Privacy Policy

Version: 2.0.0 Last Updated: 2026-08-04

Introduction

BodyFit by Mi7z ("we", "us", "our") operates the BodyFit fitness, nutrition, and wellness coaching platform ("the Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and the rights you have over your data.

By creating a BodyFit account and using the Service, you acknowledge that you have read and understood this Privacy Policy. This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data We Collect

Account data: Your email address, password (hashed), name, role, and registration date. If you register with Google, we receive your Google profile information as permitted by your Google account settings.

Profile data: Age, sex, height, weight, fitness goals, training preferences, health screening responses, dietary preferences, and any health conditions you disclose during onboarding.

Activity data: Workout sessions, exercise logs, sets, reps, weights, food logs, macro entries, body measurements, progress photos, water intake, daily check-ins, and goal progress.

Device data: When you connect a wearable (e.g., Garmin), we sync steps, heart rate, sleep stages, stress levels, body battery, activities, calories, and distance — only with your explicit OAuth authorisation.

Rewards data: Points, XP, levels, achievements, streaks, referral codes, and community memberships.

Usage data: Pages visited, features used, app interactions, session duration, browser type, device type, and IP address (hashed for audit logs only — we do not store raw IP addresses).

Communication data: Support tickets, feedback submissions, AI Coach conversation history, and notification preferences.

How We Use Your Data

We process your data on the following lawful bases under UK GDPR:

• Contract (Article 6(1)(b)): To provide the Service you signed up for — generating workout plans, nutrition targets, coaching guidance, progress tracking, and rewards.
• Consent (Article 6(1)(a)): For wearable device data sync, optional marketing communications, and non-essential cookies. You can withdraw consent at any time.
• Legitimate interests (Article 6(1)(f)): For fraud prevention, service improvement, security monitoring, and analytics. We balance our interests against your rights and only process where appropriate.
• Legal obligation (Article 6(1)(c)): Where required by law, such as retaining records for tax compliance or responding to lawful data requests.

Specific uses: Personalising your AI Coach recommendations, calculating your wellness score, generating preventative health insights, syncing wearable data, processing rewards and referrals, sending notifications and briefing emails, providing community features, and improving our coaching engine.

Data We Do Not Collect

We do not collect: raw IP addresses (only hashed), precise GPS location, biometric identifiers, financial data beyond what your payment processor provides, or data from third parties about you. We never sell your data to anyone, under any circumstances.

Data Sharing

We share your data only with:

• Cloud infrastructure providers who host our platform and database under data processing agreements.
• Payment processors (when billing features are enabled) who handle your payment data directly under PCI-DSS compliance — we never see or store your full card details.
• Wearable platforms (e.g., Garmin) when you authorise a connection — we receive data from them; we do not send your BodyFit data to them beyond what is needed for the integration.
• Nutrition data providers (Open Food Facts) for food lookups — we send search queries, not your personal data.
• Authorities where legally required, such as valid law enforcement requests or where we must report certain data under applicable law.

We do not share your personal data with advertisers, data brokers, or analytics companies that sell data.

International Data Transfers

Your data is stored on cloud infrastructure. Where any data is processed outside the UK, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements (IDTA) or equivalent protections.

Data Retention

We retain your data only as long as needed. Account data is kept while your account is active. Activity data is retained while your account is active and for a limited period after deletion for fraud prevention. Device data is deleted when you disconnect a device. See our Data Retention Policy for specific timeframes.

Your Rights

Under UK GDPR, you have the right to:

• Access your personal data (Subject Access Request)
• Rectify inaccurate or incomplete data
• Erase your personal data (right to be forgotten)
• Restrict processing of your data
• Object to processing based on legitimate interests
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, contact privacy@bodyfit.mi7z.com. We respond within 30 days.

Security

We protect your data with TLS encryption in transit, access controls, row-level security so only you can access your data, and audit logging of admin actions. See our Security & Privacy policy for technical details.

Children's Data

BodyFit is not directed at children under 13. Users aged 13–17 may use BodyFit with parental consent (Youth Mode). We do not knowingly collect data from children under 13. See our Children's Policy for details.

Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated via email and in-app notification. The version number and effective date will be updated. Continued use after changes constitutes acceptance.

Contact

For privacy questions or data requests: privacy@bodyfit.mi7z.com. For complaints: see our Contact & Complaints page. You can also complain to the ICO at ico.org.uk.