Privacy Policy

This Privacy Policy explains how BodyPlan Limited (we, us, our) collects and uses your personal data. We are the data controller for the purposes of the UK GDPR and the Data Protection Act 2018. Our registered office is at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Company number 07893705. BodyPlan is a registered trademark in the UK and USA.

What we collect

• Account details: email, name (if provided).
• Profile and training data: goals, equipment, scheduling, workouts, and body stats you log.
• Usage and technical data: device/browser information, log data, cookies.
• Support communications and feedback.
• Optional images you upload (e.g., progress photos or body photos for AI analysis).
• Body composition estimates derived from photos (e.g., body fat % and muscle mass %).
• Precise location (GPS) data, including in the background, but only while you are actively recording an outdoor workout. See “Location data” below.
• Special category data (health-related) only where you choose to provide it (e.g., weight or body composition). We process this with your explicit consent.

How we use your data

• Provide and personalise the service, including AI‑assisted workout planning.
• Process photos you upload for AI body composition estimates.
• Enforce safety rules for AI photo uploads (e.g., quality checks, single-adult requirement).
• Record outdoor workout routes and calculate distance, pace, and split times.
• Operate your account, authenticate access, and maintain security.
• Analyse usage to improve features and reliability.
• Communicate service updates and respond to support requests.
• Comply with legal obligations and enforce our terms.

Location data

BodyPlan can record your route during outdoor workouts such as running, walking, and cycling. This feature uses your device's precise location (GPS).

• What we collect: latitude and longitude, GPS accuracy, speed, and timestamps, recorded as a sequence of points forming your route.
• When we collect it: only while you have explicitly started an outdoor workout recording in the app, and until you finish or discard that recording. We do not collect location at any other time.
• Background collection: with your permission, recording continues while the app is in the background or your screen is off, so your route is not lost mid‑workout. This is necessary because workouts are performed with the phone pocketed or stowed. You can revoke background location permission at any time in your device settings.
• Why we collect it: to draw your route on a map and calculate distance, pace, and per‑kilometre splits for that workout. We do not use location for advertising or profiling, and we do not sell it.
• Where it is stored: routes are stored on your device and on our servers, attached to the workout they belong to and linked to your account.
• Map display: maps are rendered using Google Maps. Displaying your route sends the relevant coordinates to Google as our service provider, subject to Google's privacy policy.
• Sharing: routes are private by default. See “Social and public content” below.
• Deletion: deleting a workout deletes its route. Deleting your account deletes your stored routes.

Social and public content

• Your profile is private by default. You can choose to make it public in‑app.
• If your profile is public, your public username, avatar, and shared workouts may be visible to other users.
• Workout routes are never shared automatically. If you choose to share a workout that has a recorded route, you can decide whether to include the route map. If you include it, the route becomes visible to people who can view that post.
• When sharing a route you can choose to hide its start and end, which removes the points near the beginning and end of your route before it is published, so places like your home are not revealed.
• Likes, comments, and follows are visible to the people who can view the related public content.
• You can delete your comments and remove or hide your public posts at any time.
• Blocking and reporting tools are available in‑app to help keep the community safe.

Lawful bases (UK GDPR)

• Contract: to provide the service you request.
• Legitimate interests: service improvement, security, fraud prevention.
• Consent: for optional features (e.g., special category/health data you choose to enter, certain analytics, or marketing). You can withdraw consent at any time.
• Legal obligation: where required by law or competent authority.

Sharing

We may share data with service providers who process it on our behalf (e.g., AI processing, hosting/storage, analytics) under contracts that protect your data. We will only disclose data to third parties where lawful (e.g., to comply with the law, protect rights, or complete a merger or acquisition). We do not sell personal data.

Connecting BodyPlan to an AI assistant

You can connect your BodyPlan account to a third-party AI assistant such as Claude or ChatGPT, so it can answer questions using your own training data. This is entirely optional, off by default, and nothing is shared unless you explicitly connect an application and approve it.

When you connect an application you are shown exactly which categories of data it is asking for, and you can allow or refuse each one individually. The categories are: your training profile, your workouts, your training plans, your body measurements, your nutrition, and activity synced from Apple Health or Google Fit. Your body measurements, nutrition and synced activity are health data, and we rely on your explicit consent to share them (UK GDPR Article 9). We record which permissions you granted and when.

These connections are read-only. A connected application can read the data you approved. It cannot create, change or delete anything in your BodyPlan account — it cannot log workouts, generate or edit plans, post to your feed, or change your settings.

We never share the following with a connected application, whatever permissions you grant: your progress photos or photo-derived body estimates; your email address or contact details; your feed posts, comments or likes; your followers, following or blocked users; your messages; or your payment and subscription details.

If you allow the synced activity or nutrition permissions, data we received from Apple Health or Google Fit may be included. Consistent with Apple's HealthKit terms, that data is shared only to provide you with health and fitness services, is never used for advertising, and is never sold to data brokers or information resellers.

Once data reaches a connected application it is processed by that provider under their own privacy terms, which we do not control. Please read theirs alongside this policy.

You can withdraw a connection at any time from Connected apps in your account settings, or from the assistant's own settings. Revoking takes effect immediately: the credentials are invalidated and the next request the application makes is refused. Deleting your BodyPlan account removes every connection record with it. We store a record of the connection and its permissions, plus credentials in hashed form only — never in a readable form.

International transfers

If personal data is transferred outside the UK, we will ensure appropriate safeguards are in place (e.g., UK IDTA/SCCs) in accordance with UK GDPR.

Retention

We keep personal data only as long as necessary for the purposes set out above, and to comply with legal obligations. Unsaved AI analysis uploads may be auto-deleted under our retention policy. If you save a photo to your progress log, or link an analysis to a body stats entry, that photo is not subject to this auto-delete and remains until you delete it. Measurements derived from photos may remain even if the photo is deleted. You can delete your account or certain data at any time in‑app or by contacting us.

Your rights

Under UK GDPR you have rights including access, rectification, erasure, restriction, portability, and objection. You also have rights regarding automated decision‑making where applicable. To exercise these rights, contact us using the details below. You may also complain to the UK Information Commissioner’s Office (ICO).

Contact

BodyPlan Limited, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ • Company No. 07893705. For privacy enquiries, contact: privacy@bodyplan.com

Effective date: 9 August 2026