Data Retention Policy

Version: 2.0.0 Last Updated: 2026-08-04

Introduction

This Data Retention Policy explains how long BodyFit by Mi7z retains different types of personal data and when and how that data is deleted. This policy supports our compliance with UK GDPR's data minimisation principle.

Retention Periods

Account data (email, name, role): Retained while your account is active. Deleted within 30 days of account deletion.

Profile data (age, goals, health screening): Retained while your account is active. Deleted within 30 days of account deletion.

Activity data (workouts, food logs, measurements): Retained while your account is active. Deleted within 30 days of account deletion.

Device data (Garmin, wearable syncs): Deleted immediately when you disconnect a device. Otherwise deleted within 30 days of account deletion.

Rewards data (points, XP, achievements): Deleted within 30 days of account deletion.

AI Coach conversations: Retained while your account is active to provide context. Deleted within 30 days of account deletion.

Audit logs (admin actions, security events): Retained for up to 2 years for security and compliance, then deleted.

Policy acceptance records: Retained for the duration of your account plus 3 years for compliance audit purposes.

Referral records: Retained for up to 5 years for fraud prevention purposes, even after account deletion, as described in our Privacy Policy. This is a legitimate interest under UK GDPR.

Fraud flags: Retained for up to 5 years for fraud prevention and pattern detection.

Email logs: Retained for 1 year for delivery verification and troubleshooting.

Support tickets: Retained for 2 years for quality and reference purposes.

Deletion Process

When you delete your account:

1. Your account is immediately deactivated and inaccessible
2. A 30-day grace period begins — if you log in, the deletion is cancelled
3. After the grace period, personal data is permanently deleted within 30 days
4. Data retained for fraud prevention or legal obligation is anonymised where possible

Data Minimisation

We only collect data we need to provide the Service. We do not collect data "just in case." When a feature no longer requires certain data, we delete or anonymise it.

Your Rights

Under UK GDPR, you can request deletion of your data at any time. Contact privacy@bodyfit.mi7z.com. We process requests within 30 days. See our GDPR Rights page.

Exceptions

We may retain data longer than stated where required by law, legal hold, or ongoing investigation. We will inform you if your data is subject to extended retention.

Changes

We may update this policy. Material changes will be communicated via in-app notification.

Contact

For data retention questions or deletion requests: privacy@bodyfit.mi7z.com.