Privacy Policy

1. Data Controller

The controller of your personal data is Aiclysm, the trade name of a sole trader registered in the Czech Republic (hereinafter "we", "us", "Aiclysm").

Contact for privacy inquiries: support@aiclysm.com

Supervisory authority: UOOU (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic · uoou.gov.cz

2. What Data We Collect

2.1 Account Data

Email address, password (stored as a secure hash), language preference, and subscription status. Authentication is handled via password-based login. Email verification codes are used during registration and password recovery. You can also sign in with your Google Account; in that case we receive only your email address, name and Google account identifier from Google, and Google receives no data about your use of the Service. We do not collect your name, phone number, or physical address unless you provide it voluntarily.

2.2 Health & Wearable Data

When you connect a wearable platform (Polar, Withings, Fitbit, Oura, Google Health, COROS), we retrieve health-related data through their official APIs using OAuth 2.0, and we never access or store your login credentials. Google Health is the Google service that Fitbit and Pixel devices sync into, and the successor to the Fitbit Web API: when you connect it, we read what your Fitbit or Pixel devices (a Fitbit Aria scale included) and your own entries in the Fitbit app recorded in your Google account about your sleep, heart rate and its variability, blood oxygen, breathing rate, skin temperature during sleep, VO2max, steps, distance, active minutes, energy burned, workouts, weight and body fat, and we write nothing back. What other apps copied into the account, for example from Health Connect or Apple Health, we leave out, so that nothing is counted twice. When you connect COROS, you sign in on COROS’s own page, at its European server for an account registered in Europe or at its US server for an account registered anywhere else, and through COROS’s official MCP server we read your sleep (its window, stages and score), overnight HRV, resting heart rate, steps, active calories, floors climbed, daily stress index, your heart rate through the day where COROS provides it, your current VO2max and workouts (time, type, average heart rate, calories, distance, and the workout’s file for the heart rate during it); we write nothing back, and COROS receives nothing from us but your sign-in. Garmin data reaches us in two ways. When you connect your Garmin account, you sign in on Garmin’s own page, and after each sync of your watch Garmin sends us, through the official Garmin Connect API, your daily summaries (steps, distance, floors climbed, active minutes, energy burned, heart rate through the day and at rest, stress and Body Battery), your sleep (its window, stages and score, and the breathing rate and blood oxygen during it), overnight HRV, breathing rate and blood oxygen through the day, skin temperature, VO2max, the body composition and blood pressure readings recorded in Garmin Connect, Health Snapshot readings, and your workouts with their heart rate. A workout’s details can include its route; we do not keep location. Garmin sends nothing from before the day you connect, and we write nothing back to your Garmin account. You can also upload the data export file from your Garmin account, which fills in your older history. The Strava integration was retired on 28 July 2026: the authorisation was revoked, the tokens deleted and the activity data we had received from Strava removed. Our Garmin watch app (Connect IQ) sends from a paired watch your daily stress (average, maximum and the hours it covers), your Body Battery curve (morning peak, latest level, charged and drained) and Garmin's recovery time in hours. When you take a morning HRV measurement on the watch, it also sends the beat-to-beat intervals of that measurement, the body position you chose and how the watch knew you were awake (the Body Battery rise, or your steps and the time since your usual wake time); MyBodyAI computes your HRV from the intervals. From version 2.14 the watch also sends, with its requests, its model and a short technical record of the day's morning HRV attempts: how the measurement screen was opened, when an attempt started, how it ended, and how many beat intervals and seconds with a pulse the sensor delivered (counts only, never your heart rate or the intervals themselves), so that we can see why a measurement did not work; we keep these records for 90 days. Nothing else leaves the watch, no all-day heart rate, location or activity files, and unpairing it stops the sending. Our Android app reads health data from Health Connect on your phone, with your explicit permission and only in the categories you grant: heart rate and HRV, sleep, steps, floors climbed, energy burned and workouts, breathing rate and blood oxygen, body composition, blood pressure, body temperature and VO2max. It reads what other apps on that phone have already written there and writes nothing back, and you can switch the phone off as a data source in Settings at any time. With the values it sends, our app includes the names of the apps that wrote them to Health Connect (for example Garmin Connect or Samsung Health): which app counted the steps, recorded a night or a workout, or took a weight, blood pressure or other reading, and which apps recorded your heart rate through the day. That is how we take a reading from the device that measured it and avoid counting a copy twice. We do not read the list of apps installed on your phone.

2.3 Derived Health Indices

From the raw data above, our algorithms compute 12 proprietary health indices: Immunity, Recovery, Stress Load, Sleep Debt, Circadian Rhythm, ANS Balance, Body Alert, Overtraining, Respiratory, Morning Energy, Sleep Quality, Cardiac Efficiency — plus Body Status, Biological Age across 6 domains (cardiovascular system, autonomic nervous system, sleep, body composition, physical activity and aerobic fitness), and Training Load analysis. These are algorithmic estimates, not clinical measurements.

2.4 Billing Data

MyBodyAI+ is a paid subscription, processed securely by Stripe (stripe.com). We store only your subscription status and Stripe customer ID. We never see or store your credit card number. For Stripe’s privacy practices, see stripe.com/privacy.

2.5 Technical Data

IP address, browser type, device information, and server access logs. These are used for security, debugging, and service improvement. We do not use advertising or tracking cookies. For usage statistics we use Umami, a self-hosted, cookie-free analytics tool (see Section 15). When you sign in with a passkey or an authenticator app, we store the public key of that passkey — never a private key or a fingerprint — and, so that we can tell you about a sign-in from a device you have not used before, the browser identification string of each device you sign in from.

2.6 Messages You Send Us

When you write to us through the Contact form on the website or in the app, we keep the topic, the message, its language and your e-mail address (the one you give us, or your account's when you are signed in). If you leave the technical details ticked (the form shows them before you send), we keep with the message the page it was sent from, your browser identification string, the app version and your time zone and, when you are signed in, your account number, the names of your connected data sources and the version of our calculations. Never a health value or a score. We use a message only to answer it and to fix what it reports. A notice that a message has arrived reaches us by e-mail with its topic, its number, whether it came from the app or the website and whether its writer was signed in, never with its text or your address. The legal basis is our legitimate interest in answering you (Art. 6(1)(f)) and, for questions about your account, the performance of our contract with you (Art. 6(1)(b)).

3. Legal Basis for Processing

We process your personal data on the following legal bases under the GDPR:

• Contract performance (Art. 6(1)(b)) — to provide the MyBodyAI service, manage your account, and process your subscription.
• Explicit consent (Art. 9(2)(a)) — for processing health data (special category data). You grant this consent when you create your account, and again whenever a change to this policy affects what we do with your data (Section 16). We record which version of this policy you agreed to. You can withdraw consent at any time by deleting your account in Settings.
• Legitimate interest (Art. 6(1)(f)) — for security, fraud prevention, and service improvement.
• Legal obligation (Art. 6(1)(c)) — for tax records, accounting obligations, and compliance with Czech law.

4. How We Use Your Data

• To compute and display your health indices on the MyBodyAI dashboard
• To manage your account and subscription
• To send essential service notifications (e.g., subscription expiry, security alerts)
• To improve our algorithms using anonymized and aggregated data
• To comply with legal obligations
• To ensure security and prevent abuse of our services

5. Data Sharing & Third Parties

We share your data only with the following categories of recipients, all bound by data processing agreements (DPAs):

• Hosting provider — server infrastructure located in the EU
• Wearable platform APIs — data flows are user-initiated via OAuth; each platform's privacy policy governs their data handling
• Stripe — payment processing (if you choose to support us). Stripe processes payment data under their own privacy policy. We receive only subscription status.
• Google (Google Ireland Ltd.) — optional sign-in provider. When you choose to sign in with Google, we receive your email address, name and account identifier from Google under their own privacy policy (policies.google.com/privacy). Transfers to the USA are covered by the EU-U.S. Data Privacy Framework. We never send Google your health data.
• Google Health (Google Ireland Ltd.) — optional data source, separate from signing in. When you connect it, we receive from Google, through the Google Health API and read-only, the health data described in section 2. We never send Google your health data. You can disconnect it in MyBodyAI or remove the access in your Google account at any time. The use of information received from Google Health API and/or Developer Tools will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements.
• COROS (COROS Wearables, Inc., USA) — optional data source. When you connect it, you sign in on COROS’s own page, and we receive from COROS, through its official MCP server, the health data described in section 2; we only read it and never write anything to your COROS account. COROS receives only your sign-in; we never send COROS your health data. COROS keeps the data of an account registered in the EEA or the United Kingdom on servers in the EEA, and of an account registered elsewhere on servers in the USA; for such an account we read the data, at your request, from COROS’s US server into our server in the EU. You can disconnect COROS in MyBodyAI at any time. COROS gives us no way to revoke the access from our side, so we delete the access tokens, and you can also remove MyBodyAI’s access in your COROS account.
• Garmin: optional data source. When you connect your Garmin account, you sign in on Garmin’s own page, and Garmin sends us, through the official Garmin Connect API, the health data described in section 2; we only receive it and never write anything to your Garmin account. Garmin receives from us only what it takes to connect, confirm and end the link; we never send Garmin your health data. Garmin’s own privacy policy governs the data in Garmin Connect (Garmin Connect Privacy Policy). You can disconnect Garmin in MyBodyAI, or remove MyBodyAI in Garmin Connect, at any time; either one ends the access and deletes what came through it (section 6).
• Open Wearables API — our own middleware service that securely connects to wearable platforms via OAuth 2.0. Hosted on the same EU server.
• Health Connect (Android) — our Android app is published on Google Play. With your explicit permission it reads health data from Health Connect on your phone: the categories in the table above, your height, and for workouts their speed, power and elevation gain, and with a separate permission also while the app is closed, and with another one also data from before you first allowed it, up to 90 days back. That data stays on our servers and is never shared. Using the phone as a data source can be switched off in Settings.
• Sentry — error monitoring service (hosted in EU Frankfurt). Captures technical error reports (stack traces, browser type, URL) to help us fix bugs. No health data or personal identifiers are included in error reports. Sentry Privacy Policy.
• E-mail delivery (Forpsi, Czech Republic) — transactional e-mails and the weekly summary are sent through our mail provider's SMTP servers. The provider handles your e-mail address and the message body, which in the weekly summary contains your own scores. You can switch these e-mails off in Settings.
• Open-Meteo (Germany) — weather and air-quality lookups behind the "when and where to train" advice. We send coordinates rounded to roughly 1 km, and, if you search for a place by name, that search text. No name, no e-mail, no health data. Saving a location is optional and can be cleared in Settings.
• BigDataCloud (Australia) — turns coordinates into a place name so the app can show where a reading came from. Receives only coordinates rounded to roughly 1 km, no identifier. It sits outside the EEA, so the transfer relies on Standard Contractual Clauses, and it happens only when you set a location.
• Telegram (error alerts) — server error reports go to a private channel only the operator can read, so an outage is noticed within minutes. An error line can contain an account e-mail address. No wearable or health measurements are sent.
• GitHub (encrypted off-site backups) — an encrypted copy of the database backups is kept in a private repository so that losing the server is not losing your data. Archives are AES-256 encrypted before they leave the server; GitHub cannot read them.
• Push delivery (Google FCM for the Android app, browser push services for web push) — if you turn notifications on, the delivery service receives your device token and the short notification text, which can name a health state such as low recovery. Notifications stay off until you enable them, and turning them off removes the token.
• Play Integrity (Google) — when the Android app signs this phone in, Google Play services on the phone hand it a signed statement that the app is the one published on Google Play and that the phone's system is intact, and we send that statement to Google to have it read. It carries the app's package name and signing certificate, an attestation of the phone and your Google Play licence status for the app; no health data, and nothing that identifies you to us beyond the phone already signed in. Google keeps it for a fixed period under its own terms. We record one word per phone (recognised, modified, unrecognised) and nothing else.

We may disclose personal data to law enforcement or regulatory authorities only when required by law. We will notify you of such requests where legally permitted.

6. Provider-Specific Data Handling

Each wearable data provider has specific requirements for how we handle your data. We comply with all provider terms and policies:

The Strava integration was retired on 28 July 2026 and every activity record we had received from Strava was deleted from our systems. While it ran, Strava data was shown only to the user who authorized the connection, never to anyone else, and data that became unavailable was removed from our cache immediately.

In addition to GDPR breach notification requirements (72 hours to supervisory authority), we will notify affected data providers within 24 hours of discovering a security breach, as required by their respective terms.

7. International Data Transfers

Your data is primarily stored on servers within the European Union. When data is transferred outside the EEA, we rely on EU Standard Contractual Clauses (SCCs) or adequacy decisions to ensure an adequate level of protection.

8. Data Retention

After account deletion, your personal data is permanently erased from our live systems, and from the backup archives held on the server, within 30 days. Three things named in the table above outlive it: the billing records Czech tax law makes us keep for ten years, the administrator log of who touched your data, and the one-way fingerprint described below. The encrypted off-site copy at GitHub also keeps earlier archives in its version history, so a backup taken before your deletion can survive there for longer. Those archives are AES-256 encrypted before they leave the server, GitHub cannot read them, and they are used only to rebuild the service after the loss of the server. Anonymized and aggregated data (which can no longer identify you) may be retained indefinitely for statistical purposes.

That fingerprint deserves its own paragraph: it is a one-way (keyed hash) form of your e-mail address, recorded when you receive the free trial. It cannot be turned back into an address and is never used to contact you or to rebuild an account. Its only purpose is to keep the free trial at one per person, so that deleting an account and registering again does not hand out another one. We keep no e-mail address, name or account identifier alongside it. There is one exception. If you delete an account yourself within 24 hours of signing up and before any of your data has arrived, its free trial never started, so the fingerprint is deleted together with the account and a new registration receives the trial.

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (TLS 1.2+)
• Password-based authentication with secure hashing, and time-limited email verification codes for registration and password recovery, plus optional Google Sign-In (OAuth 2.0 / OpenID Connect)
• Optional two-factor authentication (TOTP authenticator apps and WebAuthn passkeys) with one-time recovery codes
• OAuth 2.0 for wearable integrations — we never store your third-party credentials
• Regular security reviews and updates
• Breach notification to UOOU within 72 hours per GDPR Article 33, and to affected data providers within 24 hours
• OAuth tokens and API credentials encrypted at rest

10. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Access (Art. 15) — obtain a copy of your personal data
• Rectification (Art. 16) — correct inaccurate data
• Erasure (Art. 17) — request deletion of your data ("right to be forgotten")
• Restriction (Art. 18) — restrict processing in certain circumstances
• Portability (Art. 20) — receive your data in a structured, machine-readable format
• Objection (Art. 21) — object to processing based on legitimate interest
• Withdraw consent (Art. 7(3)) — withdraw consent for health data processing at any time, without affecting prior processing
• Complaint — lodge a complaint with UOOU or the supervisory authority of your EU member state

To exercise any of these rights, contact us at support@aiclysm.com. We will respond within 30 days.

You can also exercise these rights directly in the app: go to your Dashboard and use Export My Data to download all your data in JSON format, or Delete Account to permanently erase your account and all associated data.

11. If You Live in the United Kingdom

The United Kingdom left the EU and took the same rules into its own law, the UK GDPR together with the Data Protection Act 2018. Every right in Section 10 is yours in the same form and on the same legal bases, and a request from the United Kingdom is handled exactly like a request from inside the EU.

Two things are specific to you. Your supervisory authority is the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · ico.org.uk, and you may complain to it instead of to the Czech UOOU named in Section 1. And the servers that hold and process your data are in the European Economic Area, which the United Kingdom recognises as offering an adequate level of protection, so nothing further is required of you for it to reach us; where something does travel beyond the EEA, Section 7 says on what basis.

12. If You Live in California

California gives its residents their own rights over personal information, under the California Consumer Privacy Act as amended by the California Privacy Rights Act. A sole trader of our size is below the revenue and volume thresholds that make those rules binding, so what follows is our own commitment rather than a duty imposed on us. It is written here because the answer would be the same either way, and because you should not have to guess.

In the categories California uses, we collect: identifiers (your email address and account identifier, and, if you sign in with Google, your name and Google account identifier); commercial information (which subscription you hold and whether it is paid, which Stripe keeps for us); internet and network activity (which screens of the app you open, your device and browser, and server access logs); coarse geolocation, derived from your IP address to the level of a city and never a precise position; and sensitive personal information, which here means health data: heart rate and its variability, sleep, activity, breathing, blood oxygen, body composition, blood pressure, temperature, and everything we compute from them. Section 2 has the detail, Section 4 says what each kind is for, and Section 8 says how long it stays.

California lets you limit how sensitive personal information is used. Ours has a single use: producing the health indices and insights you opened the app to see. We do not use it to infer characteristics about you for anyone else’s purposes, and we disclose it to no one for a purpose you would have cause to limit. There is no secondary use to switch off, which is why you will not find a switch.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We have not done either in the twelve months before the date at the top of this page, and we have nothing to do it with: the site carries no advertising cookies and nothing that follows you between sites. We do not knowingly sell or share the personal information of anyone under 16, and the service is not intended for anyone under 15 at all (Section 14).

Your rights are to know what we hold and what we do with it, to receive a copy, to have it corrected, to have it deleted, to limit sensitive personal information, and not to be treated differently for using any of them. We run no loyalty programme, and nothing about your account or your price changes because you asked. Export My Data and Delete Account in the app answer the first two and the fourth immediately, without passing through anyone. For anything else, write to support@aiclysm.com. We reply within 45 days and will tell you if we need the further 45 days California allows. You may appoint an authorised agent to ask on your behalf; we will ask for written proof of the appointment and confirm it with you directly.

Requests are verified the only way we can verify them: they must come from the email address the account uses, or from inside the app while you are signed in. We hold no other identifying information to check you against, and we will not start collecting some in order to run a check. Your data is held on servers in the European Union, so using MyBodyAI from California means it is transferred there; Section 5 names the recipients that sit anywhere else, and Section 7 says on what basis anything travels beyond the EEA. If you live in Washington, Nevada or Connecticut, your health data has a separate document of its own: the Consumer Health Data Policy.

13. Automated Decision-Making & Profiling

MyBodyAI uses automated processing to compute health indices (such as Recovery, Stress Load, Body Alert, Biological Age) from your wearable data. These scores are generated algorithmically based on published research and personalized to your historical data. No decisions with legal or similarly significant effects are made solely based on automated processing. All outputs are informational wellness insights, not medical diagnoses. You have the right to request human review of any automated assessment by contacting us.

14. Children's Data

MyBodyAI is not intended for users under 15 years of age (in accordance with Czech law). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

15. Cookies

The cookies we set ourselves are strictly necessary for the service to work: a session cookie and your language preference. We set no advertising cookies and nothing that follows you between sites, and no consent banner is required for strictly necessary cookies under the ePrivacy Directive. Shop links go straight to the brand, with no affiliate network in between that could set a cookie.

We use Umami, a privacy-focused, self-hosted web analytics tool, to understand website usage. Umami sets no cookies, stores no IP address and no account identifier, and does not track visitors across websites. It does record, per visit, an approximate location derived from the IP address — country, region and city — together with the browser, operating system, device type, screen size and language. Inside the app it also records a small number of named events, such as agreeing to connect a wearable or reaching a step of the first-run guide; these carry no account identifier and cannot be traced back to you. All of it is stored on our own servers within the EU, is not shared with anyone, and is deleted after 13 months.

Separately from Umami, and only for accounts that are signed in, we record a handful of milestones from your first run: when the account was created, when it first signed in, which first-run screens were reached, when a data source was connected and how that attempt ended, and when the first day of data and the first result arrived. These are tied to your account, so unlike Umami they are not anonymous. They exist so we can see where people get stuck setting the app up. No page views, no free text, no tracking across sites. They are included in a data export and are deleted with the account.

Affiliate Links

Shop links on this site lead straight to the brand. No affiliate network sits in between, so none of them sets an attribution cookie and no purchase earns us a commission. We do not share your MyBodyAI account data with any shop. See our Affiliate Disclosure.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before taking effect. The "Last updated" date at the top of this page will be revised accordingly.

When a change affects what we do with your data, we ask you to agree again in the app and we record which version of this policy you agreed to. A revision that only adds information — such as Sections 11 and 12, which describe rights that residents of the United Kingdom and California already had — moves the date at the top of this page without asking you to agree to anything again. A correction of a sentence that described what we do inaccurately, where what we do stays the same, is handled the same way: on 24 September 2026 this policy stopped saying that disconnecting a device deletes its data, which it never did; that data stays until you delete your account or ask us to delete it. On 25 September 2026 this policy began to name the apps that recorded your values, which the Android app has sent along with them since July 2026; what we do with them did not change. On 1 October 2026 the list of what we read through Google Health gained distance and active minutes: they belong to the activity data this policy already listed for Google Health, and from that day we read them from Google Health as we did from the Fitbit Web API. On 5 October 2026 this policy began to describe in full what the Garmin watch app sends: besides stress and Body Battery, Garmin's recovery time (since 1 September 2026) and, for a morning HRV measurement, its beat-to-beat intervals (since 13 September 2026); what we do with them did not change. On 6 October 2026 the list of what we read through Google Health gained skin temperature during sleep and VO2max: this policy already listed both for Fitbit, and from that day we read them from Google Health as we did from the Fitbit Web API. On 7 October 2026 the shop links on this site stopped carrying affiliate codes: they now lead straight to the brand, and no affiliate network can set a cookie through them; what we do with your MyBodyAI data did not change. A change that only narrows what we keep is handled the same way: on 9 October 2026 the free-trial fingerprint stopped outliving an account its owner deleted within 24 hours of sign-up, before any data arrived. On the same day the paragraph on Health Connect began to name what the Android app reads there beyond the table: your height, the speed, power and elevation gain of workouts, and reading while the app is closed; what we read did not change. Another change that only narrows what we keep: on 11 October 2026 data received from Oura began to be deleted together with everything calculated from it, as Oura's terms require, at once when you disconnect Oura and, when Oura stops letting us in on its own (for example after you revoke the access in the Oura app), once three days have passed since then without a new connection; data from your other devices stays as before. On 11 October 2026 this policy also began to describe the model and the technical record of morning HRV attempts that the Garmin watch app sends from version 2.14, and how long we keep that record; the health data the watch sends did not change. Another change that only narrows what we keep: on 12 October 2026 we dropped the three days, so when Oura stops letting us in on its own, its data is deleted as soon as we learn of it, because Oura's terms ask for processing to stop without delay. On 14 October 2026 the paragraph on Health Connect began to name reading data from before you first allowed it, up to 90 days back, which has its own permission; the categories we read did not change. On the same day COROS joined the sources this policy names: it is one more device you can choose to connect, the health data we read from it belongs to the categories this policy already listed for your other devices, and what we do with that data and how long we keep it did not change. On 22 October 2026 the Garmin Connect API joined the sources this policy names: Garmin was already a source through the export you upload, the health data the API sends belongs to the categories this policy already listed, and what comes through it is deleted when you disconnect it; what we do with your data did not change. On the same day we limited how long a Garmin delivery that failed to process is kept, to 14 days. On 23 October 2026 this policy began to describe the messages you send us through the Contact form (Section 2.6) and how long we keep them; it adds information and does not change what we do with the data in your account. On the same day the description of Biological Age began to name its six domains: the two that Garmin's stress and Body Battery readings fed left the calculation that day, and the data we read did not change. Every version of this policy stays published under the date it was issued at aiclysm.com/privacy/, so the text you agreed to is always there to read.

17. Contact

Aiclysm
Prague, Czech Republic
Email: support@aiclysm.com
Web: aiclysm.com