Privacy Policy
Effective date: [EFFECTIVE DATE] Last updated: [EFFECTIVE DATE]
This Privacy Policy explains how [COMPANY NAME] ("BodyCode", "we", "us", or "our") collects, uses, shares, and protects information about you when you use the BodyCode mobile application and related services (together, the "Service").
By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.
1. Who we are
The Service is operated by [COMPANY NAME], located at [COMPANY ADDRESS]. For the purposes of the EU and UK General Data Protection Regulation (GDPR), [COMPANY NAME] is the "data controller" of your personal information.
EU/UK representatives. If we are not established in the EEA or the UK, we have appointed representatives as required by Article 27 of the EU and UK GDPR:
- EU representative: [EU REPRESENTATIVE NAME, ADDRESS, EMAIL]
- UK representative: [UK REPRESENTATIVE NAME, ADDRESS, EMAIL]
Data-protection contact. For data-protection enquiries, contact us at [CONTACT EMAIL]. [We have appointed a Data Protection Officer, who can be reached at [DPO EMAIL]. / We are not required to appoint a Data Protection Officer.]
2. Information we collect
We collect the following categories of information.
2.1 Information you provide to us
- Account information: your email address, and your first and last name. If you sign in with Google or Apple, we receive your name and email from that provider (see Section 6).
- Profile photo: an avatar image provided by your sign-in provider (Google or Apple), if your account has one.
- Profile and fitness details: your age or date of birth, gender, height, current body weight, and body-fat / body-composition measurements.
- Training preferences: your experience level, the equipment you have access to, how often you want to train, your preferred session length, your fitness goals, and your preferred units (metric or imperial).
- Health-related inputs: any injuries or exercise limitations you choose to tell us about, and optional wellness check-ins (such as sleep quality, energy, stress, and muscle soreness) and any pain you report during a workout.
- Workout activity: your workout history, including the exercises, sets, repetitions, weights, perceived effort (RPE), duration, and any notes you record; your body-weight and body-fat history and personal records; saved workout templates; and other activities you log.
- Trainer/trainee information: if you use coaching features, your role (independent, trainer, or trainee), invite codes, and the connection between a trainer and a trainee.
- Communications: information you provide when you contact us for support.
2.2 Information we collect automatically
- Device and technical information: your device type and operating system, app version, language, and time zone.
- Push notification token: a token that lets us deliver workout reminders and notifications (you control this — see Section 12).
- Diagnostic and crash data: technical logs, error reports, and performance data that help us find and fix problems. We use a third-party error-monitoring provider for this and configure it to limit the personal data it captures (see Section 6).
2.3 Information we receive from third parties
- Sign-in providers: when you choose "Continue with Google" or "Continue with Apple", we receive a verified identifier, your email address, and (on first sign-in) your name. With Apple, you can choose to hide your email.
We do not buy personal information about you from data brokers.
3. Health-related and sensitive information
Some of the information you provide — such as your body weight, body-fat / body-composition, body measurements, age, fitness goals, injuries, and wellness check-ins — may be considered health-related or, in some regions (for example, under GDPR Article 9), "special category" data.
We process this information only to provide the Service to you — to build and personalize your workouts and track your progress. Where the law requires it, we rely on your explicit consent (Article 9(2)(a) GDPR), which we obtain in the app before collecting this information. You can withdraw your consent for specific health-related data at any time by deleting that data in the app, without deleting your whole account; you can also delete your account entirely (see Section 8).
Please note: BodyCode is a general fitness and wellness app. It is not a medical service, is not intended to diagnose, treat, or prevent any medical condition, and we are not a "covered entity" or "business associate" under HIPAA. BodyCode does not read from or write to Apple Health / HealthKit or Google Health Connect.
4. How we use your information
We use your information to:
- create and manage your account and authenticate you;
- generate and personalize your workouts and coaching, including through AI (see Section 5);
- record and display your workout history, progress, and statistics;
- send you workout reminders and notifications you have enabled;
- provide customer support and respond to your requests;
- keep the Service secure, prevent fraud and abuse, and debug and improve the Service;
- comply with our legal obligations and enforce our Terms.
Legal bases (EU/UK users). Where GDPR applies, we rely on: performance of a contract (to provide the Service you ask for); your explicit consent (for health-related/special-category data); your consent (for push notifications); our legitimate interests (to secure and improve the Service); and legal obligation (where we must process data to comply with the law).
We do not use your information for third-party advertising, and we do not sell your personal information.
5. AI-powered workout generation
BodyCode can generate workouts for you using an artificial-intelligence service provided by Anthropic (the "Claude" API).
When you request an AI-generated workout, we send the AI provider only:
- the body areas you selected to train;
- your chosen session length;
- your experience level (beginner, intermediate, or advanced); and
- a list of candidate exercises from our catalog.
We do not send your name, email address, body weight, age, gender, injuries, health information, or any other information that identifies you to the AI provider.
Under the AI provider's commercial API terms that apply to us, the inputs we send are used only to generate your workout and are not used to train the provider's AI models. To reduce repeated processing, we may temporarily cache a generated workout for a short period.
Automated processing. We use automated processing (including the AI described above) to personalize and generate your workouts. This does not produce legal or similarly significant effects within the meaning of Article 22 GDPR, and we do not make decisions about you based solely on automated processing in a way that would trigger Article 22. You can contact us at [CONTACT EMAIL] for more information about the logic involved. AI-generated workouts are produced by an automated system and may not be perfect — please see our Terms & Conditions for important safety information about AI-generated content.
6. How we share your information
We do not sell your personal information. We share it only as described below.
Service providers (sub-processors). We use trusted third parties to run the Service. They may process your information only on our instructions and must protect it to a standard at least equivalent to this Policy:
| Provider | What it does | Information involved |
|---|---|---|
| Supabase | Authentication and database hosting | Account, profile, fitness, and workout data |
| Anthropic (Claude API) | AI workout generation | Non-identifying inputs only (see Section 5) |
| Sentry | Error monitoring and diagnostics | Technical/crash logs (personal data minimized) |
| Google / Apple | Sign-in (when you choose them) | Identifier, email, name |
| Expo + Firebase Cloud Messaging | Push notification delivery | Push token, device platform |
Revoking sign-in access. You can revoke the app's access to your Apple ID at any time in iOS Settings → [your name] → Sign in with Apple, or your Google account access at myaccount.google.com → Security → Third-party access. Revoking access does not delete data already in your BodyCode account — to delete that, see Section 8.
Trainers and trainees. If you connect with a trainer, that trainer can view the profile and workout information needed to coach you. If you are a trainer, your trainees' information is shared with you for the same purpose.
Legal and safety. We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of BodyCode, our users, or others.
Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in control or use of your personal information.
Aggregated/de-identified data. We may create and use information that does not identify you (for example, aggregate usage statistics) for any lawful purpose.
7. International data transfers
Our service providers may store and process your information in countries other than where you live, including in [processor region] and the United States. These countries may have data-protection laws that differ from those in your country.
Where we transfer personal information out of the EEA, the UK, or Switzerland to a country that does not have an adequacy decision, we rely on appropriate safeguards:
- for EEA transfers, the European Commission's Standard Contractual Clauses (SCCs);
- for UK transfers, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs;
- for Swiss transfers, the SCCs with the amendments required by the Swiss Federal Data Protection Act.
You can contact us at [CONTACT EMAIL] for more information or a copy of the relevant safeguards.
8. Data retention and deletion
We keep your personal information for as long as your account is active or as needed to provide the Service, and where necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
You can delete your account at any time from within the app (Profile → Delete account), via our public account-deletion page, or by emailing [CONTACT EMAIL]. When you delete your account, we permanently delete your personal information — including your profile, workout history, body-weight and body-fat history, wellness logs, preferences, and push-notification tokens — within [30] days.
Specific retention periods:
- Account data is retained for the life of your account; if your account is inactive for [24] months, we may delete it and its data after notifying you.
- Diagnostic and crash data is retained by our error-monitoring provider for up to [90] days.
- Backups containing your data are overwritten on a rolling [30]-day cycle.
- AI inputs are retained by the AI provider only for the short period set by its commercial terms.
Some information may persist where retention is required by law, after which it is deleted.
9. Security
We use technical and organizational measures designed to protect your information, including:
- encryption of data in transit using HTTPS/TLS;
- encryption of data at rest at our database provider;
- storage of authentication tokens in your device's secure storage (Keychain on iOS, encrypted storage on Android);
- access controls and the principle of least privilege.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal-data breach that affects you, we will notify you and the relevant authorities as required by applicable law (including, where applicable, the U.S. FTC Health Breach Notification Rule and the GDPR).
10. Your privacy rights
10.1 Everyone
- Correct your information: you can review and update most of your profile information at any time in the app (Profile → Edit profile).
- Delete your account and data: see Section 8.
- Control notifications: see Section 12.
10.2 EEA / UK users (GDPR)
You have the right to: access your personal data; request correction or erasure; restrict or object to processing; request data portability; and withdraw consent at any time (without affecting prior processing). You also have the right to lodge a complaint with your local data-protection authority.
10.3 California users (CCPA/CPRA)
You have the right to: know what personal information we collect, use, and disclose; access and delete your personal information; correct inaccurate information; and limit the use of sensitive personal information. We do not "sell" or "share" your personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.
Categories we collect (CCPA). In the 12 months before this Policy's date, we collect the following statutory categories of personal information:
| CCPA category | Examples | Source | Purpose | Disclosed to |
|---|---|---|---|---|
| Identifiers | Email, name, user ID, device/push token | You; your sign-in provider; your device | Account, authentication, notifications, security | Supabase, Expo/Firebase, Google/Apple |
| Characteristics of protected classifications | Age/date of birth, gender | You | Personalize workouts | Supabase |
| Internet/network activity | App diagnostics and usage logs | Automatic | Debug and secure the Service | Sentry |
| Sensitive personal information | Health/fitness data: weight, body-fat, height, injuries, wellness check-ins, reported pain | You | Generate/personalize workouts; track progress | Supabase (a non-identifying subset to the AI provider) |
| Audio/visual | Avatar image (from sign-in provider only) | Sign-in provider | Display your profile | Supabase |
We do not collect geolocation, commercial/financial, biometric, professional, or education information, and we do not knowingly collect categories beyond those above.
Sensitive personal information (CPRA). The sensitive personal information we collect is limited to the health- and fitness-related data listed above. We use it only to provide the Service you request, and for no other purpose. Because we do not use or disclose sensitive personal information for any purpose that would give rise to the right to limit, no separate limitation request is necessary; you can delete this data at any time (see Section 8).
No sale or sharing. Because we do not sell or "share" personal information for cross-context behavioral advertising, we are not required to, and do not, provide a "Do Not Sell or Share My Personal Information" link.
"Shine the Light" (Cal. Civ. Code 1798.83). We do not share your personal information with third parties for their own direct-marketing purposes, so there is nothing to disclose under this law.
10.4 How to exercise your rights
Use the in-app tools described above, or email us at [CONTACT EMAIL]. We will respond within the time required by applicable law (generally within 30–45 days). We may need to verify your identity before acting on your request. Requests for access to, or a copy of, your data ("portability") are handled by us on request to [CONTACT EMAIL].
You may also use an authorized agent to submit a request on your behalf; we may require proof of authorization and may still verify your identity directly. If we deny your request, you may appeal by replying to our decision email.
11. Children's privacy
The Service is intended for users who are at least 13 years old. We do not knowingly collect personal information from children under 13.
In the EEA, the minimum age to consent to information-society services under GDPR Article 8 is 16, unless your country has set a lower age (no lower than 13). For users in the EEA who are below the applicable age, we carry out consent-based processing only with the verifiable consent of a parent or guardian (see also Section 2 of our Terms & Conditions).
If you believe a child under the applicable age has provided us with personal information without the required consent, please contact us at [CONTACT EMAIL] and we will delete it.
12. Push notifications and your choices
If you enable notifications, we use a push token to send you workout reminders and related messages. You can turn notifications off at any time in your device settings or within the app. Turning them off does not delete your account or other data.
13. Changes to this Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app. Your continued use of the Service after the changes take effect means you accept the updated Policy.
14. Contact us
If you have questions, requests, or complaints about this Privacy Policy or your information, contact us at:
[COMPANY NAME] [COMPANY ADDRESS] [CONTACT EMAIL]
What we do not do
For clarity, BodyCode does not:
- sell your personal information;
- show third-party advertising or use your data for ad targeting;
- use third-party analytics or tracking SDKs;
- access your location, camera, or photo library;
- read from or write to Apple Health / HealthKit or Google Health Connect;
- send your identity (name, email) to our AI provider.