BODYMAX Privacy Policy

BODYMAX ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered fitness coaching application and services.

By using BODYMAX, you agree to the collection and use of information in accordance with this policy.

1.1 Account Information

• Email address
• Username/display name
• Password (securely hashed, never stored in plain text)
• Account creation date
• Email change request records

1.2 Profile Data

• Age and date of birth
• Height and weight
• Gender
• Fitness level (beginner, intermediate, advanced)
• Fitness goals (muscle gain, fat loss, strength, etc.)
• Physical limitations or injuries
• Equipment availability

1.3 Workout and Fitness Activity Data

• Generated workout plans
• Completed workout sessions
• Exercise logs (sets, reps, weight, RPE)
• Training progress and history
• Achievement records

1.4 AI Coach Interactions

• Chat messages with AI coach
• Workout modification requests
• Feedback and preferences expressed through chat

1.5 App Usage Analytics

• App feature usage patterns
• Session duration and frequency
• Navigation and interaction data
• Error logs and crash reports
• User-submitted bug reports and feedback

1.6 Device Information

• Device type and operating system
• Browser type and version
• Device identifiers (for analytics only)
• IP address and approximate location (country/timezone)

We use the information we collect for the following purposes:

We share your data only with service providers who process data on our behalf:

• Cloud Hosting Providers

  Secure cloud infrastructure for data storage and app hosting. All data encrypted at rest.

• AI Processing Providers (OpenAI APIs)

  Powers AI coach functionality. Only fitness-related data is shared; personal identifiers and payment data are never included.

• Analytics Providers (PostHog)

  App usage analytics and performance monitoring. Data is anonymized and aggregated.

• Email Service Provider (Resend)

  Transactional email delivery for account confirmations, password resets, and security notifications. Only your email address and name are shared.

All third-party service providers are bound by data processing agreements and are prohibited from using your data for any purpose other than providing services to BODYMAX.

We implement industry-standard security measures to protect your data:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS protocols.
• Encryption at Rest: Stored data is encrypted using AES-256 encryption.
• Secure Authentication: Passwords are hashed using bcrypt with secure salting.
• Access Controls: Strict access controls limit who can access user data within our organization.
• Regular Security Audits: We conduct regular security assessments and vulnerability testing.

• Active Accounts: We retain your data while your account remains active and you continue using BODYMAX.
• Account Deletion: Upon account deletion request, your personal data is permanently deleted within 30 days.
• Anonymized Analytics: Non-identifiable, aggregated analytics data may be retained for service improvement purposes.
• Backup Systems: Encrypted backups may retain data for up to 90 days before complete purging.

You have the following rights regarding your personal data:

To exercise any of these rights, contact us at support@bodymax.fit. We will respond within 30 days.

BODYMAX is not intended for users under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at support@bodymax.fit, and we will delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we make material changes, we will notify you by:

• Posting the updated policy on this page with a new effective date
• Sending an email notification to your registered email address
• Displaying a prominent notice within the app

Your continued use of BODYMAX after changes constitutes acceptance of the updated policy.