Privacy Policy

The controller of your personal information is + SAUDE NUTRICAO INTEGRATIVA LTDA, a company registered in Brazil (CNPJ 45.937.139/0001-02), Rua Coronel Joaquim dos Santos, 736, Ceu Azul, Belo Horizonte, MG, 31580-010, Brazil.

• Privacy requests and our data protection officer (the Encarregado under the LGPD and the DPO under the GDPR): contato@bodyapp.com.br
• Representative in the European Union (GDPR article 27): not appointed yet. We will appoint one before we offer the service in the European Union and publish it here.
• Representative in the United Kingdom (UK GDPR article 27): not appointed yet. We will appoint one before we offer the service in the United Kingdom and publish it here.

• Account information: name or nickname, email, username, password (stored in protected form), language, time zone and state or region.
• Health information you enter: medication and dose you log, weight, measurements, symptoms, food logs and plate photos, water, workouts, progress photos and goals. Our Consumer Health Data Privacy Policy covers this information in detail.
• Messages: your conversations with the AI coach in the app.
• Quiz: if you take the quiz on our site, your answers, email, the name you give us (optional) and the link to your plan.
• Payment information: collected by Hotmart, which processes your payment. From Hotmart we receive your name, email, the plan, the amount, the transaction and the subscription status. We never receive your full card number.
• Technical information: device type, browser, app version and basic logs that keep the service secure.
• Cookies and similar technologies: see our Cookie Policy.

• To create your account and provide the features you ask for, such as logs, reminders and summaries. Ground: performing our contract with you (LGPD article 7, V; GDPR article 6(1)(b)).
• To process the health information you enter. Ground: your specific and explicit consent, given separately (LGPD article 11, I; GDPR article 9(2)(a)). You can withdraw it at any time.
• To answer you with AI features that use your own data. Ground: consent, which you can turn off in your profile.
• To send app notifications and marketing emails. Ground: your consent, which you can withdraw for each one.
• To manage your subscription with Hotmart, keep tax and accounting records and answer authorities. Ground: contract and legal obligations (LGPD article 7, II and V; GDPR article 6(1)(b) and (c)).
• To keep the service secure, prevent fraud and abuse and improve it with information that does not identify you. Ground: our legitimate interests, balanced against your rights (LGPD article 7, IX; GDPR article 6(1)(f)). Health information is never used on this ground.
• To exercise or defend our rights in legal proceedings (LGPD article 7, VI, and article 11, II, d; GDPR article 9(2)(f)).

When you use AI features, the content needed for the answer is sent to our AI provider (Google, through its paid API, in the United States). Under our agreement, this content is not used to train their models. AI features do not make decisions with legal or similarly significant effects on you, and you can ask a person to review any answer through Support. You can turn AI features off in your profile.

We share information only with companies that help us run My Body Diet, under contracts that limit how they can use it, and with Hotmart for payments:

• Supabase (database and file storage, United States)
• Vercel (website hosting, United States)
• Google (AI features, United States)
• Resend (email, United States)
• Hotmart (payments and subscriptions, Brazil and Netherlands). Hotmart handles payment data under its own privacy policy and never receives your health information from us.

We may also share information when the law requires it, to protect people from harm, or as part of a sale or merger of the business, with notice to you. We do not sell your personal information. On public pages only, measurement and advertising cookies from Google (Google Analytics and Google Ads) and Meta may record visits and purchases so we can measure our ads, as described in our Cookie Policy, and you can opt out at any time. We never share health information or anything you log in the app for advertising.

We operate My Body Diet from Brazil, and our service providers store and process data mainly in the United States. When information moves between countries, we protect it with the safeguards the law requires:

• under the LGPD, the standard contractual clauses approved by the Brazilian data protection authority (ANPD Resolution 19/2024) or another mechanism of article 33;
• under the GDPR and UK GDPR, the standard contractual clauses of the European Commission and the UK addendum, or the EU-US Data Privacy Framework when the provider is certified.

You can ask for a copy or a summary of these safeguards at contato@bodyapp.com.br.

We do not use advertising pixels or advertising tools inside the app or on any screen that asks about medication, weight or symptoms, and we never share health information with advertising platforms. On public pages, optional cookies are used only as described in our Cookie Policy. Visitors from the European Economic Area, the United Kingdom and Switzerland see a banner first, and nothing optional runs before they accept. We honor the Global Privacy Control signal as a request to opt out.

We keep your information while your account is open. When you delete your account, we delete your information, except what the law requires us to keep, such as tax and payment records, which we keep for the period the law requires (in Brazil, generally 5 years).

Quiz and email tips: if you took the quiz and asked for your plan without subscribing, we keep your answers, email and plan link for 30 days. If you checked the box to get tips by email, we keep this information for as long as you stay subscribed, so we can send one tip a day and keep your plan link working. When you unsubscribe (through the link in any email), we delete it within 30 days and keep only your email on our do-not-contact list, so we don't write to you again. If you subscribe to the app, the tips stop and the information moves to your account.

Wherever you live, you can:

• confirm whether we process your information and access it;
• correct information that is incomplete, inaccurate or out of date;
• get a copy in a portable format;
• ask us to delete it, or to anonymize, block or delete information that is unnecessary or excessive;
• know who we share it with;
• withdraw consent, and be told what happens if you do not give it;
• object to processing based on legitimate interests and ask us to restrict processing;
• ask for a review of decisions made only by automated processing.

If you live in a US state with a privacy law, you also have the right to know, correct and delete, to opt out of sale, targeted advertising and profiling (we do not sell your information or build profiles; to opt out of targeted advertising, use Cookie settings at the bottom of any public page or the Global Privacy Control signal) and to appeal our decision.

Most of this is available on the Privacy and my data page in your account. You can also write to contato@bodyapp.com.br. We answer within 15 days (LGPD), one month (GDPR and UK GDPR) or 45 days (US state laws), and we may need to confirm your identity first. We do not discriminate against you for using your rights.

If you are not happy with our answer, you can complain to the Brazilian National Data Protection Authority (ANPD), to the data protection authority of your country in the European Economic Area, to the UK Information Commissioner's Office (ICO) or to the attorney general of your US state. We would appreciate the chance to fix the problem first at contato@bodyapp.com.br.

We use encryption in transit, access controls and separation of each user's data. No system is perfectly secure. If an incident may cause relevant risk or harm to you, we will notify you and the competent authorities within the deadlines the law sets, such as 3 business days for the ANPD in Brazil and 72 hours for European authorities.

My Body Diet is a consumer wellness app, not a health care provider or a health plan, so HIPAA generally does not apply to it. Under the LGPD, health information is sensitive personal data, and under the GDPR it is a special category of data. We protect it under those laws and under the US state consumer health data laws described in our Consumer Health Data Privacy Policy.

My Body Diet is only for adults 18 and older. We do not knowingly collect information from children or teenagers.

We will tell you about important changes to this policy before they take effect. Questions or requests:

+ SAUDE NUTRICAO INTEGRATIVA LTDA CNPJ 45.937.139/0001-02 Rua Coronel Joaquim dos Santos, 736, Ceu Azul, Belo Horizonte, MG, 31580-010, Brazil Data protection officer: contato@bodyapp.com.br