BodySleepMind — Body, Sleep, Mind, understood as one.
Effective date: 8 August 2026
[Legal Entity Name] ("BSM", "we", "us", "our"), a company registered in England and Wales under company number [Company Number], whose registered office is at [Registered Office Address], provides the BodySleepMind wellness platform available at bodysleepmind.com and through associated applications (the "Service"). This Privacy Policy explains what personal data we collect from and about you, why we collect it, how we use it, who we share it with, and the rights you have over it.
BSM is a wellness intelligence platform. It is not a medical device and does not diagnose, treat, cure or prescribe. Some of the information you give us, and some of the information generated about you through the Service, is nonetheless health-related, biometric or genetic in nature and is treated as "special category data" under UK GDPR and, where applicable, the EU GDPR. We explain below how we handle that data with additional care.
This Policy applies to individual members, family members added to a Family Hub (including members under 18), coaches and instructors, business and therapist account holders, and visitors to our website, wherever in the world they are located. Where local law gives you rights in addition to those described here, those local rights also apply.
Please read this Policy alongside our Terms of Service and our Cookie Policy, which are incorporated by reference.
BSM is the data controller for the personal data described in this Policy, except where we say otherwise (for example, where a third-party science partner acts as controller for tests it carries out on your behalf, as explained in the "Third-Party Science Partners" section below).
Data protection queries can be directed to our privacy team at [privacy@bodysleepmind.com] or by post to [Registered Office Address]. If we appoint a Data Protection Officer, their contact details will be published here and kept up to date.
If you are in the UK, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EEA, you may complain to your local supervisory authority. We would appreciate the chance to address your concerns directly first.
We collect the following categories of personal data. Not every category applies to every user — what we collect depends on which parts of the Service you use.
When you complete your Wellness Study or update your Wellness Report, you provide information that is used to build your personalised Body, Sleep and Mind plans. This includes, depending on what you choose to answer:
If you choose to use optional verification tools, our accredited third-party science partners generate additional data that is fed into your Wellness Report:
These are optional. You are never required to use a verification tool to use the core Service, and you can delete verified results from your account at any time, which will also stop them being used in your Wellness Report.
The Verification Centre also lets you manually log the outcome of a real-world test you have had done elsewhere (for example, by your own GP or another lab) against a specific wellness factor. A logged outcome is treated as verified data and takes priority over your self-assessed answers for that factor.
Where we offer the ability to connect a wearable device or a third-party health app, and you choose to do so, we will receive data such as sleep, activity or heart-rate metrics from that integration, subject to your consent and the terms of the device or app provider. This is an optional, opt-in connection, and we will describe the specific data involved at the point you connect it.
Where a Family Hub account holder (the "Family Head") invites a family member under 18 to join, we collect the same categories of data described above for that young person, plus a record that the account was created and is being monitored by the Family Head. See the "Children's Data and Family Hub" section below for how we handle this.
Subscription payments are processed by Stripe. We receive confirmation of payment, your subscription tier, and limited billing metadata (such as the last four digits of your card and billing country) but we do not store your full card number. Stripe's own privacy policy governs their handling of your payment details.
If you hold a Coach/Instructor, Business, Gym, College, Therapist or Private Health account, we also collect professional profile details, qualifications you choose to display, seat and team management data for members you administer, and billing details for your organisation.
We rely on the following legal bases under UK GDPR (and EU GDPR, where it applies to you):
Where we ask for your consent, we will tell you clearly what we are asking for and give you an easy way to say no or to withdraw consent later without affecting the lawfulness of processing before withdrawal.
Health, biometric, genetic and (where provided) ethnicity data are "special category data". We only process this data with your explicit, opt-in consent, collected at the point you complete the Wellness Study, connect a verification tool, or otherwise submit it.
You can withdraw this consent at any time from your account settings or by contacting [privacy@bodysleepmind.com]. If you withdraw consent, we will stop using the relevant data to generate new recommendations, and — unless we are required to keep it for a legal reason — we will delete it in line with the "How Long We Keep Your Data" section below.
We restrict internal access to special category data to the systems and staff who need it to run the Service, apply encryption in transit and at rest, and do not sell this data.
The Service is intended for account holders aged 18 and over. A person under 18 may only use the Service if they have been invited into a Family Hub by a Family Head who confirms they hold parental responsibility for that young person and agrees to monitor their usage.
Where a young person under 13 is added, the Family Head is providing consent on their behalf, as permitted under UK GDPR for information society services offered directly to a child below the age of consent. Where a young person is 13–17, they may provide certain inputs themselves, but the Family Head retains oversight and administrative control of the account, including visibility of activity and the ability to remove the account.
We do not knowingly collect data from a child under 18 whose account was not created through a Family Head, and we do not send direct marketing to accounts we know belong to a user under 18. If we learn that a young person has been added without appropriate parental responsibility or consent, we will suspend the account and work with the Family Head to resolve it, deleting the data if required.
A Family Head or a young person who is old enough to exercise their own data protection rights can contact us at [privacy@bodysleepmind.com] to access, correct or delete a young person's data.
Katie AI is an in-product assistant (presented under staff or persona names such as Katie, Michael, Maria or Nigel) that responds to text and voice input using your Wellness Report, an internal knowledge base curated by our team, and the conversation itself. When you use the "Scan Your Meal" or supermarket-label scanning feature, your photo is sent to a third-party AI vision provider to identify the food or extract nutrition information; when you use barcode lookup, the barcode is checked against the Open Food Facts database and USDA nutrition data. Inputs and outputs across these features may be processed by third-party AI infrastructure providers acting as our processors, under contractual terms that prohibit them from using your data to train their own general-purpose models.
When you first interact with our chat assistant, we may also ask a short set of triage questions to place you into a general wellness-personality segment (for example, whether you are more of a planner or a spontaneous experimenter). This is used to tailor tone and content, not to make any decision that affects your legal rights, and is treated with the same care as other Wellness Study data.
None of these automated features make medical decisions, and no output from Katie AI, the food scanner, or any other automated feature (including your Food Score, wellness scoring or plan recommendations) is used to make a decision about you that produces a legal or similarly significant effect without the possibility of human review. You can always ask a member of our support team to review an automated recommendation.
Voice input to Katie AI and video/audio in Talk & Meet are processed to provide the feature (for example, converting speech to text) and, where you have consented, may be retained to improve response quality. You can disable voice input and delete stored voice/chat history from your account settings.
The "One Click Doctor Share" feature lets you generate a summary of your Wellness Report and open it in your own email application, addressed to a GP or other healthcare provider you choose. This is entirely user-initiated and user-transmitted: BSM's servers do not send your Wellness Report to any healthcare provider on our own initiative, and we do not see or retain a copy of the specific email you send. You control what level of detail is included, from a basic profile to full study data, and whether to send it at all.
Once you send that email, the healthcare provider's own handling of that data is governed by their obligations as a healthcare professional, and the security of the transmission is governed by your own email provider, not by BSM or this Policy.
Where you choose to use a verification tool (biomarker panel, gut microbiome mapping, DNA-based wellness insights, skin-microbiome analysis, or similar tools we add over time), that test is carried out by an accredited third-party partner. Depending on the partner and the test, that partner may act as an independent controller of the sample and raw result data, with BSM receiving a summary output to feed into your Wellness Report.
We only work with partners who are appropriately accredited and who commit contractually to protecting your data. Each partner's own privacy notice, provided to you before you use their test, explains their handling of your sample and results in more detail. We encourage you to read it before proceeding.
Your suggested wholefoods, supplements, activities and mind/sleep therapies may reference third-party products and services. Where we display or link to a third-party product, this is a wellness suggestion based on your Wellness Report, not a personal recommendation from a qualified professional, and we do not share your special category data with the third-party product provider unless you separately choose to purchase from or connect with them.
Some of these suggestions may be part of a commercial or affiliate relationship, meaning BSM may receive a fee if you purchase a suggested product. This does not affect the wellness logic used to generate the suggestion, and we will indicate clearly where a commercial relationship exists.
Wellness Meet lets you connect and message other members, join or create groups, and, for Coach/Instructor, Business, Therapist and Private Health accounts, maintain a public professional profile listed in our member directory. Information you choose to put in a public profile (name, photo, bio, services, credentials) is visible to anyone who views the directory, including people who are not registered members.
Messages, group posts, images and video you share through Wellness Meet are visible to the recipients or group members you choose, and are retained so that conversations remain available to participants. We may access this content where necessary to investigate abuse, enforce our Terms, or comply with law.
To protect younger members, family members under 18 do not have access to the public member directory, cannot create a public profile, and cannot message or be messaged by members outside their own Family Hub.
Connection requests, blocks, and group memberships are recorded so the feature can function (for example, so a blocked member cannot re-contact you). You can leave a group, disconnect from a connection, or delete your public profile at any time from your account settings.
Separately from member accounts, we maintain a contact database of prospective customers and business contacts — for example, people who enquire about a Business, Coach, Therapist, gym, college or Private Health arrangement, or who ask about becoming a technology or distribution partner. This may include name, email, organisation, and notes about your enquiry, processed on the basis of our legitimate interest in responding to your enquiry and, where you consent, to send you relevant marketing. You can unsubscribe at any time using the link in any marketing email we send you, or by contacting us as described in "Marketing Communications" below.
If you access the Service because your employer, health plan, gym, college or university, or another organisation (a "Sponsor") has arranged access for you, your Sponsor can typically see that you have an account, your registration and last-active dates, and aggregate, de-identified usage statistics about their group as a whole. Your Sponsor cannot see your individual Wellness Study answers, health data, Wellness Report, or the content of your conversations with Katie AI, Talk & Meet, or Wellness Meet, unless you separately and explicitly choose to share that information with a named coach, instructor or therapist connected to that Sponsor.
We use strictly necessary cookies for essential site functionality, such as keeping you signed in (including a login cookie that can keep you signed in for up to 30 days) and remembering your preferences; these do not require consent. Where we use non-essential cookies — for example, to understand how the Service is used or for marketing — we ask for your consent first via our cookie banner, and you can withdraw it at any time. We currently do not respond differently to browser "Do Not Track" signals, but we do honour opt-out preference signals such as Global Privacy Control where legally required to do so. Full detail, including a list of cookies used and how to manage your preferences, is set out in our Cookie Policy, available at bodysleepmind.com/cookie-policy/.
We do not sell your personal data. We share it only in the following circumstances:
BSM serves users worldwide, and some of our service providers and science partners are located outside the UK and the EEA. Where we transfer personal data internationally, we use appropriate safeguards recognised under UK GDPR, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or a finding that the destination country provides an adequate level of protection. You can request more detail on the safeguard used for a specific transfer by contacting [privacy@bodysleepmind.com]. Where required because we do not have an establishment in the EEA, we will appoint an EU representative under Article 27 GDPR; their contact details, once appointed, will be published here as [EU Representative Name and Address].
We keep personal data for as long as your account is active, plus a limited period afterward to comply with legal, accounting and regulatory requirements, resolve disputes, and enforce our agreements. As a general guide:
We use technical and organisational measures appropriate to the sensitivity of the data involved, including encryption in transit and at rest, access controls limiting who can view special category data, network security provided through our infrastructure and CDN/security partners, and regular review of our security practices. No system is completely secure, and we ask you to also protect your account with a strong, unique password and to contact us immediately if you suspect unauthorised access.
Subject to certain exceptions, you have the right to:
To exercise any of these rights, contact [privacy@bodysleepmind.com]. We will respond within one month, extendable by a further two months for complex requests, and we will let you know if an extension is needed. We may need to verify your identity before actioning a request.
As a self-service option, you can already download a PDF copy of your Wellness Report at any time from the Wellness Report page, generated directly in your browser without needing to contact us.
We do not use your data to make decisions that produce legal or similarly significant effects about you based solely on automated processing without human involvement. Your Food Score, wellness scoring, and plan recommendations are automated suggestions intended to inform your own choices, not decisions made about you, and you can always request human review through support.
When you complete onboarding and give us your name and email address, you expressly agree that we may contact you by email with marketing and product update communications — for example, wellness content, new features, and relevant offers. This is separate from, and in addition to, the transactional emails we send to operate your account (such as welcome and verification emails), which are not marketing and are not affected by an opt-out.
You can withdraw this agreement and opt out of marketing emails at any time, at no cost, and as easily as you gave it, using the one-click "unsubscribe" link included in every marketing email, or the marketing-email toggle in your account settings if you are logged in. Opting out takes effect immediately. You can also contact us at [marketing@bodysleepmind.com] or [privacy@bodysleepmind.com] if you have any trouble using either method.
We will not send marketing communications to accounts we know belong to a user under 18, and we do not send marketing emails to a Family Hub member added by a Family Head unless that member independently provides their own agreement to receive them.
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, or another US state with a comprehensive consumer privacy law, you have rights broadly similar to those in "Your Rights" above: to know what personal data we hold about you, to access and correct it, to delete it, to obtain a portable copy, and to opt out of the sale of personal data, of targeted advertising, and of profiling with legal or similarly significant effects. We do not sell your personal data and do not use special category health data for targeted advertising. You can exercise these rights by contacting us using the details in "Contact Us" below; we will not discriminate against you for exercising them.
If you are located in the United States, please note that BSM is not a HIPAA covered entity or business associate, and this Service is not intended to be used to store or transmit protected health information subject to HIPAA unless we have a separate written agreement with you covering that use.
We may update this Policy from time to time to reflect changes to the Service, the law, or our data practices. If we make material changes, we will notify you by email or through the Service before the changes take effect. The "Effective date" at the top of this Policy shows when it was last updated.
If you have any questions about this Policy or how we handle your data, contact us at [privacy@bodysleepmind.com] or write to [Registered Office Address]. If you are not satisfied with our response, you can contact the ICO at ico.org.uk or 0303 123 1113, or the supervisory authority in your own country.