Privacy Policy

Body By Numbers ("we," "our," or "us") provides health assessment tools. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

Our consumer tiers (Free, Snapshot, Membership) are general wellness products and do not create a clinical or provider-patient relationship. Health information you provide through those tiers is consumer health data, governed by our Consumer Health Data Privacy Policy, which controls for health-data specifics.

Body By Numbers Precision, a separate clinical product delivered through a medical practice, is not part of this service and has its own privacy notice.

Account and Profile Information

We collect the following information about you:

• Profile Information: Name, email address, date of birth, gender
• Health Information: Assessment inputs, scores, grades, and Biological Age. What we collect, store, and discard is described in detail in the Consumer Health Data Privacy Policy.
• Usage Information: Assessment history, login times, and system interactions

Technical Information

We automatically collect certain technical information:

• IP address
• Browser type and version
• Device information
• Usage patterns on our homepage and pricing page, measured with Google Analytics. Analytics runs only on those two pages. It does not run on the free grade or any signed-in page, and never receives your answers, numbers or results.

We use your information to:

• Provide the service: compute and display your assessments, scores, and reports
• Operate and improve the platform: quality, support, and product development
• Email you: service emails about your account, purchases and reports; reminders that come with a paid plan, timed by your grades (you can turn these off); and, only if you opt in, tips, offers and a monthly letter. Every marketing email has a one-click unsubscribe, and you can change your choices at any time on the Email choices page or in Settings.
• Security: protect against fraud, unauthorized access, and security threats
• Legal compliance: comply with applicable law

We do NOT:

• Sell your personal or health information
• Use your health information for marketing without your explicit consent
• Share your health information except as described in this policy or the Consumer Health Data Privacy Policy

We implement comprehensive security measures to protect your information:

• Encryption: All data encrypted at rest and in transit using industry-standard encryption
• Access Controls: Role-based access controls limit who can view your information
• Audit Logging: All access to your information is logged and monitored
• Session Security: Automatic session timeout after 30 minutes of inactivity
• Account Security: Strong password requirements and account lockout after failed login attempts
• Regular Reviews: Periodic access reviews to ensure appropriate access
• Secure Infrastructure: Data stored on secure cloud infrastructure (Firebase/Google Cloud)

We may disclose your information only in these circumstances:

• Service providers: vendors that host and operate the platform for us. Google Cloud/Firebase hosts the service and stores your account and results; Stripe processes payments and receives payment and identity information only, never your results; Resend delivers our emails, some of which include your grades (for example a member's monthly check-in); and Google Analytics measures visits to our homepage and pricing page. Each handles information only to provide its service to us.
• Legal requirements: when required by law, court order, or regulatory requirement
• With your consent: when you provide explicit authorization

We do not disclose your health information for marketing, and we do not sell it. Sharing of consumer health data requires your separate consent, as described in the Consumer Health Data Privacy Policy.

You have the following rights regarding your information, exercised directly in the product:

• Access and export: download everything we hold about you from Settings (Export my data)
• Correction: edit your profile in Settings, or re-run an assessment to correct inputs
• Deletion: delete your account and data from Settings (removed from live systems immediately, out of encrypted backups within 35 days)
• Withdraw consent: pause collection of health data from Settings
• Appeal: contact us if we decline a request; we respond within 45 days

Health-data specifics are governed by the Consumer Health Data Privacy Policy.

We retain your information while your account is active. When you delete your account, your data is removed from live systems immediately and falls out of encrypted backups within 35 days. Consent records are retained as compliance evidence; they identify you only by an internal account ID.

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Updating the version identifier shown at the top of this page
• Notifying you via email if you have an account (for material changes)

Your continued use of our platform after changes become effective constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

Complaints: If you believe your privacy rights have been violated, please contact us using the information above. Depending on where you live, you may also have the right to raise a complaint with your state consumer protection authority or attorney general.