Privacy & Safety Governance

Why this page exists

Bodywise handles information about training, nutrition, body composition, progress and health. That deserves stronger governance than simply publishing a Privacy Notice.

This page explains the internal controls and records Bodywise maintains behind its public policies.

It does not publish security-sensitive technical information, confidential provider material or information that could make Bodywise or its users less secure.

Who is accountable

Bodywise Coach is operated by Chris Mann trading as Bodywise Coach.

Privacy questions and data-rights requests can be sent to privacy@bodywise.io.

Security concerns can be sent to security@bodywise.io.

Health information

Bodywise treats health-related information as sensitive information requiring additional protection.

Ordinary personalised processing of health information uses a separate health-data consent where required.

Health-data consent is separate from accepting the Terms.

Withdrawing consent stops future processing that depends on that consent.

Data protection impact assessment

Bodywise maintains a Data Protection Impact Assessment covering the principal privacy risks created by the service, including health information, personalised training and nutrition, DEXA/body-composition information, progress information, free text, AI-supported Coach conversations, uploads, analytics and retention.

The DPIA records identified risks, safeguards, residual risks and unresolved verification work.

It is maintained as an internal accountability record rather than publishing security-sensitive details.

Record of processing activities

Bodywise maintains an internal record of its principal processing activities.

This records why information is processed, the categories involved, applicable legal bases, recipients/providers, retention, international-transfer status and relevant safeguards.

Unknown provider facts are not filled in by assumption.

Retention and deletion

Bodywise maintains a documented retention and erasure schedule.

Ordinary account information is not retained indefinitely after account deletion.

Different records have different retention periods according to their purpose.

A narrow legal/safety evidence archive may retain selected material evidence for up to 10 years under Bodywise's current provisional retention policy.

That archive is not a copy of the user's account and is not used for coaching, personalisation, analytics, marketing or advertising.

Legal and safety evidence

Bodywise maintains internal rules controlling what may enter the legal/safety evidence archive.

Examples can include material PAR-Q/safety answers, relevant safety flags, important warnings or advice, recommendations to stop or modify activity or seek professional help, and the minimum context needed to understand that evidence.

Routine workouts, meal plans, ordinary progress history, progress photographs, routine DEXA information and full Coach histories are excluded by default.

Privacy rights

Bodywise maintains an internal procedure for handling access, correction, export, deletion, restriction, objection, consent withdrawal and other applicable privacy rights.

Requests are logged, identity is verified only where reasonably necessary, applicable exceptions are assessed and completion is recorded.

Consent

Bodywise maintains separate records and controls for:

• health-data consent;
• optional analytics choices;
• marketing choices.

What consent is never inferred from

Submitting a calculator is not treated as marketing consent.

Accepting the Terms is not treated as health-data consent.

AI and the virtual Coach

The virtual Coach may use external AI/model infrastructure to understand messages and generate conversational responses using relevant Bodywise context.

Bodywise maintains an internal processing record for this use.

The external model is not treated as a doctor or clinician and is not given unrestricted authority over Bodywise safety decisions.

Provider retention, model-training use, processing locations and international-transfer arrangements must be verified rather than assumed.

Service providers and international transfers

Bodywise maintains an internal provider and international-transfer register.

It records provider roles, data involved, contractual status, processing locations, transfer mechanisms, retention/deletion information and unresolved verification items where known.

Bodywise does not publish an unverified provider fact simply to make a policy look complete.

Security incidents and personal-data breaches

Bodywise maintains an internal incident and personal-data-breach response procedure.

Suspected breaches are recorded and assessed, relevant evidence is preserved, risks are evaluated and regulator or individual notification requirements are assessed according to applicable law.

Pre-sign-up information

Bodywise maintains separate rules for information provided through pre-sign-up calculators.

Submitting a calculator is not marketing consent.

Unconverted calculator data is scheduled for deletion after 30 days unless another distinct lawful reason genuinely applies.

Advertising

Advertising is currently OFF.

Sensitive Bodywise health, training, nutrition, DEXA, Coach, progress, mood, stress or safety information is not to be used to target advertising.

International compliance

Bodywise is operated from the United Kingdom and may be used by people in other countries.

Bodywise maintains an internal regional-compliance register so jurisdiction-specific requirements can be tracked rather than pretending that one global English policy automatically satisfies every law worldwide.

Ongoing review

Privacy and safety governance is not treated as a one-off document exercise.

Bodywise's internal records should be reviewed when processing materially changes, new providers are introduced, connected health-data sources are added, advertising is activated, relevant law changes or a significant privacy/security event occurs.

If you have a question about how Bodywise handles your information, contact privacy@bodywise.io.