Privacy Policy
This policy describes how Based Body System, LLC ("Bespoke Physique," "we," "us") collects, uses, and protects your information when you use the Bespoke Physique iOS and Apple Watch apps, the Bespoke Physique web planner, and thebespokephysique.com (together, "the Service").
What we collect
Information you provide directly. Your account details (name, email address, sign-in credentials) and the data you log in the Service: body weight, blood pressure, blood sugar, meals and nutrition entries, training sessions and logged sets, recovery and readiness inputs, travel windows, personal notes, and schedules and adherence records for supplements and physician-supervised protocols.
Documents and photos you upload. DEXA scan reports, blood panel results, supplement or food label photos, and meal photos. These are processed to extract structured data (for example, turning a blood panel PDF into trended lab markers, or estimating the macronutrients of a photographed meal).
Apple Health data, with your permission. If you grant access, the app reads health data from Apple Health — such as sleep, heart-rate variability, resting and sleeping heart rate, steps, active energy, workouts, and glucose data from connected devices — and writes your morning weigh-in back to Apple Health. You control this access in iOS Settings and can revoke it at any time. Apple Health data is used only to provide the Service's features to you. It is never used for advertising, never sold, never used for data mining unrelated to the Service, and never shared with third parties except as needed to provide the Service to you with your consent.
Technical information. Basic device and usage information needed to operate the Service reliably: device type, app version, log-in events, and diagnostic and crash information.
What we do with it
We use your information to operate the Service: to display your data back to you across the web planner, iPhone, and Apple Watch; to compute your training prescriptions, energy balance, recovery scores, adherence, and trends; to generate meal plans, packing lists, and schedules; to send notifications you've enabled (such as check-in and dose reminders); to provide support; and to maintain, secure, and improve the Service.
AI processing. Some features send your data to third-party AI processing providers to do their work — for example, estimating macros from a meal photo, extracting structured markers from an uploaded DEXA or blood panel, and Signal, the intelligence layer that answers questions about your own data. These providers process your data on our behalf, under commercial terms that prohibit using it to train their models. They retain it only briefly — currently up to seven days — so they can detect misuse of their service, after which it is deleted. They may not use it for any other purpose of their own.
What we share, and with whom
We share data only with the service providers required to run the Service, and we name them rather than describing them in categories: Neon (database hosting), Vercel (application hosting), Anthropic (AI processing), FatSecret (nutrition database lookups), Resend (transactional email), Stripe (payments — billing identity only, no health data), Google (sign-in — email address only, no health data), Apple (App Store and TestFlight distribution, notifications, HealthKit), and HeyCatch (marketing analytics on our public website only — never in the apps, the planner, or the application form). Each provider receives only what its function requires, and none is permitted to use your data for its own purposes. Based Body System, LLC has no parent, subsidiary, or affiliated company, so there is no affiliate sharing to disclose.
Beyond that, we disclose information only if required by law or legal process, to protect the rights, safety, or property of you, us, or others, or as part of a business transition (in which case this policy continues to apply to your data).
We do not sell or rent personal information. We do not share it with data brokers or advertisers. We use one analytics provider, HeyCatch, and only on our public marketing pages, to understand which channels bring people here. It is deliberately absent from the advisory application form and from these legal pages. No health data ever reaches it, and no data from the Service is used to target advertising.
The shared restaurant library
One feature deserves its own explanation, because it is the only place where anything derived from your data helps somebody other than you.
When you eat out, the Service can estimate a dish's macros from the menu description. Those estimates get better when they are corrected by what people actually ate. So when you photograph a restaurant plate and record it, the macronutrient numbers alone — calories, protein, carbohydrate, fat — may be added to a shared library for that dish at that restaurant, and used to improve the estimate the next member sees.
What is contributed: four numbers, the dish name, and the month. That is all.
What is never contributed: your name, your account, any identifier that could be traced to you, the date you ate it, the photograph, your notes, or anything about your body, your protocol, or your plan. Contributions are pooled and surfaced only as an aggregate — never as an individual meal, and never in a way that could be attributed to a person. The photograph itself is discarded after the estimate is produced, as described below.
We consider this de-identified data rather than personal information, and we do not sell it, license it, or share it outside the Service. If you would prefer not to contribute at all, email us and we will turn it off for your account. Everything else works exactly the same way; you will simply be drawing on the library without adding to it.
Retention and deletion
We keep your data for as long as your account is active, because longitudinal trends are the point of the Service. If you close your account — or ask us to — we will delete your personal data from our active systems within 30 days, and from encrypted backups and archives as those are cycled, in no case more than six months from your request. We instruct every service provider named above to do the same. We will confirm when active deletion is complete, and again when backups have cycled. The only things we keep are records we are legally required to keep, such as billing records. To request deletion, email james@thebespokephysique.com from your account email.
Security
Your data is encrypted in transit and at rest. Access is restricted to your own authenticated account; sign-in credentials are stored using the iOS secure keychain on device. No system is perfectly secure, but the Service is built and operated on the assumption that your health data deserves financial-grade care.
Your rights
You can access and review your data in the Service at any time. You may request a copy of your data, correction of inaccurate data, or deletion of your account and data by emailing james@thebespokephysique.com. Depending on where you live, you may have additional rights under applicable privacy laws (for example, state privacy laws in the United States or the GDPR in the European Union), including the right to lodge a complaint with a supervisory authority. We honor these requests regardless of jurisdiction wherever practicable.
How quickly we respond. We will provide a copy of your electronically stored health information within 15 business days of a request, and complete a deletion request within 30 days, excepting records we are legally required to keep. If a request will take longer than that — because it is unusually large, or because we need to verify who you are — we will tell you before the deadline rather than after it.
Consumer health data
Health data has its own, stricter rules in some states, and its own policy here. Our Consumer Health Data Privacy Policy sets out exactly which categories of health data we collect, where each one comes from, every company that processes it, by name, and how to see it, withdraw consent, or have it deleted. It applies to everyone, not only residents of the states that require it.
Notice regarding electronic disclosure of your health information
This notice is provided under Texas Health and Safety Code § 181.154.
Bespoke Physique creates and receives health information about you, and that information is subject to electronic disclosure in the ordinary course of providing the Service. Concretely, that means your information is transmitted electronically to, and stored electronically by, the service providers described above — our hosting and database infrastructure, our AI processing providers, our payment processor, and Apple — each receiving only what its function requires.
We do not electronically disclose your health information for any purpose other than operating the Service for you. We do not disclose it for marketing, we do not sell it, and we do not provide it to data brokers or advertisers.
Your authorization. Except where a disclosure is required or permitted by law, we ask for your authorization before disclosing your health information electronically, and you may withdraw that authorization at any time by writing to james@thebespokephysique.com. Withdrawal applies going forward; it does not undo disclosures already made. Because the Service cannot be operated without transmitting your data to the infrastructure that runs it, withdrawing this authorization ends the Service — we will tell you so plainly rather than quietly degrading what you receive.
What this Service is not
The Service measures, organizes, and educates. It does not provide medical advice, diagnosis, or treatment. Protocol-tracking features are private logging tools for regimens prescribed and managed by your own licensed clinician. Nothing in the Service is a substitute for the judgment of a physician who knows you.
Age
The Service is intended for adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us and we will delete it.
Changes
If we change this policy, we'll update the effective date above and, for material changes, notify you in the app or by email before the change takes effect.
Contact
Based Body System, LLC (d/b/a Bespoke Physique Protocol)
james@thebespokephysique.com