1. Who We Are
The Body Clock is operated by Whole Brain Corp Inc., located in Clearwater, Florida, United States. This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our website (thebodyclock.com), mobile applications, and related services (collectively, the "Service").
For privacy-related inquiries, contact us at: [email protected]
2. Information We Collect
Information You Provide
- Account information: Name, email address, password (hashed)
- Assessment data: Chronotype responses, sleep/wake times, age, sex, weight, dietary preferences, health goals, fitness level
- Payment information: Processed by Stripe — we do not store credit card numbers on our servers
- Coach Pro data: Client names, client emails, client assessment data, practice information, professional role (health/fitness)
- Communications: Emails you send to our support team
Information Collected Automatically
- Usage data: Pages visited, features used, quiz completions, blueprint generations, time spent on pages
- Device information: Browser type, operating system, screen size, IP address
- Cookies: We use essential cookies for authentication and functionality, plus optional analytics cookies (see Section 7)
- Analytics: Google Analytics for aggregated traffic and usage patterns
3. How We Use Your Information
- Service delivery: To generate your personalized Body Clock Code, display results, and manage your account
- Improvement: To analyze usage patterns and improve the Service
- Communication: To send transactional emails (purchase confirmations, blueprint delivery) and, with your consent, marketing communications
- Research: To conduct anonymized and aggregated research on circadian patterns and health outcomes
- Commercial purposes: To create anonymized, aggregated datasets for product development, marketing materials, and potential partnerships with third parties
- Legal compliance: To comply with applicable laws, regulations, and legal processes
4. How We Share Your Information
We do NOT sell your personally identifiable information.
We may share information in these limited circumstances:
- Service providers: Stripe (payments), Supabase (database), Vercel (hosting), Google Analytics (analytics) — each bound by their own privacy policies
- Coach Pro: If you are a client of a Coach Pro user, your assessment data is shared with your coach for the purpose of generating your blueprint
- Anonymized data: We may share or sell anonymized, aggregated data that cannot identify you individually
- Legal requirements: If required by law, subpoena, court order, or government request
- Business transfers: In connection with a merger, acquisition, or sale of assets
5. Data Retention
We retain your personal data for as long as your account is active or as needed to provide the Service. After account deletion, we retain anonymized data indefinitely for research purposes. Personally identifiable data is deleted within 30 days of an account deletion request.
To request account deletion, email [email protected].
Transformation photos: if you choose to upload a photo for the optional chronotype transformation image, it is processed once in memory to generate your image and is deleted immediately. We never store your photo, never use it for training, and never share it. The generated image exists only on your device unless you choose to share it.
6. Data Security
We implement industry-standard security measures including:
- TLS/SSL encryption for all data in transit
- Encrypted database storage via Supabase (AES-256)
- Secure authentication via Google and Apple OAuth
- Row-level security policies on database tables
- No storage of credit card data on our servers (handled by Stripe PCI-DSS Level 1)
While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.
7. Cookies
We use the following types of cookies:
- Essential cookies: Required for authentication, session management, and core functionality. Cannot be disabled.
- Analytics cookies: Google Analytics to understand how visitors use the Service. Can be declined via the cookie banner.
- Preference cookies: To remember your language preference, theme, and display settings.
You can manage cookies through your browser settings. Disabling essential cookies may prevent the Service from functioning properly.
8. Your Rights
All Users
You have the right to access your personal data, correct inaccurate data, request deletion of your data, and withdraw consent for optional data processing. Contact [email protected] to exercise any of these rights.
European Economic Area (GDPR)
If you are in the EU/EEA, you have additional rights: right to data portability, right to restrict processing, right to object to processing, and the right to lodge a complaint with your local Data Protection Authority. Our lawful basis for processing is consent (provided by accepting our disclaimer) and legitimate interest in providing and improving the Service.
California (CCPA/CPRA)
California residents have the right to: know what personal information is collected, request deletion, opt out of the sale of personal information, and not be discriminated against for exercising these rights. We do not sell personally identifiable information as defined by CCPA. To submit a request, contact [email protected].
Canada (PIPEDA)
Canadian users have the right to access their personal information, challenge its accuracy, and withdraw consent. Data is processed in the United States.
United Kingdom (UK GDPR)
UK residents have the same rights as EEA residents. Complaints may be directed to the Information Commissioner's Office (ICO).
Australia (Privacy Act 1988)
Australian users have the right to access and correct personal information. Complaints may be directed to the Office of the Australian Information Commissioner (OAIC).
9. International Data Transfers
Your data is processed and stored in the United States. By using the Service, you consent to the transfer of your data to the U.S. We rely on standard contractual clauses and service provider agreements to ensure adequate protection of data transferred internationally.
10. Children's Privacy
The Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal information, contact us at [email protected].
11. Third-Party Links
The Service may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to read the privacy policies of any third-party site you visit.
12. Changes to This Policy
We may update this Privacy Policy at any time. We will notify users of material changes by posting the updated policy with a new "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.
13. Contact Us
For questions about this Privacy Policy or to exercise your data rights:
Whole Brain Corp Inc.
Clearwater, Florida, United States
[email protected]