Hot Body — Privacy Policy

Your privacy matters to us. This Privacy Policy explains what information Hot Body collects, how we use it, who we share it with, and the choices you have. By using the Hot Body mobile application and related services (the "Service"), you agree to the practices described in this policy.

1. Information We Collect We collect the following categories of information:

Account information: when you register, we collect information needed to create and secure your account, such as your email address, username, and authentication credentials.

Profile information: details you provide about yourself, such as your name, date of birth or age, sex, height, starting weight, goals, and preferences.

Workout and check-in data: information you record while using the Service, including workout logs, sets and repetitions, exercises performed, body measurements, progress check-ins, and personal notes.

Nutrition data: meals and foods you log (including by photo or voice), your nutrition targets and macro calculations, and any meal plans generated for you.

Bloodwork and lab results: if you upload a lab report, we extract and store the test results and values it contains so they can be tracked over time and used to answer your questions through the Service's AI coaching feature.

Photos: progress photos you choose to upload, which are stored privately and associated with your account.

AI chat data: the messages you send to and receive from our AI coaching assistant, and any photos or documents you attach in that conversation (for example, a bloodwork report).

Purchase information: when you make a purchase, our payment processor collects and processes your payment details. We receive limited transaction information such as confirmation of payment and subscription status, but we do not store your full payment card number.

Technical and usage information: basic information generated automatically as you use the Service, such as device and app version details and diagnostic data used to operate and improve the Service.

2. How We Use Your Information We use the information we collect to: create and maintain your account; provide, personalize, and improve the Service; deliver workouts, programs, nutrition tracking, and AI-powered coaching; process purchases and manage subscriptions; provide customer support and respond to your requests; maintain the security and integrity of the Service; and comply with our legal obligations. We do not sell your personal information. We do not use your health, fitness, nutrition, or bloodwork data for advertising or marketing purposes, and we do not use it to make insurance, credit, or employment decisions about you.

3. AI-Powered Features Hot Body offers optional AI-powered features, including an AI coaching assistant ("Holly") and AI-assisted meal logging from photos or voice. These features are powered by Click Digital, our AI technology partner. When you use these features, the information involved — which may include your chat messages, photos or documents you share (such as a bloodwork report), and, when the assistant looks it up to answer your question, your workout, nutrition, weight, check-in, and bloodwork data — is sent to Click Digital to generate a response. Click Digital maintains administrative, technical, and physical safeguards consistent with HIPAA standards for the health-related information it processes on our behalf, and may retain conversation history to provide ongoing, personalized coaching.

By choosing to use these AI-powered features, you consent to this data being shared with Click Digital for that purpose. You can decline simply by not using the AI coaching or AI meal-logging features — the rest of the Service remains fully available without them. Contact us through the support options in the app if you have questions about this processing.

4. Third Parties We Share With We share information with service providers who process it on our behalf and under our instructions. We require every service provider we share your information with to protect it to a standard equal to or greater than what is described in this policy. These providers include:

Supabase, which provides our database and authentication infrastructure and stores your account, profile, workout, check-in, nutrition, and photo data.

Stripe, which processes payments and manages subscriptions. Stripe handles your payment details under its own privacy policy.

Click Digital, our AI technology partner described above in "AI-Powered Features."

Resend, which delivers transactional emails such as account and welcome messages.

Workout demonstration videos are delivered through an embedded YouTube player; your interaction with that player is subject to Google's own privacy practices.

We may also disclose information if required to do so by law, to enforce our Terms, to protect the rights, safety, or property of Hot Body or others, or in connection with a merger, acquisition, or sale of assets. Aside from these cases and the service providers above, we do not share your personal information with third parties for their own marketing purposes.

5. Data Storage and Retention Your data is stored using our infrastructure providers described above. We retain your personal information for as long as your account is active or as needed to provide the Service, and thereafter as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. When your information is no longer needed, we take reasonable steps to delete or anonymize it.

6. Security We use reasonable technical and organizational measures designed to protect your information against unauthorized access, loss, misuse, or alteration, including encryption in transit, authentication controls, and access restrictions such as row-level security so that your private data — including progress photos and bloodwork — is accessible only to you and authorized administrators. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

7. Your Rights and Choices You can access and update much of your profile information directly within the Service. You may request access to, correction of, or deletion of your personal information, and you may delete your account, which removes your personal data from our systems except where we are required to retain it by law. Your conversation history with Click Digital is retained separately to provide the AI coaching feature and may not be deleted immediately when you delete your account; contact us if you would like it removed sooner. Depending on where you live, you may have additional rights under applicable data protection laws, such as the right to object to or restrict certain processing or to request a copy of your data. To exercise these rights, use the account controls in the Service or contact us through the support options available in the app.

8. Children's Privacy The Service is intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18 years of age. If we learn that we have collected personal information from a child, we will take steps to delete it. If you believe a child has provided us with personal information, please contact us so we can address it.

9. Changes to This Policy We may update this Privacy Policy from time to time. When we make material changes, we will update the "last updated" date and, where appropriate, provide additional notice within the Service. Your continued use of the Service after the changes take effect constitutes acceptance of the revised policy.

10. Contact If you have questions or requests regarding this Privacy Policy or your personal information, please contact us through the support options available within the Service.