Bodylake

Privacy policy

Version 2026-10-20, in effect from 20 October 2026

Deutsche Fassung

At a glance

The rest of this policy says, for each thing we do, which data we use, why, on what legal basis and for how long. “GDPR” means the EU General Data Protection Regulation.

Who is responsible

The controller is Sascha Schwabbauer, trading as Bodylake, c/o POSTFLEX PFX-318-277, Emsdettener Straße 10, 48268 Greven, Germany. Phone +49 152 079 92 398.

For anything about your data, write to privacy@bodylake.com.

What we process and why

Visiting the website

When you open a page on bodylake.com, your browser sends its request to our servers, and they use your IP address to answer it. Our access log keeps the time, the kind of page, the response status and how long it took. It doesn’t keep your IP address, your browser or the exact address you opened. We also count how often each page is requested, without knowing who requested it.

Legal basis: our legitimate interest in delivering the website securely (Art. 6(1)(f) GDPR). Access log: 30 days.

Signing in to connect an AI app

When you connect an AI app, you sign in with your passkey on a page on bodylake.com. That page sets one cookie, __Host-blk_authz, which ties the sign-in to your browser so nobody else can finish it. It holds a random value, and we store only a hash of it.

Legal basis: carrying out the connection you asked for (Art. 6(1)(b) GDPR). The cookie is strictly necessary for it (§ 25(2) no. 2 of the German TDDDG), so it needs no separate consent. It expires after 10 minutes.

Your account

To create your account we use your email address and your passkey. We store your email address encrypted and find it by a keyed hash. From your passkey we receive its public key, a name and technical details such as its ID and a sign-in counter. The private key stays in your password manager, such as iCloud Keychain, and never reaches us. We also store which devices you use the app on, the app’s language (English or German, so that our emails and notifications reach you in it), your sign-in sessions (only as hashes of the tokens) and which version of the terms you accepted, and in which language. You need an email address and a passkey to have an account. The sign-up code we email you is valid for 10 minutes; a recovery ticket for 48 hours.

Legal basis: our contract with you (Art. 6(1)(b) GDPR); for security notices, our legitimate interest in keeping your account safe (Art. 6(1)(f) GDPR). We keep your account data until your account is deleted.

Your health data

With your permission, the Bodylake app reads the data in your Apple Health app and copies it to your private store: every type of data you allow in the Health app’s permission sheet, as raw samples, and Apple’s own daily totals. This can include workout routes with precise locations, ECG recordings, State of Mind entries, cycle tracking data, profile details such as your date of birth and biological sex, and information that other apps add to your Health records. Medications are copied only if you approve them in their separate prompt.

This is health data, a special category of personal data (Art. 9 GDPR). We process it so that the AI apps you connect can read it for you. Without health data Bodylake can’t do its job, but which types you share is up to you.

Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which you give on its own screen in the app before the Health app asks you which data to share, and our contract with you (Art. 6(1)(b) GDPR). We keep it until it is deleted under the rules in “When we delete your data”.

Uploading your history

The first copy of your history travels in upload files. We convert each file into your encrypted store and delete it straight after. A file that can’t be converted is deleted after 7 days at the latest.

Legal basis: as for your health data.

Connecting an AI app

When you connect an AI app, we show you which app it is and where it sends your data, and you allow it or not. We record your consent with the app’s name and address, and we keep the connection until you disconnect it or delete your account.

Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which also covers the transfer described in “Transfers outside the EU” (Art. 49(1)(a) GDPR).

Questions from your AI

When your AI app needs your data to answer you, it sends Bodylake a database query. Bodylake runs it on your data, read-only, and returns the result to that app. We don’t store the query or its result.

Legal basis: as for connecting an AI app.

The access log

For each time an AI app reads your data, we record the time, the app, what it did, whether it worked, how many rows it received, how long it took and a hash of the query, never the query or the result. You see this list in the app.

Legal basis: our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in detecting misuse (Art. 6(1)(f) GDPR). Kept for 90 days.

Protection against abuse

To stop people from guessing codes, flooding sign-ups or overloading the service, we count requests per IP address, per email address and per account. We use your IP address and email address only as keyed hashes inside such counters.

Legal basis: our legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR). A counter expires at the end of its window: after 1 hour, or after 24 hours for the daily limit on your AI’s queries.

Operational and security logs

Our services log what they do so we can run and secure them: a random account ID, event names, counts, durations and error names. These logs never contain your health values, your AI’s queries or their results, your email address or any token. A separate audit log records every use of the keys that protect your data.

Legal basis: our legitimate interest in running a secure service (Art. 6(1)(f) GDPR). Logs: 30 days; key audit log: 1 year.

Your subscription

Apple sells the subscription, in some countries on our behalf, and handles payment, Family Sharing, cancellation and refunds as an independent controller under its own privacy policy. For each subscription, we receive from Apple the plan (monthly or yearly), whether the free month is running, whether it is your own purchase or shared through Family Sharing, whether it renews and at what price, when it ends, refunds and the end of Family Sharing, and Apple’s transaction numbers. We never receive your name, Apple Account or payment details. A subscription covers one Bodylake account at a time.

Legal basis: our contract with you (Art. 6(1)(b) GDPR).

Push notifications

If you allow notifications, we send deletion warnings and notices about account recovery and new passkeys to your iPhone through Apple’s push service. For that we store a push token for your device. The notices have fixed texts and never contain health data.

Legal basis: our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in warning you about your account (Art. 6(1)(f) GDPR). We keep the push token until your account is deleted or Apple tells us it’s no longer valid.

Emails we send you

We email you sign-up codes, a confirmation of your contract when you sign up, and notices about your account, such as a new passkey or a recovery. About your subscription, we remind you 2 days before your free month ends, tell you when your access ends, and warn you 7 days before we delete your data. We send all of them through Amazon’s email service and don’t keep them after sending.

Legal basis: our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in warning you about your account (Art. 6(1)(f) GDPR).

Writing to us

When you write to us, we use what you send us to answer you.

Legal basis: our contract with you, if you use Bodylake (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering you (Art. 6(1)(f) GDPR). We keep your messages for 2 years after the last message.

Backups

So we can restore the service after a failure, we keep encrypted backups: copies of your stored health data in a separate account, and a 35-day history of our database, which holds your account data, consent records and access log.

Legal basis: our legitimate interest in not losing your data and the security of processing (Art. 6(1)(f), Art. 32 GDPR). Deleted data is gone from the backups within 35 days.

We record which version of the consent text you agreed to and when, and each AI app you allowed.

Legal basis: our duty to be able to prove your consent (Art. 6(1)(c), Art. 7(1) GDPR). We keep these records until your account is deleted.

Exporting your data

You can export all of your data from the app as Parquet files with a description of their contents. The download link works for 50 minutes, and we delete the file after 24 hours.

Legal basis: your rights of access and portability (Art. 6(1)(c), Art. 15 and 20 GDPR).

When we delete your data

We delete your account and all of its data:

Deleting your account destroys your personal key at once, so the health data in our live storage can no longer be read. The rest is deleted within hours; records of past sign-ins and requests, which can no longer be used, expire within 90 days, and backup copies are gone within 35 days. Data that an AI app already received stays with that provider; see “Who receives data”.

Who receives data

You choose and allow each AI app yourself. From the moment it receives your data, that provider is an independent controller, and its own terms and privacy policy apply. It may keep the results and, depending on your settings there, use them to train its models. We can’t delete data that the provider holds; ask the provider to do that, and use your rights against it with the provider.

Transfers outside the EU

Your copy, our backups and our logs stay in Germany. Data leaves the EU only in four cases:

How we protect your data

Your rights

You have the following rights. Most of them work directly in the app; for everything else, write to privacy@bodylake.com. We answer within one month (Art. 12(3) GDPR), free of charge.

Access

You can ask what data we have about you (Art. 15 GDPR). In the app, Your Data shows what is stored and the Access Log shows what your AI read.

Correction

You can have wrong data corrected (Art. 16 GDPR). Health values are corrected in the Health app; Bodylake then copies the change.

Deletion

You can have your data deleted (Art. 17 GDPR). Delete Account in the app starts this at once.

Restriction

You can ask us to restrict how we use your data (Art. 18 GDPR).

Portability

You can get your data in a common, machine-readable format (Art. 20 GDPR). Export in the app gives you Parquet files.

Objection

Your right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We then stop unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims. Write to privacy@bodylake.com.

You can withdraw your consent at any time, without affecting anything we did before (Art. 7(3) GDPR). There are three ways, and each does something different:

Complaints

You can complain to a data protection authority, in particular in the EU country where you live or work. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2–4, 40213 Düsseldorf, https://www.ldi.nrw.de.

Cookies and similar technologies

The pages of the website set no cookies and load nothing from anyone else. Signing in to connect an AI app sets the one cookie described in “Signing in to connect an AI app”. The app stores your sign-in tokens in your iPhone’s Keychain and reads Health data with your permission. Both are strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG).

No automated decisions, no advertising, no AI of our own

We make no decisions about you by automated means and build no profiles (Art. 22 GDPR). Bodylake has no AI of its own, shows no ads, sells no data and trains no AI models. The app has no analytics or tracking, and we never store your health data in iCloud. We never use your health data for advertising, marketing or data mining.

Minimum age

You must be at least 18 years old to use Bodylake.

Users in Switzerland

Under Art. 19(4) of the Swiss Federal Act on Data Protection (FADP): we disclose data to Germany, where we store it; with your explicit consent (Art. 17(1)(a) FADP), to the countries where the AI app you connect processes data, for example the US; and, as far as our contract with you needs it (Art. 17(1)(b) FADP), to the countries where Apple’s push service and your own email provider process it. When you write to us, we also disclose your messages to the US, where Google LLC, which hosts our email together with Google Cloud EMEA Limited, is certified under the Swiss-US Data Privacy Framework (Art. 16(1) FADP), and, under standard data protection clauses (Art. 16(2)(d) FADP), to the other countries where Google’s subprocessors process them.

Users in the US

Our consumer health data privacy policy adds the information that US state laws on consumer health data require.

Changes to this policy

The version and the date it took effect are at the top of this page. When we change this policy, we publish the new version here and tell you in the app.