Privacy Policy
Privacy notice for clients, leads, corporate wellness participants, app users, event attendees, and website visitors.
1. Scope
This Policy explains how BODIQO, operated by Bodiqo Enterprises LLP (“BODIQO”, “we”, “us”, or “our”), collects, uses, stores, shares, protects, and retains personal data when you interact with our website, mobile apps, client portal, coaching services, corporate wellness programs, events and experiences, or other related services.
Where applicable, BODIQO acts as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), and as a body corporate under the Information Technology Act, 2000 and rules thereunder, including the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”).
This Policy does not govern third-party websites, apps, payment gateways, or partner services that operate under their own policies. This Policy also covers Muscle Manual Magazine (musclemanualmag.com), an editorial property operated by Bodiqo Enterprises LLP, in respect of personal data collected through that property.
2. Who This Policy Covers
This Policy applies to:
- Clients enrolled in BODIQO coaching, nutrition, or wellness programs
- Prospective clients and leads who contact us, complete assessments, or submit inquiries
- Users of the BODIQO Client App, BODIQO Coach App, or any BODIQO digital portal
- Corporate wellness program participants and their employer or coordinator contacts
- Event and experience registrants and attendees
- Website visitors to bodiqo.com and musclemanualmag.com
- Family members or guardians interacting or consenting on behalf of a participant
- Business contacts engaging with BODIQO for scheduling, service delivery, or billing
3. Categories of Personal Data We Collect
3.1 Identity and Contact Information
Name, phone number, email address, age, date of birth, city, country, organisation, designation, and emergency contact details where relevant.
3.2 Program and Profile Information
Dietary preference, goals, training history, fitness preferences, habits, adherence responses, sleep details, lifestyle information, scheduling preferences, performance assessment responses, and progress notes.
3.3 Health and Safety Disclosures
Information you choose to provide, including injuries, surgeries, past or current medical conditions, pregnancy or post-partum status, allergies, physical limitations, medications, discomfort levels, and blood-work or clinical inputs relevant to your program.
3.4 Service-Use and Coaching Data
Workout logs, meal logs, macro and nutrition entries, check-ins, progress photos and body measurements, session attendance, coach comments, support records, renewal history, and in-app interactions.
3.5 Media and Progress Content
Photos, videos, transformation submissions, progress comparisons, event images, and recordings that you upload or provide to us.
3.6 Payment and Billing Information
Invoices, receipts, transaction status, payment confirmation details, tax information, and limited payment metadata from our payment processor. BODIQO does not store full card numbers, CVVs, or complete bank account credentials.
3.7 Device, App, and Usage Data
IP address, browser type and version, device identifiers, app version, operating system, crash logs, error reports, performance diagnostics, and app usage events.
3.8 Cookies, Pixels, and Tracking Data
Data collected through cookies, pixels, tags, session replay tools, and similar technologies on our website and landing pages. See Section 11 for details.
3.9 Wearable and Health Integration Data
If you connect a health integration such as Apple Health / HealthKit, Google Fit, or a compatible wearable device, we may receive activity data, workouts, step counts, sleep metrics, heart rate data, and other biometric data that you authorise through the integration. See Section 8 for further detail.
3.10 Communications Data
Messages you send us through WhatsApp, email, in-app messaging, or other channels; support ticket content; booking and scheduling requests; and records of communications relevant to service delivery.
3.11 Corporate and Business Contact Data
Organisation name, work contact details, designation, department, billing information, contract details, and coordination records for corporate wellness programs and B2B engagements.
4. How We Collect Your Data
We may collect personal data:
- Directly from you when you register, complete a form or assessment, upload content, make a booking, or otherwise interact with our services
- Automatically through your use of our website, mobile apps, or digital portals, including through cookies and analytics technologies
- From your employer or corporate coordinator in connection with a corporate wellness program
- From a family member or authorised representative acting on your behalf
- From payment processors, booking systems, or scheduling tools in connection with a transaction
- From coaches or team members recording service observations during delivery
- From health or wearable integrations you choose to connect
- From other sources permitted by applicable law, to the extent relevant to your relationship with BODIQO
5. Why We Process Your Data — Purposes and Legal Bases
We process personal data for the following purposes, relying on consent, contractual necessity, legal obligation, and legitimate interests as applicable under the DPDP Act, SPDI Rules, and other applicable Indian law:
5.1 Service Delivery
Creating and managing accounts; delivering coaching, nutrition, and wellness services; scheduling sessions, calls, and workshops; tracking adherence and progress; and providing customer support.
5.2 Program Administration
Sending invoices, payment reminders, and receipts; managing renewals and collections; maintaining internal service records; and managing service continuity.
5.3 Safety and Risk Management
Assessing health and safety disclosures; adapting programs to avoid injury or harm; responding to emergencies or incidents at events; and ensuring participant safety.
5.4 AI-Assisted Insights and Coaching
Generating automated coaching suggestions, nutritional insights, progress reports, and personalised recommendations using AI. See Section 7 for details.
5.5 Analytics and Product Improvement
Measuring website traffic, app engagement, quiz conversion, marketing attribution, and campaign performance to improve our products, services, and coaching methodologies.
5.6 Marketing and Communications
Sending service updates, program reminders, educational content, and promotional messages where permitted by law or based on consent or prior interaction. See Section 19 for opt-out details.
5.7 Legal Compliance and Fraud Prevention
Complying with applicable laws, regulatory orders, court proceedings, and tax obligations; preventing fraud and misuse; and enforcing our contracts.
5.8 Internal Operations
HR, finance, operations, contractor management, and internal business planning within the BODIQO team.
6. Consent and Legal Bases for Processing
We process personal data on the following grounds as applicable under the DPDP Act, 2023:
- Consent: Where you have given free, specific, informed, and unambiguous consent for a particular processing purpose. You may withdraw consent at any time by contacting info@bodiqo.com. Withdrawal does not affect prior lawful processing and may affect our ability to continue the relevant service.
- Contractual necessity: Where processing is necessary to perform a service agreement or to take steps at your request before entering a contract.
- Legal obligation: Where processing is required to comply with applicable Indian law, regulatory obligations, or court orders.
- Legitimate interests: Where processing is reasonably necessary for BODIQO's legitimate operational, safety, or business interests, balanced against your rights and expectations, to the extent permitted by applicable law.
The substantive provisions of the DPDP Act and DPDP Rules are being implemented on a phased timeline (full enforcement from 14 May 2027). BODIQO is building its compliance framework to be fully ready before that date. Our consent mechanisms and this Policy will be updated as required under each phase.
7. AI-Assisted Processing and Automated Insights
BODIQO uses artificial intelligence (AI) and large language model (LLM) technology to deliver intelligent coaching insights, performance assessments, nutritional reports, and automated suggestions. This section explains how AI processing works and what it means for your data.
7.1 What AI Processing Is Used For
- Generating personalised insights from your Performance Profile assessment results
- Producing automated coaching and nutritional suggestions based on your program data
- Creating progress reports and summaries for you and your coach
- Assisting coaches and nutritionists with data analysis and program planning
- Future planned features may include AI-powered real-time coaching recommendations, habit nudges, and personalised meal planning within the BODIQO app
7.2 AI Providers We Use
We use AI and language model providers, accessed via their API services, to generate coaching insights and content. The specific providers in use may change from time to time as technology and service quality evolve. Creative asset generation tools used for editorial and marketing content generation do not process client coaching or health data.
7.3 Data Minimisation and Pseudonymisation
When your data is processed through AI models, BODIQO applies data minimisation principles:
- Where technically feasible, AI calls use your internal system identifier (User ID) rather than your name, email address, or phone number
- Direct personal identifiers are not included in AI prompts unless strictly necessary for the specific output
- Coaching and health data passed to AI models is structured for the purpose of generating insights and is not used for advertising, profiling, or model training
- Pseudonymised data remains personal data under applicable law and is handled accordingly
7.4 AI Provider Data Practices
BODIQO uses the API-based (non-consumer) versions of Anthropic and OpenAI services. Under the standard API terms of these providers, data submitted via the API is not used to train their models without explicit consent. BODIQO does not authorise AI providers to use your personal or health data for any purpose other than generating the requested output for the specific call.
7.5 AI Observability and Internal Logging
All AI model calls made by BODIQO are logged through an internal observability system for cost tracking, quality monitoring, and debugging purposes. Access to these logs is restricted to authorised BODIQO technical personnel and the logs are not shared with AI providers.
7.6 Human Oversight of AI Outputs
AI-generated insights are intended to assist coaches and support personalised service delivery. They are not used as the sole basis for significant decisions about your program without human review. Your coach or nutritionist retains oversight over any AI-generated recommendation that affects your program.
7.7 Your Rights in Relation to AI Processing
You may:
- Request that your program data not be processed through AI systems (this may limit certain automated features)
- Request a human coach or nutritionist review of any AI-generated insight or recommendation
- Request a general explanation of the logic of AI processing applied to your account
- Exercise any other applicable data principal rights under Section 15 in relation to AI-processed data
8. Wearable and Health Integration Data
If you choose to connect a wearable device or health integration to your BODIQO account or app, we may receive:
- Activity and fitness data (steps, calories, exercise sessions, workouts)
- Sleep data (duration, quality, stages)
- Heart rate and cardiovascular biometrics
- Body composition metrics (where supported by your device)
- Calendar availability or scheduling data (where connected)
Data shared through health integrations such as Apple Health / HealthKit or Google Fit is used solely for coaching, tracking, and related product features. It is not used for advertising, ad targeting, or shared with advertising networks.
You can disable integrations at any time through your device settings, your app settings, or by contacting us.
9. Corporate Wellness Programs
If you participate in a corporate wellness program facilitated by BODIQO, your employer, organiser, or corporate coordinator may provide us with limited participant information such as your name, work email or phone number, batch allocation, department, attendance slot, or related logistics.
BODIQO will ordinarily provide attendance, utilisation, and wellness reporting to the corporate customer in aggregated or de-identified form. Participant-level information may be shared with the corporate customer only where reasonably necessary for attendance management, scheduling, billing, service delivery, safety follow-up, misconduct handling, or compliance, or where specifically disclosed in the corporate program setup.
If you have questions about what data your employer has shared with us or received about you, you should also contact your employer’s designated HR or wellness contact.
10. Events and Experiences
If you register for or attend a BODIQO event or experience, we may process registration details, attendance information, dietary or accessibility preferences, emergency information, payment records, event images, and communications needed to manage the event.
General ambience, group, or stage photography and video may be captured at events for operational, archival, and promotional purposes. If you object to targeted identifiable promotional use of your image, please notify us in writing before or at the event. Incidental crowd or ambience capture may still occur even if such a request is made.
13. Cross-Border Data Transfers
Some vendors and AI providers used by BODIQO process or store personal data outside India. These include cloud infrastructure providers, AI model providers (Anthropic, OpenAI), analytics platforms, and email services.
As of the effective date of this Policy, the Central Government has not published a restricted-country list under the DPDP Act, 2023. Cross-border transfers are therefore currently permissible. BODIQO uses contractual and operational safeguards it considers appropriate for each service provider and will monitor government notifications that may restrict specific jurisdictions.
Where data localisation requirements are introduced for specific categories of data, including health data, BODIQO will implement required measures within any applicable transition period.
14. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes described in this Policy:
- Active service and account records: For the duration of your program and for a reasonable period after its end, typically up to 3 years from your last substantive interaction.
- Health and safety data: For the duration of your active program and a reasonable period thereafter for safety review, dispute handling, and insurance purposes.
- Payment, billing, and tax records: As required by applicable Indian tax and accounting law, typically 7 years or as specified.
- Legal, compliance, and regulatory records: For as long as required by applicable law or until limitation periods expire.
- Marketing consent and opt-out records: For a period sufficient to demonstrate compliance.
Data may also be retained in aggregated or de-identified form for analytics and business planning beyond the above periods. Some data may continue in encrypted backups or archived records until ordinary deletion cycles complete (typically within 90 days for active backup sets following a deletion request).
15. Your Rights
Subject to applicable law, including the DPDP Act, 2023 and the DPDP Rules, 2025, you have the following rights as a Data Principal:
15.1 Right to Access Information
You may request a summary of the personal data we hold about you and the purposes for which it has been processed.
15.2 Right to Correction
You may request correction of inaccurate or incomplete personal data. You can also update much of your information directly within the app.
15.3 Right to Erasure
You may request erasure of your personal data. Where we accept a valid erasure request and are not required or entitled to retain the data, we will take reasonable steps to erase or de-identify the relevant data from active systems within a reasonable period. Some data may be retained in backups or legally required records as described in Section 14.
15.4 Right to Withdraw Consent
Where we process your data on the basis of consent, you may withdraw consent at any time. Withdrawal does not affect prior lawful processing and may affect our ability to continue the relevant service.
15.5 Right to Grievance Redressal
You may file a grievance with our Grievance Officer. We will acknowledge and respond in accordance with applicable law and the DPDP Rules.
15.6 Right to Nominate
Under the DPDP Act, you may nominate another individual to exercise your data principal rights on your behalf in the event of your death or incapacity, to the extent such provisions are operative under applicable rules.
15.7 Right to Approach the Data Protection Board of India
If you are not satisfied with our response to a grievance, you may approach the Data Protection Board of India (DPBI) once complaint mechanisms are fully operative under the DPDP Act enforcement timeline.
15.8 Rights Related to AI Processing
See Section 7.7 for specific rights relating to AI-assisted processing of your data.
15.9 How to Submit a Request
Submit your request to info@bodiqo.com with sufficient detail to identify your account and the nature of your request. We may need to verify your identity before acting. Requests are generally handled within a reasonable period, and may take longer for complex or technically involved cases.
16. Security
BODIQO uses reasonable administrative, technical, and organisational safeguards to protect personal data, including:
- Role-based access controls limiting data access to authorised personnel only
- Encrypted data storage and transmission using industry-standard protocols
- Secure infrastructure practices on cloud and self-hosted systems
- Vendor security obligations through contractual arrangements
- Internal access controls and logging for sensitive data systems
- Version-controlled infrastructure and change management practices
No information system is completely secure. You remain responsible for protecting your device, one-time passwords, access credentials, and account information. Please notify us immediately if you believe there has been unauthorised access to your account.
Regarding session replay tools: Microsoft Clarity captures anonymised session interactions on our website for usability analysis. Sensitive input fields are masked by default. If you wish to opt out, you may do so by declining analytics cookies through our cookie consent mechanism.
17. Personal Data Breach Response
BODIQO maintains incident response procedures to detect, contain, investigate, and remediate personal data breaches.
Upon becoming aware of a personal data breach, BODIQO will:
- Assess the nature, scope, and likely impact of the breach without undue delay
- Notify the Data Protection Board of India (DPBI) without delay, as required by the DPDP Act and DPDP Rules
- Notify affected Data Principals without delay where required, providing information about the nature of the breach and the contact for further queries
- Take reasonable steps to contain and remediate the breach and prevent further harm
- Maintain internal records of all breaches and remediation actions
The notification obligation is triggered from the moment BODIQO becomes aware of a breach, not from its date of occurrence.
18. Children and Minors
BODIQO does not knowingly allow minors to independently purchase services requiring direct contracting without parent or guardian involvement.
Where a minor participates in any BODIQO service or program:
- The parent or lawful guardian must provide required consents and accurate health and safety information
- The guardian is responsible for supervising the minor’s participation
- Where required under the DPDP Act or applicable rules, BODIQO will obtain verifiable parental or guardian consent for processing a minor’s personal data. BODIQO will not process a minor’s data for targeted advertising, tracking, or any purpose prohibited by applicable law.
19. Marketing Communications and Opt-Out
BODIQO may send:
- Service communications: Booking confirmations, payment reminders, session updates, program notices, and support replies. These are necessary for service delivery and cannot be fully opted out while you are an active client.
- Marketing and promotional messages: Newsletters, offers, educational content, and event announcements, sent where permitted by law or based on your consent or prior interaction.
You may opt out of non-essential marketing communications at any time by:
- Clicking the unsubscribe link in any email from BODIQO
- Replying STOP to any promotional WhatsApp or SMS message
- Contacting info@bodiqo.com with an explicit opt-out request
Opt-outs are processed within a reasonable period. You may continue to receive essential service communications after opting out of marketing.
20. Third-Party Services
Our services connect with or rely on third-party platforms including payment gateways, messaging providers, calendar tools, health integrations, analytics platforms, AI providers, and hosting services. These third parties operate under their own terms and privacy policies.
BODIQO is not responsible for the independent data practices of third parties outside the scope of our own processing or contractual arrangements. We recommend reviewing the privacy practices of any third-party service you use directly.
21. Changes to This Policy
We may update this Policy from time to time to reflect business, product, operational, legal, or regulatory changes, including changes arising from the phased implementation of the DPDP Act and Rules (full enforcement: 14 May 2027).
The updated version will be posted on bodiqo.com, our app, and our portal with a revised effective date. Where changes are material, we will provide reasonable advance notice through the app, email, or another appropriate channel.
Your continued use of our services after the effective date of any update constitutes acceptance of the revised Policy for future processing.
22. Contact, Grievance, and Requests
For privacy requests, access, correction, erasure, consent withdrawal, complaints, or any grievance relating to personal data, contact:
Role: Grievance Officer / Privacy Contact
Email: info@bodiqo.com
Phone: +91 89287 67448
Data Fiduciary: Bodiqo Enterprises LLP (LLPIN: ACJ-2197)
Address: 5, Floor-2, Plot-47A, Kala Niketan, Bhulabhai Desai Road, Cumballa Hill, Mumbai – 400026, Maharashtra, India
We will acknowledge grievances in a timely manner and respond in accordance with the DPDP Act, the DPDP Rules, and other applicable Indian law.
If you are not satisfied with our response to a grievance, you may approach the Data Protection Board of India (DPBI), once its complaint mechanisms are fully operative.
BODIQO — Stronger systems. Better outcomes.
Bodiqo Enterprises LLP | LLPIN: ACJ-2197 | Mumbai, India