ETHEREAL BODYLABS

Privacy Notice

Last updated: 29 July 2026

1. Who we are

Ethereal Material Pty Ltd (trading as "Ethereal Bodylabs"), an Australian company, is the data controller for the personal data processed through the Ethereal Bodylabs service ("Service"). You can contact us at privacy@etherealbodylabs.app.

2. Data we collect

  • Account data: name, email, password hash, authentication tokens, passkeys.
  • Profile & fitness data: body metrics, workouts, exercise logs, personal records, nutrition and meal entries, dosing/protocol logs, physique photos.
  • Health-related data you choose to add: bloodwork uploads, symptoms, medical notes.
  • AI interactions: prompts and messages you send to Alice and other AI features.
  • Device & usage data: IP address, browser/device identifiers, telemetry and logs used to secure and improve the Service.
  • Support communications: messages you send us.

3. Why we use your data (purposes and legal bases)

  • To provide the Service — account creation, tracking, coaching, AI features (contract performance).
  • To keep the Service safe — fraud, abuse, and security monitoring (legitimate interests).
  • To communicate — service updates and support (contract / legitimate interests); marketing only with your consent.
  • To improve the Service — aggregate analytics and product improvement (legitimate interests).
  • To meet legal obligations — tax, accounting, and lawful requests (legal obligation).

4. Sharing your data

We share personal data only with:

  • Service providers & subprocessors we use to run the Service, including hosting, database, storage, email, and AI model providers.
  • Payment processors (RevenueCat and Stripe for web billing; Apple for iOS in-app purchases) for subscription management, payment processing, tax compliance, and invoicing.
  • Professional advisers such as legal and accounting firms where necessary.
  • Authorities where required by law or to protect our rights and users.

We do not sell your personal data.

5. International transfers

Some subprocessors are located outside your country of residence, including in the United States and the European Union. Where personal data is transferred from the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an applicable adequacy decision.

6. Retention

We retain your personal data only for as long as needed to provide the Service and to comply with legal obligations. When you delete your account, we delete or anonymise personal data within a reasonable period, except where retention is required by law (e.g. tax records).

7. Your rights

Subject to applicable law you may have the right to:

  • access your personal data and request a copy;
  • correct inaccurate data;
  • request erasure ("right to be forgotten");
  • restrict or object to certain processing;
  • data portability;
  • withdraw consent where processing is based on consent;
  • lodge a complaint with your local data protection authority.

To exercise these rights, email privacy@etherealbodylabs.app. We will respond within one month.

8. Security

We use appropriate technical and organisational measures — including encryption in transit and at rest, role-based access controls, database row-level security, audit logging, and secure authentication (including passkeys and OTP) — to protect your personal data.

9. Cookies

We use essential cookies for authentication and session management, and minimal analytics cookies to understand aggregate product usage. You can control cookies via your browser settings.

10. Changes

We may update this notice from time to time. Material changes will be notified in-app or by email.