Legal

Privacy Notice

Last updated: 26 August 2026

1. Who is responsible for your information

BodySyncPro is a trading name of BabbleHub Limited, a company registered in England and Wales under company number 10350788. BabbleHub Limited is the controller of the personal information described in this notice. Our registered office is 84a Lancaster Road, Via Kynaston Road, Enfield, Middlesex, England, EN2 0BX. Our ICO registration number is ZA376874.

Contact us about privacy at hello@bodysync.pro.

2. Who the service is for

BodySyncPro is for people aged 18 or over. We do not knowingly offer accounts to children. If you believe a person under 18 has provided information to us, please contact us so that we can investigate and remove it where appropriate.

3. Information we collect

• Account and identity information: name, email address, age confirmation, date of birth, profile details and authentication records.
• Health and fitness information: height, weight, sex used for calculations, goals, activity, nutrition, meals, workouts, habits, body measurements, progress photos and information you choose to enter. If you connect Apple Health or Android Health Connect, BodySyncPro requests read-only step-count access and stores available daily aggregates for up to 24 months with your account for history and statistics. Manual, Apple Health and Health Connect totals are kept as separate sources. The app displays manual entries together with the connected-health source for the platform currently in use and does not bridge incompatible health platforms. Sync occurs when you connect, open the connected app or select Sync now; background health collection is not enabled. We do not write health records, request unrelated health categories, use connected-health data for advertising, or sell it. Disconnecting stops future syncs but retains existing history. Delete imported history in Profile disconnects and erases imported Apple Health and Health Connect totals while retaining manual entries. Account deletion also erases imported step totals, subject to the retention terms below.
• Professional relationships: linked coach or client details, client-place history, programmes, messages and the sharing permissions chosen by the client.
• Membership and transaction information: plan, subscription status, AI-credit balance, billing dates and Stripe customer or subscription references. Stripe receives and handles payment-card details; BodySyncPro does not store full card details.
• Support and technical information: correspondence, security events, device/browser information, IP address and operational logs generated when the service is used.

4. Why we use information and our legal bases

• To create and secure your account, provide requested features, administer memberships and support you: necessary to perform our contract with you.
• To process health and fitness information needed for personalised tracking, calculations and AI-assisted features: necessary to provide the requested service and, for special-category health information, based on your explicit consent under Article 9(2)(a) UK GDPR.
• To prevent misuse, maintain security, diagnose faults and improve reliability: our legitimate interests in operating a safe and effective service, balanced against your rights.
• To measure use of our site and app, understand journeys and improve our services using optional analytics technologies: your consent, which you may refuse or withdraw without losing access to the service.
• To measure advertising, attribute conversions and build advertising audiences using optional marketing technologies: your consent. We do not use this consent to permit advertising providers to receive health and fitness entries from the authenticated app.
• To maintain invoices, financial records and respond to regulators or lawful requests: compliance with legal obligations.
• To publish a progress photo or disclose it to a linked coach: your separate, affirmative sharing choice. Each progress photo is private by default.

You may withdraw consent at any time by changing the relevant setting or contacting us. Withdrawal does not affect processing that was lawful before withdrawal. Some personalised or AI features cannot operate without the health information they require.

5. Progress photos and coach access

Progress photos are stored privately by default. For each photo, you can separately choose to (a) show it in your public BodySyncPro gallery and/or (b) share it with the professional currently linked to your client account. Turning off a sharing choice prevents new authorised access; a short-lived link already issued may remain usable briefly until it expires. Removing a coach link removes that coach's continuing access through BodySyncPro.

Anything placed in a public gallery can be viewed and copied by other people. Only use public sharing for material you are comfortable making public. A coach may be an independent controller for information they keep separately for their own professional practice; ask your coach about their privacy arrangements.

6. AI-assisted and nutrition features

When you choose an AI-assisted feature, the prompt and information needed to answer it may be sent to an AI provider. This may include health, nutrition or image information you submit for that request. BodySyncPro uses AI outputs to assist with informational suggestions; they may be inaccurate and are not medical diagnosis or treatment. We do not use AI to make solely automated decisions that produce legal or similarly significant effects about you.

7. Who receives information

We use providers that help us run the service, including Supabase for authentication, database and file storage; Stripe for payments and subscription management; Cloudflare and our hosting providers for delivery and security; OpenAI for selected AI-assisted features; and nutrition-data services such as API Ninjas, CalorieNinjas and Open Food Facts where the applicable feature is used. With your optional consent, Google Analytics and Microsoft Clarity receive analytics information, while Meta Platforms and LinkedIn receive marketing measurement information from the marketing site. We also disclose information to a linked coach only as described above, and where required by law or to protect legal rights.

Providers handle information under their contractual terms and privacy obligations. Stripe may act as an independent controller for some payment-related processing.

8. International transfers

Some providers or their support operations may process information outside the UK. Where UK data-protection law requires it, we use an adequacy regulation or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum, together with relevant transfer-risk measures. Contact us if you would like more information about safeguards for a particular provider.

9. How long we keep information

• After you schedule deletion, a paid account remains active until all current paid subscription periods end. The account, health, fitness, message and photo content is then erased automatically, normally within 15 minutes of the scheduled time. A free account is queued for deletion shortly after confirmation. A processing failure may require a short additional period while we complete the request, and legal exceptions may apply.
• Progress photos you delete are removed from active storage; temporary caches and backup copies expire through provider retention cycles.
• Accounting and transaction records are normally retained for six years from the end of the relevant financial year, and longer only where law or an active dispute requires it.
• Security and support records are kept only as long as reasonably needed for the issue, fraud prevention, legal claims or service security.

10. Cookies and local storage

We use cookies and similar technologies, including local storage and tracking pixels. Essential storage supports sign-in, security, your service choices and locally saved guest information. Essential storage operates without optional consent where it is necessary to provide the service you request.

Optional technologies remain blocked until you make a choice through our privacy panel:

• Google Analytics (analytics): helps us understand page and screen visits, navigation, referral sources, device/browser characteristics and selected non-sensitive events such as account creation or subscription completion. Google may receive online identifiers and IP-derived approximate location information. We use Google Consent Mode v2 in basic mode, so Google Analytics does not load or send measurement requests before the relevant consent. See how Google uses information from partner sites and apps.
• Microsoft Clarity (analytics): helps us understand use of the public marketing site through page views, clicks, scrolling, heatmaps and session playback. Clarity uses pseudonymous identifiers and interaction data. It is disabled within the authenticated BodySyncPro app. See Microsoft's Clarity cookie information.
• Meta Pixel (marketing): helps us measure whether advertising leads to visits or selected conversions and may support advertising audiences on Meta services. Meta may receive browser/device details, page and event information, online identifiers and referral information. It is disabled within the authenticated BodySyncPro app. See Meta's Cookie Policy.
• LinkedIn Insight Tag (marketing): helps measure LinkedIn campaign performance and selected conversions and may support website audience reporting. LinkedIn may receive device/browser details, page and event information, IP address and LinkedIn cookie identifiers. It is disabled within the authenticated BodySyncPro app. See LinkedIn's Cookie Policy.

You can accept, reject or customise optional technologies and later withdraw consent using the Privacy choices link in the site footer or app control. Changing your choice reloads the page so previously enabled tags stop running. Provider cookies have different lifetimes and may change; current details are available in the linked provider policies. Microsoft currently retains Clarity playback data for 30 days and aggregated click and heatmap data for up to nine months.

11. Your rights

Depending on the circumstances, you may ask for access, correction, erasure, restriction, objection or portability, and you may withdraw consent. Email hello@bodysync.pro. We may need to verify your identity. You can also complain to the Information Commissioner's Office.

12. Security and changes

We use technical and organisational safeguards designed for the nature of the information, but no online service can guarantee absolute security. We may update this notice when the service, providers or law changes. Material changes will be brought to your attention where appropriate.