This Privacy Policy explains how The Body School Inc.(“The Body School”, “we”, “us”) collects, uses, discloses, and protects your personal information when you visit global.thebody.school(the “Site”) or use The Body: Care or related services (together, the “Services”).
We comply with applicable data protection laws, including the EU/UK General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).
1. Who we are
The Body School Inc. is a corporation incorporated in the State of Delaware, USA.
- Data controller: The Body School Inc.
- Authorised contact: Sofiia Rozhko
- Mailing address: 8 The Green, Dover, DE 19901, USA
- Email: info@thebody.school
2. Information we collect
Information you give us
- Quiz responses — when you take our assessment, we collect the answers you provide so we can match you to the right programme.
- Contact details — name, email, and phone number when you sign up, book a call, or contact us.
- Programme intake — once you join CARE, you may share health and lifestyle information with your specialists. This is processed under a separate, more detailed clinical-intake notice provided when you start the programme.
- Communications — emails or messages you send us, including via Calendly bookings.
Information we collect automatically
- Technical data — IP address, browser type, device information, referring pages.
- Usage data — pages viewed, time on page, links clicked. Collected anonymously by Vercel Analytics and Vercel Speed Insights, and only if you accept analytics in our cookie banner.
- Cookies and similar technologies — see our Cookie Policy.
3. How we use your information
We use your information to:
- Provide the Services you have requested (matching, programme delivery, support).
- Communicate with you about your account, programme, and updates you have asked for.
- Send marketing emails when you have opted in (you can unsubscribe at any time).
- Improve the Site and Services.
- Comply with legal obligations and enforce our terms.
Legal bases (UK/EU GDPR)
We rely on the following legal bases:
- Contract — to deliver the Services you have signed up for.
- Consent — for marketing emails and non-essential cookies. You can withdraw consent at any time.
- Legitimate interests — to keep the Site secure, prevent fraud, and improve our offering.
- Legal obligation — to keep records required by tax and consumer protection law.
4. Sharing your information
We do not sell or rent your personal information.
We share information with the following categories of recipients, only as needed:
- Hosting and analytics: Vercel Inc. (USA) — hosts the Site, processes server logs, and (with your consent) provides anonymous Web Analytics and Speed Insights.
- Booking: Calendly LLC (USA) — processes calls scheduled through our booking links.
- Email delivery: our email service provider (e.g., eSputnik or similar) — sends transactional and marketing emails when you opt in.
- Programme team: the licensed specialists who deliver The Body: Care (under strict confidentiality), only once you join the programme.
- Professional advisers: auditors, lawyers, accountants — only when strictly necessary.
- Authorities: when required by law or to protect rights.
5. International transfers
We are based in the United States and most of our service providers operate globally. When we transfer personal data from the UK or the EU to the United States or other countries outside those jurisdictions, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or equivalent mechanisms.
6. How long we keep it
- Quiz and contact enquiries — up to 2 years from your last interaction.
- Marketing list — until you unsubscribe.
- Programme records — for the duration of the programme and 6 years afterwards (for tax and complaint records).
- Server logs — typically 30 days.
7. Your rights
Under GDPR (UK and EU residents)
You have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data erased (“right to be forgotten”) where applicable.
- Restrict or object to processing.
- Data portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time.
- Lodge a complaint with your local supervisory authority (e.g., the UK ICO at ico.org.uk).
Under CCPA/CPRA (California residents)
You have the right to:
- Know what personal information we collect, use, disclose, and sell or share.
- Delete personal information we have collected (with limited exceptions).
- Correct inaccurate personal information.
- Opt out of the “sale” or “sharing” of personal information — we do not sell or share for cross-context behavioural advertising.
- Limit the use of sensitive personal information.
- Non-discrimination for exercising any of these rights.
To exercise any of these rights, email info@thebody.school. We will respond within the time frame required by law.
8. Security
We use industry-standard administrative, technical, and physical safeguards to protect your information — including TLS encryption in transit, access controls, and regular reviews of our service providers. No system is perfectly secure, and we cannot guarantee absolute security.
9. Children
The Services are intended for adults aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will delete it.
10. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when it was last changed. Material changes will be communicated by email or a notice on the Site.
11. Contact us
Questions about privacy or your data? Email info@thebody.school.