1. Who we are
Kay Uwe Andree operates Spine & Full Body Fitness and decides how and why your personal data is processed, which makes us the data controller. You can reach us through the support channel listed in the app.
2. Data we collect, why, and our legal basis
- Account data (email, display name, login credentials) — to create and secure your account. Legal basis: performance of our contract with you.
- Profile and health data (age, sex, height, weight, activity level, goal, dietary preferences, health conditions, mobility limitations, medications, supplements, preferred activities, training places, equipment) — to generate your assessment, meal plan and fitness plan. Legal basis: your explicit consent, which you can withdraw at any time; withdrawing means we can no longer generate personalised plans.
- Body photos and food photos — for AI analysis of body composition and nutrition. Legal basis: your explicit consent.
- Usage and device data (app interactions, error reports, IP address) — to keep the service secure and improve it. Legal basis: our legitimate interest in a reliable, secure product.
- Purchase records (plan, status, subscription identifiers) — to give you access to what you paid for. Legal basis: contract performance and legal obligations such as tax record-keeping. Card and billing details are collected by Paddle, not by us.
We do not sell your personal data, and we do not use your body photos to train AI models.
3. Body photos and health information
Body photos are stored in a private bucket accessible only to you, and are sent to an AI model for analysis. Health information and photos are special category data; we process them only with your explicit consent and only to deliver the features you request. You can delete your photos at any time by deleting your account or contacting support.
4. AI processing
Some features send your profile details and photos to AI models to generate assessments, plans and nutrition estimates. Outputs are informational suggestions only and are not medical advice — see our Medical Disclaimer. No decision with legal or similarly significant effects is made about you by automated means.
5. Who we share data with
- Paddle.com — our Merchant of Record and reseller. Paddle receives the data needed to sell the product to you: your email, billing and transaction data, subscription status and tax/location information, and it handles payments, invoicing, tax compliance, subscription management and refunds. See Paddle's privacy notice.
- Service providers / subprocessors — hosting, database and file storage, authentication, and AI model providers, acting on our instructions.
- Professional advisers — legal and accounting, where necessary.
- Authorities — where required by law.
- Other members — only content you deliberately post to the community, such as posts, comments and your display name and avatar.
Where data is transferred outside the UK/EEA, we rely on adequacy decisions or Standard Contractual Clauses.
6. Retention
We keep your data while your account is active. When you delete your account we remove your profile, plans and photos within 30 days, except records we must keep by law (for example transaction and tax records, typically 7–10 years, held largely by Paddle). Data no longer needed is deleted or anonymised.
7. Your rights
Depending on where you live you have the right to access, correct, delete, restrict or object to processing, to data portability, and to withdraw consent at any time without affecting prior processing. You can export or delete your data from your profile settings, or contact us; we respond within one month. If you are in the UK/EEA you may also complain to your local supervisory authority.
8. Security and cookies
We apply appropriate technical and organisational measures, including encryption in transit, access controls and row-level database security so members can only reach their own records. We use essential cookies and local storage to keep you signed in and remember preferences; we do not use advertising cookies. Paddle may set cookies necessary for checkout and fraud prevention.
9. Children
The app is available from age 12. Members under 16 need a parent or guardian to review and consent to this notice and our Terms before uploading photos or using AI plans; that consent is recorded during onboarding.
10. Changes and contact
We may update this notice and will communicate material changes in the app or by email. For privacy requests, contact Kay Uwe Andree through the support channel listed in the app.