Privacy Policy

1. Introduction

Welcome to BodyBuddy ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI health coaching service.

If you are a Washington consumer, our separate Consumer Health Data Privacy Policy describes how we handle consumer health data under Washington's My Health My Data Act.

2. Information We Collect

Personal Information

• Name and contact information (phone number)
• Health and fitness data (weight, height, age, gender)
• Fitness goals and preferences
• Daily activity and nutrition information shared via text messages
• Photos you upload (avatar photos, meal photos, exercise photos)
• Message history and conversation transcripts for service improvement

Appointment Recordings (Visit Recording)

If you choose to use visit recording, we collect:

• Audio recordings of your own health and fitness appointments (for example, visits with a doctor, therapist, or trainer) that you choose to record
• Transcripts of those recordings, and the AI-generated summaries and coaching plans created from them

Visit recording is optional, and the recording screen displays a recording notice before you record. See Section 3a for how this data flows through our systems.

Health Condition Notes

During onboarding and afterward, you may optionally share health context in your own words, such as medical conditions, medications (for example, GLP-1s), injuries, or pregnancy. Sharing this information is entirely optional, and we use it only to personalize your coaching.

Imported Documents

You may paste, photograph, or upload medical or training documents (for example, care instructions after an appointment, physical therapy protocols, or workout programs). We store these documents and process them with AI to turn them into plans within the app.

Information About Your Health Professionals

You may enter the names and roles of the health professionals you work with (for example, "Dr. Lee, physical therapist") so you can attach plans to them. This is information about other people that you provide to us. Please only enter what is needed to organize your care, and only information you are comfortable sharing.

Apple HealthKit Data

With your permission, we may collect health data from Apple HealthKit, including:

• Step count and walking/running distance
• Workout and exercise data
• Body weight measurements
• Sleep analysis data
• Active energy burned
• Dietary calorie totals

Important: HealthKit data is used solely to provide you with personalized coaching and progress tracking. We do NOT use HealthKit data for advertising purposes, and we do NOT sell or share HealthKit data with third parties for marketing or advertising purposes.

Voice Calls

If you have a voice call with BodyBuddy, we collect the audio of that call, a transcript of it, and the phone number used. We use calls to coach you and to pull out the things you tell us during the call, such as meals, workouts, or how your week is going, so they show up in your history the same way a text conversation would.

Automatically Collected Information

• Device information and identifiers
• Advertising identifiers (with your permission via App Tracking Transparency)
• Usage data and interaction patterns
• Message metadata (timestamp, frequency)
• Session recordings of how you use the app and website, which our analytics provider captures so we can find places where the product is confusing. These recordings can include text and images shown on screen, so they may include parts of your conversations

3. How We Use Your Information

We use your information to:

• Provide personalized AI coaching services
• Facilitate daily text-based check-ins and accountability
• Process and analyze photos for meal tracking, exercise logging, and avatar generation
• Generate and display your Future You transformations
• Track your progress and provide insights
• Transcribe, summarize, and turn your appointment recordings and imported documents into plans, when you use those features
• Improve our AI models and service quality (using anonymized data)
• Communicate important updates about the service
• Ensure the security and integrity of our platform

No AI Training on Sensitive Health Content: We do not use your appointment recordings, transcripts, imported medical or training documents, or health condition notes to train or improve AI models. This content is processed by AI only to provide the Service to you (for example, to produce your transcript, summary, or plan).

Human Review of Conversations: No one is actively monitoring your chats. BodyBuddy may flag specific conversations for review by authorized internal personnel only, in limited circumstances: explicit requests for human support, signs of acute user distress, medical or safety concerns warranting human guidance, or suspected violations of our Terms of Service (such as attempts to jailbreak or misuse the AI). Flagged conversations are reviewed solely for the purpose of user wellbeing and platform integrity, are not shared with third parties, and are retained only as long as needed to resolve the flag.

3a. How Visit Recording Works

When you record an appointment with visit recording, your data moves through the following steps:

• Recording notice: The app displays a recording notice on the recording screen. By starting a recording, you confirm that you are a participant in the appointment, that you are complying with applicable recording laws, and that you have obtained any consent required from the people you record, as described in our Terms of Service.
• Recording and upload: Audio is recorded on your device and uploaded in segments to encrypted cloud object storage (Amazon Web Services). Audio is encrypted in transit and encrypted at rest using AWS Key Management Service.
• Transcription and processing: Third-party AI services transcribe the audio, and AI models (from OpenAI, Anthropic, and Google) process the transcript into a summary and a coaching plan. The resulting transcripts, summaries, and plans are stored encrypted in our database, not in cloud object storage.
• On-device copy: A local copy of the audio stays on your device until our server confirms the transcript is safely stored. It is then deleted from your device.
• Your review: You can review the summary and plan generated from your recording and flag anything that looks wrong.

As described in Section 3, appointment recordings and transcripts are never used to train AI models. See Section 7 for how long we keep audio and transcripts.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• AI Service Providers: We use third-party AI providers including OpenAI, Anthropic, and Google to process your messages, photos, and data to provide coaching responses, meal analysis, and recommendations, and to transcribe and summarize appointment recordings and process imported documents when you use those features. Most of these requests are routed through OpenRouter, which passes them to the model that handles them. We also use Replicate for some image processing, such as removing the background from a photo. These providers may process your content according to their privacy policies.
• Cloud Storage (Amazon Web Services): We use AWS to store your data, including photos, imported documents, and appointment audio. This content is encrypted in transit and at rest. Transcripts and summaries are stored encrypted in our database rather than in object storage.
• Analytics and Advertising Partners: We use Meta (Facebook) SDK to measure ad effectiveness, understand how users find our app, and improve our marketing. If you grant permission through App Tracking Transparency, Meta may collect device identifiers to provide personalized ads and measure conversions. You can opt out of this tracking at any time in your device settings.
• Messaging and Calls: Linq delivers your text conversations with your coach and receives the content of those messages. If you have a voice call with BodyBuddy, the call runs through Vapi, with transcription by AssemblyAI and the coach's voice generated by ElevenLabs, and Twilio provides the underlying phone service.
• Other Service Providers: Third-party services that help us operate, including PostHog for analytics and session recordings, Supabase for account sign-in, Mem0 to store facts from your conversations so your coach remembers them later, Superwall for subscription screens, Expo for push notification delivery, and Airbridge to understand which ads bring people to BodyBuddy.
• Payment Processors: Payments are processed securely by Apple (for App Store purchases) or Stripe (for web purchases). We do not store your full credit card information.
• Legal Requirements: When required by law or to protect rights and safety
• Business Transfers: In connection with any merger, sale, or acquisition

Note: Apple HealthKit data is never shared with third parties except as required to provide the Service, and is never used for advertising.

Plan Sharing You Initiate

You can choose to share a plan with another person through the app's sharing feature (for example, via a link or their phone number). When you do:

• The recipient can see the content of the plan you chose to share, such as its steps, schedule, and instructions
• Sharing only happens when you initiate it; we never share your plans with other people on our own
• You can revoke a share at any time. When you revoke, the recipient can no longer access the plan through BodyBuddy. Revocation cannot retract copies the recipient has already made outside BodyBuddy, such as screenshots or exports

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes encryption, secure servers, and regular security assessments.

6. Your Rights and Choices

You have the right to:

• Access and receive a copy of your personal data
• Correct or update inaccurate information
• Request deletion of your personal data
• Opt-out of certain communications
• Withdraw consent for data processing
• Control ad tracking through iOS Settings > Privacy & Security > Tracking

7. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations:

• Photos and message history are retained for service improvement and progress tracking
• Raw appointment audio is deleted from our systems after your transcript is safely stored. If transcription fails, we keep the uploaded audio for up to 30 days so you can retry, then delete it
• Transcripts, summaries, plans, imported documents, and health condition notes are retained while your account is active so the app can keep coaching you from them
• You can request deletion of your photos at any time through your account settings or by contacting support
• When you delete your account, your data (including photos, appointment audio, transcripts, imported documents, and health condition notes) will be removed from our active systems within 30 days
• Some anonymized data may be retained for analytics and AI model improvement; this never includes appointment recordings, transcripts, imported medical or training documents, or health condition notes

8. Children's Privacy

BodyBuddy is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last updated" date and, for significant changes, providing additional notice through the app or via email.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at: