This Privacy Policy explains how Body Software Ltd ("we", "us") collects, uses, stores and shares personal data when you use our app and website (the "Service"). We are the data controller for the personal data we process about you under UK GDPR.
1. Data we collect
- Account data: name, email, hashed password, role, referral code.
- Health data (special category): daily check-in metrics (energy, pain, sleep, mood), symptom notes, posture analysis results, uploaded images. Processed with your explicit consent.
- Network & commission data: referrals, activity events, earnings, payout requests.
- Technical data: IP address, device type, browser, pages viewed (via Vercel Analytics — anonymised).
- Communication preferences: push / email / WhatsApp opt-ins and any contact details you provide.
2. Legal basis for processing
- Contract: to provide the Service you signed up for.
- Explicit consent: for health/wellness data.
- Legitimate interest: service improvement, fraud prevention.
- Legal obligation: tax, accounting, regulatory record-keeping.
3. How we use your data
To operate the Service, deliver personalised content, calculate commissions and administer manual payouts, send notifications you have opted into, and improve the platform.
4. Sharing
- With your assigned practitioner (if applicable) — they see your check-in data to support your care.
- With our processors: Vercel (hosting), Neon (database), Resend (email), Cloudinary and Anthropic (planned posture-image storage and analysis; uploads are currently unavailable — see below), Twilio (WhatsApp messaging if opted in), Shopify (order processing), PayPal or bank details (manual payout administration).
- With your referrer — registration and commercial referral activity. The referral dashboard does not show health check-ins, pain-improvement events or patient check-in counts.
5. AI processing
Posture-photo analysis and healing-session sketch uploads are currently unavailable while private image handling is prepared. These upload routes do not send new images to Cloudinary or Anthropic. Daily check-in photo attachments are a separate feature. Before posture-image processing is enabled, we will explain the providers, consent choices and retention arrangements.
6. International transfers
Some processors are based outside the UK. Where this is the case we rely on Standard Contractual Clauses or other approved safeguards.
7. Retention
We keep account and health data for as long as your account is active, then for 6 years after closure to comply with UK records-retention obligations. Anonymised analytics may be retained indefinitely.
8. Your rights
You have the right to:
- access the data we hold about you;
- request correction or deletion;
- withdraw consent at any time;
- object to or restrict processing;
- data portability;
- complain to the Information Commissioner's Office (ico.org.uk).
To exercise these rights email privacy@bodysoftware.co.uk.
9. Cookies
We use only the minimum cookies required for the Service to work (session, authentication). Analytics is anonymised. See the cookie banner that appears on your first visit.
10. Security
Passwords are hashed (bcrypt). All traffic is encrypted in transit (HTTPS). We restrict admin access to a minimal number of authorised staff.
11. Contact
Body Software Ltd · Registered in England & Wales · privacy@bodysoftware.co.uk