Privacy policy

1. Controller

Apua 24 Oy / BodiBuddy

Mäkitie 8 b 1, 01840 Klaukkala, Finland

Business ID: 3234038-4

Email for privacy matters: hello@bodibuddy.com

Phone: +358 50 371 9531

Website: bodibuddy.com

Apua 24 Oy is the controller of the personal data processed in the BodiBuddy service.

2. What data we process

BodiBuddy processes personal data needed to provide, personalise, secure and develop the service. This may include the following.

Account data

• name or username
• email address
• user ID
• subscription and access rights data

Information you give during onboarding

When you start using BodiBuddy, we ask about your wellbeing and goals. We also ask for your height, weight, date of birth and gender. This information is used to create your personal wellbeing analysis.

Other questions may cover, for example:

• your wellbeing goals
• your life situation
• your experience of sleep and recovery
• exercise and activity
• nutrition
• mood, stress and perceived wellbeing
• other information you give BodiBuddy to build your personal wellbeing profile

Wellbeing and health data

With your separate permission, BodiBuddy reads the following data types from Apple Health / HealthKit on iOS and from Health Connect on Android:

• steps
• sleep
• workouts
• active energy burned (active calories)
• dietary energy (calories)
• water intake
• mindfulness sessions

BodiBuddy does not read any other data types from Apple Health or Health Connect, and it does not write data to them. BodiBuddy only gets access to the data types you have permitted.

BodiBuddy also processes the mood, stress, perceived wellbeing and free-form feelings that you log yourself.

Nutrition data

• food and meal information you enter
• food photos you send to the service
• nutritional information recognised from photos or confirmed by you

Buddy conversations

• messages you send to Buddy
• the content of conversations
• wellbeing data and other context needed for the conversation

This data is used to create personal responses, observations and suggestions.

Technical and usage data

• information about how you use the app
• technical information about your device and operating system
• app version
• error and crash data
• log data needed for the security and operation of the service

We also use this data to measure use of the service (e.g. active users, retention, subscription conversion) with Google Firebase analytics. No health or wellbeing data, such as sleep, activity, mood or nutrition data, and no Buddy conversation content is sent to analytics.

Content and video library

Videos in the BodiBuddy video library and related content are fetched to your device directly from Mux (video playback and streaming) and Sanity (content management for the video library, e.g. video titles, descriptions and categories). Because your device connects directly to these services, Mux and Sanity also process your device's IP address as a normal part of network traffic. When you search the video library, your search terms are sent to Sanity to run the search.

Location data

If you allow it, BodiBuddy may use your location to show wellbeing services or professionals near you. You can withdraw location permission at any time in your device settings.

Notifications

If BodiBuddy sends you push notifications (e.g. morning or evening reminders), Google Firebase Cloud Messaging is used on both iOS and Android.

3. Where the data comes from

• from you
• from the device you use
• with your permission, from Apple Health / HealthKit (iOS)
• with your permission, from Health Connect (Android)
• from technical data generated when you use the app

You decide whether to give BodiBuddy access to the wellbeing data on your device. You can also manage these permissions in your device settings.

4. What the data is used for

• providing the service
• building your personal wellbeing profile
• making observations about your wellbeing
• identifying connections between different areas of wellbeing
• creating personal suggestions and recommendations
• supporting your goals
• tracking your progress
• generating Buddy conversations
• maintaining the app
• investigating technical problems and errors
• ensuring information security
• analysing how the service works and tracking business metrics (e.g. usage activity, subscription trends) without health or wellbeing data
• developing BodiBuddy based on usage analytics and error data

We do not compile combined reports or statistics from users' health or wellbeing data.

5. Personal wellbeing analysis

When you start using BodiBuddy, the service may combine the information you give, your goals and the wellbeing data obtained with your permission to create a personal wellbeing analysis for you. The analysis helps you see your wellbeing as a whole and identify related strengths, areas for development and connections.

BodiBuddy may, for example, look at connections between sleep, recovery, exercise, nutrition, mood and everyday choices. The analysis may change and become more precise as BodiBuddy receives new information from you.

6. Main goal and personal guidance

Based on its wellbeing analysis, BodiBuddy may suggest a main goal for the next period. The suggestion is based on the information you have given, your own goals and the available wellbeing data.

You decide on your own goal and can change it in the app at any time. BodiBuddy uses the chosen main goal to create personal observations, suggestions and smaller intermediate goals. When your situation, data or goals change, the guidance may also be adjusted.

7. Automated processing and AI

BodiBuddy uses automated processing and AI, for example to:

• generate Buddy conversations
• structure your data
• identify connections related to wellbeing
• create your personal wellbeing analysis
• create goals and suggestions
• produce observations and suggestions suited to your situation

AI provider: OpenAI

BodiBuddy's AI features are provided using OpenAI's language model service. Our contracting party is OpenAI Ireland Ltd, and the data is processed on OpenAI's servers in the United States (see section 13). Depending on the feature, the following data is sent to OpenAI:

• the messages you write to Buddy and the most recent messages in the conversation
• data read from Apple Health / Health Connect: steps, sleep, workouts, active energy burned, dietary energy, water intake and mindfulness sessions
• the mood, stress and free-form feelings you log
• your onboarding answers (e.g. sleep, exercise, mood, stress and eating habits)
• food and meal information and the food photos you send, for recognising nutritional content
• your profile data: first name, age, gender, height, weight and your goals
• wellbeing scores calculated from these, as well as previous observations and suggestions

Your date of birth is not sent to OpenAI, only your age calculated from it.

OpenAI processes the data only on BodiBuddy's behalf under a data processing agreement. OpenAI does not use your data to train its AI models. OpenAI retains data sent to it for abuse monitoring for up to 30 days, unless the law requires longer retention, after which it is deleted. This also applies after your account has been deleted. BodiBuddy has no access to this data retained by OpenAI.

Consent and withdrawing it

We ask for your separate, explicit consent in the app before any of your data is sent to OpenAI. Without consent, no data is sent.

Because the BodiBuddy service – Buddy conversations, wellbeing analysis, programmes and suggestions – is based on AI processing, the service cannot be used without this consent. You can withdraw your consent at any time by deleting your account in the app (Settings → Delete my account, see section 16) or by sending a request to hello@bodibuddy.com. Processing of your data and sending it to OpenAI then stop.

BodiBuddy does not make fully automated decisions about users that would have legal or similarly significant effects on them.

AI-based development tools (e.g. Claude, ChatGPT) may also be used in developing BodiBuddy's software. These tools, used only for software development, are not used to process BodiBuddy users' personal data.

8. BodiBuddy is not a healthcare service

The analyses, observations, suggestions and conversations provided by BodiBuddy are intended to support general wellbeing and everyday life. They are not medical diagnoses, health assessments or treatment instructions from a healthcare professional.

If you have questions or concerns about your health, contact a healthcare professional.

9. Apple Health / HealthKit, Health Connect and health data

Data from Apple Health / HealthKit (iOS) and Health Connect (Android) is used only to provide BodiBuddy's wellbeing features to the user.

Once you have given your consent (see section 7), data from HealthKit and Health Connect is sent to OpenAI to produce your personal wellbeing analysis, observations, programmes and suggestions. It is not disclosed to any other third parties, except for the technical operation of the service (Amazon Web Services, EU).

Data from HealthKit or Health Connect is not:

• sold
• used for advertising profiling
• used for advertising targeted at the user
• disclosed to advertisers or other third parties for advertising purposes
• sent to analytics services

The data is processed only to the extent necessary to provide BodiBuddy's features.

You can change or withdraw the permissions you have given BodiBuddy at any time: on iOS through the Apple Health app or device settings, and on Android through Health Connect settings.

10. Service providers, commercial content and advertising

BodiBuddy shows wellbeing-related service providers, services and offers in the app in the "Nearby offers" and "Professionals" sections. All service providers shown in the app are paying BodiBuddy partners, so their visibility is commercial content. For a provider, we may show, for example, their name, logo, location and contact details, and a link to their own website or online store.

If you go to a provider's page, you decide yourself whether to make a purchase. Any purchase takes place in the provider's own service, outside the BodiBuddy app. BodiBuddy does not currently handle bookings or purchases directly in the app.

BodiBuddy:

• does not make purchases on your behalf
• does not process the payment for such purchases
• does not currently receive a commission or other share of purchases you make from a provider

A provider's commercial visibility does not mean that the provider gets access to your personal wellbeing or health data. Users' HealthKit, Health Connect or other health data is not disclosed to service providers.

If you give information directly to a provider, that provider is responsible for processing it under its own privacy policy.

11. Legal basis for processing

Depending on the situation, the processing of personal data is based on:

• performance of the contract with the user
• the user's consent
• the controller's legal obligations
• the controller's legitimate interest, for example in ensuring the security and technical operation of the service

Health and wellbeing data belong to the special categories of personal data. Their processing and transfer to OpenAI are based on your explicit consent (Article 9(2)(a) of the EU General Data Protection Regulation), which we ask for separately in the app before processing begins.

You can withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

12. Disclosure of personal data and technical service providers

BodiBuddy uses external technical service providers to deliver the service:

• OpenAI (OpenAI Ireland Ltd, processing in the United States): all AI-based language model features, such as Buddy conversations, observations, programmes, suggestions and food photo recognition. The data sent is listed in section 7.
• Resend: sending service-related emails.
• Sentry (EU): detecting and investigating app errors, crashes and technical problems.
• Google Firebase: app usage analytics (e.g. active users, retention) and push notifications. No health or wellbeing data is sent to analytics.
• Mux: playback and streaming of video library videos. Your device connects directly to Mux, so Mux also processes your device's IP address.
• Sanity: content management for the video library (e.g. video titles, descriptions and categories) and video library search. Your device connects directly to Sanity, so Sanity also processes your device's IP address.
• Google Maps: showing service providers on a map in the iOS app. Your device connects directly to Google, so Google also processes your device's IP address.
• Amazon Web Services (AWS, EU): hosting the app's backend and database.
• Apple App Store and Google Play: distributing the app and managing payments and subscriptions.
• Google and Apple: sign-in, if you sign in with your Google or Apple account. We receive an identifier, your name and your email address from them.

Sentry may receive app version information, technical information about the device and operating system, error reports, crash data and technical log data. Resend may receive information needed to deliver email, such as your email address and the technical content of the message.

Service providers may process personal data only to the extent required to perform their task. We require all service providers to which personal data is transferred – including analytics and error-tracking services and software libraries (SDKs) included in the app – to protect the data at least to the same level as described in this privacy policy and as required by applicable data protection law.

We do not sell users' personal data.

13. Transfers of personal data outside the EU and EEA

Some of BodiBuddy's technical service providers may process data outside the European Union or the European Economic Area. In such cases, we ensure that the transfer has a legal basis under applicable data protection law and appropriate safeguards, such as standard contractual clauses approved by the European Commission or another applicable transfer mechanism.

OpenAI processes data in the United States. The transfer is based on the standard contractual clauses approved by the European Commission, which are included in OpenAI's data processing agreement.

14. Data retention

We keep personal data only for as long as it is needed to provide the BodiBuddy service or as long as there is another lawful basis for keeping it.

• Account data is generally kept for as long as your account is active.
• If an account has been inactive (no use of the app and no active subscription) for more than 24 months, we may contact you and, if necessary, delete or anonymise the account data.
• When an account is deleted, the personal data related to it is deleted or anonymised, unless there is a legal reason to keep it.
• Data retained by OpenAI is deleted within 30 days at the latest (see section 7).
• Data in backups may be deleted with a delay according to the normal backup cycle.

15. Your rights

Under applicable data protection law, you have the right to:

• be informed about the processing of your personal data
• access your personal data
• request correction of inaccurate or incomplete data
• request deletion of your personal data
• request restriction of processing
• object to the processing of your personal data in certain situations
• in certain situations, have your data transferred from one system to another
• withdraw your consent (for consent to AI processing, see section 7)

You can request your data or exercise your other rights by sending a request to hello@bodibuddy.com. You can also manage Apple Health / HealthKit and Health Connect permissions directly in your device settings.

You also have the right to lodge a complaint with the competent data protection authority. In Finland, this is the Office of the Data Protection Ombudsman (tietosuoja.fi).

16. Deleting your account and data

You can delete your BodiBuddy account and the related data in two ways:

1. In the app: Settings → Delete my account.

2. Without the app: send a deletion request to hello@bodibuddy.com from the email address you registered with. This also works if the app is no longer installed. We process the request without undue delay and within one month at the latest.

After your account is deleted, the personal data related to it is deleted or anonymised, unless there is a legal reason to keep some of it. Data in backups may be deleted with a delay according to the normal backup cycle.

Data stored in Apple Health or Health Connect at the original source is not deleted when you delete your BodiBuddy account. You can manage data and permissions in those services through their own settings.

Please note: deleting your account does not automatically cancel a subscription made through the App Store or Google Play. Cancel the subscription first in your app store's subscription settings.

17. Minors

BodiBuddy is intended for users aged 18 and over. The service is not intended for children, and we do not knowingly collect personal data from minors. If we learn that we have accidentally collected personal data from a minor, we will delete it without undue delay.

18. Information security

We protect personal data with appropriate technical and organisational measures. These may include:

• encryption of data in transit
• restricting access rights
• user authentication
• system monitoring
• logging
• backups
• assessing the information security of technical service providers

Access to personal data is limited to people and service providers who need it to perform their tasks. However, no system connected to the internet can guarantee complete security.

19. Cookies and similar technologies

This section applies to the bodibuddy.com website. The BodiBuddy mobile app does not use browser cookies; the app's data processing is described in the other sections of this policy.

On bodibuddy.com, we use cookies and similar technologies (such as the browser's local storage) only for clearly defined purposes and only to the extent the user has consented.

Cookie categories

• Necessary: required for the website's operation, security and stability. They do not require separate consent and cannot be switched off. They remember, for example, your language choice and your cookie consent.
• Analytics: anonymised statistics on how the website is used. These are not loaded until the user has separately accepted analytics.
• Advertising and measurement: cookies used to measure advertising effectiveness and show relevant offers. These are not loaded before consent.
• Preferences: cookies used to remember the user's preferences, such as display settings. These are not loaded before consent.

Giving and withdrawing consent

Users are asked for cookie consent on their first visit. They can accept all cookies, reject all optional cookies or choose by category which cookies to allow. Consent is stored in the browser's local storage and versioned so that new cookie categories can be asked about separately later.

Users can change or withdraw their consent at any time through the Cookie settings link in the website footer. The change takes effect immediately, and previously permitted cookies stop being used the next time the page loads.

Legal basis

Necessary cookies are based on our legitimate interest in providing and securing the website. Other cookie categories are based on the user's explicit consent, which can be given, refused or withdrawn at any time. Questions about cookies can be sent to hello@bodibuddy.com.

20. Changes to this privacy policy

BodiBuddy is evolving, so this privacy policy may be updated. If there are significant changes to how data is processed, we will inform users in the app or in another appropriate way. The date of the latest update is shown at the top of this privacy policy.

21. Contact

If you have questions about the processing of your personal data or want to exercise your data protection rights, contact us:

Apua 24 Oy / BodiBuddy

Mäkitie 8 b 1, 01840 Klaukkala, Finland

Email: hello@bodibuddy.com

Phone: +358 50 371 9531

Website: bodibuddy.com