Effective date: 13 October 2026
Version: 2.1-beta
Web address: https://www.miphyfitness.com/app-privacy
This is the version of our privacy policy for the MiPhy beta test. We will publish a new version, and tell you, before MiPhy opens to everyone.
This policy has two parts:
- Part A applies to everyone, in every country. It is written to the standard of the United Arab Emirates Personal Data Protection Law, our home law, and we apply the stricter rules of other countries' laws to everyone where we can (for example, we treat health information as sensitive and ask for your consent everywhere).
- Part B adds what the law in your country or region requires on top of Part A. If Part B and Part A differ, Part B wins for people in that place.
Part A: for everyone
A1. Who we are
MiPhy ("Mind & Physique") is a fitness, food, habits and mindfulness app. It is run by Mind & Physique For Lifestyle Coaching, a sole establishment licensed in Dubai (mainland), United Arab Emirates ("MiPhy", "we", "us").
- Address: Dubai (mainland), United Arab Emirates
- Trade licence: 1657912, issued by the Dubai Department of Economy and Tourism (DET)
- Email for privacy questions and requests: support@miphyfitness.com
We decide why and how your personal data is used, so we are the controller of your data (called the "data fiduciary" in India). Where a law asks for a named privacy contact, data protection officer or grievance officer, that is our founder, Niranjan, at the same email address.
A2. What MiPhy is, and is not
MiPhy personalises your training, food and habits from your answers. It doesn't diagnose or treat medical conditions, and it doesn't replace your doctor's advice. It is not a medical device and not a healthcare provider, and it does not cure or prevent any illness. The AI coach is an AI, not a doctor, therapist or person. Talk to a doctor before making medical decisions. Full details are in our Terms of Use.
A3. The short version
- MiPhy is for adults aged 18 or over.
- During the beta, MiPhy is free, it is invite-only (you need a beta code), and every feature is on for everyone. There are no prices and nothing to pay.
- During the beta, MiPhy is offered in every country except the European Union and European Economic Area, the United Kingdom, Saudi Arabia, Oman, Qatar and mainland China.
- We collect what you type, log, photograph or film in the app, so the app can work for you. Much of it is health information, and we treat it as sensitive in every country.
- The AI coach (including logging food by telling the coach), check-in suggestions and Snap a meal send some of your information to our AI provider, Anthropic. These only run if you turn on AI help, and you can turn it off at any time. The AI never changes your plan by itself.
- Your plan is not written by AI in the beta. It is a ready-made program that our training rules pick from your setup answers.
- Voice typing uses your phone's or browser's own speech service (Apple or Google). MiPhy never receives the audio. It works whether AI help is on or off.
- Posture photos and form videos are never sent to the AI and never analysed. Meal photos from Snap a meal are sent to the AI only to identify the food. Posture and meal photos you choose to keep (the "Keep my photos" switch) are seen only by you and the MiPhy team, to compare your progress, give you feedback and check Snap. Form videos are not shown to anyone else.
- There is no human coach in the beta. During the beta, authorised members of the MiPhy team can look at your account in a private, view-only admin screen (your setup answers, logs, progress, measurements, stats and AI chats, and your posture and meal photos while "Keep my photos" is on; never form videos or your profile photo) to check how the app and the AI are working for you and to improve them. Every look is recorded (section A9).
- We do not sell your data, do not share it for advertising, show no ads, use no analytics or advertising trackers, and do not use your data to train AI models.
- Your data is stored in Mumbai, India. Some service providers are in the USA (section A11).
- You can see, correct, download and delete your data. You can delete your account inside the app at any time.
A4. What we collect
A4.1 Account and sign-in
| What | Details |
|---|---|
| Email address | Used to create your account, sign in and reset your password. When you create an account we email you a 6-digit code once to confirm the address. |
| Password | If you sign in with email. It is stored only as a one-way scrambled value (a "hash") by our sign-in provider. Nobody at MiPhy can see it. |
| Google sign-in | If you choose "Continue with Google", Google tells us your email address, your name and your Google profile picture link, and that Google confirmed your email. We never see your Google password. |
| Account ID | An internal number created when you sign up. |
| Name and profile photo | Your first name (required), last name (optional), and a profile photo if you add one. |
| Settings | Language, appearance, units, time zone (read from your phone so "today" starts at your local midnight). |
| Beta access | The beta code you entered, when you used it, and whether your access is active or stopped. |
| Plan | During the beta every account has every feature. We keep the plan field (Free or Progress) for after the beta. The app never receives payment details. |
| Consent records | Each consent choice you make (section A8), with the date and the version of the wording you saw. We keep the history, not just your latest answer. |
| Safety note | The date you ticked "I've read this and I'm ready to start", and the version you saw. |
| Sign-in records | Date of sign-up and of your last sign-in. |
| Approximate location | The city and country of your internet connection when you sign in. Our hosting network works this out and passes it to our server; we do not use a separate look-up service. We keep only the city and country. We never store your IP address for this, and we never collect your precise (GPS) location. The app never asks for location permission. |
A4.2 Setup questions
After you agree to the health-information consent, setup asks short questions. Answers are saved step by step so you can stop and continue later. Every health question has a Prefer not to say or Not sure answer.
| What | Required or optional |
|---|---|
| Name | First name required |
| Sex (male / female / prefer not to say) | Required. Used for calorie estimates and which body measurements the app suggests. "Prefer not to say" uses an average. |
| Main goal, age (18+), height, weight, daily activity, training experience | Required. Goal weight is optional. BMI is worked out for the plan rules but not shown or saved. |
| Pain or soreness: the areas you tap on a front and back body map, whether it is soreness or pain, a 0–10 score, and any warning signs you tick | Optional |
| Health conditions you choose to tell us about (for example diabetes, blood pressure, heart, kidney, thyroid, PCOS, cholesterol, asthma) and, for each, optional follow-up answers: type, since when, medicines (by group, such as "tablets", "insulin" or "beta blockers", never names or doses), roughly when you last checked at home or saw a doctor, roughly when your last blood test was (for example "this month"; never results), and one or two condition-specific answers (for example low-sugar episodes in the last month). We never ask for reports or results. | Optional |
| Right now: pregnant, had a baby recently or breastfeeding, surgery in the last 12 weeks, chest pain or fainting, or a doctor said not to exercise; your blood pressure reading band if you have high blood pressure; and whether a doctor has said exercise is OK | Optional, but some answers pause the plan until a doctor's OK |
| Diet type, foods you don't eat, halal preference, food allergies | Optional. A halal preference can suggest your religious belief, so we treat it as sensitive data, in the same way as health information. |
| Current habits: roughly how much protein you eat now and how many steps you do now | Optional |
| How you want to start (Fast track, Steady or Easy start) and how you'd like to log food (Snap, Say it, Tell your AI coach, Type it) | Optional |
| Which weekdays you train, session length, where you train (gym, home, outdoors) and your equipment | Required |
| What you want help with (sleep, stress, focus, energy) | Optional |
| Starter habits and coach tone (encouraging, balanced or direct) | Optional |
How we use your health answers: to keep your plan safe (for example easier effort, no maximum lifts, or a pause until a doctor's OK), to show safety tips (for example carrying a snack if you use insulin), and to set starting targets. Each condition screen shows how MiPhy uses that answer.
A4.3 What you log
- Food: meals with date, time, meal slot, foods, amounts, estimated calories, protein, carbohydrate and fat, notes, foods you add yourself, and meals you save to My meal library.
- Water, steps and activity, and your own daily water and steps goals.
- Habits and each day's status (done, tiny version, paused).
- Workouts: sessions, sets, weights, reps, time, exercises added or swapped, an optional "discomfort" flag, effort rating (RPE), notes, and your saved routines. The app works out personal bests and volume from these.
- Targets: your calorie and protein targets and the numbers the estimate used.
- Body stats: weight, and if you choose, body-fat % and muscle mass with the method used.
- Body measurements you enter.
- Mindfulness sessions: technique, length, whether you finished, how you felt before and after, and what prompted it.
- "Make today fit your day": your mood, sleep, available time, energy and main barrier for that day, and the change you applied.
- Weekly check-ins: how the week went; energy, sleep, hunger and plan difficulty; optionally a win and a barrier in your words, your weight, and your menstrual-cycle status (period this week / expected soon / not relevant).
- "Coming to MiPhy" votes: which future features you said you want.
A4.4 AI features (only when AI help is on)
- AI coach chat: the messages you type or dictate, and the AI's replies. During the beta each person can send up to 100 messages a month. If you tell the coach what you ate, it suggests food entries; you check them before anything is saved.
- Check-in suggestions: after a check-in the AI may propose plan changes. Nothing changes unless you tap Accept.
- Snap a meal: the photo you take or choose, sent to our AI provider to name the foods and estimate amounts. You check and edit the foods before anything is saved.
- Reports: if you tap Report this reply on an AI reply, we store your reason with that reply, and the MiPhy team reviews it.
- Safety flags: if our safety rules or the AI flag a chat message (for example sharp pain, chest pain, pregnancy, very low eating, a medical question, or thoughts of self-harm), we store the flag type and time with the message.
- AI usage record: for each AI request, the feature, AI model, amount of text processed, cost and whether it worked. It never contains your messages. If you delete a chat, we keep only the time of each AI reply for up to about 2 months so the monthly message limit still works.
Plans (no AI in the beta): your workout plan is a ready-made program that our training rules pick and adjust from your setup answers, with a short "Why this plan?". It is made on our server without AI, and nothing about it is sent to our AI provider. AI-written plans may come later; we will tell you before that happens, and they would run only with AI help on.
A4.5 Photos and videos
- Posture photos: up to 4 photos per set (front, side, side with arms lifted, back), with the date and view. The camera opens only after you tap Start. Posture photos are saved only while "Keep my photos" is on (section A8). Before you save, the app tells you who can see them.
- Form videos: short exercise clips you record or upload, with the exercise and linked workout. Clips are compressed before upload. A clip may include sound. A clip you choose from your gallery may still carry sound and other details your phone stored in it (for example, where it was filmed). If you prefer, remove these on your phone before you upload.
- Meal photos. When you use Snap a meal, the photo is sent to our AI provider (Anthropic) to identify the foods and estimate portions. If "Keep my photos" is on, the photo is then stored privately with that meal, and is deleted when you delete the meal or your account. Under Save, the app tells you who can see it, and you can tap "Don't keep this photo" for any single meal. If "Keep my photos" is off, Snap uses the photo once and keeps nothing. The app removes location data from meal photos before they are uploaded. You can turn AI help off in Profile → Privacy.
- Profile photo, if you add one.
- All are kept in private storage and shown through links that expire. Posture photos, form videos and your profile photo are not sent to the AI and not analysed. Meal photos are sent to the AI only as described above. Kept posture and meal photos are seen only by you and the MiPhy team, as described in section A9. Form videos and your profile photo are not shown to anyone else. We do not create face or body templates from any of them. If we ever add AI video analysis, we will ask for your separate consent first.
- If you choose "save to my phone", a copy goes to your phone's gallery, which you control.
A4.6 Voice
"Talk to log", "Describe a meal" and the microphone in the AI chat use voice typing. Voice typing uses your phone's or browser's own speech service: Apple on iPhone, usually Google on Android, and your browser's service on the web (in Chrome, that is Google's). Depending on your device, your voice may be sent to Apple or Google under their own privacy terms. MiPhy never receives or stores the audio; the app gets only the text. Voice typing works whether AI help is on or off. When AI help is off, the AI chat, and with it the chat microphone, is hidden. The microphone runs only after you tap it. You see and can edit the text before anything is saved or sent. Anything the app reads aloud (for example the breathing and listening guides) uses your phone's or browser's own text-to-speech.
A4.7 Stored only on your phone
Language, theme, reminder choices, voice-guide settings, camera timer, the state of a workout in progress, and your sign-in session. Reminders are scheduled on your phone; nothing about them is sent to us. In the beta, MiPhy does not send push messages and does not register your phone for them.
A4.8 Technical information
Our database host and web host keep standard server logs (for example IP address, time, device or browser type) for security and troubleshooting, for a short time (section A12). We do not use them to track you. The only location we keep is the approximate city and country from sign-in (section A4.1).
A4.9 Support and website enquiries
If you email us, we keep the email and our reply. If you contact us through our website, we may keep your name, email or phone number, your goal, how you heard of us, and our notes, so we can reply. Website enquiries are not linked to what you log in the app.
A4.10 What we do not collect
No precise (GPS) location and no location permission (only the approximate city and country in section A4.1), no contacts, calendar, advertising ID, payment card details, heart rate, or Apple Health / Google Health Connect data. No analytics, advertising or crash-reporting tools in the app. No cookies for tracking or advertising; the web version stores only what it needs to work (section A4.7).
A4.11 The MiPhy food database
The food list is the same for everyone and holds no personal data. Values come from published food composition tables and from MiPhy's own recipe estimates; estimated foods are marked Estimate. Your searches are not stored.
A5. Health information and other sensitive data
Most of what you give MiPhy is health information or can reveal it: pain areas and scores, health conditions and their follow-up answers (including medicine groups and when you last had a check-up or blood test), pregnancy, recent birth or breastfeeding, blood pressure band, body stats and measurements, posture photos, meal photos, food, foods you don't eat and allergies, menstrual status, mood, sleep, and anything you tell or say to the AI coach. A halal preference can reveal religious belief. Many laws treat this as sensitive (for example "sensitive personal data" in the UAE and Saudi Arabia, "special category data" in the EU and UK, "consumer health data" in some US states).
So, everywhere, we:
- collect it only after you give the health-information consent (section A8), and ask for extra consent before it is sent to the AI provider;
- use it only to run the app for you, never for ads, never sold, never used to train AI;
- keep it in private, access-controlled storage, encrypted in transit and at rest;
- show it to no one at MiPhy except authorised team members, only for the beta review and other tasks described in section A9;
- delete it when you delete your account.
We do not want official medical records. Please do not upload lab reports or medical documents or type ID numbers into the chat.
A6. How the AI features use your data
What we send (only when AI help is on, and only what each request needs):
- AI chat: your message, earlier messages in the chat, and a short summary of your profile, plan and recent logs (for example goal, experience, equipment, pain areas, health conditions you told us about, recent workouts, food and step totals, recent check-ins), so the reply fits you.
- Plans: nothing. In the beta, plans are made from ready-made programs and our training rules, without AI (section A4.4).
- Food logging in the chat: what you tell the coach you ate, and the MiPhy food list, so the AI can suggest entries for you to check.
- Check-in suggestions: your check-in answers, current plan and recent workout logs.
- Snap a meal: the photo and the MiPhy food list, so the AI can match what it sees to foods in our database.
- Voice typing is handled by your phone or browser (section A4.6). MiPhy and our AI provider never receive the audio.
What we never send to the AI provider: your email address, password, last name, profile photo, posture photos, form videos, the medicine groups and other follow-up answers about a condition from your setup, or voice audio. Of your name, we send only your first name, so the coach can greet you.
How: requests go from our server (never from your phone) to Anthropic, PBC (USA), which runs our AI with its Claude models (in the beta, Claude Haiku). Anthropic works for us as a service provider under a written contract. Under Anthropic's commercial terms it does not use your data to train its models. Anthropic keeps requests only for a limited time: in normal cases up to 30 days. It may keep requests flagged for possible misuse for longer, as its terms allow. We use no other AI provider in the beta. If Anthropic is unavailable, the AI features pause; nothing is sent to anyone else.
Our own checks: our code, not the AI, decides safety. If your answers or a message suggest you should see a professional first, the app shows a rules-based safety card. AI output is checked against our rules before you see it.
Limits: AI answers are labelled AI, can be wrong, and are not medical advice. The AI cannot change your plan, targets or logs by itself.
If you turn AI help off: nothing new goes to the AI provider, and the AI chat (with its microphone and food logging), check-in suggestions and Snap a meal stop. Everything else keeps working: your plan, logging by typing or voice, your own routines and quick workouts, targets, habits, mindfulness and stats. Your earlier chat stays until you delete it.
No automated decisions with legal effects. MiPhy does not make decisions about you that have legal or similarly important effects (such as credit, insurance, employment or access to healthcare). The AI only suggests; you decide.
A7. Why we use your data, and our legal grounds
| Why | Data | Legal ground |
|---|---|---|
| Create your account, sign you in, keep it secure, check your beta code, and see roughly where beta testers are | Account and sign-in data, approximate city and country, beta code, technical logs | Needed to provide the app you asked for (contract); our legitimate interest in security |
| Run the app: store and show your logs, targets, stats and progress, and make your plan from ready-made programs and our training rules | Setup answers, logs, photos, videos, check-ins | Your explicit consent (health information, and "Keep my photos" for kept photos), and the contract |
| AI chat (including food logging in the chat), check-in suggestions, Snap a meal | Section A6 | Your separate explicit consent (AI help) |
| Beta review: authorised MiPhy team members look at individual accounts to check that plans, targets, safety cards and AI replies are right, and to improve the app and the AI | Setup answers, logs, progress, measurements, stats, check-ins, AI chats; posture and meal photos only while "Keep my photos" is on (never form videos or your profile photo) | Your explicit consent (health information, which names this purpose, and "Keep my photos" for photos) |
| Safety cards and checking safety-flagged chats | Flag type, time, the flagged message | Your consent; our legitimate interest and, where it applies, protecting your vital interests |
| Control AI costs and the monthly message limit | AI usage record | Legitimate interest; contract |
| Reply to support and website enquiries | Your messages and contact details | Legitimate interest; contract; consent where required |
| Keep consent and deletion records, meet legal duties, handle legal claims | Consent history, request records | Legal obligation; legitimate interest |
| Tell you about important changes to the app or this policy | Email, in-app notices | Contract; legal obligation |
We do not use your data for advertising, profiling for marketing, selling, or training AI. We will not send you marketing emails unless you separately agree.
A8. Your consents
| Consent | What it allows | Required? |
|---|---|---|
| Health information | Storing your answers about health, body and food, your logs, body stats, measurements, check-ins and mindfulness sessions so the app can work, in our database in India (section A11), and letting authorised MiPhy team members review them and your AI chats during the beta to check and improve the app and the AI (section A9). | Required to use the app, because the app cannot work without it. |
| AI help | Sending the information in section A6 to our AI provider (Anthropic, USA), including meal photos when you use Snap a meal. | Optional. On or off any time in Profile → Privacy. |
| Keep my photos | Keeping posture and meal photos in private storage, where you and the MiPhy team can see them, to compare your progress, give you feedback and check Snap. | Optional. You give it the first time you keep a posture or meal photo, right after a note that tells you who can see it. On or off any time in Profile → Privacy. While it is off, Snap keeps no photo, posture photos are not saved, and the MiPhy team cannot see your photos. |
Form videos are saved only when you choose to record or upload one, and you can delete each one.
Withdrawing consent: switch AI help or Keep my photos off in Profile → Privacy, or email us. Nothing new is sent or stored from then on, and the MiPhy team loses access to your photos straight away. To remove what was already saved, delete the chat, the photos or videos, or your account. Withdrawing the health-information consent means we can no longer provide the app, so we will delete your account if you ask. Withdrawal does not make earlier processing unlawful.
A9. Who can see your data
- You. Other MiPhy users cannot see anything you log. Nothing is posted publicly.
- No human coach in the beta.
- The MiPhy admin dashboard (authorised MiPhy team members only, protected by a second sign-in step) shows: beta codes; a user list with name, email, approximate city and country, beta access, sign-up and last sign-in dates, and how many AI messages you sent this month; AI cost totals; and safety flags and reported AI replies (flag type or your reason, rules or AI, time, person).
- Beta review of your account. During the beta, authorised members of the MiPhy team can open a view-only page for any account. It shows your setup answers, food and other logs, workouts, progress, body stats, measurements, statistics, check-ins and AI coach chats, so we can see how the app and the AI responded to you and make them better. Only while your "Keep my photos" switch is on, it also shows your posture and meal photos, through links that expire after 10 minutes. It never shows form videos or your profile photo, and nothing can be changed from it. Every time an account or its photos are opened, we record who opened it, which account and when. Access is limited to the few people who need it to run the beta, and what we see is never shared, sold or used for advertising. You can ask us for the list of times your account was viewed. This review is part of the health-information consent you give at sign-up (section A8), and, for photos, of "Keep my photos". The beta review ends when the beta ends. If we ever want to continue it after the beta, we will ask you first.
- Database administration: our database administrator can technically reach the database and private storage. We do so only for the beta review above, support you ask for, security, fixing faults, or a legal duty. We look at your photos only through the recorded beta review while "Keep my photos" is on, or when you ask us to. Every such access is limited to what the task needs.
- Service providers (section A10), only to run MiPhy for us.
- Authorities, only when the law requires it, for example a valid court order. Where allowed, we will tell you first.
- A buyer or successor, if MiPhy is ever sold or merged; they must keep this policy's promises, and we will tell you first.
We do not share your data with advertisers, data brokers, insurers or employers.
A10. Service providers
| Provider | What they do | Data they handle | Where |
|---|---|---|---|
| Supabase Inc. | Database, sign-in, private file storage, server functions | Everything stored in your account | Mumbai, India (AWS ap-south-1) |
| Anthropic, PBC | AI replies (including food logging in the chat), check-in suggestions and Snap a meal, only when AI help is on | Section A6 only, including meal photos | USA, and other countries where Anthropic processes requests |
| Resend Inc. | Sends sign-in and password-reset codes | Your email address and the code email | USA |
| Google LLC (Google sign-in) | Lets you sign in with Google, if you choose | Your Google email, name and profile picture link | USA / global |
| Cloudflare Inc. (Cloudflare Pages) | Serves the web version of the app | Standard request logs (IP address, time) | Global network |
| Google LLC (Google Workspace) | Our support email | Emails you send us | USA / global |
Each provider handles data only on our instructions, under a data processing agreement, and must protect it at least as well as this policy does.
Voice typing is not one of our services. If you use it, your phone's or browser's speech service (Apple or Google) turns your speech into text under its own terms with you. MiPhy does not control it and never receives the audio.
A11. Where your data goes (international transfers)
- Main storage: Mumbai, India. Account data, logs, photos and videos.
- USA: sign-in emails (Resend), Google sign-in, our AI provider (Anthropic) and our support email (Google).
- Worldwide: the web host's network serves the web app from the location nearest you.
- UAE: our own backup copies, kept securely by MiPhy for up to 12 weeks.
If you use voice typing, Apple or Google may process your voice in any country where they operate, under their own terms.
So your data will usually be processed outside the country where you live. Where the law of your country requires it, we protect these transfers with the safeguards it recognises, such as standard contractual clauses, your explicit consent, or an adequacy decision (Part B lists them by region). You can ask us for a copy of the safeguards we use.
A12. How long we keep your data
| Data | How long |
|---|---|
| Account, setup answers, logs, routines, targets, body stats, measurements, mindfulness, check-ins, plans | While your account exists. Deleted when you delete your account. You can delete most single entries yourself. |
| AI chat messages | Until you delete the chat or your account. Only reply times are kept for up to about 2 months after a chat is deleted, for the monthly limit. |
| Posture photos, form videos, profile photo | Until you delete them or your account. |
| Meal photos | Until you delete the meal or your account (removed within a minute of deleting the meal). Not kept at all if "Keep my photos" is off, or if you choose "Don't keep this photo". |
| Copies held by Anthropic | In normal cases up to 30 days. Longer for requests flagged for possible misuse, as Anthropic's terms allow. |
| Voice audio | Never received or kept by MiPhy. Apple or Google handle voice typing under their own terms. |
| Consent history | While your account exists. Deleted with your account. |
| AI usage record | Kept for cost records, unlinked from you when you delete your account. Never contains your messages. |
| Beta codes | The code and date stay in our records, unlinked from you when you delete your account. |
| Inactive accounts | During the beta we do not delete accounts just because they are not used. Before the beta ends, we will email you to say what will happen to your account and data. You can delete your account at any time. |
| Approximate city and country | Updated at each sign-in; deleted with your account. |
| Server logs | Up to 7 days. |
| Database provider backups | Up to 7 days, then overwritten. |
| Our own backups | Up to 12 weeks, then overwritten. |
| Sign-in emails at Resend | Up to 30 days. |
| Support emails and website enquiries | Up to 12 months after the last message. |
| Record of beta-review views (who opened which account, when) | Up to 2 years. After you delete your account, it holds only an internal ID number, not your name or anything you logged. |
| Records of privacy requests (what was asked and when we answered) | Up to 3 years, to show we met the law. |
A13. Deleting your account
In the app: tap your photo (top right) → Profile → Delete account → type DELETE → tap Delete my account. If you have not finished setup, use Delete my account at the bottom of the consent or setup screens. Your photos and videos are deleted first, then your account and everything in it, straight away. This cannot be undone. Copies you saved to your phone's gallery stay on your phone.
Without the app: email support@miphyfitness.com from your sign-in address with the subject "Delete my MiPhy account", or follow Delete your MiPhy account. That page works without signing in. We may send a code to confirm it is you, and we delete the account within 7 days.
Some copies remain for a short time in backups and with providers, as listed in section A12, and are then overwritten.
A14. Security
- All traffic is encrypted (HTTPS/TLS). Stored data is encrypted at rest by our providers.
- Database rules let each person reach only their own data.
- Photos and videos are in private storage, shown only through links that expire.
- Secret keys, including the AI provider key, live only on our server, never in the app.
- The admin dashboard needs a second sign-in step.
- AI spending has a daily cap.
No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the authorities without undue delay, and within the deadline each law sets (Part B).
A15. Your rights
Wherever you live, you can ask us to:
- Know what data we hold about you, how we use it, who we share it with, and where it goes;
- Get a copy of it, in a common machine-readable format (portability);
- Correct or complete it (you can edit most of it yourself);
- Delete it (you can do this yourself, section A13);
- Withdraw consent at any time (section A8);
- Restrict or stop processing, or object to it;
- Not be subject to decisions made only by automated means that seriously affect you (we make none);
- Name someone to act for you, including after your death or if you cannot act;
- Complain to us, and to the data protection authority where you live (Part B lists them).
How: email support@miphyfitness.com with "Privacy request" in the subject, from your sign-in address. We may send a code to that address to confirm it is you. We reply within 30 days, or sooner where your law requires. If a request is complex we may extend this where the law allows, and we will tell you why. Requests are free, unless clearly unfounded or excessive. We will never treat you worse for using your rights.
Getting a copy: in the app, Profile → Privacy → Download my data opens an email to us. We send your copy by email, to your sign-in address.
A16. Adults only
MiPhy is for adults aged 18 and over in every country, even where the local age of digital consent is lower. Setup does not accept ages under 18. We do not knowingly collect data from anyone under 18; if we learn we have, we delete the account. If you think a child has signed up, email us.
A17. No selling, no ads, no tracking
We do not sell or rent personal data, do not "share" it for cross-context behavioural advertising, do not use advertising or analytics trackers, and do not track you across other apps or websites. Because we do none of this, there is nothing to opt out of; we also honour browser "Global Privacy Control" and "Do Not Track" signals by default.
A18. Changes to this policy
We will update the date and version at the top, and tell you in the app (and by email for important changes) before a change takes effect. If a change needs your consent, for example a new use of health data, a new AI feature, AI video analysis, or a new country for storage, we will ask first. Earlier versions are available on request.
A19. Contact and complaints
Mind & Physique For Lifestyle Coaching
Dubai, United Arab Emirates
Email: support@miphyfitness.com (privacy contact and grievance officer: Niranjan, founder)
Please contact us first so we can try to fix the problem. You can also complain to the data protection authority in your country (Part B).
Part B: extra rules for your country or region
Part A applies everywhere. The sections below add what each law requires. We follow the law that gives you more protection.
B1. United Arab Emirates (home law)
Law: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). It applies to people in the UAE and to our processing as a UAE company.
- Health and other sensitive data: the PDPL treats data about your physical, psychological or mental condition, biometric data and religious beliefs as sensitive personal data. We process it only with your specific, clear and unambiguous consent (section A8), given separately for AI help.
- Not a health service: MiPhy is a general fitness and wellbeing app, not a licensed health facility, and does not provide health services.
- Transfers outside the UAE: the UAE has not yet published a list of countries with adequate protection. We transfer data to India (main storage) and the USA (section A11) under binding contracts with each provider that require PDPL-level protection, together with your express consent given in the app (PDPL Article 23).
- Your rights (PDPL Articles 13 to 18): information about the processing; data portability; correction and erasure; restriction; stopping processing; and objecting to decisions based only on automated processing, with the right to ask for human review. We do not make such decisions.
- Data protection officer: Niranjan, founder, support@miphyfitness.com.
- Breaches: we will notify the UAE Data Office and affected people as the PDPL and its Executive Regulations require.
- Complaints: contact us first. You can then complain to the UAE Data Office. As of October 2026, the PDPL's Executive Regulations have not been published, and the Telecommunications and Digital Government Regulatory Authority (TDRA) acts as the interim contact.
B2. India
Law: the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. It applies because we offer MiPhy to people in India and store data in India.
Notice in brief (Rule 3). We, Mind & Physique For Lifestyle Coaching, are the data fiduciary.
| Personal data | Purpose (service it is needed for) |
|---|---|
| Email, password or Google sign-in, name, account ID | Creating your account and signing you in |
| Approximate city and country at sign-in | Security, and seeing roughly where beta testers are |
| Setup answers (age, sex, height, weight, goals, pain, conditions and their follow-up answers including medicine groups, pregnancy and other "right now" answers, diet, allergies, training) | Personalising your plan, targets and safety notices |
| Logs: food, water, steps, workouts, habits, body stats, measurements, mindfulness, mood and sleep, check-ins | Showing your progress and adjusting your plan |
| Posture photos and form videos | Letting you compare your posture and form over time |
| Meal photos | Identifying the food in Snap a meal (only with AI help on), and keeping the photo with the meal (only with "Keep my photos" on) |
| Your plan (made from ready-made programs and our training rules, without AI) | Giving you a workout plan that fits your answers |
| AI chat messages and the profile summary in section A6 | AI coach replies, food logging in the chat and check-in suggestions (only with AI help on) |
| Technical logs | Security and fixing problems |
- Consent: we rely on your consent for each purpose, given in the app. Where we rely on a "legitimate use" under section 7 of the Act (for example, complying with a law or responding to a medical emergency), we say so.
- Withdraw consent: Profile → Privacy, or email support@miphyfitness.com. Withdrawing is as easy as giving consent. When you withdraw, we stop and delete the data unless a law requires us to keep it.
- Your rights: information about your data and who it was shared with; correction, completion, updating and erasure; grievance redressal; and to nominate another person to exercise your rights if you die or become unable to act (email us with their name and contact).
- Grievance officer: Niranjan, founder, support@miphyfitness.com, Dubai, United Arab Emirates. We respond within 30 days, and in any case within the 90 days the Rules allow.
- Complaints to the Board: if you are not satisfied, you can complain to the Data Protection Board of India through the online channel the Board publishes. Updates are available from the Ministry of Electronics and Information Technology (https://www.meity.gov.in).
- Transfers: your data is stored in Mumbai, India. Some is processed in the USA (section A11). The Act allows this unless the Government restricts a country; we will follow any such restriction.
- Breaches: we will tell you and the Board without delay, with a detailed report to the Board within 72 hours, as the Rules require, and report cyber incidents to CERT-In where required.
- Children: MiPhy is for adults only (section A16), so we do not process children's data.
- Languages: this notice is in English. You can ask us for it in Hindi or in any other language listed in the Eighth Schedule to the Constitution of India, and we will provide it.
B3. Switzerland
Applies if you live in Switzerland. Law: the Federal Act on Data Protection (nFADP).
- Controller: Mind & Physique For Lifestyle Coaching (section A1). We have no office in Switzerland.
- Health data is sensitive personal data. We process it only with your explicit consent (section A8), and send it to our AI provider only with a separate explicit consent (AI help).
- Do you have to give the data? Account data and the health-information consent are needed to use the app; without them we cannot provide it. AI help, Keep my photos, form videos and every optional setup question are your choice.
- Transfers outside Switzerland: to India (Supabase, main storage) under standard contractual clauses adapted for Swiss law; to the USA (Resend, Google, Anthropic) under the Swiss-U.S. Data Privacy Framework where the provider is certified, and otherwise under those clauses. You can ask us for a copy.
- Rights: information and access, correction, deletion, data portability, objection, withdrawing consent at any time, and not being subject to automated individual decisions (we make none).
- AI: the AI coach is clearly labelled as AI.
- Complaints: the Federal Data Protection and Information Commissioner (FDPIC) (https://www.edoeb.admin.ch).
- Breaches: we notify the FDPIC as soon as possible where a breach is likely to lead to a high risk for you, and tell you where needed to protect you.
B4. United States
We do not sell personal data, do not share it for targeted advertising, and do not profile you in ways that produce legal or similarly significant effects. We do not use your personal data to train large language models or any AI model.
B4.1 Consumer health data (Washington, Nevada, Connecticut and similar laws)
Much of what you log in MiPhy is "consumer health data" under Washington's My Health My Data Act, Nevada's SB 370 (NRS 603A), and Connecticut's consumer health data rules. Our separate Consumer Health Data Privacy Policy explains exactly what we collect, why, who we share it with, and how to use your rights. In short:
- we collect consumer health data only with your consent, and only for the features you use;
- we share it only with the service providers in section A10 that process it for us, and with the AI provider only after your separate consent (AI help);
- we never sell it;
- we do not use geofencing;
- you can access it (including a list of every third party we shared it with), delete it (including from our providers), and withdraw consent at any time.
B4.2 Your rights in states with privacy laws
Depending on your state (for example California, Colorado, Connecticut, Texas, Virginia and others), you may have the right to: know and access your data; correct it; delete it; get a portable copy; opt out of sale, targeted advertising and significant profiling (we do none of these); and limit the use of sensitive data (we use it only to provide the service you asked for, with your consent). Use them by emailing support@miphyfitness.com. You can use an authorised agent; we may ask them for proof. We do not discriminate against you for using your rights.
Appeals: if we decline your request, you can appeal by replying to our decision with "Appeal" in the subject. We answer appeals within 45 days. If you are not satisfied, you can contact your state Attorney General.
B4.3 California
The categories of personal information we collected in the last 12 months are listed in section A4: identifiers (email, account ID), approximate geolocation (city and country of your internet connection at sign-in), personal records (name), characteristics (age, sex), sensitive personal information (health information, account sign-in), audio, electronic, visual or similar information (photos including meal photos, and form videos, which may include sound; voice typing is handled by your phone's or browser's speech service, and MiPhy never receives the audio), and internet activity limited to server logs. Sources: you, and Google if you use Google sign-in. Purposes: section A7. Disclosed for a business purpose to: the service providers in section A10. Sold or shared: none. Retention: section A12. Do Not Track and Global Privacy Control: we do not track you across other sites or apps, and no third party tracks you through MiPhy, so these signals have nothing to change; we treat them as a request to opt out anyway.
B4.4 Health breach notices
If a breach of your unsecured health information happens, we will notify you, and the U.S. Federal Trade Commission where its Health Breach Notification Rule applies.
B5. Other Gulf countries, and UAE free zones
- Bahrain (Law No. 30 of 2018): health data is sensitive and is processed with your consent. Transfers abroad rely on your consent and contractual safeguards. Complaints: the Personal Data Protection Authority.
- Kuwait: there is no general data protection law that applies to us; Part A applies in full.
- DIFC and ADGM: their data protection laws apply only to businesses licensed or processing data in those free zones. We are not, so the federal PDPL (B1) applies to people there.
B6. Other countries
Brazil (LGPD). Health data is sensitive and is processed with your specific, highlighted consent (Art. 11). Transfers to India and the USA use the ANPD's standard contractual clauses. Our data protection officer (encarregado) is our founder, Niranjan, support@miphyfitness.com, and you can write in Portuguese. You can complain to the ANPD (https://www.gov.br/anpd).
Canada (PIPEDA; Quebec Law 25). We get your express consent for health information. The person in charge of protecting personal information is our founder, Niranjan, support@miphyfitness.com. Your data is stored in India and processed in the USA, where it may be accessed by local authorities under local law; we assessed these transfers before making them. We use no technology that profiles, identifies or locates you. Complaints: the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca), or in Quebec the Commission d'accès à l'information (https://www.cai.gouv.qc.ca).
Australia (Privacy Act 1988). We treat MiPhy as handling health information under the Australian Privacy Principles. Your data is disclosed to recipients in India and the USA (section A10). We do not use computer programs to make decisions that significantly affect your rights or interests; AI features only suggest, and you decide. You can access and correct your information and complain to us, then to the Office of the Australian Information Commissioner (https://www.oaic.gov.au). We follow the Notifiable Data Breaches scheme.
Singapore (PDPA). Our data protection officer is our founder, Niranjan, support@miphyfitness.com. Transfers abroad are protected by contract to a comparable standard. Complaints: the Personal Data Protection Commission (https://www.pdpc.gov.sg).
Japan (APPI). We obtain your consent before acquiring special care-required information (such as medical history). Your data is transferred to India and the USA; information on their privacy laws is available from Japan's Personal Information Protection Commission, and we protect the data by contract. Our security measures are described in section A14. Regulator: PPC (https://www.ppc.go.jp/en/).
South Korea (PIPA). Health information is processed with your separate consent. Data is stored in India and processed in the USA by the providers in section A10, for the purposes and periods in sections A7 and A12. You can refuse; optional features then stop. Regulator: PIPC (https://www.pipc.go.kr).
South Africa (POPIA). Health information is special personal information, processed with your consent. Our information officer is our founder, Niranjan, support@miphyfitness.com. Regulator: the Information Regulator (https://inforegulator.org.za).
Nigeria (NDPA 2023), Kenya (DPA 2019), Türkiye (KVKK) and others with similar laws. Health data is processed with your explicit consent, and transfers abroad use contractual safeguards. You can complain to your national authority (Nigeria: NDPC; Kenya: ODPC; Türkiye: KVKK).
B7. Where MiPhy is not offered during the beta
During the beta, MiPhy is not offered in the European Union, the European Economic Area (Iceland, Liechtenstein and Norway), the United Kingdom, Saudi Arabia, Oman, Qatar or mainland China.
B8. Everywhere else
If you live in a country not named above, Part A applies to you in full: you have every right in section A15, health information is collected only with your consent, it is never sold, and we follow any stricter rule in your local law. If your local law gives you a right this policy does not mention, email us and we will honour it.