Privacy Policy

1.1AIFORMA PTY LTD, ABN 81 700 739 224 ("AIFORMA", "we", "us", or "our"), respects the privacy of individuals who use the AIFORMA website, iOS application, Android application, and related services.

1.2AIFORMA is an AI-powered physique-intelligence platform through which users may create accounts, upload front, side, and back physique photographs, provide body measurements, body weight, training experience, fitness goals, and lifestyle information, and receive AI-generated physique analyses, educational insights, recommendations, comparisons, and progress summaries.

1.3AIFORMA PTY LTD is responsible for determining how and why personal information is processed through the Services and acts as the relevant privacy-law controller or equivalent regulated entity where applicable.

1.4This Privacy Policy applies to personal information collected through AIFORMA and is intended to address applicable requirements under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”), as well as privacy requirements applicable to users in the United Kingdom and United States where those laws apply.

1.5Australian privacy law applies to organisations providing health services and holding health information in circumstances prescribed by the Privacy Act, including certain organisations that would otherwise qualify as small businesses. The Office of the Australian Information Commissioner (“OAIC”) expressly identifies online health services and other organisations handling health information within this framework.

2.1We may collect account and identity information including your name, email address, username, account identifier, age or confirmation that you are at least 18 years old, authentication information, subscription status, and account preferences.

2.2We collect physique and fitness information that you choose to provide, including body weight, body measurements, training experience, fitness and physique goals, exercise-related information, lifestyle information, assessment history, and progress information.

2.3We collect physique photographs that you upload for analysis, including front, side, and back photographs and subsequent progress photographs.

2.4Information concerning your body, fitness, lifestyle, physique, or information inferred from those details may constitute health information, sensitive information, special-category data, or consumer health data under applicable law.

2.5Physique photographs are personal information where an individual is identified or reasonably identifiable and may reveal, or support inferences concerning, health, physique, or other sensitive characteristics. AIFORMA does not use physique photographs for facial recognition, identity verification, or the creation of biometric identifier templates for the purpose of uniquely identifying a user. If AIFORMA later introduces biometric identification, biometric authentication, facial recognition, identity verification, or comparable functionality, additional disclosures and any consent or authorisation required by applicable law will be provided before that processing begins.

2.6We may collect technical and usage information including IP address, device type, operating system, app version, browser information, language, approximate location derived from technical information, session information, crash reports, diagnostic information, log data, feature interactions, and security events.

2.7Where analytics, advertising, or similar technologies are introduced, additional information may be collected through cookies, software development kits, pixels, or comparable technologies in accordance with the AIFORMA Cookie Policy and any consent mechanism required by applicable law.

2.8Subscription and transaction information may be received from Apple App Store or Google Play, including subscription status, product purchased, renewal information, and transaction identifiers. Apple and Google ordinarily process the payment credentials used for purchases made through their respective stores. If AIFORMA introduces direct payments, payment processing may be provided by Stripe or another disclosed payment provider.

3.1Most personal information is collected directly from you when you create or manage an account, complete an assessment, upload photographs, enter measurements or other information, contact AIFORMA, or use the Services.

3.2Information may also be generated through your use of AIFORMA, including AI-generated analyses, progress comparisons, inferred physique information, usage information, and technical logs.

3.3We may receive limited information from service providers involved in authentication, subscriptions, payments, analytics, application distribution, security, or technical support.

3.4Future integrations with wearable devices, Apple Health/HealthKit, Google Health Connect, and other health, fitness, wellness, or external platforms may allow AIFORMA to receive information made available through an integration enabled by the user. AIFORMA will access information through such integrations only for the relevant enabled functionality and after any consent, permission, or authorisation required by applicable law or the relevant platform has been obtained.

4.1We use personal information to create, authenticate, maintain, and secure user accounts.

4.2Physique photographs, measurements, weight, training information, goals, lifestyle information, and related information are processed to perform requested physique assessments, generate AI-based insights, personalise the AIFORMA experience, create progress summaries, compare assessments over time, and provide the fitness-related functionality requested by the user.

4.3We may use account, device, usage, and diagnostic information to operate the Services, maintain functionality, troubleshoot faults, prevent fraud and abuse, protect accounts, investigate security events, improve application performance, provide customer support, and understand how features are used.

4.4We may process information to administer subscriptions, verify entitlements, communicate service notices, respond to enquiries, enforce our Terms and Conditions, comply with legal obligations, establish or defend legal claims, and protect AIFORMA, users, and third parties.

4.5Where permitted by law, we may send service-related communications that are necessary for your account or subscription. Marketing communications will be sent only where permitted by applicable law, and you may opt out of marketing communications at any time.

5.1AIFORMA uses artificial-intelligence systems to analyse information submitted by users and generate physique assessments, educational insights, recommendations, comparisons, and progress summaries.

5.2AI processing may involve sending information necessary for the requested functionality to OpenAI or another third-party provider of AI models, APIs, inference services, model hosting, or related artificial-intelligence technology engaged by AIFORMA from time to time (each an "AI Provider"). The information disclosed to an AI Provider will be limited to information reasonably necessary for the relevant functionality.

5.3User photographs, body measurements, and other personal information are currently processed for the individual user’s AIFORMA experience and the other purposes described in this Policy and are not currently used by AIFORMA to train or improve AI models. If AIFORMA proposes in the future to use personal information for AI model training, fine-tuning, or improvement, AIFORMA will update the applicable privacy information and obtain any consent or authorisation required by applicable law before commencing that processing.

5.4AIFORMA does not intentionally provide user photographs, measurements, or health-related information to AI Providers for their independent advertising purposes or independent model training or improvement.

5.5AI-generated information may be inferred from information that you submit. Inferences connected or reasonably capable of being connected to you are handled as personal information where required by applicable law.

5.6Where an AI Provider or another service provider processes personal information on behalf of AIFORMA, AIFORMA will maintain written contractual arrangements governing the provider’s permitted processing, instructions, confidentiality, security obligations, permitted use of information, assistance with applicable privacy rights, and deletion or return of information to the extent required by applicable law. An AI Provider or other processor must not use AIFORMA consumer health data for its own independent purposes except where that processing has been separately disclosed and lawfully authorised.

6.1Because AIFORMA processes physique, body-measurement, fitness, and related information, some information may be legally classified as sensitive information, health information, special-category data, or consumer health data.

6.2Under Australian privacy law, health information and other sensitive information receive additional protection. Where AIFORMA collects sensitive information, including information revealed or inferred from physique photographs, body measurements, or related user inputs, AIFORMA will obtain express consent where required and will collect the information only where it is reasonably necessary for AIFORMA’s functions or activities, subject to any applicable statutory exception.

6.3For users to whom UK data-protection law applies, AIFORMA will identify an applicable lawful basis under Article 6 of the UK GDPR for each relevant processing activity. Where physique photographs, body measurements, AI-generated inferences, fitness information, lifestyle information, or other information constitutes health data or another special category of personal data, AIFORMA will also identify an applicable condition under Article 9 of the UK GDPR. Where AIFORMA relies on explicit consent, that consent will be requested through a specific affirmative mechanism that is separate from acceptance of the AIFORMA Terms and Conditions and sufficiently clear to identify the special-category processing to which the user agrees.

6.4You may withdraw consent where processing is based on consent. Withdrawal does not affect processing lawfully carried out before withdrawal. If information is essential to an assessment you have requested, withdrawing consent may prevent AIFORMA from continuing to provide that feature.

7.1AIFORMA may disclose personal information to service providers only to the extent reasonably necessary for them to perform services for AIFORMA.

7.2Recipients may include hosting and cloud-infrastructure providers, AI Providers, Apple in connection with the App Store and any enabled Apple Health/HealthKit integration, Google in connection with Google Play and any enabled Google Health Connect integration, Stripe if direct payment processing is introduced, authentication providers, communications providers, security providers, analytics providers, wearable-device and health-platform providers, professional advisers, and other technology providers required to operate enabled AIFORMA functionality.

7.3Analytics or marketing providers such as Google Analytics, Mailchimp, Meta technologies, or comparable providers may be introduced in the future. Where their use requires consent, AIFORMA will obtain the required consent before activating the relevant processing. Health-related information and physique photographs will not be disclosed to advertising providers for targeted advertising without any specific consent or authorisation required by law.

7.4We may disclose personal information where required by law, court order, lawful governmental request, or where reasonably necessary to establish, exercise, or defend legal rights.

7.5If AIFORMA undergoes a merger, acquisition, corporate restructuring, financing, or sale of all or part of its business, personal information may be transferred as part of that transaction subject to applicable privacy obligations.

8.1AIFORMA does not sell physique photographs, body measurements, fitness information, AI-generated physique information, or other consumer health data for monetary or other valuable consideration.

8.2Where United States state law treats a particular disclosure as a "sale" more broadly than ordinary commercial usage, AIFORMA will obtain any specific authorisation required before undertaking that disclosure.

8.3AIFORMA will not condition access to its ordinary Services on authorisation to sell consumer health data where applicable law prohibits that practice.

9.1AIFORMA is established in Australia and serves users internationally. Personal information may therefore be processed or stored outside the country in which a user is located.

9.2AIFORMA currently uses hosting infrastructure located in Sydney, Australia. As AIFORMA expands its Services to the United Kingdom, United States, and other jurisdictions, information may also be processed in other countries where AIFORMA’s service providers operate, including providers supporting AI processing, app distribution, payments, communications, security, and analytics.

9.3Under APP 8, Australian entities making applicable overseas disclosures must take reasonable steps to ensure that overseas recipients handle personal information consistently with the APP framework, subject to statutory exceptions.

9.4Where UK data-protection law applies and a transfer constitutes a restricted international transfer, AIFORMA will use a legally permitted transfer mechanism, which may include applicable UK adequacy regulations, the International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another lawful safeguard or exception. Current ICO guidance requires restricted transfers to be supported by adequacy, appropriate safeguards, or a lawful exception.

10.1AIFORMA retains personal information only for as long as reasonably necessary for the purposes for which it was collected, to provide the Services, maintain appropriate business and security records, resolve disputes, enforce agreements, and satisfy legal, regulatory, accounting, or reporting obligations.

10.2Retention periods depend on the nature and sensitivity of the information, the duration of the user relationship, the purposes for which it is processed, security requirements, applicable limitation periods, and legal retention obligations.

10.3Users will be able to request deletion of their account directly within the AIFORMA application.

10.4Following a valid deletion request, personal information that is no longer required will be deleted, anonymised, or de-identified from active systems within a reasonable period, subject to applicable law. Information may remain temporarily within secure backups until those backups are overwritten through ordinary backup cycles. Where the Washington My Health My Data Act applies to consumer health data, deletion from archived or backup systems may be delayed only as permitted by that law and will be completed no later than six months after authentication of the applicable deletion request. Limited information may otherwise be retained where required or permitted by applicable law, including where necessary for security, fraud prevention, dispute resolution, or the establishment, exercise, or defence of legal claims.

10.5Australian APP 11 requires covered entities to take reasonable steps to destroy or de-identify personal information that is no longer required, subject to applicable retention requirements.

11.1AIFORMA uses reasonable administrative, organisational, and technical safeguards appropriate to the nature and sensitivity of the information processed.

11.2Safeguards may include access controls, authentication mechanisms, encryption where appropriate, secure communications, system monitoring, logging, restricted staff or contractor access, vulnerability management, backups, and contractual security obligations imposed on relevant service providers.

11.3No internet-connected service can guarantee absolute security. Users must maintain the confidentiality of their account credentials and notify AIFORMA promptly if they suspect unauthorised access.

12.1Australian users may request access to personal information AIFORMA holds about them and may request correction of information that is inaccurate, out of date, incomplete, irrelevant, or misleading, subject to applicable exceptions. APPs 12 and 13 establish rights concerning access and correction.

12.2Requests may be submitted to founders@ai-forma.net. AIFORMA may take reasonable steps to verify your identity before providing access to information or acting on a request.

12.3Users may also raise a privacy complaint using the contact details in clause 19.

13.1Where UK data-protection law applies, you may have rights to be informed, obtain access to personal data, request rectification, request erasure in applicable circumstances, restrict processing, obtain applicable data in a portable format, and object to certain processing.

13.2You have the right to withdraw consent at any time where consent is the lawful basis for processing.

13.3You have an absolute right to object to the use of personal data for direct marketing.

13.4AIFORMA’s AI physique-analysis features are intended to provide informational fitness insights and do not make decisions that produce legal effects or comparably significant effects concerning a user.

13.5Requests may be submitted to founders@ai-forma.net. Rights are subject to the conditions, limitations, and exemptions contained in applicable law.

14.1Certain United States laws regulate consumer health data outside the HIPAA framework. AIFORMA may be subject to those requirements where their jurisdictional conditions are satisfied.

14.2For purposes of applicable consumer-health privacy laws, categories of consumer health data processed by AIFORMA may include body measurements, weight, physique photographs, fitness and training information, lifestyle information, user-selected goals, assessment information, and health or physique information inferred through AI analysis.

14.3Those categories are collected primarily from users and from information derived from their interaction with the Services. They are processed to provide requested assessments, progress tracking, recommendations, account functionality, security, and other Services described in this Policy.

14.4Consumer health data may be disclosed to processors necessary to provide requested Services, including hosting, AI-processing, security, and other technical providers. AIFORMA does not disclose consumer health data to third parties for independent targeted advertising without any consent required by applicable law.

14.5Where applicable, users may request confirmation of whether AIFORMA collects, shares, or sells their consumer health data, request access to applicable information, request deletion, withdraw consent, or request information concerning third parties with whom consumer health data has been shared.

14.6Where AIFORMA is subject to the Washington My Health My Data Act, AIFORMA will maintain a separate Consumer Health Data Privacy Policy containing the disclosures required by applicable Washington law and will make that policy available through a separate and prominently displayed link from each location treated as a homepage under that law, including relevant website and application locations. AIFORMA will publish that Consumer Health Data Privacy Policy, including the required prominently displayed link, before the Services are made available to users in Washington State.

14.7Where the Washington My Health My Data Act applies, AIFORMA will collect or share consumer health data only with the consent required by applicable law or to the extent necessary to provide a product or service requested by the consumer. Where consent is required, consent to collect consumer health data will be obtained through a clear affirmative process and will not be incorporated into general acceptance of the AIFORMA Terms and Conditions. Any consent required for sharing consumer health data will be separate and distinct from consent to collection. AIFORMA does not sell consumer health data. Any future sale of consumer health data would require the separate valid authorisation required by applicable law before the sale occurs.

14.8Where Nevada consumer-health-data legislation applies, AIFORMA will provide the disclosures, consumer rights, consent mechanisms, security measures, and other protections required for covered consumer health data. Applicable Nevada disclosures may be included within AIFORMA’s separate Consumer Health Data Privacy Policy where legally permitted.

14.9Requests concerning United States consumer health data may be submitted to founders@ai-forma.net. Where applicable law provides an appeal right following denial of a privacy request, a consumer may appeal by replying to AIFORMA’s decision and stating that they wish to appeal.

15.1AIFORMA will investigate suspected personal-information breaches and take reasonable containment and remediation measures.

15.2Where the Australian Notifiable Data Breaches scheme applies and a breach is likely to result in serious harm, AIFORMA will notify affected individuals and the OAIC as required by the Privacy Act.

15.3For United States users, the FTC Health Breach Notification Rule may apply to certain non-HIPAA health applications and technologies holding identifiable health information. Where applicable, AIFORMA will provide legally required notifications following a qualifying breach.

16.1The AIFORMA website and applications may use essential technologies necessary for authentication, security, preferences, and technical functionality.

16.2Analytics, marketing, advertising, or similar non-essential technologies will be governed by the AIFORMA Cookie Policy and any consent-management mechanism required in the user’s jurisdiction.

17.1AIFORMA is intended only for individuals aged 18 years or older. AIFORMA does not knowingly permit persons under 18 to create accounts or submit physique photographs through the Services.

17.2If AIFORMA becomes aware that a person under 18 has submitted personal information in breach of this restriction, appropriate steps will be taken to remove the account and associated information, subject to applicable legal obligations.

18.1AIFORMA may update this Privacy Policy to reflect changes in its Services, technology, legal obligations, service providers, integrations, or privacy practices.

18.2The current version will display its applicable “Last Updated” date. Where a change materially affects how personal information or consumer health data is collected, used, or shared, including a future proposal to use such information for AI model training or improvement, AIFORMA will provide additional notice and obtain any consent or authorisation required by applicable law before undertaking the materially different processing.

19.1Privacy enquiries, requests, withdrawals of consent, consumer health data requests, and privacy complaints may be sent to founders@ai-forma.net.

19.2AIFORMA PTY LTD, ABN 81 700 739 224, is the relevant Australian entity.

19.3Business address: PO Box 431 North Lakes, QLD 4509 Australia

19.4AIFORMA will appoint a United Kingdom Representative under Article 27 of the UK GDPR before the Services are made available to users in the United Kingdom. Once appointed, the Representative’s name, address, and contact details will be published in this clause.

19.5Once designated, the United Kingdom Representative identified in clause 19.4 will be available under Article 27 of the UK GDPR in relation to processing activities subject to the UK GDPR. Individuals in the United Kingdom and the Information Commissioner’s Office will be able to contact the United Kingdom Representative regarding AIFORMA’s processing of personal data, the exercise of applicable data-protection rights, or AIFORMA’s obligations under UK data-protection law, without limiting any right to contact AIFORMA directly.

19.6A privacy complaint should first be submitted to AIFORMA at founders@ai-forma.net so that the matter can be investigated and addressed. Where UK data-protection law applies, AIFORMA will provide a clear complaints process, acknowledge a complaint within 30 days, investigate it appropriately, and communicate the outcome in accordance with applicable law.

19.7Australian users who remain dissatisfied may contact the Office of the Australian Information Commissioner. Information concerning privacy complaints is available at oaic.gov.au/privacy/privacy-complaints.

19.8Where UK data-protection law applies, users also have the right to complain to the Information Commissioner’s Office in accordance with applicable law. Information about complaints is available at ico.org.uk/make-a-complaint.