Privacy Policy

BodyArc LLC — Effective Date: July 13, 2026

1. Who We Are

The BodyArc applications and websites (the "Service") are operated by BodyArc LLC, a Wyoming limited liability company ("BodyArc," "we," "our," or "us"). We are the controller of the personal information described in this policy. Contact: support@bodyarc.ai · BodyArc LLC, 10490 Little Patuxent Parkway, Suite 600, PMB #8016, Columbia, MD 21044, USA.

The Service is for adults 18 and older. We do not knowingly collect information from anyone under 18; if we learn we have, we delete it.

2. Information We Collect

Health and fitness data you provide — this is sensitive data, and we treat it that way:

• Workouts, exercises, sets, and training history
• Nutrition logs, including photos of food you submit for AI analysis
• Body weight, body-composition data, and progress photos you choose to add
• Water intake, steps, and sleep
• Apple HealthKit data (steps, sleep, weight, heart data) — only with your explicit permission, and only to provide the Service
• Goals, preferences, and conversations with the AI coach

Account information: email address, name, and a securely hashed password.

Billing information: handled by Stripe, our payment processor. We never see or store your full card number. We retain records of your subscription status and your consent to auto-renewal terms.

Usage and device information: app interactions, feature usage, device type, and diagnostics — used to operate and improve the product.

3. How We Use Information

• To provide the Service: generate your training plan, analyze food photos, power the AI coach, track progress
• To process subscriptions and payments
• To provide support and send transactional email (receipts, account notices)
• To keep the Service safe, debug, and improve it

What we do not do: we do not sell your personal information; we do not share it with data brokers; we do not use your health data for advertising. HealthKit data is never used for advertising, marketing, or data mining, and is never shared with third parties for their own purposes.

4. Service Providers (Subprocessors)

We share data only with the providers required to run the Service, under contracts that limit their use of it to providing services to us:

• OpenAI — AI coaching and food-photo analysis (API data is not used to train their models)
• Stripe — payment processing
• Vercel — application hosting
• Neon — database hosting
• PostHog — product analytics
• Resend — transactional email
• Apple — App Store subscriptions, when purchased through iOS

We may also disclose information if required by law, or to protect the rights, safety, and security of BodyArc, our users, or others.

5. Retention and Deletion

• Your data is retained while your account is active.
• You can delete your account at any time in the app. Deletion removes your personal and health data from our production systems and directs our subprocessors to do the same, except where retention is legally required.
• Legal retention carve-out: billing records, subscription-consent records, and tax records are retained for at least the period required by law (consent records at least 3 years), even after account deletion.

6. Security and Breach Notification

Data is encrypted in transit; passwords are stored hashed; access to production systems is restricted. No system is perfectly secure — if a breach of security involving your identifiable health information occurs, we will notify you without unreasonable delay and no later than 60 days after discovery, and will notify the Federal Trade Commission as required by the FTC Health Breach Notification Rule (simultaneously with individual notices when 500 or more people are affected).

7. Your Rights and Choices

• Access, correction, export: you can view and edit your data in the app, and request a copy at support@bodyarc.ai.
• Deletion: in-app account deletion, or email support@bodyarc.ai.
• HealthKit: you control HealthKit permissions in iOS Settings and can revoke them at any time.
• State privacy rights: depending on where you live (for example, California), you may have rights to know, delete, correct, and limit use of sensitive personal information. We honor these rights on request and do not sell or share personal information as those terms are defined by the CCPA. We honor the Global Privacy Control signal where it applies.
• Analytics: you can opt out of product analytics by contacting support@bodyarc.ai.

8. Cookies

The web app uses essential cookies for sign-in and session security, and product analytics (PostHog) to understand how features are used. We do not use advertising cookies or cross-site trackers.

9. International Users

The Service is operated from the United States and currently offered to U.S. customers; data is processed in the U.S. If you use the Service from elsewhere, you consent to processing in the U.S.

10. Changes

We may update this policy from time to time. Material changes will be announced by email or in-app notice before they take effect, and the effective date above will change.

11. Contact

BodyArc LLC
10490 Little Patuxent Parkway, Suite 600, PMB #8016
Columbia, MD 21044, USA
support@bodyarc.ai