selfies, progress updates, achievements, and questions. Other members can like and comment. Moderated by gym staff.

• Challenges: Gym-created challenges: “30-Day Attendance Challenge,” “10K Steps Daily,” “Most Improved Body Composition.” Members opt in, progress is tracked automatically (via check-in data, workout logs), leaderboard updated in real-time.

• Leaderboards: Monthly leaderboards for: most check-ins, longest streak, most workouts completed, challenge rankings. Top members get recognition (featured on the gym feed, small rewards).

• Achievements: Badge system for personal milestones. Achievements are displayed on the member’s profile. Some are public (shareable), some are private. Achievement notifications provide positive reinforcement.

• Buddy System (Phase 3): Pair members with similar goals for accountability. Buddies see each other’s check-in status and can send encouraging messages.

Module 8: My Trainer

Why it matters: The trainer-member relationship is the strongest predictor of retention. Making the trainer accessible and visible in the app strengthens this relationship beyond gym-floor interactions.

Key Features:

• View Trainer Profile: Trainer’s photo, qualifications, specializations, and experience. Client reviews and ratings. This builds trust, especially for new members who haven’t built a personal rapport yet.

• Messaging: Direct messaging with assigned trainer (via the in-app messaging system). Text, images, voice notes. Used for: form check videos, diet questions, schedule changes, and general fitness guidance.

• Upcoming Sessions: View scheduled PT sessions with trainer. Reschedule or cancel (within policy).

• Rate Sessions: After each PT session, rate the experience (1-5 stars) with optional feedback. This data helps the gym owner monitor trainer quality.

India-First Design Principles

These are not afterthoughts or Phase 2 features. They are foundational design decisions baked into the architecture from day one.

WhatsApp-Native

Why: WhatsApp has 500M+ users in India. Gym owners, trainers, and members all live on WhatsApp. Email open rates in this demographic are below 5%.

How: GymStack integrates with WhatsApp Business API (via Gupshup or Wati) for:

• Outbound: Renewal reminders, birthday wishes, class confirmations, payment receipts
• Inbound (Phase 2): 2-way chatbot where members can check expiry, book sessions, view diet plan, and make payments — all without opening the app
• Onboarding: Entire gym onboarding flow happens via WhatsApp (no email verification, no app download required initially)

UPI-First Payments

Why: 80%+ of digital payments in India are UPI. Credit card penetration is under 5% in Tier-2/3 cities. Any payment solution that isn’t UPI-first is dead on arrival.

How: Razorpay integration with UPI as the default payment method. UPI autopay for recurring memberships. QR code payments at the front desk. Payment links sent via WhatsApp that open directly in the member’s UPI app.

GST Built-In

Why: Every gym in India needs GST-compliant invoices. The reduced 5% GST rate (from Sep 2025) makes compliance even more important as more gyms formalize.

How: Auto-generated invoices with correct HSN/SAC codes (SAC 99971 for fitness services). Gym GSTIN stored in settings. Monthly GST summary report for CA/tax filing. No manual invoice creation needed.

Phone-First Design

Why: Gym owners in Tier-2/3 cities do not sit at desktops. Trainers are on the gym floor with a phone in their pocket. The “admin dashboard” must work on a 6-inch screen as well as a 15-inch monitor.

How: Flutter enables native mobile apps for both Admin and Trainer roles. The Next.js web dashboard is responsive but optimized for desktop (used for deep analytics and reports). Day-to-day operations (check-in, member management, session logging) are all optimized for mobile-first interaction.

Hindi-First (Phase 2)

Why: 70%+ of target gyms operate primarily in Hindi. Trainers with basic smartphone literacy often struggle with English-only interfaces. The 80%+ of Indian gym staff who are not comfortable in English are locked out by every current competitor.

How: Full Hindi interface from Phase 2. Exercise names and instructions in both English and Hindi. Diet plan food items in Hindi. WhatsApp message templates in Hindi. Phase 3 extends to regional languages (Tamil, Telugu, Marathi, Bengali).

Offline-Capable (Phase 3)

Why: Internet reliability in Tier-2/3 India is inconsistent. A trainer building a workout plan should not lose work because of a 30-second connectivity drop. A front desk doing check-ins should not stall because the API is unreachable.

How: Local-first architecture using SQLite/Hive on the Flutter app. All critical operations (check-in, member lookup, workout display, diet display) work offline. Data syncs to the cloud when connectivity is restored. Conflict resolution for edits made offline by multiple users.

Feature Priority Matrix

Bold items are Phase 1 MVP scope.

White-Label Specification

White-label is a Phase 2 feature but architecturally designed from Phase 1. The entire system is built as multi-tenant from day one, making white-label a configuration layer, not a rewrite.

How Branding Customization Works

Each gym tenant has a gym_config record in the database containing:

gym_config {
  gym_id: uuid
  name: "Pro Fitness Kankarbagh"
  logo_url: "https://cdn.gymstack.in/profitness/logo.png"
  primary_color: "#FF6B00"
  secondary_color: "#1A1A2E"
  accent_color: "#FFD700"
  splash_screen_url: "https://cdn.gymstack.in/profitness/splash.png"
  app_icon_url: "https://cdn.gymstack.in/profitness/icon.png"
  tagline: "Transform Your Body, Transform Your Life"
  support_phone: "+91-9876543210"
  support_email: "info@profitness.in"
  social_links: { instagram: "...", youtube: "..." }
  features_enabled: ["billing", "check_in", "workout", "diet", "crm"]
  plan_limits: { max_members: 500, max_trainers: 10 }
}

In the generic GymStack app, branding is applied dynamically at runtime (the app reads the config on login and applies colors/logos). For white-label published apps, branding is baked in at build time.

App Store / Play Store Publishing Flow

1. Gym opts for white-label (included in Pro plan or Rs 2,000/month add-on)
2. Gym provides assets: Logo (1024x1024 PNG), app icon (various sizes, or source file), splash screen image, brand colors (hex codes), app name, app description, and privacy policy URL
3. Developer account setup:
   • Play Store: Gym creates a Google Play Console account ($25 one-time). GymStack is added as a “linked developer” or the gym gives publishing access.
   • App Store: Gym creates an Apple Developer account ($99/year, requires D-U-N-S number for organization accounts). GymStack is added to App Store Connect as a developer.
4. GymStack builds the app: CI/CD pipeline generates a tenant-specific build flavor (see below)
5. Review & approval: GymStack team reviews the build, submits to both stores
6. Publishing: App appears on App Store and Play Store under the gym’s name. Members search for “Pro Fitness” and download the branded app.
7. Updates: When GymStack releases a new version, all white-label apps are rebuilt and resubmitted automatically. The gym sees the update within 1-3 days of GymStack’s release (pending store review).

Build Flavor System (CI/CD Pipeline)

Flutter Project Structure:
├── lib/
│   ├── main.dart              (shared app code)
│   ├── config/
│   │   ├── flavor_config.dart (runtime config loader)
│   │   └── themes/
│   │       ├── default.dart   (GymStack default theme)
│   │       ├── profitness.dart (Pro Fitness theme)
│   │       └── ...
│   └── ... (shared feature code)
├── flavors/
│   ├── gymstack/
│   │   ├── assets/ (default logos, icons)
│   │   ├── android/ (package name: com.gymstack.member)
│   │   └── ios/ (bundle ID: com.gymstack.member)
│   ├── profitness/
│   │   ├── assets/ (Pro Fitness logos, icons, splash)
│   │   ├── android/ (package name: in.profitness.app)
│   │   └── ios/ (bundle ID: in.profitness.app)
│   └── [gym_slug]/
│       ├── assets/
│       ├── android/
│       └── ios/

CI/CD (GitHub Actions):
1. Trigger: new gym onboarded to white-label OR new app version released
2. Generate flavor config from gym_config database record
3. Build Flutter app with --flavor=[gym_slug] flag
4. Android: Generate signed APK/AAB with gym's keystore
5. iOS: Build with gym's provisioning profile and certificate
6. Upload to respective stores via Fastlane
7. Notify gym owner: "Your app update has been submitted for review"

What Can Be Customized

• App name (as it appears on the phone home screen and in stores)
• App icon (the icon on the phone home screen)
• Splash screen (loading screen when app opens)
• Primary, secondary, and accent colors (entire UI theme changes)
• Logo (header of the app, login screen, invoices)
• Tagline and welcome message
• Support contact details
• App Store / Play Store listing details (description, screenshots)
• Privacy policy and terms of service URLs

What Stays Shared

• All source code (there is one Flutter codebase, not one per gym)
• All features (billing, check-in, workouts, etc.)
• All bug fixes and improvements (every gym benefits from every fix)
• Backend API (all white-label apps hit the same GymStack API, differentiated by gym_id)
• Exercise library and content
• Security patches and compliance updates

This means GymStack can support 100 or 1,000 white-label apps with the same engineering effort as supporting one. The marginal cost of adding a new white-label tenant is near zero (a new CI/CD config file and asset folder).

Non-Functional Requirements

Performance Targets

Security

• Data Encryption at Rest: AES-256 encryption for all data stored in PostgreSQL (RDS encryption) and S3 (SSE-S3). Progress photos and sensitive documents are encrypted at the application level as well.

• Data Encryption in Transit: TLS 1.3 for all API communications. Certificate pinning in the Flutter app to prevent man-in-the-middle attacks. No data is ever transmitted over unencrypted connections.

• Authentication: JWT access tokens (15-minute expiry) + refresh tokens (30-day expiry, stored securely in device keychain). Phone-based OTP login (India standard — no email/password). Optional biometric unlock (fingerprint/face) for returning to the app.

• Role-Based Access Control: Five roles with granular permissions: Owner, Branch Manager, Front Desk, Trainer, Member. Each API endpoint checks both authentication (who are you) and authorization (are you allowed to do this). A trainer cannot access financial reports. A front desk cannot delete a member.

• Row-Level Security: PostgreSQL RLS ensures data isolation between gym tenants at the database level. Even if there’s a bug in the application layer, the database will not return data from another gym.

• GDPR-Like Compliance: While India’s DPDP Act (Digital Personal Data Protection) is the governing regulation, GymStack adopts best practices from GDPR:

  • Consent for data collection (member agrees to terms during onboarding)
  • Right to access (member can export all their data)
  • Right to deletion (member can request account deletion; data is anonymized/deleted within 30 days)
  • Data minimization (collect only what’s needed)
  • Privacy policy clearly stating data usage

• Audit Trail: Every sensitive action (member deletion, payment modification, plan change, data export) is logged with: who, what, when, and from which IP/device. Audit logs are immutable and retained for 3 years.

• Input Validation: All API inputs validated against OpenAPI schema. SQL injection prevention via parameterized queries (ORM-level). XSS prevention via output encoding. File upload validation (type, size, malware scan).

Scalability

• Multi-Tenant Design: Single PostgreSQL database with RLS supports 1,000+ gyms without schema changes. Connection pooling via PgBouncer handles concurrent connections from many tenants.

• Horizontal Scaling: Stateless API servers (Fastify on Node.js) behind a load balancer. Add more containers as traffic grows. Redis for session state means any server can handle any request.

• Database Scaling Path:

  • Phase 1 (0-200 gyms): Single RDS instance (db.r6g.large)
  • Phase 2 (200-500 gyms): Read replicas for analytics queries
  • Phase 3 (500-2,000 gyms): Evaluate partition-by-gym or move to Citus for distributed PostgreSQL
  • Phase 4 (2,000+ gyms): Shard by region if needed

• Media Storage: S3 with CloudFront CDN for exercise images, progress photos, and workout animations. Auto-resize images on upload (thumbnail + full-size). Lifecycle policies to move old photos to S3 Infrequent Access after 6 months.

• Target Support: 1,000+ gyms, 500,000+ members, 10,000+ concurrent users without degradation.

Availability

• Uptime Target: 99.9% (allows ~8.7 hours of downtime per year)

• Infrastructure: Multi-AZ deployment on AWS Mumbai (ap-south-1). RDS with Multi-AZ failover. ECS services spread across availability zones. Health checks and auto-restart for failed containers.

• Disaster Recovery: Daily automated backups (RDS snapshots retained for 30 days). Point-in-time recovery for the database. S3 cross-region replication for media files. Documented runbook for recovery procedures.

• Monitoring & Alerting: CloudWatch for infrastructure metrics (CPU, memory, disk, network). Sentry for application errors. Custom alerts for: API error rate >1%, p95 latency >1s, database connection pool >80%, payment webhook failures. PagerDuty (or equivalent) for on-call alerting.

• Zero-Downtime Deployments: Blue-green deployment strategy. New version deployed alongside old version; traffic gradually shifted. Rollback in under 2 minutes if issues detected.

Appendix: Glossary