Privacy policy

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, use our services, or contact us. This includes:

• Name, email address, and contact information
• Health and fitness data you choose to share
• Payment and billing information
• Communications with coaches and support
• Health and fitness data from apps you connect, such as Apple Health or Android Health Connect (see Section 8)
• Device information needed to operate the app, including a push-notification token so we can deliver the notifications you have enabled, and your device's time zone so your daily totals start and end at your local midnight

2. How We Use Your Information

We use the information we collect to provide, maintain, and improve our services, including to:

• Create and manage your account
• Personalize workout and nutrition recommendations
• Calculate your daily calorie and macronutrient targets from your body metrics and the activity you record
• Power AI-based coaching, recommendations, and insights (see Section 5)
• Process payments and subscriptions
• Send you the notifications you have enabled, and messages required to operate your account
• Send you updates and promotional communications

3. Data Security

We implement appropriate technical and organizational measures to protect the security of your personal information. All data is encrypted in transit and at rest using industry-standard encryption protocols. On your phone, your sign-in credentials are held in the operating system's secure keystore (the iOS Keychain or the Android Keystore), not in ordinary app storage.

4. Data Sharing

We do not sell or share your personal information. We may disclose your information to:

• Your assigned coach (for program delivery)
• Third-party AI providers that power our AI features (see Section 5)
• Service providers who assist in our operations
• Your employer (for corporate wellness programs, aggregated data only)

We never share your information with advertising networks or data brokers, and we do not use your health or fitness data for advertising.

5. AI-Powered Features

Some BodyF1RST features — including the AI Coach, personalized workout and meal recommendations, and progress insights — are powered by third-party artificial-intelligence providers. To generate these responses in real time, we send relevant information to these providers, which may include your name, profile and health and fitness data (such as goals, body metrics, and dietary preferences), and the messages or notes you submit to these features.

We currently use the following AI providers to process this information:

• OpenAI
• Anthropic
• Google (Vertex AI)

We do not send the records we read from Apple Health or Android Health Connect to these AI providers. Where an AI feature refers to a figure calculated from them — such as your daily calorie target — only that figure is included, never the underlying health records.

We do not sell this information, and we do not use your content to train AI models. Under our agreements with these providers, the information we send is used only to generate a response back to us and is not used to train their models. If you have questions about how AI features use your data, contact us at support@bodyf1rst.com.

6. Data Retention

We retain your personal information only for as long as necessary to provide our services and for the purposes described in this policy. Retention periods vary by the type of data:

• Account information (name, email, profile) — kept for as long as your account is active.
• Health and fitness data, including data imported from Apple Health or Health Connect — kept while your account is active so we can track your progress, and deleted or anonymized when you delete your account.
• Payment and billing records — retained for up to 7 years after a transaction, as required by applicable tax and accounting laws.
• Communications with coaches and support — retained for up to 24 months after your last interaction.

When you delete your account, we delete or de-identify your personal data within 30 days, except where we are legally required to retain it (for example, to comply with tax, accounting, or other legal obligations) or to resolve disputes and enforce our agreements. Residual copies in our encrypted backups are purged within 30 days of deletion. You can request deletion of your account and data at any time by contacting support@bodyf1rst.com.

7. Your Rights

You have the right to access, update, or delete your personal information at any time. You can also opt out of promotional communications. To exercise these rights, please contact us at support@bodyf1rst.com.

8. Health Connect & Apple Health

With your explicit permission, BodyF1RST connects to Android Health Connect and Apple Health so your health and fitness data stays in sync across your apps. We access this data only after you grant permission, we request only the categories listed below, and you can disconnect at any time.

What we read

With your permission, we read the following from Health Connect / Apple Health:

• Nutrition — meals and dietary information you have logged (calories, protein, carbohydrates, fat, fiber, sugar, and sodium), so meals logged in another app appear in BodyF1RST.
• Steps — your daily step count, shown on your progress screens and used to estimate your everyday activity.
• Active energy — the calories you have burned, used to calculate your daily calorie target from measured activity rather than a self-reported guess.
• Workouts and exercise sessions — activities you record in other apps or on a watch, so they count toward your calorie target and your Body Points.
• Distance — the distance covered during those activities, shown alongside them.
• Heart rate and resting heart rate — to show your average heart rate for a workout and to track your resting heart rate over time.
• Body weight — to record your weigh-ins, chart your progress, and keep your calorie and macronutrient targets accurate as your weight changes.
• Sleep — the timing of each night and its stage breakdown (awake, light, deep, REM), so you can see how long and how well you slept alongside your nutrition and training.

We read only these categories. BodyF1RST does not request or access blood glucose, blood pressure, oxygen saturation, body temperature, menstrual or reproductive health data, or medical records.

Reading in the background

With your permission, BodyF1RST reads the categories listed above in the background — that is, while the app is closed. Your daily calorie target is calculated from the activity you actually record, and that activity accrues throughout the day. Reading in the background means the target is already correct when you open the app to decide what to eat, rather than reflecting whatever was known the last time you closed it. It is also what allows us to notify you when a workout recorded in another app has arrived and changed your goal.

Background reading covers no additional categories beyond those listed above. Reads are batched and rate-limited rather than continuous, and are skipped while your device is locked. You can turn off background access at any time in Health Connect or in your iPhone's Health settings, without disconnecting BodyF1RST entirely.

What we write

With your permission, we write the following back to Health Connect / Apple Health:

• Nutrition — meals you log inside BodyF1RST.
• Water — hydration you log inside BodyF1RST.
• Workouts — workouts you complete inside BodyF1RST.

We do not write sleep, heart rate, body weight, step, or calorie-burn data back to Health Connect or Apple Health. Data we import is never written back, and an imported night of sleep never overwrites a night you entered yourself in BodyF1RST.

How this data is used, shared, and deleted

We use this data only to provide BodyF1RST's features to you — showing your nutrition, activity, sleep, and progress, and calculating your daily targets and Body Points — and, only if you explicitly opt in, to share that progress with your personal coach inside BodyF1RST. We do not sell this data, we do not use it for advertising or marketing, we do not share it with data brokers, and we do not use it to train artificial-intelligence models. It is encrypted in transit and at rest.

You can disconnect Health Connect or Apple Health at any time from Settings › Linked Accounts in the app, or by revoking BodyF1RST's permissions in Health Connect or the Apple Health app; either stops the import immediately. When you delete your BodyF1RST account we delete this data within 30 days.

9. Biometric Sign-In (Face ID, Touch ID, and Fingerprint)

You can choose to unlock BodyF1RST with Face ID, Touch ID, or your device's fingerprint or face unlock. This is optional, it is off unless you turn it on, and you can turn it off at any time in the app's settings.

BodyF1RST never receives, collects, or stores your biometric data. Your face and fingerprint data never leave your device and are not accessible to us. The check is performed entirely by your device's operating system (Apple's Local Authentication or Android's BiometricPrompt), which tells the app only whether the unlock succeeded or failed. All we store is your preference that the feature is switched on, together with your existing sign-in credential, held in your device's secure keystore.

Because we do not collect biometric identifiers or biometric information, we do not sell, lease, trade, or otherwise profit from them, and we have no biometric data to retain or destroy.

10. Notifications

If you allow notifications, we store a push-notification token for your device so we can deliver them. You control what you receive from Settings › Notifications in the app, and you can turn notifications off entirely there or in your device settings. A small number of messages relating to your account — for example, a change to your account's status — are sent regardless of that preference, because they are necessary to operate your account. We do not use your notification token for advertising.

11. Your California Privacy Rights

This section applies to residents of California and supplements the rest of this policy. It is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA").

Categories of information we collect

In the past 12 months we have collected the following categories of personal information. Each is collected for the business purposes described in Section 2, disclosed only to the recipients described in Section 4, and retained for the periods described in Section 6.

• Identifiers — your name, email address, account identifier, and a push-notification token for your device.
• Customer records — contact details and payment and billing information.
• Commercial information — your subscription and purchase history.
• Internet or other electronic network activity — how you use the app, such as the features you open and the workouts and meals you log.
• Audio, electronic, or visual information — profile and progress photos you choose to upload.
• Inferences — the goals, targets, and recommendations we generate from the above.
• Sensitive personal information — health and fitness data, including the categories described in Section 8 and any body metrics, weigh-ins, or dietary information you provide.

We do not collect your precise geolocation. We collect your device's time zone only, so that your daily totals begin and end at your local midnight.

We do not sell or share your personal information

We have not sold or shared personal information — as "sell" and "share" are defined by the CCPA, which includes disclosing it for cross-context behavioral advertising — in the preceding 12 months, and we do not do so now. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

How we use sensitive personal information

We use and disclose your health and fitness data only to perform the services you have asked us for — showing your progress, calculating your targets, and, if you opt in, sharing that progress with your coach. We do not use it to infer characteristics about you, and we do not use or disclose it for any purpose beyond those permitted by the CCPA. For that reason we are not required to offer, and do not offer, a "Limit the Use of My Sensitive Personal Information" option.

Your rights

• Right to know — to request the specific pieces and categories of personal information we have collected about you, the sources, the business purpose, and the categories of third parties to whom we disclosed it.
• Right to delete — to request that we delete the personal information we hold about you, subject to the exceptions the CCPA allows.
• Right to correct — to request that we correct inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of.
• Right to non-discrimination — we will not deny you services, charge you a different price, or provide you a different quality of service because you exercised any of these rights.

How to exercise them

You can delete your account and its data at any time from Settings › Delete Account in the app. For any of the rights above, contact us at support@bodyf1rst.com. We will verify your request against the information associated with your account, and we will respond within 45 days, extending by a further 45 days where the request is complex and telling you if we do. An authorized agent may submit a request on your behalf with proof that you have permitted them to act for you.

Shine the Light

California Civil Code Section 1798.83 permits residents to request information about disclosures of personal information to third parties for their own direct marketing purposes. We do not make such disclosures.

12. Children's Privacy

BodyF1RST is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us with personal information, contact us at support@bodyf1rst.com and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make a material change, we will notify you in the app and ask you to review the updated policy before continuing to use BodyF1RST. The effective date shown above always reflects the current version.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

BodyF1RST LLC
Email: support@bodyf1rst.com