Privacy Policy

1. Introduction

Welcome to BodyBuddy ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI health coaching service.

If you are a Washington consumer, our separate Consumer Health Data Privacy Policy describes how we handle consumer health data under Washington's My Health My Data Act.

BodyBuddy is not a healthcare provider, health plan, or clearinghouse, and it is not a HIPAA covered entity. HIPAA does not govern the information you share with us; this policy, the Consumer Health Data Privacy Policy, and applicable state privacy laws do.

2. Information We Collect

Personal Information

• Name and contact information (phone number)
• Health and fitness data (weight, height, age, gender)
• Fitness goals and preferences
• Daily activity and nutrition information shared via text messages
• Photos you upload (avatar photos, meal photos, exercise photos)
• Message history and conversation transcripts for service improvement

Appointment Recordings (Visit Recording)

If you choose to use visit recording, we collect:

• Audio recordings of your own health and fitness appointments (for example, visits with a doctor, therapist, or trainer) that you choose to record
• Transcripts of those recordings, and the AI-generated summaries and coaching plans created from them

Visit recording is optional, and the recording screen displays a recording notice before you record. See Section 3a for how this data flows through our systems.

Health Condition Notes

During onboarding and afterward, you may optionally share health context in your own words, such as medical conditions, medications (for example, GLP-1s), injuries, or pregnancy. Sharing this information is entirely optional, and we use it only to personalize your coaching.

Your Health Record

As you text with BodyBuddy, we build a health record from what you tell us: symptoms, injuries, conditions, feelings, medications, allergies, the situations getting in the way of your goals, and the places on your body they belong to, each kept with its history over time. The record is drawn from your own messages, your onboarding answers, documents and notes you import, and your appointment transcripts. You can see it on a figure of your body in the app, edit or resolve any entry, and ask us to delete any of it.

Imported Documents, Notes, and Assistant Exports

You may paste, photograph, or upload medical or training documents (for example, care instructions after an appointment, physical therapy protocols, or workout programs). We store these documents and process them with AI to turn them into plans within the app. You may also paste what another AI assistant (for example, ChatGPT or Claude) knows about your health, or your own notes. We keep the paste, extract it with AI, and use what it says to prefill your profile and your health record (injuries, conditions, medications, allergies, symptoms, feelings, and goals) and to brief your coach.

Email You Send to Your BodyBuddy Address

If we give you a BodyBuddy email address and you send documents or notes to it, we read that mail, store what you sent, and process it the same way as imported documents. We do not read any other mailbox of yours.

Wearables and Fitness Apps

If you connect a wearable or fitness app (for example, WHOOP, Oura, Garmin, or Fitbit), we retrieve activity, sleep, and body data from it through Junction, a connection service, and store what it returns. You can disconnect at any time in the app.

Shared Video Links

You may send BodyBuddy a link to a video (for example, from YouTube, TikTok, or Instagram) so it can turn the video into a plan for you. When you do, we collect the link and the video's public details (such as its title, creator name, caption, and thumbnail), and our AI providers analyze the linked content to create your plan. We keep the link and those public details with the plan so it can show where it came from, but we never download or store the video file itself. We do not use the videos you link to, or content retrieved from them, to train AI models.

Information About Your Health Professionals

You may enter the names and roles of the health professionals you work with (for example, "Dr. Lee, physical therapist") so you can attach plans to them. This is information about other people that you provide to us. Please only enter what is needed to organize your care, and only information you are comfortable sharing.

Apple HealthKit Data

With your permission, we may collect health data from Apple HealthKit, including:

• Step count and walking/running distance
• Workout and exercise data
• Body weight measurements
• Sleep analysis data
• Active energy burned
• Dietary calorie totals

Important: HealthKit data is used solely to provide you with personalized coaching and progress tracking. We do NOT use HealthKit data for advertising purposes, and we do NOT sell or share HealthKit data with third parties for marketing or advertising purposes.

Voice Calls

If you have a voice call with BodyBuddy, we collect the audio of that call, a transcript of it, and the phone number used. We use calls to coach you and to pull out the things you tell us during the call, such as meals, workouts, or how your week is going, so they show up in your history the same way a text conversation would.

Automatically Collected Information

• Device information and identifiers
• Advertising identifiers (with your permission via App Tracking Transparency)
• Usage data and interaction patterns
• Message metadata (timestamp, frequency)
• Session recordings of how you use the app and website, which our analytics provider captures so we can find places where the product is confusing. These recordings can include text and images shown on screen, so they may include parts of your conversations

3. How We Use Your Information

We use your information to:

• Provide personalized AI coaching services
• Facilitate daily text-based check-ins and accountability
• Process and analyze photos for meal tracking, exercise logging, and avatar generation
• Generate and display your Future You transformations
• Track your progress and provide insights
• Transcribe, summarize, and turn your appointment recordings and imported documents into plans, when you use those features
• Build and keep your health record from what you tell us, and show it back to you on your body
• Retrieve and analyze videos you link to and turn them into plans, when you use that feature
• Improve our AI models and service quality (using anonymized data)
• Communicate important updates about the service
• Ensure the security and integrity of our platform

No AI Training on Sensitive Health Content: We do not use your appointment recordings, transcripts, imported medical or training documents, or health condition notes to train or improve AI models. This content is processed by AI only to provide the Service to you (for example, to produce your transcript, summary, or plan).

Human Review of Conversations: No one is actively monitoring your chats. BodyBuddy may flag specific conversations for review by authorized internal personnel only, in limited circumstances: explicit requests for human support, signs of acute user distress, medical or safety concerns warranting human guidance, or suspected violations of our Terms of Service (such as attempts to jailbreak or misuse the AI). Flagged conversations are reviewed solely for the purpose of user wellbeing and platform integrity, are not shared with third parties, and are retained only as long as needed to resolve the flag.

3a. How Visit Recording Works

When you record an appointment with visit recording, your data moves through the following steps:

• Recording notice: The app displays a recording notice on the recording screen. By starting a recording, you confirm that you are a participant in the appointment, that you are complying with applicable recording laws, and that you have obtained any consent required from the people you record, as described in our Terms of Service.
• Recording and upload: Audio is recorded on your device and uploaded in segments to encrypted cloud object storage (Amazon Web Services). Audio is encrypted in transit and encrypted at rest using AWS Key Management Service.
• Transcription and processing: Third-party AI services transcribe the audio, and AI models (from OpenAI, Anthropic, and Google) process the transcript into a summary and a coaching plan. The resulting transcripts, summaries, and plans are stored encrypted in our database, not in cloud object storage.
• On-device copy: A local copy of the audio stays on your device until our server confirms the transcript is safely stored. It is then deleted from your device.
• Your review: You can review the summary and plan generated from your recording and flag anything that looks wrong.

As described in Section 3, appointment recordings and transcripts are never used to train AI models. See Section 7 for how long we keep audio and transcripts.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• AI Service Providers: We use third-party AI providers including OpenAI, Anthropic, Google (Gemini), and DeepSeek to process your messages, photos, and data to provide coaching responses, meal analysis, and recommendations, to build your health record, and to transcribe and summarize appointment recordings, process imported documents and notes, and analyze videos you link to when you use those features. Most of these requests are routed through OpenRouter, which passes them to the model that handles them; some short reading tasks run on Cerebras or Groq. We also use Replicate for some image processing, such as removing the background from a photo. These providers may process your content according to their privacy policies.
• Cloud Storage (Amazon Web Services): We use AWS to store your data, including photos, imported documents, and appointment audio. This content is encrypted in transit and at rest. Transcripts and summaries are stored encrypted in our database rather than in object storage.
• Analytics and Advertising Partners: We use Meta (Facebook) SDK to measure ad effectiveness, understand how users find our app, and improve our marketing. If you grant permission through App Tracking Transparency, Meta may collect device identifiers to provide personalized ads and measure conversions. You can opt out of this tracking at any time in your device settings.
• Messaging and Calls: Linq delivers your text conversations with your coach over iMessage or SMS and receives the content of those messages; Apple and your mobile carrier carry them in transit as they do any message. If you have a voice call with BodyBuddy, the call runs through Vapi, with transcription by AssemblyAI and the coach's voice generated by ElevenLabs, and Twilio provides the underlying phone service.
• Wearable Connections (Junction): When you connect a wearable or fitness app, Junction retrieves your data from that device or app on your behalf and passes it to us. Junction sees the account you connect and the data it retrieves.
• Other Service Providers: Third-party services that help us operate, including PostHog for analytics and session recordings, Supabase for account sign-in, Mem0 to store facts from your conversations so your coach remembers them later, Superwall for subscription screens, Expo for push notification delivery, and Airbridge to understand which ads bring people to BodyBuddy.
• Payment Processors: Payments are processed securely by Apple (for App Store purchases) or Stripe (for web purchases). We do not store your full credit card information.
• Legal Requirements: When required by law or to protect rights and safety
• Business Transfers: In connection with any merger, sale, or acquisition

Note: Apple HealthKit data is never shared with third parties except as required to provide the Service, and is never used for advertising.

Sharing Your Health Record with a Professional

You can share a read-only page of your health record with a professional you choose, such as a doctor, physical therapist, dietitian, or coach, by creating a link in the app. When you do:

• You choose what goes on the page: one or more topics, or your whole current record. The page shows where each topic stands, how it has felt over time, related plans and care, and any questions you add for the recipient
• Your text messages, quotes from them, your ratings in your own words, and the rest of your record are never on the page
• Anyone with the link can open the page in a web browser; no account is needed. We count how many times a link is opened so you can see whether it was read
• The link works for 90 days from when you create it. You can turn it off at any time in the app, and when you delete your account every link stops working. Turning a link off cannot retract copies the recipient has already made, such as a printout or screenshot
• Sharing only happens when you create a link; we never share your record with other people on our own

Teams

If you join a team in the app, other members see your wins (for example, a streak or a completed plan) as anonymous entries with no name or photo. Your record, your messages, and your health data are never shown to other members.

Plan Sharing You Initiate

You can choose to share a plan with another person through the app's sharing feature (for example, via a link or their phone number). When you do:

• The recipient can see the content of the plan you chose to share, such as its steps, schedule, and instructions
• Sharing only happens when you initiate it; we never share your plans with other people on our own
• You can revoke a share at any time. When you revoke, the recipient can no longer access the plan through BodyBuddy. Revocation cannot retract copies the recipient has already made outside BodyBuddy, such as screenshots or exports

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes encryption, secure servers, and regular security assessments.

6. Your Rights and Choices

You have the right to:

• Access and receive a copy of your personal data
• Correct or update inaccurate information
• Request deletion of your personal data
• Opt-out of certain communications
• Withdraw consent for data processing
• Control ad tracking through iOS Settings > Privacy & Security > Tracking

7. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations:

• Photos and message history are retained for service improvement and progress tracking
• Raw appointment audio is deleted from our systems after your transcript is safely stored. If transcription fails, we keep the uploaded audio for up to 30 days so you can retry, then delete it
• Transcripts, summaries, plans, imported documents and notes, your health record, and health condition notes are retained while your account is active so the app can keep coaching you from them
• Links to your shared record stop working 90 days after you create them, or sooner if you turn them off; when you delete your account, every link stops working within 30 days
• Links you share and the public video details we retrieve (such as a title or thumbnail) are retained with the plans created from them; we never store the video file itself
• You can request deletion of your photos at any time through your account settings or by contacting support
• When you delete your account, your data (including photos, appointment audio, transcripts, imported documents and notes, your health record, wearable data, and health condition notes) will be removed from our active systems within 30 days
• Some anonymized data may be retained for analytics and AI model improvement; this never includes appointment recordings, transcripts, imported medical or training documents, or health condition notes

8. Children's Privacy

BodyBuddy is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last updated" date and, for significant changes, providing additional notice through the app or via email.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at: