Privacy Policy

Last updated: September 4, 2026

This Policy explains what data Bodylab.coach (“Bodylab”, “we”) collects, what we use it for, who we share it with, and what rights you have over it. It applies to the Bodylab mobile app and the bodylab.coach website. This is policy version “2026-07”, the same one you accepted with the explicit consent when you registered.

1. Data controller

The controller of your data is Bodylab, a company incorporated and based in Colombia, which operates the Bodylab app and the bodylab.coach website for users in different countries.

For any question about this policy or about your data, write to us at soporte@bodylab.coach.

2. What data we collect

Account data: email, name, password (stored hashed, never in plain text), language, time zone and email verification status.

Health and biometric data (special category): weight, height, estimated body composition, physical goal, injuries and discomforts, answers to the physical readiness questionnaire (PAR-Q), meals you log or scan with their estimated macros, and your physical activity (workouts, walks, runs). This data is the heart of the Service: without it we can’t generate your plan or coach you.

Pre-registration questionnaire data: your answers to the initial questionnaire (including your measurements and your goal) are stored on your device while you complete it, along with a random anonymous identifier that lets us link that questionnaire to your account if you register. If you leave us your email to save your plan before creating an account, we use it to associate your projection with you and remind you of your plan; you can request its deletion by writing to us.

Photos: the body photo you upload to generate your plan and the meal photos you scan. They are used exclusively for AI analysis and your own tracking; they are never published or used for other purposes.

Location data (GPS): only while you record an activity (walk, run, bike ride), to trace the route and calculate distance, pace and elevation. We do not track your location outside an active recording.

Payment data: processed by Stripe (web purchases) or Apple/Google (in-app purchases). We never see or store card numbers; we only receive the status of your subscription.

Technical and usage data: device model, operating system, push notification identifiers, error reports and usage metrics, to operate, debug and improve the Service.

3. Cookies and storage on your device

On the website we only use first-party cookies and storage, essential for it to work. We do not use advertising cookies or third-party trackers.

Cookies: your chosen language (1 year), your approximate country based on IP so we can show you prices for your region (1 year) and, if you arrive through the link of a partner in our referral program, an attribution cookie (90 days) to recognize that referral if you subscribe — the partner sees aggregate statistics, never your personal data.

Browser storage: the draft of the initial questionnaire (so you don’t lose your answers if you reload the page), the random anonymous identifier described above and, for the session, the campaign parameters you arrived with (UTM).

You can clear cookies and storage from your browser settings; the site keeps working with the defaults.

4. What we use your data for

To generate and adapt your training and nutrition plan, estimate the macros of your meals, comment on your GPS activities, and give your AI coach real context (your profile, today’s meals, your last workout, your injuries and restrictions).

To operate your account: authentication, email verification, notifications you have enabled, support and billing.

To keep the Service safe and stable: fraud and abuse prevention, and error diagnosis.

Your plans, estimates and coach responses are generated automatically by AI models. We do not make automated decisions that produce legal effects on you or similarly significantly affect you; you can always write to us to have a person review any result.

5. Legal basis

Health data and body photos: we process them only with your explicit consent (Art. 9(2)(a) GDPR and equivalent rules), which you give with a specific checkbox when you register. You can withdraw that consent at any time; withdrawing it does not affect the lawfulness of prior processing.

Everything else: performance of the contract (providing the service you asked for), legitimate interest (security, abuse prevention, service improvement) and compliance with legal obligations (e.g. billing).

7. International transfers

Our providers operate in different countries (mainly the United States and the European Union), so your data may be transferred outside your country. When that happens we rely on recognized safeguards, such as Standard Contractual Clauses and each provider’s data processing agreements.

8. How long we keep your data

We keep your data while your account is active. If you delete your account, it is deactivated immediately and your personal data is permanently purged within the following 30 days. We only keep for longer what a legal obligation requires us to: billing records are anonymized (amounts and dates with no link to your identity), and Stripe, Apple and Google keep their own payment records under their own obligations.

Pre-registration data: anonymous questionnaire events are kept for 3 months. If you left your email and never created an account, we delete it after 6 months at most — and you can request its deletion earlier, at any time, by writing to us.

9. Your rights

Access and portability: from the app you can request a full export of your data, which arrives by email (up to once per day).

Rectification: you can correct your profile, your measurements and your logs from the app itself.

Deletion: you can delete your account from Settings in the app, with no external steps. Timelines are in the retention section.

Withdrawal of consent: you can withdraw consent for the processing of health data at any time; since that data is essential for the Service, withdrawing it means deleting the account.

Complaints: if you are in the EU/EEA, you can complain to your data protection authority; in Colombia, to the Superintendencia de Industria y Comercio; in other countries, to the equivalent local authority. You can also write to us first: we usually resolve things faster.

10. Security

We apply encryption in transit (TLS) on all communications, per-user data isolation at the database level (row-level security), short-lived sessions with token revocation, and restricted internal access. No system is infallible, but the Service is designed to minimize risk.