Effective Date: 15 June 2026 Last Updated: 19 October 2026 App: Biohack Tracker Operated by: Broly Group Pty Ltd (ACN 698 980 915), Victoria, Australia Contact:[email protected]
1. Introduction
Biohack Tracker is operated by Broly Group Pty Ltd (ACN 698 980 915) ("we," "our," or "us"), and is built on a privacy-conscious principle. This Privacy Policy explains how we collect, use, store, and protect your information when you use our mobile application and related services. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Health information is sensitive information and is treated with a higher standard of protection.
Our core commitments: Your data is stored in your private, password-protected account so the app works across sessions and devices and can power features like charts, reminders, and AI insights. We do not sell your data. We do not use it for advertising. We minimize what we collect, encrypt it both in transit and at rest, and let you delete it at any time.
2. Information We Collect
2.1 Account Information
Email address (used for authentication and account recovery)
Password (stored only as a secure one-way hash; we cannot read it)
Optional: Name or display name, and a phone number for account/support contact (the phone number is never sent to our AI provider)
Optional profile details you choose to add (for example sex, date of birth, training profile, goals, diabetes status and a free-text "About you" note for the Biohack coach)
2.2 Health & Wellness Data
When you use the app, the following data is saved to your private account on our servers so it is available whenever you log in and can power features such as charts, reminders, and AI insights:
Protocol and dose logs (substances, doses, routes, schedules, adherence records)
Injection-site logs (which body area was used and when — never dose amounts)
Glucose and metabolic data (including data you choose to sync from connected sources)
Wellbeing check-ins: sleep hours and quality, mood and energy ratings, symptom logs and non-peptide supplements
Nightly sleep and recovery summaries synced from Apple Health or Health Connect, if you connect them (see 2.3.1)
If you connect them: smart-scale body composition, workouts and daily activity, and mindful minutes, time in daylight and logged mood from Apple Health or Health Connect (see 2.3.1)
Body composition readings you type in or read from a screenshot of your scale app
Supplement products you scan or search for (barcode, product name, and the label's ingredients and serving size)
Body weight, body composition metrics and progress photos
Goal settings
AI-generated insights, reports and your Biohack coach conversation history (so the coach can remember recent context)
Scores calculated from the data above — a Vitality score (labs), a Wellbeing score (last 7 days) and a combined Biohack score — with general suggestions; these are computed on our servers and are never sent to advertisers or sold
This data is linked to your account, protected by authentication, and is not shared with other users. Lab-report PDFs you upload for parsing are processed in memory only and are not retained after the values are extracted.
Health-data consent: in some countries the app asks for your explicit consent on a health-data consent screen before you start logging health information. You can review or withdraw that consent at any time in Profile → Privacy; withdrawing it does not delete data already saved (you can delete it separately, see section 6).
2.3 Connected Services (Optional)
If you choose to connect a third-party source (for example a continuous glucose monitor account such as Dexcom), the data you authorize is imported into your account. These connections are always opt-in and can be disconnected at any time.
2.3.1 Apple Health (HealthKit) and Android Health Connect
On iPhone you can optionally connect Apple Health, and on Android Health Connect, to sync your glucose readings (Metabolic health; on Android from app version 1.5.2), your sleep and overnight recovery data (Wellbeing), smart-scale body composition (Body composition), workouts and daily activity (Training), and mindful minutes, time in daylight and logged mood (Wellbeing) into the app. Each is a separate, opt-in connection, and the operating system lets you choose each data type individually. If you connect one:
What we read (read-only): blood glucose readings; body measurements (weight, BMI, body fat, lean mass and, on Android, bone mass, body water and basal metabolic rate); workouts (type, date, duration, energy, distance and the app that recorded them), steps, active energy and VO2 max; mindful minutes, time in daylight and, on iPhone, moods you log in the Health app (State of Mind); sleep (time asleep, sleep stages, time in bed); and overnight recovery signals — heart rate variability, resting heart rate, breathing rate, blood oxygen, wrist/skin temperature and, on iPhone, Apple's sleeping breathing-disturbance measurements and sleep-apnea notifications. Sleep and recovery data is summarised on your phone and only one summary per night is sent to your account (for example: minutes of deep sleep, bedtime, average overnight heart rate variability), along with the names of the apps or devices that recorded it, shown only to you. We never write to Apple Health or Health Connect, and we do not read any other categories.
Background syncing: from app version 1.5.2 the app can also sync the types you connected in the background (roughly once an hour, when your phone allows it), so new data arrives without opening the app. It reads the same categories, read-only. On Android this uses Health Connect's separate "access data in the background" permission, which you can switch off in Health Connect → App permissions → Biohack Track; on iPhone you can turn off Background App Refresh for the app (Settings → General → Background App Refresh).
Your consent controls it: access happens only after you approve the operating system's permission prompt, and you can revoke it at any time (iPhone: Settings → Privacy & Security → Health; Android: Health Connect → App permissions). Revoking stops all future syncing; "Disconnect" under Profile → Connected apps stops syncing too, and logging out of the app stops it automatically so another account on the same phone never receives your data.
Where it goes: synced data is stored in your private, password-protected account (encrypted in transit and at rest), exactly like values you enter manually. Glucose powers your time-in-range, average-glucose and variability views; sleep and recovery data fills in your Wellbeing sleep log and trends. Hours you type in yourself are never overwritten by a sync. Where the app shows a note such as "worth mentioning to your GP" (for example after a sleep-apnea notification), it is educational only and not a diagnosis.
AI features: like your other health data, synced glucose, sleep, recovery, training, body-composition and mood values (as summaries) may be included in a request to our AI provider only when you actively use an AI feature, solely to generate your result. Health data — including Apple Health data — is never used to train AI models.
Never for advertising: we do not use Apple Health or Health Connect data for advertising, marketing, or data mining, do not share it with data brokers, and do not sell it. This data is also covered by your in-app "Delete account" right, which permanently removes it.
2.3.2 Scanning supplements and scale screenshots
Supplement scanner: when you scan a barcode or search, we look the product up in our own catalogue and in public label databases (the US NIH Dietary Supplement Label Database and Open Food Facts); only the barcode or search text is sent to them, never your identity. If you take a photo of a label, the photo (with location and camera data removed) is sent to our AI provider to read the product name, serving size and ingredients. When you confirm a product, its label details (never who you are) are added to our shared product catalogue so the next person can find it faster.
Adding a product we don't have yet: you can take two photos: the front of the pack and the Supplement Facts panel. Both are sent to our AI provider (with location and camera data removed) to check the front photo shows only a real product and to read the label. You check and edit the details before saving. The front-of-pack photo is kept and shown to other users of the scanner so they can recognise the same product; please photograph only the product, with no faces, prescriptions or personal details. Photos that fail our automatic check are not kept. The Supplement Facts photo is not stored. Products you add are not linked to your name, and if you delete your account they stay in the catalogue without any link to you. Anyone can report a product or photo; reported items are hidden and reviewed. If you tick "Also share with Open Food Facts" for a product, its barcode, name, brand, serving size and front-of-pack photo are also published to Open Food Facts (a public, open product database) from our app account; nothing that identifies you is sent, and once published it is public under their open licences.
Coach nudges: if notifications are on, the app may send at most one coach notification a day (for example a plan check-in or a retest reminder), between 8 am and 8 pm your local time, using your device's push token and time zone. The notification text never contains your results or other health details. Turn them off in Profile → Coach nudges.
Photo questions: if you send the coach a photo (for example a meal or a supplement label), it is sent to our AI provider with location and camera data removed, only to answer your question. The photo is not stored; only your question and the coach's answer are kept in your chat history. Please don't photograph people or documents with personal details.
4-week plans: if you ask the coach for a plan, it uses your data (as for any AI feature) to suggest three everyday habits. The plan, your daily ticks and the related lab result are stored in your account, and a retest reminder is added. Stop a plan any time on the Today screen; plans are removed when you reset your data or delete your account.
What the coach remembers: when you answer the Biohack coach's questions or mention everyday habits in chat (for example how much alcohol or water you drink), short notes of those facts are saved to your account so the coach doesn't ask again. Only facts you state about yourself are kept, never medicine doses. You can see and delete them in Profile → What the coach remembers; they are removed when you reset your data or delete your account.
Runna calendar (optional): if you paste your Runna calendar link, we store the link encrypted and fetch it every few hours to show your upcoming planned sessions (date, time, title and description) on the Training screen. We don't connect to your Runna or Strava account; completed Strava and Runna workouts arrive only through Apple Health or Health Connect, as described above. Remove the calendar at any time on the Training screen; deleting your account removes it too.
Items you add by name: when you add a protocol item that isn't in our library, we keep its name so it appears in your own search next time. The name (only the name: never your doses, notes or who added it) is also shown to other users when they search. New names and user-added products are checked automatically, including by our AI provider (only the name is sent), and reviewed by us; anything inappropriate is hidden. If you delete your account, the names stay without any link to you.
Scale screenshots: if you choose to read your scale app from a screenshot, the image (with location and camera data removed) is sent to our AI provider only to read the numbers, which you confirm before anything is saved.
Lab report photos and scans: if you use Photo AI scan on a lab report (or upload a scanned, image-only PDF), the image or the first pages of the scan (with location and camera data removed) are sent to our AI provider only to transcribe the values, which you check before saving; the image is then discarded. This happens only after you have given AI consent.
2.3.3 Purchases and Promo Codes
The one-time Lifetime unlock, subscriptions and promo/offer codes are handled by Apple (App Store) or Google (Google Play) or, if you buy on our website (biohacktracker.ai/buy), by our payment processor, which charges your card. We never receive your full card details. Our subscription service provider, the store or our payment processor tells us which plan you hold and its renewal/expiry so we can unlock Pro features. When you tap "Have a code?", the code is entered in Apple's or Google's own redemption screen, not in our app.
2.4 Usage & Diagnostic Data
Server error logs (kept to diagnose problems; we avoid logging health values)
Security logs: when a device or script appears to be attacking, scanning or bulk-copying our service, we record its IP address, the time, the addresses it requested, its browser/app type and, if signed in, the account. We use these only to protect the service and our users, and to support legal action against misuse
App crash reports (the error message and technical details of where it happened, the platform and app version, linked to your account so we can fix the problem; we avoid including health values)
Device type and OS version (for compatibility)
First-party, account-linked product events (for example app opens, paywall views, onboarding completion) used to measure activation and retention — never sold or used for advertising
AI usage counters (how many AI requests you made today / this month), used only to apply fair-use limits
Your AI data-sharing choice (whether and when you allowed AI features to send data to our AI provider), so we can honour it
2.4.1 Website Waitlist
If you join the launch waitlist on biohacktracker.ai, we store your email address (and which page and device type you signed up from) only to email you once when the app is available. It is not added to marketing lists, shared or sold, and you can ask us to delete it at any time by emailing [email protected].
2.4.2 Weekly Training Plans
If you unlock a weekly training plan on biohacktracker.ai/training, we store your email address, the plan you unlocked, how you reached the page (for example "instagram", from the link's campaign tags), the wording of the consent box you ticked and the date. We email you once to confirm the address; you only join the launch list, and we only send you launch news and training plans, after you click that confirmation link. Every email has an unsubscribe link, and you can ask us to delete your details at any time by emailing [email protected]. We also set a small cookie in your browser that remembers the plan pages are unlocked; it holds a reference number (your sign-up or account number, never your email address), signed so it can't be guessed, and is not used for tracking or advertising. Links from the app and from our training emails set the same cookie so the week opens unlocked. Your details are not shared or sold.
2.5 What We Do NOT Collect
We do not collect real names unless you provide them.
We do not collect location data.
We do not collect browsing history.
We do not collect health data from third-party services without explicit permission.
3. How We Use Your Information
Purpose
Data Used
Account authentication
Email, password hash
Purchases, subscriptions & promo codes
Whether you've bought the Lifetime unlock, and plan and renewal status, from Apple/Google or our web payment processor via our subscription service provider
AI fair-use limits
Daily/monthly AI usage counters
App functionality
Your account's health & wellness data
AI insights
Relevant account data sent to our AI provider to generate insights when you use AI features
Email notifications
Email address (for account verification, password reset, sign-in and security messages only; we do not send marketing emails). Emails do not contain your health data. Retest and dose reminders are notifications on your phone, not emails.
Customer support
Email, optional name, app version
App improvement
First-party product events, server error logs and app crash reports
4. Data Storage & Security
Account-Based Cloud Storage
Your account information and health/wellness data are stored in a database on our secured servers so they are available across sessions and devices. The database is encrypted at rest using industry-standard encryption, so the stored data cannot be read from the database file without our encryption keys. We also protect data in transit using encrypted connections (HTTPS/TLS). Passwords are stored only as secure one-way hashes and cannot be read by us. Sign-ins use secure, expiring session tokens, and we restrict access to your data to authenticated requests on your account.
Progress Photos
Progress photos are stored as files on our servers, encrypted at rest, and can only be retrieved through your authenticated account. The storage location is not publicly accessible.
Data Breach Notification
No system is perfectly secure. If we become aware of an eligible data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme of the Privacy Act 1988 (Cth).
AI Processing
AI features only run after you give explicit permission in the app (a one-time "Allow AI features to use your data?" prompt). Until you allow it — or after you switch it off in Profile → AI features — nothing is sent to an AI provider and the rest of the app keeps working. When you use an AI feature (such as the AI Coach, chat, or an insight generator), the data needed for that feature is sent to our third-party AI provider, which is based in the United States, to generate your result. For progress-photo insights, only numeric trends and your written notes are sent — your actual photos are not sent to the AI provider. Under our agreement, your data is not used to train the provider's models. If no AI provider is configured, the app falls back to built-in, rule-based analysis that does not involve any third-party AI provider.
5. Data Sharing & Third Parties
We do not sell, rent, or trade your personal information.
We may share minimal data with:
Email service providers — for verification and notification emails only.
AI providers — receive the data needed to generate a result when you use an AI feature; they do not use it to train their models, and we do not permit them to sell it.
Subscription and payment processing (Apple, Google, our subscription service provider and, for website purchases, our payment processor) — unlock purchase, plan and renewal status only; no health data. Card details go straight to the payment processor; we never receive your full card number.
Bot protection (Cloudflare Turnstile) — checks that website sign-ups and purchases come from a real person, using technical browser signals; no health data.
Google Sign-In — only if you choose to sign in with Google; Google tells us your email address and confirms your identity. We do not receive your Google password.
Connected health accounts (for example Dexcom) — only if you choose to connect one; we receive the data you authorize (such as glucose readings) and can disconnect at any time.
Hosting (our cloud hosting provider, Sydney region) — stores our encrypted database and encrypted photo files on our behalf.
We do not share health data with employers, insurers, or advertisers.
Website advertising measurement. Our public website (biohacktracker.ai, not the app) uses an advertising partner's measurement pixel and cookies to count page visits from our ads and to measure how well those ads perform. It records only that a page was viewed, plus standard technical data such as your browser type and IP address. It never receives your health, protocol, lab or account data. You can limit this with your browser's cookie settings or your ad preferences in your social media account settings. The app itself contains no third-party advertising or analytics SDKs.
6. Your Rights & Choices
Access & Export
You can view all your data within the app. Pro users can export clinician-ready PDF reports. Where your local law gives you a right to a copy of your data, Profile → Privacy → Download my data gives you a full copy (where available in your country). Anyone can also request a copy by email.
Deletion
You can delete your account and all associated data at any time from the Profile screen (Profile → Account → Delete account). This removes your profile, protocols and dose logs, bloodwork, glucose data, wellbeing check-ins, symptoms, supplements, sleep and recovery summaries, injection-site logs, progress photos, AI insights and chat history, usage events and AI usage counters. Deletion is permanent and irreversible. Deleting your account does not cancel an App Store / Google Play subscription — manage that in your store account settings (or, for a website purchase, from the link in your receipt email or by emailing us).
Opt-Out
Emails: we only send account and security emails (verification, password reset and sign-in alerts), which are needed to run your account. We do not send marketing emails. If we ever do, they will only go to people who agree, and every one will include an unsubscribe link.
AI features: data is sent to our AI provider only for AI features you have turned on, after you give AI consent: when you use the Biohack coach or an AI analysis, and, if you are on Pro, to prepare your optional weekly digest. You can withdraw AI consent at any time in Profile, and then no data is sent externally.
Health-data consent: where the app asks for it, you can withdraw your health-data consent at any time in Profile → Privacy.
Product events: these are first-party only (no third-party analytics or advertising SDKs). Contact us to have them deleted, or delete your account.
Australia (Privacy Act / APPs)
Under the Australian Privacy Principles you may request access to the personal information we hold about you and ask us to correct it. We will respond within a reasonable period. If you have a privacy concern, contact us first at [email protected]; if you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
GDPR & CCPA
If you are in the European Economic Area (including Norway and Iceland), the United Kingdom, Switzerland or California, you have additional rights including:
Biohack Tracker is not intended for users under 18 years of age. We do not knowingly collect data from children. If you believe we have inadvertently collected data from a minor, contact us immediately.
8. Data Retention
Active accounts: Data retained as long as your account is active.
Deleted accounts: All other data permanently erased within 30 days of deletion request (except purchase records and unlinked catalogue products, described below and in section 2.3.2).
Purchase records: When you delete your account we keep a record of your purchases and subscriptions (product, price, date and an anonymous account number, held by our payment providers and the app stores) for as long as tax and accounting laws require, usually 5 to 7 years. These records contain no health data.
Security logs: Kept for up to 12 months, then deleted, unless needed for an ongoing investigation or legal claim.
Backups: Encrypted backups may persist for up to 90 days in standard disaster-recovery systems before automatic purging.
9. International Data Transfers
Our primary database is hosted in Sydney, Australia. Some data may be processed in other countries (for example, the United States) by our AI, email, subscription and payment providers when you use those features. We use appropriate safeguards, contractual protections, and encryption in transit to protect international transfers.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification. The "Last Updated" date at the top indicates the latest revision.
11. Contact Us
For privacy questions, data requests, or concerns:
Email:[email protected] Response time: We aim to reply within 2 business days. Requests to access, export, correct or delete your data are completed within the time your local privacy law allows (for example, within 30 days, or 45 days in some US states), and we will tell you if we need more time.
12. Legal Disclaimers
Biohack Tracker provides educational and organizational support only. It is not a medical device, diagnostic tool, or treatment recommendation system. Lab "worth discussing with your GP" patterns, sleep notes, dose reference ranges and the "How to inject" guide are educational prompts, not diagnoses or instructions. Wearable data are consumer-device estimates. Always consult qualified healthcare professionals for medical decisions.