BioForge — Privacy Policy

Last updated: 2026-10-24

1. Who we are

The data controller for BioForge is A-X Software, a French SAS, registered office at 122 Rue Amelot, 75011 Paris, France, SIREN 929 602 365.

This policy covers the BioForge app (iOS, and the web app at app.bioforge.science) and the bioforge.science site (section 10).

Our Data Protection Officer can be reached at dpo@bioforge.science.

Our supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL) (France). You have the right to lodge a complaint there at any time.

2. What data we process

BioForge is a personal health and performance intelligence app. We process several categories of data, including special-category data under GDPR Article 9:

• Account data — email, name, profile picture (from OAuth), authentication identifiers.
• Athletic profile — age, weight, height, training metrics (FTP, VMA, CSS pace, max HR, LTHR), experience level, weekly hours.
• Health data (Article 9) — blood-work panels and markers, microbiome profiles, medical-history records, prescriptions, recommendations, and the safety record of each plan generation that read your health record (the restrictions detected, the rules applied).
• Training data — training plans and their generation history, volume goals, completed sessions, wellness entries, the races you target, your private notes on a race and the reports you send on a race, the coach's rituals you tick, race briefs, chat history with the coach.
• Connected sources — with your permission: Apple Health (heart rate, HRV, resting heart rate, respiratory rate, sleep, weight, height, VO2 max, heart-rate recovery, workouts), Garmin, WHOOP and Intervals.icu; the home trainer (power, cadence, speed) and Bluetooth heart-rate strap — recorded during a session you start; a bedside device you set up (your bedroom's CO2, temperature and humidity, summed up each night, and the mood, motivation and soreness you enter on it, how hard your day felt (1 to 10) and the tags you put on a night (medication, illness, alcohol, other, travel, retreat, late meal, late caffeine, late screen: health data, codes only, never free text); it shows back your recovery, HRV against your normal, sleep duration and the day's session; it works with a key you create and can revoke in Settings; only a fingerprint of that key is kept). The app also sends the sessions you choose to your Apple Watch.
• Technical data — IP address, user-agent, request timestamps, error logs, audit logs of admin access to your data; for each email we send you, a keyed fingerprint of the address (never the address), kept 2 days so that no address receives repeated emails.
• Usage records — per day, the tokens and the cost of the analyses run for you, to prevent abuse and control costs (legitimate interest, Article 6(1)(f)); kept 90 days, deleted with your account.
• Crash reports (iOS app) — when the app crashes, an anonymous technical report: the error and where it happened in the code, the device model, the iOS and app versions, and whether the session ended in a crash. It carries no health value, no name, no email and no identifier linked to you or your account, and is sent to Sentry (section 4).

Apple Health data is never used for advertising or marketing, never sold, shared only with the section 4 processors needed to run the service (the AI provider only with your consent), and never stored in iCloud.

Account data is required to create an account. Everything else is optional: without it, the matching analyses are simply not available.

3. Lawful basis

• Account data + technical data (crash reports included) — performance of the contract with you (Article 6(1)(b)) and our legitimate interests in operating a secure and reliable service (Article 6(1)(f)).
• Health data — your explicit consent (Article 9(2)(a)), which you can withdraw at any time without affecting the lawfulness of past processing. Withdrawing consent for health data prevents new analyses but does not retroactively undo recommendations already produced.
• Training data — performance of the contract (Article 6(1)(b)).
• Visits to the bioforge.science site and emails you send us — our legitimate interest in knowing which pages are read and in answering you (Article 6(1)(f)). You can object at any time (section 7).

4. Sub-processors

To operate BioForge we share data with the following sub-processors. Each is bound by a Data Processing Agreement under Article 28 GDPR. We never sell your data and never share it for advertising.

Transfers to processors outside the EEA rely on an adequacy decision of the European Commission — for Switzerland (Decision 2000/518/EC), and for the EU-US Data Privacy Framework (Decision 2023/1795) when the processor is certified under it, as marked above — and otherwise on the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914).

5. Retention

• Account, athletic, health, training data — retained for the duration of your account. When you delete your account (or request erasure under Article 17), all athlete-scoped rows cascade-delete from the database.
• Audit logs (admin access, consent events) — retained 5 years after the underlying account is deleted, in pseudonymised form, to satisfy our accountability obligations under Article 5(2) and Article 24.
• Technical data — server logs at most 30 days; error and crash reports at most 90 days (Sentry); then deleted automatically.
• Backups — Railway-managed backups roll over; the longest residual window is the backup retention configured at the infrastructure level.
• bioforge.science site — its hosting logs follow the technical-data rule above; the visitor hash of the audience measurement is discarded after 24 hours (section 10).
• Emails you send us — kept 3 years after our last exchange, then deleted.

6. Cookies

BioForge sets only strictly-necessary cookies. In the app: bioforge-jwt (authentication, 48 hours), bioforge-refresh (keeps you signed in, 30 days) and locale (the language you choose, 1 year). On the bioforge.science site: NEXT_LOCALE (the language of the page, deleted when you close your browser). We do not set analytics, advertising, or fingerprinting cookies, and we do not embed advertising or cross-site trackers; the site measures its audience without any cookie (section 10). Because we only use strictly-necessary cookies, no consent banner is required under the ePrivacy Directive.

7. Your rights

You can exercise the following rights at any time:

• Access (Article 15) — download a complete machine-readable copy of your data via GET /api/gdpr/export from the app, or by emailing the DPO.
• Rectification (Article 16) — edit your athletic profile and health records directly in the app.
• Erasure (Article 17) — delete your account from the app; cascading deletions remove all athlete-scoped data from the live database.
• Restriction (Article 18) — pause processing by emailing the DPO.
• Portability (Article 20) — same export as Article 15, JSON format.
• Objection (Article 21) — object at any time to what rests on our legitimate interest (the audience measurement of the bioforge.science site, the handling of the emails you send us) by writing to the DPO.
• Withdrawal of consent (Article 7(3)) — withdraw consent for BIA analysis at any time without losing access to manual features.
• Audit trail — see who from the BioForge team has accessed your data via GET /api/gdpr/admin-access-log.
• Complaint (Article 77) — file a complaint with the CNIL.

We answer every request within one month (Article 12(3)).

8. Security

Health data is special-category data (Article 9) and we treat it accordingly. In summary, we encrypt data in transit (TLS 1.2+ everywhere, with public-key pinning on the iOS app), require per-user authentication on all access (no shared accounts), enforce ownership checks at the API layer (you cannot read another user's data even if you guess an ID), and log all admin overrides for transparency. Our security disclosure policy is at /legal/security-policy.

9. BIA Processing Transparency

BioForge uses Large Language Models (LLMs) — specifically Anthropic's Claude — for cross-domain health analysis, personalized training programs and recommendations, BIA coaching conversations with full health context, session/race brief analysis, and the extraction of scientific claims from the videos you submit.

Data shared with the LLM. Only aggregate fitness metrics computed within BioForge's own infrastructure (training-load indices such as TSS, ATL, CTL and TSB; recovery trends; weekly volume and zone distributions; periodization variables) and non-device health context (blood-work summaries, microbiome composition, health records and aggregated wellness markers) are transmitted to the LLM provider.

Coach and health analyses. With your consent to AI processing of your health data, the Coach and the health analyses also receive the medical context needed for safe advice: your medical conditions (current, past, allergies), current medications with dose and frequency, injury notes, your health records and blood-work markers, and your wellness entries of the last 14 days.

Photos in the Coach. A photo you attach to a Coach message is transmitted to the LLM provider at least twice. First, to check that it shows a sports product (supplement or nutrition label, gel, bar, drink, gear, apparel, training machine, race bib) or a screenshot of BioForge itself; a photo that does not is refused and never stored. A screenshot of BioForge shows your figures (sleep, HRV, readiness, weight), so it is accepted only while AI processing of your health data is on, and refused and never stored otherwise. Then with each request that builds the answer, several when the Coach looks up your data. BioForge keeps an accepted photo with your message (Cloudflare R2) and deletes it with your account. Do not attach photos of people, of documents or of anything unrelated to sport.

Lab reports you upload. When you import a blood-work, microbiome or stool-analysis report, the original file you upload — including the raw image or PDF itself — is transmitted to our LLM provider (Anthropic, in the United States) so the model can read it and extract the values. We send the raw document, not only a summary we produced beforehand; the document may contain whatever your laboratory printed on it, including your name and other details present on the report. This transmission happens only when you choose to import a report and only if you have enabled AI processing of your health data. The provider processes the file as our service provider, solely to read it and extract the values, and returns them to BioForge. For how the provider handles data sent to it — including its data-retention period and the safeguards that apply to transfers outside your country — see the provider's own terms.

Personal identifiers. Only your first name, age, weight, height, sex, experience level, dietary preference and race goal are transmitted as athlete context. We never transmit your email address, surname, postal address, phone number, payment information or precise location to the LLM provider.

Raw device-API data. Raw, continuous-sample data obtained via third-party device APIs — including Garmin Connect, WHOOP, Intervals.icu and Apple HealthKit — is never shared with any external AI provider. This applies to GPS tracks, per-second heart-rate sample streams, beat-to-beat intervals (BBI), per-second power and cadence streams, sleep-stage details and any other continuous-sample field.

Per-lap aggregates (opt-in). Per-lap aggregate metrics — lap index, duration, distance, average heart-rate, average pace, average power, average cadence and elevation gain and loss — may be transmitted to the LLM provider for coaching analysis if and only if you have enabled the “Coaching BioForge Intelligence (per-interval)” toggle in your privacy settings. The lap aggregates do not contain GPS coordinates, raw timestamps, sample streams or any field that could re-identify the activity beyond the session itself. Without this consent, the LLM only receives session-level aggregates with no per-lap breakdown. You can withdraw this consent at any time from Profile → Privacy; the change takes effect immediately for any subsequent analysis (cached analyses for past sessions are not retroactively recomputed).

LLM provider data handling. Anthropic never uses your data to train its models and deletes it automatically within at most 30 days, unless longer retention is required by law or to enforce its usage policies. Transfers to the US are made under the Standard Contractual Clauses.

No automated decision-making. BioForge provides BIA-generated recommendations and insights, but does not make automated decisions that produce legal or similarly significant effects. All recommendations are advisory in nature.

10. The bioforge.science site

bioforge.science presents BioForge. It has no account, no form and no newsletter: “Join the beta” opens the app at app.bioforge.science, where the sections above apply. A visit to the site involves only the following.

• Hosting — the site is served by Vercel which, like any web server, receives your IP address, your browser's user agent and the page requested, in its technical logs (section 5).
• Audience measurement — Vercel Web Analytics records each page view with its time, the page, the referring site, an approximate location (country, region, city), the browser, the operating system and the device type. It sets no cookie and stores nothing on your device; a visitor is recognised by a hash of the request that Vercel discards after 24 hours, and page views are not tied to your IP address. These statistics are never linked to a BioForge account.
• Cookie — only NEXT_LOCALE, the language of the page (section 6).
• Nothing loaded from third parties — fonts and images are served by the site itself; GitHub and the app are plain links.
• Writing to us — emails sent to an @bioforge.science address (hello, support, the DPO) pass through Cloudflare Email Routing, which forwards them without storing them to our mailbox at Proton Mail (Proton AG, Switzerland). We use your address and your message only to answer you (retention: section 5).

11. Changes

We will update this page when our processing changes materially. The “Last updated” date at the top reflects the most recent revision. If a change requires fresh explicit consent for special-category data, we will ask for it at next sign-in rather than relying on a passive page update.