Privacy Policy

1. Scope and data controllers

1.1 BodySculpt AI Corp., under the trade name U Body, acts as the controller of the personal data of Coaches and of visitors to its sites, as well as of the data it processes to operate the platform, bill for its services, protect its systems, and comply with the law. As a Canadian corporation, it is subject to Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA), and it also recognizes the rights that Law 1581 of 2012 grants to residents of Colombia, the rights described in Sections 14 and 15 for residents of the United States, and the rights that the laws of other countries grant to their residents (Section 13).

1.2 With respect to Clients' data, the Coach who invites them to their app decides the purposes for which that data is collected and is, to that extent, the controller; U Body processes that data on the Coach's behalf to provide the Services, in accordance with this Policy and the Terms. If you are a Client and have questions about how your Coach uses your information, contact your Coach directly; in any event, you may exercise the rights described in Section 9 with U Body.

2. Information we collect

2.1 Information you provide to us.

If you are a Coach: your name, email address, WhatsApp number, country, Instagram username, and password (which we store using a function that does not allow it to be recovered); your page's username; your photograph and the photographs on your page; the name under which you present yourself to your Clients, whether you present yourself as a female or a male coach, and your app's color palette; information about your business (type of activity, approximate number of clients, city, offer, and price); your training methodology, whether as selected options, text, or documents you upload; your referral code and, if you participate in the Referral Program, the details of the account in which you wish to receive your commissions (Nequi number, PayPal email address, Wise details, or payment link); and the communications you send us.

If you are a Client: your name, your WhatsApp number, and, if provided, your email address, which your Coach provides when inviting you; your answers to the initial questionnaire, which include your training goal, experience level, sex, age or year of birth, height, current weight and target weight, available days and session length, training location and the equipment available to you, muscle groups of interest, and language; an optional photograph of your current physical condition; the food preferences that you or your Coach specify (eating style, allergies, foods you want to include or exclude, budget, and cooking skill level) and the changes you make to your meal plan; the workouts you log (exercises, sets, repetitions, and weights), your nutrition logs, and your body measurements (Section 2.2); the messages, photographs, videos, and voice notes you send in the app's chat; and the password you choose to create. Much of this information relates to your health and physical condition and is considered sensitive data. You are not required to provide it, although without it the app cannot generate an appropriate plan.

2.2 Body measurements and health data. The app allows Clients to keep a record of their body measurements (the “Measurements” section): weight, body fat percentage, fat mass, lean mass, and body mass index; circumferences (neck, chest, arms, waist, hips, thighs, and calves); skinfolds; and resting heart rate, blood pressure, maximal oxygen uptake (VO₂ max), hours of sleep, steps, hydration, and calories. These measurements are logged by the Client from their app or by their Coach from their dashboard, and each entry is saved with its date to show the Client's progress in charts. We use this information solely so that the Client can track their progress and so that their Coach can adjust their programming. Only the Client and their Coach can see it; U Body stores and processes it on the Coach's behalf, through the providers listed in Section 5.4, for the sole purpose of providing the Services. This data relates to the Client's health and physical condition and is considered sensitive data under Colombia's Law 1581 of 2012 and the equivalent laws of the other countries of Latin America, and sensitive personal information and consumer health data under certain U.S. laws (Sections 14 and 15). Logging it is voluntary: you are not required to provide it, and we process it with the express consent you give by accepting this Policy and by logging it in the app. When the Coach is the one who logs it, the Coach does so in the context of their relationship with the Client and under the Coach's own responsibility (Section 1.2). You may access, correct, and request the deletion of this data at any time in accordance with Section 9. U Body does not sell this data, does not use it for advertising purposes, and does not share it with the advertising platforms mentioned in Section 6.

2.3 Payment information. Coaches' payments are processed through Stripe. U Body does not receive or store your full card numbers; we retain only the identifiers Stripe returns to us, the Plan subscribed to, the amounts, the currency, and the status of the subscription and its invoices. Payments between a Coach and their Clients are made outside the platform, and U Body does not receive information about them.

2.4 Information from third parties. If you sign in with Google or Apple, we receive from that provider your name (if you choose to share it), your email address (or the relay address Apple assigns to you), and an account identifier, which we use solely to recognize you. If you are a Client, we receive your contact details from your Coach. If you sign up with another Coach's referral code, we associate your account with that Coach's account.

2.5 Information collected automatically. When you visit ubody.ai or coach.ubody.ai, we record the page visited, the date and time, the page you came from, and the campaign parameters in the URL (such as utm, fbclid, and ttclid), together with the approximate country that our content delivery network infers from your IP address; we do not store the IP address with that visit. On ubody.ai, we also record how far down the page you got and which sign-up button you clicked, linked only to that visit. When you create a Coach account, we retain the IP address and browser from which you signed up, for security and advertising measurement purposes (Section 6). Our servers also keep the usual technical logs (access dates, errors, device type, operating system, and app version) for a limited time. We also record when the app is used, so that each Coach knows whether their Clients are active. If you allow notifications, we store the identifier your browser or device assigns for receiving them.

2.6 Information we do not collect. We do not access your device's precise location, your contacts, or your files, except for the photographs, videos, or audio recordings you choose to send through the app.

3. How we use information

We use the information we collect for the following purposes:

1. To provide the Services: to create and manage accounts, publish the Coach's branded page and app, generate and sync training and meal plans, operate the chat and the artificial intelligence assistant, and show the Coach their Clients' activity.
2. To manage our business relationship: to administer subscriptions, free trials, charges, invoices, and the Referral Program.
3. To communicate with you: to send you the emails used to access your account and notices about your account, your subscription, and your payments, and to respond to your requests.
4. To protect the Services: to prevent fraud, abuse, and unauthorized access, and to diagnose and fix errors.
5. To improve the Services: to analyze, in aggregate, how the Services are used in order to decide what to improve.
6. To measure our advertising, in accordance with Section 6.
7. To comply with the law: to meet legal, accounting, and tax obligations, and to respond to requests from competent authorities.

Our processing is based on the consent you give when you sign up for or use the Services, on the performance of the contract between us, on our legitimate interest in operating and protecting the platform, and on compliance with legal obligations. We may send Coaches news about U Body; each of those emails includes a way to stop receiving them, and we will honor your request to unsubscribe within ten (10) business days. Even if you unsubscribe, we will continue to send you service messages related to your account, such as messages about sign-in, security, billing, or changes to our legal documents. You can turn off notifications in your device or browser settings. We do not send third-party marketing communications.

4. Artificial intelligence and automated processing

4.1 Automatically generated plans. The app generates each Client's training plan through an automated process that combines the Client's questionnaire answers, the methodology their Coach has configured, and our exercise database. The Client's meal plan is generated in a similar way: calorie and nutrient targets are calculated using standard reference formulas based on the Client's weight, height, age, sex, activity, and, where available, body fat percentage, and our artificial intelligence provider selects recipes from our catalog among those compatible with the Client's preferences and exclusions, without setting any quantities. The Coach can review and modify both plans from their dashboard.

4.2 The assistant. Each app's artificial intelligence assistant responds to Clients on behalf of their Coach. To do so, it has access to the Client's plan, training history, questionnaire answers, and conversation. The text messages, photographs, and videos the Client sends are forwarded to our artificial intelligence provider to generate the response, and voice notes are transcribed into text by the same means. Under that provider's terms of service, the information we send it is not used to train its models. Each message from the assistant is identified as generated by artificial intelligence, and the Coach can read the entire conversation and take part in it.

4.3 The Coach's methodology. When a Coach describes their methodology in their own words or uploads a document, that text is processed once by automated means to convert it into the rules used to configure their Clients' plans.

4.4 No decisions with legal effects. U Body does not make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you. Decisions about your account, your subscription, or the Referral Program are reviewed by a person when you request it.

4.5 Client photographs. If a Client uploads a photograph of their current physical condition in the questionnaire, we send it once to our artificial intelligence provider to obtain an approximate estimate of the Client's body fat percentage, which we use only to calculate the targets of their meal plan and which we stop using once a measurement has been logged.

4.6 Coach photographs. When a Coach uploads their photograph, our artificial intelligence provider analyzes it to describe the Coach's appearance in general terms (skin tone, hair, and build), which is used to draw the illustrations on their page. If the Coach requests it, the provider also checks that the Coach's photographs clearly show the same person and generates exercise images featuring the Coach. We do not extract or store biometric identifiers, such as facial templates or facial geometry, and we do not use these images to identify anyone.

4.7 Your permission for the use of artificial intelligence. The mobile apps ask for your permission before using artificial intelligence with your information, and in any version of the Services you can decline or withdraw it at any time from the profile in your app or the settings in your dashboard. In the web version, permission is deemed given until you withdraw it. Without that permission, we do not send your information to our artificial intelligence provider, and the features that depend on it are offered without it or are unavailable; if a Coach withdraws it, their assistant stops replying to their Clients.

5. Who we share information with

5.1 Between the Coach and their Clients. The Coach sees the information of each of their Clients in their dashboard: their contact details, questionnaire answers, photographs, logged workouts, body measurements, activity, and all chat conversations, including those with the assistant. The Client sees their Coach's name, photograph, and brand, and the messages the Coach sends them.

5.2 The Coach's public page. The name, photographs, city, offer, price, Instagram username, and WhatsApp or payment link that the Coach configures are published on the Coach's ubody.ai page, which is public and may be indexed by search engines while it is active. The Coach controls that content from their dashboard.

5.3 Referral Program. If you sign up with another Coach's code, that Coach will see in their dashboard your name, your username, your email address, your WhatsApp number, the Plan you subscribed to, the status of your subscription, and the amount of the commission owed to that Coach, so that they can keep track of their referrals.

5.4 Service providers. We share information with the providers we need in order to operate the Services, solely for the purposes described in this Policy and subject to contractual confidentiality and security obligations. Our current providers are:

• Stripe (United States): processing of Coaches' payments and management of their subscriptions.
• OpenAI (United States): artificial intelligence models for the assistant, transcription of voice notes, analysis of photographs and videos sent in the chat, estimation of body fat from the questionnaire photograph, selection of recipes for meal plans, analysis of the Coach's photographs and generation of their images, and processing of the Coach's methodology.
• Cloudflare (global network): hosting and delivery of the sites and apps, and protection against attacks.
• Fly.io (United States): servers on which the app runs.
• Bubble (United States): database of Clients' accounts, their plans, and their workout logs.
• Airtable (United States): exercise catalog and Coach directory.
• Amazon Web Services (United States): plan-generation infrastructure, storage, and email delivery.
• Resend (United States): delivery of sign-in and notification emails.
• Google (United States): sign-in with Google, distribution of the Android app, delivery of notifications to Android devices, and the fonts used on our sites.
• Apple (United States): sign-in with Apple, distribution of the iOS app, and delivery of notifications to Apple devices.
• Expo (United States): delivery of notifications to the mobile apps.
• Browser push services (such as those of Google, Apple, or Mozilla): delivery, in encrypted form, of the web notifications you allow.
• Meta Platforms (United States): advertising measurement, in accordance with Section 6.
• TikTok (TikTok Pte. Ltd. and its affiliates): advertising measurement, in accordance with Section 6.
• Microsoft (United States): session recording on our sites and apps through Microsoft Clarity, in accordance with Section 6.

Each provider processes the information in accordance with its own privacy policy. We may replace or add providers; where doing so entails a material change in the processing, we will update this Policy.

5.5 Legal obligations. We may disclose information when required by law, a court order, or a request from a competent authority, or when necessary to protect the rights, safety, or property of U Body, its users, or third parties.

5.6 Corporate transactions. If U Body is involved in a merger, acquisition, reorganization, or sale of assets, the information may be transferred to the resulting entity, which will be bound by this Policy. We will notify you before your information becomes subject to a different policy.

5.7 With your consent. In any other case, we will share your information only with your prior consent.

5.8 We do not sell it. U Body does not sell or rent personal information for money, and does not transfer it to third parties for their own commercial purposes, with the sole exception of the information about visitors to ubody.ai and coach.ubody.ai and about Coaches that reaches Meta and TikTok so that we can measure our advertising (Section 6.2), which those platforms may also use for their own purposes and which some U.S. laws consider “sharing” information or targeted advertising. You can opt out as described in Section 14.

6. Cookies and tracking technologies

6.1 Session cookies. The Coach dashboard (coach.ubody.ai) and the app (app.ubody.ai) use a strictly necessary cookie to keep you signed in. That cookie is not accessible to scripts running in the browser and is not used for advertising, and the apps do not store your information in the browser's local storage.

6.2 Meta and TikTok pixels and their server APIs. On ubody.ai and coach.ubody.ai, we use the Meta pixel, which sets the _fbp and _fbc cookies, to measure the results of our advertising on Facebook and Instagram, and the TikTok pixel, which sets the _ttp cookie, to measure the results of our advertising on TikTok. These pixels record page visits, the creation of a Coach account, and the start of the checkout process. In addition, when a Coach creates their account, starts their free trial, or makes their first payment, we send that event to Meta and TikTok from our servers together with the Coach's email address and phone number in hashed form (using a function that does not allow them to be recovered), the identifiers stored in those cookies, and the IP address and browser from which the Coach signed up, so that each platform can attribute the event to the corresponding ad. We do not send these events for accounts created in the iOS app. The Clients' app does not include any of these pixels or any other advertising tool. You can limit this tracking with the Global Privacy Control signal (Section 6.7), by asking us to opt you out as described in Section 14, by blocking third-party cookies in your browser, or by adjusting the ad preferences in your Meta or TikTok accounts.

6.3 Visit measurement. Our pages send our servers an anonymous record of each visit, containing the information described in Section 2.5, without cookies or persistent identifiers.

6.4 Session recording. On ubody.ai, on coach.ubody.ai, and in the app (app.ubody.ai), we use Microsoft Clarity, which records how the page is used (scrolling, clicks, taps, and cursor movements) so that we can see where users get confused and improve the service. In the Coach dashboard and in the Clients' app, Clarity does not receive the content of the screen: text and images (names, messages, measurements, photos) are masked on your device before they are sent, and URLs that contain access codes are not recorded. On ubody.ai, Clarity masks the text you type into form fields. Clarity sets the _clck and _clsk cookies, which are shared across ubody.ai, coach.ubody.ai, and app.ubody.ai to recognize a single visit, and stores a session identifier in the browser's session storage. Microsoft processes that data in accordance with its own privacy statement.

6.5 Fonts. Our sites load fonts from Google's servers, which receive your IP address when serving them.

6.6 Your choices. You can set your browser to reject or delete cookies. If you block the session cookie, you will not be able to stay signed in to the dashboard or the app.

6.7 Global Privacy Control. If your browser sends the Global Privacy Control (GPC) signal, ubody.ai and coach.ubody.ai do not load the Meta or TikTok pixels, our websites and web apps do not load Microsoft Clarity, and, if you create your Coach account with that signal on, we will not send your account's events to Meta or TikTok from our servers either. We treat the signal as a request to opt out of the sale or sharing of your information and of targeted advertising under Section 14. The signal is specific to each browser, so you need to turn it on in each browser and on each device you use; to have the opt-out also apply to your account on any device, write to us as described in Section 14.

7. Security

We apply reasonable technical and organizational measures to protect your information: communications with the Services are encrypted using HTTPS; passwords are stored using key derivation functions that do not allow them to be recovered; the keys used to access our providers are never included in the apps installed on devices; access to information is limited to the people who need it to operate the Services; and our infrastructure providers hold recognized security certifications. No system is completely secure, so we cannot guarantee the absolute security of information. If we become aware of an incident affecting your personal data, we will notify you without undue delay and as required by law. We recommend that you protect your credentials and notify us immediately at [email protected] if you suspect unauthorized access to your account.

8. Data retention

We retain your information for as long as your account exists and for as long as necessary for the purposes described in this Policy:

• A Coach's account information and the information of their Clients is retained while the account is active and, after termination of the Subscription, for a reasonable period that allows the account to be reactivated with the same data. After that period, U Body may delete or anonymize it.
• Chat conversations are retained in full for as long as the account exists, because they form part of the history the Coach consults in their dashboard. Attachments may be deleted sooner for capacity reasons.
• Billing records, invoices, and the information needed to meet accounting and tax obligations are retained for the periods required by law.
• Anonymous visit records are retained for a maximum of four hundred (400) days, and server technical logs for a shorter period.
• Data from a Coach sign-up that was not completed is retained for a limited period so that the sign-up can be resumed, and is then deleted.

When you request the deletion of your account in accordance with Section 9, we delete or anonymize your personal information, except for information we must retain to comply with a legal obligation or to defend against claims.

9. Your rights and how to exercise them

Regardless of your country of residence, U Body recognizes that you have the following rights, which correspond to those provided under Canadian law (PIPEDA) and, for residents of Colombia, under Law 1581 of 2012 and Decree 1377 of 2013:

1. to know, update, and rectify your personal data;
2. to request proof of the authorization granted for its processing, except where the law does not require such authorization;
3. to be informed of the use that has been made of your data;
4. to revoke your consent and request the deletion of your data when there is no legal or contractual duty requiring it to be retained;
5. to access your personal data free of charge; and
6. to file complaints with the competent data protection authority: the Office of the Privacy Commissioner of Canada with respect to BodySculpt AI Corp., the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio) if you reside in Colombia, or the authority of your country.

You may exercise these rights by writing to [email protected] from the email address associated with your account, stating your name, the account concerned, and the request you are making. We will respond to inquiries within a maximum of ten (10) business days and to claims within a maximum of fifteen (15) business days, counted from their receipt; if it is not possible to address them within that period, we will inform you and indicate the date on which we will do so, which will in no case exceed the additional periods permitted by applicable law or the thirty (30) days established by Canadian law.

You can update much of your information yourself: Coaches from the settings section of their dashboard and from the billing portal, and Clients from the profile in their app. You can also delete your account at any time from those same places. Clients may also contact their Coach, who is the one who decides the purposes for which their data is used.

If you reside outside Colombia, you have the equivalent rights granted to you by the laws of your country (access, rectification, cancellation, objection, and, where applicable, portability), which you may exercise by the same means. If you reside in the United States, Sections 14 and 15 describe your rights and the timeframes within which we will respond.

10. “Do Not Track” signals

Some browsers allow you to send a “Do Not Track” signal to the sites you visit. There is not yet an accepted standard for how to respond to such a signal, so our sites do not change their behavior when they receive one. That signal is different from the Global Privacy Control signal, which we do honor as described in Section 6. You can limit tracking as described in Section 6.

11. Minors

The Services are intended for persons eighteen (18) years of age or older and are not directed to children under thirteen (13). We do not knowingly collect personal information from children under thirteen (13), and they may not be registered as Clients. A Coach may register a person between thirteen (13) and seventeen (17) years of age as a Client only with the express consent of that person's parent or legal guardian and where permitted by law, and the Coach is responsible for obtaining that consent. We do not sell or share, as those terms are used in U.S. law, the personal information of individuals we know to be under sixteen (16) years of age. If you become aware that a child under thirteen (13) has provided us with personal information, or that a minor has done so without the required consent, write to us at [email protected] and we will delete it.

12. International transfers

BodySculpt AI Corp. is headquartered in Canada, its team operates from Colombia, and it provides the Services to users in various countries. The servers on which the Services run and the providers listed in Section 5.4 are located primarily in the United States, so your information is transferred to Canada and the United States and processed outside your country of residence. By using the Services, you expressly consent to that transfer. We require our providers to make contractual confidentiality and security commitments, and we adopt the safeguards that applicable law requires for international transfers of personal data.

13. Regional disclosures

13.1 Canada. BodySculpt AI Corp. is subject to Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA), which requires personal information to be handled with the consent of the individual concerned, for purposes that a reasonable person would consider appropriate, with appropriate security safeguards, and for as long as necessary. You may file a complaint with the Office of the Privacy Commissioner of Canada.

13.2 Colombia. For residents of Colombia, this Policy serves as the personal data processing policy for the purposes of Law 1581 of 2012 and Decree 1377 of 2013, as compiled in Decree 1074 of 2015, and U Body acts as the controller under the terms of Section 1. Data relating to health and physical condition is sensitive data: you are not required to authorize its processing, and we process it only with your express consent and for the purposes described. The data protection authority is the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio).

13.3 Mexico. If you reside in Mexico, you have the rights of access, rectification, cancellation, and objection recognized by the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), which you may exercise in accordance with Section 9. The competent authority is the body responsible for guaranteeing the protection of personal data.

13.4 Other Latin American countries. If you reside in another country in the region, you have the rights recognized by your national data protection laws, which you may exercise by the means indicated in Section 9, without prejudice to your right to apply to the authority of your country.

13.5 European Economic Area and United Kingdom. The Services are not directed at residents of those territories. If you nonetheless use the Services, you have the rights granted to you by the General Data Protection Regulation and the laws of the United Kingdom, including the rights of access, rectification, erasure, restriction, objection, and portability, which you may exercise by the same means.

13.6 United States. If you reside in the United States, Section 14 describes your rights under state privacy laws, including California's, and Section 15 is our Consumer Health Data Privacy Policy under the laws of Washington, Nevada, and other states.

14. Your privacy rights in the United States

14.1 Scope. This section supplements the Policy for residents of California, under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”), and for residents of the other states with comprehensive privacy laws, such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island (together with the CCPA, the “State Privacy Laws”). These laws apply to businesses that meet certain thresholds; whether or not they apply to us, we extend the rights described here to all residents of the United States. When we process a Client's data on behalf of their Coach (Section 1.2), we act as the Coach's service provider or processor; even so, we will respond directly to the Client's requests or, where appropriate, forward them to the Client's Coach and let the Client know.

14.2 Categories of personal information. In the past twelve (12) months, we have collected the following categories of personal information, from the sources indicated:

• Identifiers: name, email address, phone or WhatsApp number, username, Instagram username, account identifiers, IP address, and cookie and notification identifiers. Sources: you, your Coach if you are a Client, Google or Apple if you sign in with them, and your browser or device.
• Customer records (California Civil Code Section 1798.80(e)): name, phone number, email address, and the billing information Stripe returns to us, without your card numbers. Sources: you and Stripe.
• Characteristics of protected classifications: sex, the gender with which a Coach presents themselves, and age or year of birth. Source: you.
• Commercial information: the Plan subscribed to; subscription, payment, and free trial history; and Referral Program commissions and payouts. Sources: you and Stripe.
• Internet or other electronic network activity: pages visited, referring page, campaign parameters, interactions with our sites and apps (including the session recordings described in Section 6, with the content of the screen masked), app usage, and technical logs. Source: your browser or device.
• Geolocation data: only the approximate country inferred from your IP address. We do not collect your precise location.
• Audio, electronic, or visual information: photographs, videos, and voice notes. Source: you.
• Professional information: for Coaches, information about their business, offer, prices, and methodology. Source: you.
• Health and fitness information: questionnaire answers, body measurements, heart rate, blood pressure, sleep, steps, food preferences and allergies, photographs of physical condition, and workout logs (Sections 2.1 and 2.2). Sources: you and your Coach.
• Inferences: the body fat percentage estimated from a photograph, calorie and nutrient targets, and, for Coaches, the general description of their appearance used for the illustrations on their page (Section 4). We use them only to provide the Services and do not create profiles for advertising purposes.

14.3 Sensitive personal information. Of the categories above, the following are sensitive personal information: your account login credentials, health and fitness information, and the contents of chat messages. We use and disclose sensitive personal information only to provide the Services you request and for the other purposes the law permits, such as security, fraud prevention, and legal compliance, and we do not use it to infer characteristics about you. For that reason, we do not offer a mechanism to limit its use, although you may write to us at any time with questions about it.

14.4 Purposes. We use each category for the purposes described in Section 3: providing the Services, managing our business relationship, communicating with you, protecting and improving the Services, and complying with the law. To measure our advertising, we use only identifiers, commercial information (the start of a trial or subscription), and the internet activity of visitors to ubody.ai and coach.ubody.ai and of Coaches.

14.5 Who we disclose it to. We disclose personal information for business purposes to the following categories of recipients: (a) our service providers and contractors listed in Section 5.4 (hosting, databases, payments, email, notifications, artificial intelligence, and analytics), all categories, depending on the service each one provides; (b) each Client's Coach and, in the Referral Program, the Coach who referred them, the categories indicated in Sections 5.1 and 5.3; and (c) authorities, courts, and professional advisers, when required by law or necessary to defend our rights (Section 5.5).

14.6 Sale, sharing, and targeted advertising. In the past twelve (12) months, we have not sold personal information for money. However, the Meta and TikTok pixels on ubody.ai and coach.ubody.ai, and the events we send from our servers (Section 6.2), make identifiers (including hashed email addresses and phone numbers, cookie identifiers, and IP addresses), commercial information, and the internet activity of visitors to those sites and of Coaches available to Meta Platforms and TikTok, which may also use them for their own purposes. Under the CCPA, this may constitute “sharing” personal information for cross-context behavioral advertising and, under the other State Privacy Laws, targeted advertising or a sale. You have the right to opt out (Section 14.9). We do not sell or share sensitive personal information, information from the Clients' app, or the personal information of individuals we know to be under sixteen (16) years of age.

14.7 Retention. We retain each category for the periods described in Section 8: account information, health and fitness information, messages, and files, for as long as your account exists and for a reasonable period afterward that allows it to be reactivated, or until you request their deletion; commercial and billing information, for the periods required by accounting and tax laws; visit records, for up to four hundred (400) days; and technical logs, for a shorter period.

14.8 Your rights. Depending on your state of residence, you have the right to:

1. know what personal information we have collected about you, including its categories, its sources, the purposes for which we use it, and the categories of recipients to whom we have disclosed it, and access the specific pieces of information;
2. request the deletion of the personal information we have collected from you, subject to the exceptions permitted by law;
3. request the correction of inaccurate personal information;
4. receive your personal information in a portable and commonly used format;
5. opt out of the sale and sharing of your personal information and of its processing for targeted advertising;
6. limit the use of your sensitive personal information, in the cases described in Section 14.3;
7. opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, which we do not carry out (Section 4.4);
8. withdraw any consent you have given us to process sensitive personal information;
9. obtain, where your state's law provides for it, a list of the specific third parties to which we have disclosed your personal information; and
10. not receive discriminatory treatment for exercising any of these rights: we will not deny you the Services, charge you a different price, or provide you a different level of quality because you exercised them.

14.9 How to exercise them. Write to us at [email protected] with the subject line “U.S. Privacy Request,” stating your state of residence and your request; you can also delete your account from the app or the dashboard (Section 9). To opt out of the sale, sharing, and targeted advertising, turn on the Global Privacy Control signal in your browser (Section 6) or write to us with the subject line “Do Not Sell or Share My Personal Information.” You do not need an account or to verify your identity to opt out.

14.10 Verification and authorized agents. To protect your information, before responding to a request to access, delete, or correct information, we will verify your identity by comparing the information you provide with the information we hold, usually by asking you to write from the email address associated with your account or to confirm certain details of it. An authorized agent may submit a request on your behalf with your signed permission or a valid power of attorney under your state's law; we may ask you to verify your identity directly with us or to confirm that you gave that permission.

14.11 Timeframes. We will confirm receipt of your request within ten (10) business days and respond within forty-five (45) calendar days of receiving it. If we need more time, we will let you know within that period and may extend it by up to forty-five (45) additional days where the law permits. We act on opt-out requests as soon as possible and, in any event, within fifteen (15) business days. Requests are free of charge unless they are manifestly unfounded, excessive, or repetitive.

14.12 Appeals. If we deny your request in whole or in part, we will explain why. You may appeal our decision by writing to us at [email protected] with the subject line “Privacy Appeal” within a reasonable period after our response. We will respond to your appeal in writing within forty-five (45) days of receiving it, a period that may be extended where your state's law permits, explaining our decision and the reasons for it. If we deny your appeal, you may submit a complaint to your state's attorney general.

14.13 California “Shine the Light” notice. California residents may ask us for information about our disclosure of their personal information to third parties for those third parties' own direct marketing purposes. We do not disclose personal information to third parties for those purposes.

15. Consumer Health Data Privacy Policy

15.1 Scope. This section is our Consumer Health Data Privacy Policy under Washington's My Health My Data Act (Chapter 19.373 of the Revised Code of Washington), Nevada's consumer health data law (Senate Bill 370 of 2023), and similar state laws. It applies to “consumer health data,” meaning personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status, and it prevails over the rest of the Policy with respect to that data.

15.2 Consumer health data we collect. Body measurements (weight, measured or estimated body fat percentage, fat mass and lean mass, body mass index, circumferences, and skinfolds); resting heart rate, blood pressure, maximal oxygen uptake, hours of sleep, steps, hydration, and calories; questionnaire answers about your goal, experience, height, weight, and age; photographs of your physical condition and those you send in the chat; your workout logs; your food preferences, allergies, and excluded foods, and your meal plan; and any information about your health that you include in chat messages or voice notes.

15.3 How we use it. Solely to provide the Services that you and your Coach request: generating and adjusting your training and meal plans, showing you your progress, enabling your Coach to support you, operating the artificial intelligence assistant if you have not withdrawn your permission (Section 4.7), and maintaining and protecting the Services. We do not use it for advertising.

15.4 Where we get it. From you, when you answer the questionnaire, log your measurements, or write in the chat; from your Coach, when they log your measurements or set up your plan; and from our automated processes, such as the estimate of your body fat from your photograph or the calculation of your calorie and nutrient targets.

15.5 Who we share it with. With your Coach, who sees it in their dashboard as part of the service you receive from them; with our processors, which process it only on our behalf and under our instructions: Fly.io, Cloudflare, Bubble, and Amazon Web Services (hosting, storage, and plan generation) and OpenAI (artificial intelligence, if you have not withdrawn your permission); and with authorities, when required by law. We have no affiliates with which we share it. We do not share it with advertising platforms, and we do not sell it.

15.6 Consent. Providing this data is voluntary. We collect and use it to the extent necessary to provide the service you request and, where the law requires it, with your consent. We will not share it for any other purpose without your prior consent, which you may withdraw at any time by writing to us at [email protected]. We do not use geofences around health care facilities.

15.7 Your rights. You have the right to: (a) confirm whether we collect, share, or sell your consumer health data and access it, including a list of all third parties and affiliates with which we have shared it or to which we have sold it, with their contact information; (b) withdraw your consent to its collection and sharing; (c) request its deletion, which we will communicate to our processors and to the third parties with which we have shared it, and which will extend to our backups within the period required by law; (d) appeal our decision on your request; and (e) not receive discriminatory treatment for exercising these rights.

15.8 How to exercise them. Write to us at [email protected] with the subject line “Health Data,” or delete your measurements or your account from the app. We apply the verification, timeframes, and appeal procedure described in Sections 14.10 through 14.12. If we deny your appeal, you may submit a complaint to the Attorney General of the State of Washington, of the State of Nevada, or of your state of residence, as applicable.

16. Changes to this Policy

We may update this Policy to reflect changes in the Services, our providers, or the law. The date of the last update appears at the top of this page. When a change is material, we will notify you at the email address registered to your account before it takes effect. We recommend that you review this Policy periodically.

17. Contact

For any inquiry, request, or claim relating to this Policy or to the processing of your personal data, you may contact:

Data controller

BodySculpt AI Corp., a corporation incorporated in Canada, operating under the trade name U Body.

Email

[email protected]

Website

ubody.ai

Headquarters

Canada, with an operations team in Colombia.

You can find more information about U Body at ubody.ai/nosotros and our Terms and Conditions at ubody.ai/terms.