Privacy Policy

BodyBioLog is operated by BodyBioLog LLC, a Florida-based limited liability company (the "Company", "we", "us"). This Privacy Policy explains what data the BodyBioLog mobile app and the bodybiolog.com web platform (collectively, the "Service") collect, why we collect it, who we share it with, and the rights you have over it.

Reading this should take five minutes. If you have a specific question, use Cmd+F. The same content is mirrored inside the mobile app under Settings → Privacy Policy.

1. Who we are

BodyBioLog LLC. Registered in the State of Florida, United States. For privacy questions or data requests: support@bodybiolog.com.

2. What data we collect

2.1 Account data

• Email address (from sign-up)
• Password (hashed by Supabase Auth — we never see plaintext)
• Full name (optional, used in coach-client interactions)
• Role (client or coach)
• Profile photo (optional)
• Time zone and locale preferences

2.2 Health and fitness data

Imported from Apple HealthKit, Android Health Connect, Oura, or Garmin (only the integrations you enable):

• Heart rate variability (HRV)
• Resting heart rate (RHR)
• Sleep stages (light, deep, REM, awake) and total sleep duration
• Steps and active calories
• VO₂ max
• Weight and body composition
• Workouts (type, duration, heart-rate zones, GPS routes for outdoor sessions)

You log directly inside BodyBioLog:

• Meals (text descriptions, photos, AI-extracted macros)
• Workouts (sets, reps, loads, rest, supersets)
• Supplements, medications, and peptides (name, dose, schedule, inventory)
• Progress photos (front/side/back, weight, body measurements)
• Lab results (you upload PDFs or photos; AI extracts biomarker values)
• Goals, notes, and protocol adherence checks

2.3 Device and usage data

• Expo push notification token (so we can send protocol reminders)
• Device model, OS version, app version (for crash diagnostics only)
• IP address at sign-in (rate-limiting and abuse prevention)
• Which AI features you use and how often (for quota enforcement)
• Anonymized error stack traces (via Sentry; no PII included)

3. How we use your data

Every use below is tied to delivering the Service. We do not use your data for any other purpose without explicit consent.

• AI features. Anonymized excerpts of your biosignal, protocol, and lab data are sent to the Anthropic Claude API to generate responses. We never send your name, email, or account identifier with these requests.
• Health Score and insights. Computed locally and on our servers from your wearable data, adherence, and labs.
• Protocol reminders. Local notifications (no server round-trip) and weekly Sunday recap pushes via Expo Push.
• Coach-client features. If you sign in as a client linked to a coach, your coach can view your data per the in-app permissions you grant.
• Billing. Stripe processes all subscription payments. We store the Stripe customer ID and subscription status — never your card number.
• Customer support. If you email us, we may reference your account for troubleshooting.

4. Third-party processors

BodyBioLog is built on top of these services. Each has its own privacy policy.

5. We do not sell your data

6. Data sharing

We share data with the third-party processors listed above strictly for Service delivery. We additionally share data:

• With your coach (if you have one and have linked your accounts via invite code), per the per-feature permissions you control in Settings.
• With law enforcement, only when compelled by valid legal process.
• In a merger or acquisition, your data would transfer to the acquiring entity bound by this same Privacy Policy. We would notify you 30 days in advance.

7. Health data and HIPAA

BodyBioLog is a consumer wellness application. We are not a covered entity under HIPAA, and HIPAA does not apply to data you log voluntarily in a consumer health app.

That said, we treat your uploaded lab PDFs and biomarker data with the same controls a HIPAA-compliant system would use: encryption at rest in Supabase Storage, encrypted in transit (TLS 1.3), access-restricted via row-level security, and never sent to AI processors with personal identifiers attached.

If you are a healthcare provider using BodyBioLog with patients, contact us for a Business Associate Agreement before storing protected health information.

8. Data retention

We retain your data while your account is active. When you delete your account (Settings → Delete Account in the mobile app), we run our delete_my_account() server function which permanently deletes your rows from 29 tables — including subscriptions, AI conversations, photos, labs, workouts, meals, supplements, peptides, medications, goals, messages, push tokens, and your auth user. We retain anonymized billing records for tax and accounting purposes for the period required by law (typically 7 years).

Cached data on your device clears when you uninstall the app.

9. Your rights

You can exercise these rights at any time by emailing support@bodybiolog.com or via the in-app Settings:

• Access — request a copy of your data in machine-readable format
• Correction — fix anything inaccurate in your profile
• Deletion — Settings → Delete Account, or email us if you cannot open the app
• Portability — request a JSON export of your data
• Withdraw consent — disconnect wearable integrations or delete your account

9.1 California (CCPA / CPRA)

California residents have the right to know what personal information we collect (this Policy), request deletion, opt out of "sale" or "sharing" of personal information (we do neither), and not be discriminated against for exercising these rights.

9.2 Europe (GDPR)

Our legal basis for processing your data is your consent (granted at sign-up and when connecting wearables) and the performance of our contract with you. You can withdraw consent at any time. Data Subject Access Requests (DSARs) are honored within 30 days. We use Standard Contractual Clauses for EU-to-US transfers.

9.3 Children

BodyBioLog is not intended for users under 18. We do not knowingly collect data from minors. Parents who believe their child has created an account should email support@bodybiolog.com and we will delete the account within 7 business days.

10. International data transfers

BodyBioLog's primary data centers are located in the United States (Supabase, Vercel). If you access the Service from outside the US, your data is transferred to and processed in the US. We rely on Standard Contractual Clauses for any transfers from the EEA, UK, or Switzerland.

11. Security

We use industry-standard security measures: TLS 1.3 in transit, AES-256 at rest in Supabase Storage and Postgres, row-level security on every user-owned table, hashed passwords (Supabase Auth bcrypt), Stripe-tokenized billing (no card storage on our side), and Sentry monitoring with PII scrubbing. No system is perfect, but we treat security as a first-class requirement, not a checkbox.

12. Changes to this policy

We may update this Privacy Policy. Material changes will be reflected in the "Last updated" date at the top and surfaced in the app via an in-app notice. Continued use of the Service after changes constitutes acceptance.

13. Contact us

Privacy questions, data requests, security reports, or anything else: support@bodybiolog.com.

BodyBioLog LLC
State of Florida, United States