Legal
Privacy notice.
Last updated: 18 October 2026
This notice explains how Bodacious Club Ltd uses your personal information when you visit bodacious.club, join the Bodacious Club programme and use our web app. Our iPhone app has its own privacy policy, in the app, for features only it offers (such as Apple Health). US residents should also read our consumer health data policy.
In short: we use your information to deliver and personalise your programme, and nothing else that would surprise you. Health information is used only with your explicit consent. We never sell your information or use it for advertising. Our AI coaches run on Google’s Gemini models. You can ask to see, correct or delete your information at any time.
1. Who we are
Bodacious Club Ltd (company number 15963213, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom) is the controller of your personal information. Contact us about privacy at fithappens@bodacious.club or by post at our registered office.
2. What we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email address, profile photo, account ID | Google or Apple when you sign in; you |
| Purchase and delivery | Market, price paid, payment status, billing address, delivery address, order and refund history (not your full card number) | Stripe, Klarna, you |
| Health check | Health conditions, pregnancy, medications (including weight-loss medication) and anything you add in the optional note | You |
| Programme | Goals, preferences, schedule, workouts, meals and nutrition, weight, body measurements estimated from photos, training performance, Gains | You, your smart scale, our apps |
| Coaching | Messages with Boddy and Bodessa, voice calls (processed live), call transcripts if you agree, booked calls with our team | You |
| Consents and choices | Terms accepted, health-data consent, start-now request, marketing choice, call and transcript choices | You |
| Technical | Device and browser type, IP address, security and error logs | Your device |
3. How we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating your account, taking payment, delivering your scale and providing the programme you bought | Contract |
| Checking the programme is safe for you and tailoring it to your health | Your explicit consent (see section 4) |
| AI coaching, progress analysis and adapting your training and nutrition | Contract; explicit consent for health information |
| Saving call transcripts | Your consent |
| Service messages about your membership, scale and programme | Contract |
| News and offers by email | Your consent — only if you opt in, and you can unsubscribe at any time |
| Keeping our services secure, preventing fraud and misuse, and improving our services | Our legitimate interests in running a safe, reliable service |
| Keeping tax and accounting records, and handling legal claims | Legal obligation; legitimate interests |
4. Health information
Information about your health, body and medication is special category data. We use it only with your explicit consent, which you give by ticking the consent box on the health check, and only to check the programme is safe for you, to tailor your programme and coaching, and to measure your progress. We never use it for advertising and never sell it.
You can withdraw your consent at any time by emailing fithappens@bodacious.club. We will then stop using your health information and delete it, unless we must keep a record for a legal claim. Because we cannot safely provide the programme without it, withdrawing consent ends your membership; we refund the full weeks remaining.
The automated health check
The health check uses fixed rules to decide whether the programme is safe to start now, needs a clinician’s agreement first, or isn’t suitable. For example, some heart conditions or recent surgery mean we ask for a clinician’s agreement, and some conditions mean the programme isn’t suitable. If you add a note, Google’s Gemini model reads it to flag anything our team should look at. If the check declines you or asks for clearance, you can ask a person on our team to review the decision, tell us anything you think we missed, and challenge the outcome — email fithappens@bodacious.club.
Body measurements from photos
When you take a body scan, your front and side photos are sent securely to our processing service, used to estimate your body measurements, and then deleted. Your front photo is also used to create the image of you shown with your scan, which we keep with your scan.
5. AI
Boddy and Bodessa are AI coaches built on Google’s Gemini models, which process your messages, voice and programme information to reply to you. Voice calls are processed live and not recorded; we keep a transcript only if you agree. Our team can see your coaching history so they can oversee your programme. Apart from the health check (section 4), AI does not make decisions that have a legal or similarly significant effect on you.
6. Who we share it with
We share your information only with suppliers who help us run Bodacious, under contracts that require them to protect it and use it only on our instructions (except Klarna and Amazon, which are responsible for their own use, as the table explains), and where the law requires it. We do not sell your information or share it for advertising.
| Supplier | What for | Where |
|---|---|---|
| Google (Firebase, Google Cloud, Gemini, Workspace) | Sign-in, secure database, app services, AI coaching and voice calls, your body-scan image, calendar and video calls, address search when you enter your delivery address | UK (main database in London), with some processing in the US |
| Vercel | Hosting our website and web app | UK and US |
| Stripe | Taking payments and refunds | UK, EU and US |
| Klarna | Instalment payments, if you choose them (Klarna also acts as an independent controller for its credit decision) | EU |
| RevenueCat | Recording your membership so the iPhone app recognises it | US |
| Modal | Processing body-scan photos into measurements (photos deleted after processing) | US |
| HubSpot | Managing scale orders and customer support: your name, email and delivery address (never health information) | US |
| Amazon | Delivering your smart scale: we order it for you with your name and delivery address. Amazon is responsible for its own use of them, under its privacy notice | The country you live in |
| Customer.io | Sending service emails, and marketing emails unless you opted out | EU |
| Apple | Sign in with Apple, and in-app purchases made in the iPhone app | US |
We may also share information with professional advisers, with authorities where the law requires it, or with a buyer of our business, who would have to protect it in the same way.
7. International transfers
Some suppliers process information outside the UK, mainly in the US. When they do, we rely on the UK Extension to the EU–US Data Privacy Framework where the supplier is certified, or otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, which give your information equivalent protection.
8. How long we keep it
| Information | How long |
|---|---|
| Your account and programme | While you have an account. If you ask us to delete it, within 30 days (and from backups within 90 days). Accounts with no membership and no activity for 24 months are deleted. |
| Health check of someone who doesn’t join | 12 months, so a decision can be reviewed, then deleted |
| Messages with Boddy and Bodessa; call transcripts | Up to 12 months |
| Body-scan photos | Deleted once measurements are produced. The image made from your front photo is kept with your scan until you delete your account |
| Booked calls with our team | 12 months |
| Payment, refund and tax records; records of your consents and the terms you accepted | 6 years after the end of the financial year they relate to, as UK law requires and to handle any claim |
| Marketing choice | Until you unsubscribe, then a suppression record so we don’t email you again |
9. Keeping it secure
Your information is encrypted in transit and at rest, access is limited to people and systems that need it, payment events are signature-verified, and our suppliers are bound to protect it. No system is perfectly secure; if a breach affects you, we will tell you and the regulators as the law requires.
10. Your rights
You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw any consent at any time (this doesn’t affect what we did before). Email fithappens@bodacious.club. We may need to confirm your identity, usually by replying from the email address of your account. We respond within one month.
If you are unhappy with how we have used your information, please tell us first at fithappens@bodacious.club: we acknowledge privacy complaints within 30 days and respond without undue delay. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk).
If you live in the United States
Depending on your state, you may have rights to know, access, correct and delete your personal information, to withdraw consent for the use of your health information, and to appeal a decision we make about your request. Email fithappens@bodacious.club; if we decline your request, reply to ask for an appeal and we will respond within 45 days. We do not sell personal information, share it for targeted advertising, or use it for profiling with legal effects other than as described in section 4. Our consumer health data policy sets out the rights under Washington, Nevada and other state health-data laws.
11. Cookies and similar technology
We don’t use advertising or analytics cookies. We use only what the site needs to work: a cookie that remembers whether you see UK or US prices, Firebase storage that keeps you signed in, and browser storage that lets an interrupted workout resume. You can clear them in your browser settings, though sign-in will then stop working until you sign in again.
12. Children
Bodacious is only for adults aged 18 and over. We don’t knowingly collect information from anyone younger; if we learn we have, we delete it.
13. Changes to this notice
We will update this notice when how we use information changes, and change the date at the top. If a change materially affects you, we will tell you by email before it takes effect.