How we handle your data

Account information

Email address, name, and password hash when you register.

Onboarding data

Age, sex, height, weight, body fat estimate, training experience, goals, dietary preferences, training environment, and schedule.

Progress photos

Photos you upload for physique analysis. You choose how they are handled: "Analyse only" (the default) means the photo is analysed and then discarded, and only the written analysis is kept; "Store securely" means the photo is encrypted and kept so you can compare progress over time. We never keep a photo without that choice, and you can change it in Settings at any time.

Body measurements

Weight entries, body measurements, and check-in data you submit over time.

Training and nutrition data

Your generated plans, logged workouts (sets, reps, weights), meal logs, and food scans.

Health Connect data

If you connect Health Connect on Android, MaiaForm can read permissioned health data such as steps, sleep, weight, workouts, heart rate, heart-rate variability, and active calories. Imported health data is optional and can be cleared in the app.

Coach conversations

Text messages and voice transcripts from your interactions with the AI coach.

Voice recordings

If you use voice coaching, audio is streamed to our AI provider for real-time processing. We do not store raw audio recordings after the session ends.

Device and usage data

Browser type, device type, and basic usage patterns to maintain and improve the service.

AI coaching and plan generation

Your profile, measurements, training data, and conversation history are sent to Google Gemini (our AI provider) to generate personalised training plans, nutrition plans, physique analysis, and coaching responses.

Progress tracking

We use your check-ins, photos, and measurements to generate reports and track your progress over time.

Wearable context

Permissioned Health Connect data may be used to prefill editable check-ins and provide coaching context. MaiaForm does not require wearable data to use the core app.

Service improvement

Aggregated, anonymised usage patterns may be used to improve the product. We do not sell your personal data.

Account management

Email address is used for account authentication and essential service communications.

Google Gemini API

Your data is processed by Google's Gemini AI models to provide coaching, analysis, and plan generation. This means your profile information, photos, and conversations are sent to Google's servers for processing.

Data sent to AI

When you interact with the coach, we send relevant context including your profile, current plans, recent check-ins, and conversation history to generate accurate responses.

Photo analysis

Progress photos are sent to our AI provider (Google Gemini by default) for physique analysis, not retained by Google beyond the API request. Photos are only stored on our infrastructure, encrypted, if you chose to store them.

Storage location

Your data is stored on our servers using PostgreSQL (structured data), MinIO (photos and files), and Redis (temporary cache). Infrastructure is hosted on European servers.

Encryption

Passwords are hashed using industry-standard algorithms. Stored progress photos and API keys you provide are encrypted at rest using Fernet encryption, and photo metadata such as location is removed before analysis or storage. All connections use HTTPS/TLS.

Access control

Access to production data is restricted to authorised administrators. User photo and file access is mediated by JWT-based API authentication and account-scoped storage paths.

Active accounts

Your data is retained for as long as your account is active and you continue to use the service.

Account deletion

You can delete your account yourself in Settings → Your data & privacy, or by contacting us. Deletion immediately and permanently removes your profile, health details, coach conversations, plans, logs, check-ins, photo analyses and stored photos from our systems. We do not keep backup copies, so nothing is retained once deletion completes. You can also delete all photos at any time without closing your account.

Voice data

Voice audio is streamed in real-time and not stored after the session. Transcripts of voice conversations are stored as part of your coach history.

Access

You can view all your data within the app (profile, plans, progress, conversations).

Correction

You can update your profile information and settings at any time.

Deletion

You can delete your photos, or your account and all associated data, yourself in Settings at any time.

Data portability

You can export your progress data from within the app.

GDPR

If you are in the UK or EU, you have additional rights under GDPR including the right to restrict processing and the right to object. Contact us to exercise these rights.

Google Gemini

AI model provider for coaching, analysis, and plan generation.

Stripe

Payment processing for paid subscriptions (when payments are enabled).

RevenueCat

Native mobile subscription and restore-purchase status for Android and iOS app builds.

Google Health Connect

Optional Android health-data permission and data-sharing layer controlled by your device settings.

Infrastructure providers

Hosting, database, and storage services to run the application.

Privacy requests

For any privacy-related questions, data access requests, or account deletion requests, contact us at privacy@maiaform.com.

Updates

We may update this policy as the product evolves. Material changes will be communicated through the app.