Privacy Policy for BodyLab

Last updated: July 14, 2026

BodyLab is a fitness and body-tracking application that lets you log workouts, track your weight and muscle development, and receive AI-powered analysis of your training and body composition. It is published and operated by an independent developer (sole proprietorship — entrepreneur individuel) registered in France, SIREN 949 332 993, SIRET 949 332 993 00029, VAT FR33949332993 ("we", "our", or "us"). This Privacy Policy explains how we collect, use, and protect your information when you use our app.

1. Information We Collect

We only collect data that is necessary to provide the app's features:

Account data: e-mail address, authentication identifiers, and a username, managed through our backend provider (Supabase).
Profile data: information you provide during onboarding and in your profile, such as gender, age, height, weight, fitness goals, training frequency, available equipment, and physical limitations.
Fitness and activity data: workouts, exercises, sets, repetitions, training volume, weight logs, muscle statistics, streaks, and rankings.
Body scan photos: photos you voluntarily submit for the Bodyscan feature, used solely to generate your AI body-composition analysis.
Purchase information: your subscription status and transaction identifiers, processed by Apple and our subscription-management provider (RevenueCat). We never see or store your payment card details.
Diagnostics: device model, operating system version, app version, language, and crash/performance data needed to run and improve the app.

We do not collect your precise location, your contacts, or advertising identifiers, and we do not show third-party advertising.

2. How We Use Your Information

Create and manage your account and sync your data across devices.
Provide the app's core features: workout tracking, weight and muscle statistics, journal, rankings, and social features (followers/following).
Generate AI-powered features: personalized workout plans and body scan analysis. Your training history and the photos you submit may be processed by an AI provider (OpenAI) strictly to produce these results.
Manage subscriptions, free trials, and purchases (via RevenueCat and Apple).
Send you notifications (reminders, tips) only if you grant notification permission — you can revoke it at any time in your device settings.
Ensure security, prevent fraud and abuse, and comply with legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

3. Legal Bases (GDPR)

We process your data under the following legal bases of the EU General Data Protection Regulation (GDPR): performance of a contract (providing the app and your subscription), consent (body scan photos, health-related fitness data, notifications), legitimate interest (app security, diagnostics), and legal obligation (accounting and tax records for purchases).

Health-related data (weight, body measurements, body photos) is processed only with your explicit consent, which you may withdraw at any time by deleting the relevant data or your account.

4. Third-Party Service Providers

We share the data described above only with the processors needed to run the app:

Supabase (authentication, database, and storage backend).
RevenueCat (subscription management).
OpenAI (AI analysis: workout generation and body scan).
Apple App Store (app distribution, payments, and receipts).

These providers process data on our behalf under data-processing agreements and their own privacy commitments.

5. Data Retention

Account and fitness data: kept as long as your account is active, then deleted or anonymized when you delete your account.
Body scan photos: kept only as long as needed to provide the feature; you can delete your scans at any time in the app.
Purchase records: kept for the duration required by French accounting and tax law (up to 10 years).

6. Your Rights

Under the GDPR and the French Data Protection Act (Loi Informatique et Libertés), you have the right to access, rectify, erase, and port your data, to restrict or object to its processing, and to withdraw your consent at any time. You can delete your account and associated data directly in the app (Settings), or contact us at [email protected]. We will respond within one month. You also have the right to lodge a complaint with your supervisory authority (in France, the CNIL).

7. Children

BodyLab is not intended for children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.

8. Security

Data in transit is encrypted (HTTPS/TLS), credentials are stored securely on your device, and access to our backend is restricted. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your data against unauthorized access, alteration, or loss.

9. International Transfers

Some providers listed in Section 4 process data in the United States or other countries outside the EEA. Where they do, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

10. Changes to This Policy

We may update this policy from time to time. The "Last updated" date above reflects the latest version, and material changes will be signposted in the app.

11. Contact Us

For any privacy question or request: [email protected]