Privacy Policy
We are committed to protecting your personal and health data. This policy explains everything we collect, why we collect it, and how we keep it safe.
Table of Contents
- 1. Introduction and Who We Are
- 2. Information We Collect
- 3. How We Use Your Information
- 4. AI Processing and Automated Content
- 5. Sensitive Health Data and Medical Disclaimer
- 6. App Permissions and Device Access
- 7. Third-Party Services and Data Sharing
- 8. Data Storage, Security, and Retention
- 9. Your Rights and Choices
- 10. Children's Privacy and Age Restrictions
- 11. In-App Purchases and Subscriptions
- 12. Cookies and Tracking Technologies
- 13. Changes to This Policy
- 14. Contact Us
1. Introduction and Who We Are
BodyFastLane ("we," "our," or "us") is a health and fitness platform available on iOS and Android, with a website at https://bodyfastlane.com. This Privacy Policy explains what personal information and health data we collect, why we collect it, how we use and store it, with whom we share it, and what rights you have.
By downloading, installing, or using the BodyFastLane App or website, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use our services.
This policy applies to all users regardless of device or platform. We are committed to handling your information transparently and responsibly, particularly because the App processes sensitive health data. Contact us at wellfit.ojas@gmail.com with any questions.
Last updated: August 5, 2026. We reserve the right to update this policy. For material changes, we will notify users via in-app notification or email. Continued use after changes constitutes acceptance.
2. Information We Collect
We collect information to provide and improve the BodyFastLane experience across the following categories:
2.1 Account and Identity Information
When you create an account, we collect your name, email address, password (stored as a secure hash), profile photo, and account timestamps.
2.2 Physical and Health Profile Data
During onboarding you voluntarily provide health profile information including age, sex, height, weight, fitness level, activity level, fitness goals, sleep habits, stress level, workout preferences, dietary restrictions, and food allergies.
2.3 Medical and Caretaker Data
The Caretaker feature allows you to record health information such as medical conditions, medications, appointment records, and health logs. This data is voluntarily provided, classified as sensitive personal data, and never used for advertising.
2.4 Uploaded Medical Reports
The Report Analysis feature lets you upload a photo or PDF of a lab report or medical document. We store the file you upload and the data our AI extracts from it (values, reference ranges, and flagged findings) as a history in your account until you delete it.
2.5 Activity and Fitness Data
We collect step counts, distance, active minutes, GPS run routes, and workout records. We also collect AI-generated workout plans assigned to you, your completion status, and mood or sleep ratings.
2.6 Nutrition Data
When you use the nutrition feature, we collect food photos, portion estimates, AI-identified nutritional values, and manually logged food entries.
2.7 Location Data
With your permission, we collect precise GPS coordinates during run tracking, which we store as part of your run history until you delete it. Separately, for the Environmental Health Risk feature, we use your GPS location — or, if GPS is denied, approximate location derived from your network connection — to retrieve local air quality, weather, and UV data; that assessment, including the location used to generate it, is saved to your account for up to 45 days. See Section 7 for full retention details.
2.8 Images and Media
The App may access your camera and photo library for food scanning, medical report scanning, medicine label scanning, profile photos, and progress photos. Images may be transmitted to our backend for analysis and can be deleted at any time via account settings.
2.9 AI Chat and Interaction Data
When you interact with our AI coach or health chat, we collect the text of your messages, attached images, conversation timestamps, and metadata. This data is sent to our secure backend for processing.
2.10 Gamification and Social Data
We collect data related to challenges, leaderboard rankings, points, achievements, and community interactions.
2.11 Subscription and Purchase Data
If you subscribe to Pro or Family, we receive purchase confirmation from the App Store or Google Play including subscription status and expiry date. We do not store credit card or payment details.
2.12 Technical and Device Data
We automatically collect device type, operating system version, app version, and unique device/installation identifiers for bug fixing and performance improvement.
3. How We Use Your Information
We use the information we collect for the following purposes:
3.1 Providing Core App Features
Your profile, health, and activity data are used to personalise AI-powered workout plans, meal plans, health assessments, report analysis, and caretaker reminders.
3.2 Step and Fitness Tracking
Step and activity data is used to display daily progress, calculate rewards, update leaderboards, and generate motivational messages. Data read from Apple HealthKit or Health Connect is read-only and is not shared with third parties for commercial purposes.
3.3 AI-Powered Coaching and Analysis
Your health profile, workout history, nutrition logs, uploaded reports, and chat messages are processed by our backend and forwarded to our AI processing partner to generate personalised responses, plans, and insights. See Section 4 for details on AI processing.
3.4 Caretaker Reminders
Medicine data, reminder times, and appointment dates are used to schedule local push notifications and sync reminders across sessions.
3.5 Environmental Health Assessment
Your location is used to fetch air quality, weather, and UV data to generate a personalised environmental health risk score, saved to your account for a limited period (see Section 7).
3.6 Community and Social Features
Your display name, profile photo, step count, and challenge submissions are shared with other users within the community features based on your privacy settings.
3.7 Rewards and Gamification
We track your engagement and activity to award coins, badges, and achievement milestones.
3.8 Communication
We use your email for account verification, password resets, and, where opted in, product announcements. We do not sell your email address.
3.9 Security and Fraud Prevention
We monitor usage patterns to detect and prevent unauthorised access and abuse.
3.10 Legal Obligations
We may process your data to comply with applicable laws, respond to lawful requests, enforce our Terms of Service, or protect the rights and safety of our users.
4. AI Processing and Automated Content
4.1 What Gets Sent to Our AI Partner
Features such as the AI food scanner, Report Analysis, AI FastLane Coach, health-risk analysis, vitamin/mineral check, and stress decoder send the specific input needed for that feature — a food photo, an uploaded report image or PDF, questionnaire answers, or relevant fields from your health profile — to our AI processing partner, OpenAI, to generate a response.
4.2 How OpenAI Handles This Data
Data we send is used only to generate the output returned to you. Under OpenAI's API terms, data submitted through its API is not used to train OpenAI's models by default.
4.3 AI Output Is Informational, Not a Decision About You
We do not use AI to make any decision that produces a legal or similarly significant effect on you — such as denying you a service — without that outcome being a plainly labelled, informational suggestion you remain free to disregard.
4.4 Scores and Risk Flags Are Estimates
Where a feature presents a score, risk level, or flagged finding (Report Analysis, the Health Risk Report, the Vitamin & Mineral Check), this is an AI-generated, informational estimate meant to prompt appropriate follow-up — not a clinical or diagnostic determination. AI-generated content can occasionally be inaccurate or incomplete.
4.5 Your Choice
You can decline to use any individual AI feature; doing so does not affect your ability to use the Service's non-AI features.
5. Sensitive Health Data and Medical Disclaimer
5.1 Sensitive Health Data
BodyFastLane processes data that qualifies as sensitive personal data under GDPR, CCPA, India's DPDP Act, and similar frameworks — including medical conditions, medications, health logs, uploaded medical reports, and biometric measurements. We apply heightened security to this data. It is never used for advertising, sold to data brokers, or shared with insurers, employers, or financial institutions.
5.2 Apple HealthKit (iOS)
With your permission, we read (and never write) heart rate, resting heart rate, heart rate variability, blood oxygen, respiratory rate, VO2 max, blood pressure, blood glucose, body temperature, active/resting energy burned, exercise and stand time, flights climbed, walking/running distance, body mass, body fat percentage, BMI, mindful session records, and sleep analysis. Revoke access anytime via iOS Settings → Privacy & Security → Health → BodyFastLane.
5.3 Health Connect (Android)
With your permission, we read (and never write) the equivalent Health Connect record types: heart rate, resting heart rate, heart rate variability, blood oxygen, respiratory rate, VO2 max, blood pressure, blood glucose, sleep sessions, active/total calories burned, exercise sessions, floors climbed, weight, body fat, steps, distance, and body temperature. Revoke access anytime via Android Settings → Health Connect → App permissions.
5.4 Medical Disclaimer
BodyFastLane is a general fitness and wellness application. It is NOT a medical device and is NOT a substitute for professional medical advice, diagnosis, or treatment — including Report Analysis, the Health Risk Report, and the Vitamin & Mineral Check, all of which produce AI-generated, informational estimates only. Always consult a qualified healthcare professional before starting a new exercise programme, changing medications, or making health decisions based on App content. In a medical emergency, contact local emergency services immediately.
5.5 Medication Tracking
The Caretaker feature is a personal tracking tool only. It does not provide medical dosing recommendations. Always follow your healthcare provider's instructions.
6. App Permissions and Device Access
The App requests the following device permissions, each optional but limiting some functionality if denied:
6.1 Camera
Used to capture food photos, medical report photos, and medicine labels for scanning, and to take profile photos. We do not capture images in the background.
6.2 Photo Library
Used to select existing photos or PDFs for profile images, food logging, report analysis, and challenge submissions. We do not scan or index your photo library.
6.3 Location
Used for GPS run tracking (while the app is in use) and, separately, when you open the Environmental Health feature to fetch air quality, weather, and UV data. We do not track your location in the background outside an active run.
6.4 Motion / Pedometer
Used to count daily steps via your device's accelerometer and motion coprocessor.
6.5 Health Data (HealthKit / Health Connect)
Used, with your explicit permission, to read the vitals, activity, body, and sleep metrics listed in Section 5. We only ever request read access.
6.6 Push Notifications
Used for medicine reminders, appointment alerts, step goal check-ins, and challenge notifications. You may disable notifications at any time in App Settings or device notification settings.
6.7 Background Processing
Background processing is used for step synchronisation and reminder scheduling only, not for data collection.
7. Third-Party Services and Data Sharing
We do not sell your personal information. We share certain data with the following service providers as necessary to operate the App:
7.1 Google Firebase
User data — including health records, fitness logs, uploaded reports, chat messages, and media — is stored via Firebase Authentication, Firestore, and Cloud Storage. Data may be stored in data centres in the United States or other regions.
7.2 OpenAI
Our backend forwards the specific inputs described in Section 4 to OpenAI to generate AI-powered responses. Data sent is used only to generate your response and is not used to train OpenAI's models by default.
7.3 Environmental Data Providers
When you use the Environmental Health Risk feature, your location is sent to OpenWeatherMap to retrieve air quality, weather, and UV data; if GPS is unavailable, we use ipapi.co to estimate your approximate location from your network connection.
7.4 Google Sign-In
If you sign in with Google, we receive your name, email, and profile photo as permitted by your Google account settings, used only to authenticate you.
7.5 Apple App Store and Google Play Billing
In-app purchase transactions are processed entirely by Apple or Google. We do not access your payment method or full billing details.
7.6 Cloudflare
Hosts static, non-personal app content such as exercise demonstration media. It does not receive or store your personal data.
7.7 Expo Push Notification Service
Used to deliver push notifications to your device. It receives only your device's push token, not your health data.
7.8 No Advertising or Data Brokers
We do not use any advertising network, ad SDK, data broker, or third-party analytics/crash-reporting SDK beyond the providers listed above.
7.9 Legal Disclosures
We may disclose your information if required by law, court order, or to protect the rights, safety, and property of BodyFastLane or its users.
7.10 Business Transfers
If BodyFastLane is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.
8. Data Storage, Security, and Retention
8.1 Data Storage
Your data is stored in Google's secure cloud infrastructure. Local caching on your device stores lightweight copies of frequently accessed data for offline functionality.
8.2 Security Measures
We implement industry-standard security measures including secure authentication, server-side access controls that restrict data to the authenticated owner, HTTPS encryption for all data in transit, and regular security reviews. Despite these measures, no system is perfectly secure. Contact wellfit.ojas@gmail.com immediately if you suspect unauthorised access.
8.3 Data Retention
We retain your account and app data for as long as your account is active. GPS run routes and Report Analysis history are retained until you delete the individual item or your account. Device-health snapshots are retained until account deletion. Vitamin-check assessments are retained for 30 days; Health Risk assessments (including the location used to generate them) are retained for 45 days, after which the App treats them as expired. When you delete your account, we delete your primary profile and disable sign-in immediately; associated feature data is deleted according to the schedules above, or on request — contact us to confirm full deletion of a specific data type. We may retain minimal transaction records after account deletion as required for financial or legal compliance.
8.4 Data Breach Notification
If we become aware of a data breach affecting your personal information, we will notify affected users and relevant authorities as required by applicable law, without undue delay.
8.5 International Data Transfers
Your data may be processed in data centres outside your country, including the United States, where our cloud and AI processing partners operate. Where required, we rely on appropriate safeguards such as standard contractual clauses.
8.6 Data Minimisation
We collect only the data necessary for the features you choose to use. Features requiring specific permissions are opt-in.
9. Your Rights and Choices
Depending on your country of residence, you may have the following rights:
9.1 Right of Access
You may request a copy of all personal data we hold about you.
9.2 Right to Correction
You may update or correct inaccurate information in the App's profile and settings.
9.3 Right to Deletion
You may delete your account via Settings → Account → Delete Account, or by contacting wellfit.ojas@gmail.com. See Section 8.3 for what this deletes and on what timeline.
9.4 Right to Portability
You may request an export of your data in a machine-readable format by contacting wellfit.ojas@gmail.com.
9.5 Right to Restrict or Object
You may request that we restrict or stop certain processing, subject to legal and operational limitations.
9.6 Right to Withdraw Consent
Where processing is based on consent (health data access, location, AI features), you may withdraw it at any time without affecting the lawfulness of prior processing.
9.7 Non-Discrimination
We will not deny you the Service or provide a lesser level of service solely because you exercised a privacy right.
9.8 California Residents (CCPA/CPRA)
California residents have the right to know what data we collect, the right to delete and correct it, and the right to non-discrimination. We do not sell or share personal information for cross-context behavioural advertising, so no "opt out of sale" action is required. You may designate an authorised agent to act on your behalf, subject to verification.
9.9 European and UK Residents (GDPR)
Our legal bases for processing include consent, performance of a contract, legitimate interests, and legal obligation. EEA/UK users have the right to lodge a complaint with a local Data Protection Authority.
9.10 India (DPDP Act, 2023)
Where the Digital Personal Data Protection Act, 2023 applies, we process your data on the basis of your consent. You may access a summary of your data and processing activities, request correction or erasure, and withdraw consent at any time.
9.11 HealthKit / Health Connect Data
You may revoke health-data permissions at any time via your device's OS settings (see Section 5).
We aim to respond to privacy requests within 30 days; for complex requests we may take up to 90 days and will tell you within the initial 30-day period. To exercise any of these rights, contact: wellfit.ojas@gmail.com
10. Children's Privacy and Age Restrictions
BodyFastLane is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18.
If you are a parent or guardian and believe a minor has provided us with personal information, contact wellfit.ojas@gmail.com. We will promptly delete the account and all associated data.
Caretaker features allow an adult account holder to manage health information on behalf of a dependent; the adult account holder is responsible for ensuring they have the legal right to do so.
11. In-App Purchases and Subscriptions
BodyFastLane offers a Free tier and Pro/Family subscriptions, billed on a recurring basis and processed entirely by Apple (App Store) or Google (Play Billing).
We do not store your credit card or payment details. Subscription management, billing disputes, and refund requests must be directed to Apple or Google through their standard processes.
Free trial periods automatically convert to paid subscriptions unless cancelled before the trial ends. Cancelling prevents future charges but does not refund the current billing period. Access continues until the end of the paid period.
If you need to restore a subscription on a new device, use the "Restore Purchases" option in the App's settings.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via in-app notice or email prior to taking effect. Continued use of the Service after an update constitutes acceptance of the revised policy. The most current version is always available at https://bodyfastlane.com/privacy.
This Privacy Policy was last updated on August 5, 2026.
14. Contact Us
For questions, concerns, or requests regarding this Privacy Policy, contact us:
Email: wellfit.ojas@gmail.com General Support: wellfit.ojas@gmail.com Website: https://bodyfastlane.com
For EU/UK users, if we have not adequately addressed your concern, you have the right to lodge a complaint with your local Data Protection Authority.
We aim to respond to privacy inquiries within 30 days. For complex requests, we may take up to 90 days and will inform you within the initial 30-day period.
Questions about how we handle your data? We're here to help.
Contact Privacy Team