Privacy Policy

1.1. AIBODY is a health and wellness application available on iOS, Android, and the web. It provides AI-powered lab result analysis, personalized vitamin recommendations, nutrition planning, wearable device integration, and health tracking.

1.2. This Policy applies to all personal information we collect through the App, our website (aibody.app), related APIs, and connected third-party integrations (WHOOP, Telegram, Google OAuth, Apple Sign-In).

1.3. We are committed to protecting your privacy and handling your personal information in accordance with applicable U.S. data protection laws, including the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), the Health Insurance Portability and Accountability Act (HIPAA) where applicable, and other applicable federal and state regulations.

1.4. By registering, accessing, or using the App, you acknowledge that you have read, understood, and agree to the terms of this Policy.

2.1. Account Information: name, email address, phone number, date of birth, gender, and profile photo.

2.2. Health and Medical Data: laboratory test results (blood, urine, and other biomarkers), medical documents and reports, images of medical documents, health status and wellness assessments, information about medications and supplements, chronic conditions and medical contraindications.

2.3. Biometric and Wearable Data: heart rate, heart rate variability (HRV), sleep stages and duration, recovery scores, workout strain, SpO2, skin temperature, respiratory rate, and other physiological metrics from connected devices such as WHOOP.

2.4. Nutrition and Lifestyle Data: food photos analyzed via AI, dietary preferences and meal plans, food allergies and intolerances, sleep patterns and stress levels, physical activity levels.

2.5. Technical Data: IP address, device type and operating system, app version, Telegram ID (if using the Telegram bot), push notification tokens, cookies and similar technologies.

2.6. Payment Data: subscription status, purchase history, and transaction identifiers. We do not store credit card numbers or banking details — all payment processing is handled by Apple App Store, Google Play, or Stripe.

3.1. Core App Functionality: AI-powered analysis and interpretation of lab test results, personalized vitamin and supplement recommendations based on your health data, individualized nutrition plans accounting for your health goals and conditions, food photo analysis to determine nutritional content, organ and body system health tracking and trend analysis, medication and supplement reminders.

3.2. Wearable Integration: displaying recovery, sleep, workout, and strain metrics from connected devices (e.g., WHOOP), providing cross-correlated health insights combining wearable data with lab results and nutrition data.

3.3. Communication: sending in-app notifications about health recommendations, push notifications for reminders and updates (with your consent), email notifications about account activity and important updates.

3.4. Service Improvement: analyzing aggregated, anonymized usage patterns to improve the App, fixing bugs and improving performance, developing new features based on anonymized usage trends.

3.5. We do NOT use your personal data for: advertising or marketing to third parties, selling or licensing your data to any third party, profiling for purposes unrelated to your health goals.

4.1. AIBODY uses artificial intelligence services to deliver its core features. Your data may be processed by the following third-party AI providers:

4.2. Google Vertex AI / Gemini (Google LLC): medical document analysis and interpretation, nutrition plan generation, vitamin recommendations, food photo analysis. Google’s Privacy Policy: https://policies.google.com/privacy

4.3. OpenRouter API: supplementary analysis of medical documents and data extraction.

4.4. Data transmitted to AI services is used solely for generating personalized health insights. We do not train general-purpose AI models on your individual data.

4.5. All data transmission to third-party services is encrypted via TLS/SSL and performed strictly within the scope of the App’s stated functionality.

5.1. WHOOP Integration: AIBODY connects to WHOOP via the official WHOOP Developer API v2 using OAuth 2.0. We access recovery, sleep, workout, and cycle data. A separate WHOOP-specific privacy policy is available at /whoop-privacy.

5.2. Future Integrations: we may add support for additional wearable devices and health platforms. Each integration will be documented with its own data handling disclosures.

5.3. All wearable integrations are optional and require your explicit consent through the OAuth authorization flow. You can disconnect any integration at any time from the App’s settings.

6.1. The App offers a Telegram bot for food photo analysis and health tracking.

6.2. When using the Telegram bot, we process: your Telegram user ID, food photos sent through the bot, and messages or comments accompanying photos.

6.3. Data received through the Telegram bot is processed with the same security measures and for the same purposes as data submitted through the main App.

7.1. Your data is stored in secured PostgreSQL databases hosted on protected cloud infrastructure with encrypted connections.

7.2. We implement comprehensive security measures including: SSL/TLS encryption for all data in transit, encryption of sensitive data at rest (medical records, OAuth tokens), strict access controls — each user can only access their own data, multi-factor authentication for administrative access, regular security audits and monitoring, encrypted backups with restricted access, secured cloud storage (Supabase) for medical documents and images.

7.3. Medical and health data is subject to enhanced security protections, including additional encryption layers and restricted personnel access.

7.4. OAuth tokens for third-party integrations (WHOOP, Google) are stored encrypted and used only to communicate with those services on your behalf.

8.1. General personal data is retained for as long as your account is active, plus 3 years after your last app usage, unless a longer retention period is required by applicable law.

8.2. Medical and health data is retained for 5 years from your last interaction or until you withdraw your consent for processing.

8.3. Wearable device data (e.g., WHOOP) is retained while the integration remains connected. Upon disconnection, synchronized data is retained for up to 30 days to allow for reconnection, after which it is permanently deleted.

8.4. Upon account deletion, all personal data is permanently deleted within 30 calendar days.

8.5. Aggregated, anonymized statistics that cannot be used to identify any individual may be retained indefinitely for service improvement.

9.1. We do NOT sell, rent, or share your personal data with third parties for their own marketing or commercial purposes.

9.2. Your data may be shared with the following categories of service providers, solely to operate the App:

9.3. AI Providers: Google Vertex AI/Gemini and OpenRouter — for health analysis (data is anonymized before transmission where possible).

9.4. Infrastructure Providers: Supabase (database and authentication), cloud hosting providers.

9.5. Payment Processors: Apple App Store, Google Play, Stripe — for subscription and payment processing.

9.6. Wearable Platforms: WHOOP — for data synchronization via their official API.

9.7. We may disclose your information if required by law, regulation, legal process, or governmental request, including to comply with a subpoena, court order, or similar legal procedure.

9.8. Do Not Sell or Share: we do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising as defined under the CCPA/CPRA. We have not sold or shared personal information in the preceding 12 months.

10.1. Depending on your state of residence, you may have the following rights regarding your personal information:

10.2. Right to Know: request details about the categories and specific pieces of personal information we have collected about you, the sources, the business purposes, and the categories of third parties with whom we share it.

10.3. Right to Delete: request deletion of your personal information, subject to certain legal exceptions.

10.4. Right to Correct: request correction of inaccurate personal information we hold about you.

10.5. Right to Opt-Out of Sale/Sharing: we do not sell or share your personal information for cross-context behavioral advertising. If this changes, you will have the right to opt out.

10.6. Right to Limit Use of Sensitive Personal Information: request that we limit the use of your sensitive personal information (including health data) to purposes necessary to provide the App’s services.

10.7. Right to Data Portability: request your data in a structured, machine-readable format.

10.8. Right to Non-Discrimination: we will not discriminate against you for exercising any of your privacy rights.

10.9. To exercise any of these rights, contact us at support@aibody.app or through the in-app feedback form. You may also designate an authorized agent to make a request on your behalf.

10.10. We will respond to all verifiable consumer requests within 45 days. We may need to verify your identity before processing your request. If we need additional time, we will notify you of the extension and the reason.

11.1. You may withdraw your consent to data processing at any time by: adjusting your preferences in the App’s settings, disconnecting third-party integrations, contacting us at support@aibody.app, or deleting your account.

11.2. Upon withdrawal, data processing will cease and your data will be deleted within 30 calendar days, unless retention is required by law.

11.3. Withdrawing consent for medical data processing may result in the inability to use core App features such as lab analysis, vitamin recommendations, and nutrition planning.

12.1. AIBODY is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 13 in compliance with the Children’s Online Privacy Protection Act (COPPA), or under 16 where required by state law.

12.2. If we become aware that we have collected personal information from a child without proper parental consent, we will take steps to delete such information promptly.

12.3. If you believe a child has provided us with personal information, please contact us at support@aibody.app.

13.1. Your data is primarily processed and stored within the United States using secure cloud infrastructure.

13.2. Some data processing by third-party AI providers (Google Vertex AI/Gemini, OpenRouter) may occur at data centers located in the United States or other jurisdictions where these providers maintain facilities.

13.3. All third-party service providers are contractually obligated to maintain appropriate security measures and to process your data only for the purposes described in this Policy.

14.1. The App and website may use cookies and similar technologies for: session management and authentication, remembering your language and display preferences, analyzing aggregated usage patterns (anonymized).

14.2. We do not use cookies for third-party advertising or cross-site tracking.

14.3. You can manage cookie preferences through your browser settings.

15.1. We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date.

15.2. Material changes will be communicated via in-app notification or email.

15.3. Continued use of the App after changes are posted constitutes your acceptance of the updated Policy.

15.4. We encourage you to review this Policy periodically.

16.1. For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us:

16.2. Email: support@aibody.app

16.3. In-app feedback form (Settings → Help & Feedback)

16.4. We aim to respond to all inquiries within 5 business days.