Last updated: July 18, 2026
1. Who processes your data (Controller)
Controller: ARENA Centrum s.r.o., Company ID: 06753051, registered office at Palackého 717/11, 110 00 Prague 1, email: info@mojeinbody.cz, phone: +420 228 225 751 (reception).
GDPR contact email: info@mojeinbody.cz.
2. What data we process
We mainly process:
- identification and contact data (for example email, name, phone number, date of birth, gender, height, and account language),
- account login and security data (one-time login codes, sign-in records, IP address, and details of the browser and device used for remembered devices),
- data from measurements taken on our devices and their history over time: body composition (InBody), MaxPulse measurements, grip strength (InGrip) and blood pressure, plus imported historical results, result sheet files, optional measurement notes, and AI reports if you request them,
- data about goals, badges, and measurement comments if you use these features,
- account settings and recorded consents,
- data about results-sharing lifecycle between users (who shares with whom, request status, acceptance or termination timestamps) and about public measurement links you create yourself,
- email addresses of other people that you enter yourself (results-sharing invitation, referral to a friend, gift voucher delivery) — including where those people do not yet have an account,
- data about where you came to the website from (traffic source and campaign parameters), see Section 13,
- data about vouchers, referral and retention offers, extended-results access, memberships, and other benefits if you use these features,
- data about orders and payments related to the Service (ordered items, price, payment status, variable symbol, applied voucher or discount, invoice or receipt, and data needed for payment matching),
- data from communication with us (for example personal-data change requests, replies to our emails, or other support communication), including copies of emails the Service sends to you.
This data may include a special category of personal data (health-related data).
3. Processing purposes and legal basis
a) Account creation and management, storage and access to measurement history including imported results: based on your explicit consent.
b) Operational and security communication related to the account and the Service (for example login code, security notices, information about a new result, sharing status, or an order): performance of a contract and/or necessity for service provision; optional notifications also according to your settings and consent.
c) On-demand AI report: based on your explicit consent granted when enabling the AI report feature.
d) Results sharing with another user explicitly selected by you, and creation of a public measurement link: based on your explicit consent / active action in the Service, while sharing becomes active only after recipient confirmation (see Sections 11 and 12).
e) Processing orders, payments, vouchers, extended-results upgrades, and displaying related documents in the account: performance of a contract.
f) Compliance with legal obligations, especially accounting and tax documentation: compliance with a legal obligation.
g) System security and operations (logs, abuse prevention, rate limiting, bank payment matching, and protection of legal claims): legitimate interest in securing and properly operating the Service.
h) Handling your requests for data change, deletion, support, or the exercise of GDPR rights: compliance with a legal obligation and/or our legitimate interest in properly resolving the request.
i) Sending information about vouchers, referral offers, and retention offers (if these features are active in the Service): based on your email communication consent and/or in connection with your use of these Service features.
4. Who has access to the data (Recipients / Processors)
- hosting and technical infrastructure provider in the EU: netcup GmbH,
- email notification providers: ZeptoMail (Zoho) and Mailtrap.io,
- AI processing provider for AI reports: primarily OpenAI (API), with automatic fallback processing via Anthropic (Claude API) (depending on current service configuration and availability),
- Fio banka, a.s. for receiving, matching, and recording payments and issuing documents, and SumUp for card payments at our branches,
- Google (Google Tag Manager) for analytics and marketing storage in consent mode (see Section 13),
- another registered user explicitly selected by you for Results Sharing (within the scope described in Section 11 below).
5. Transfers outside the EU/EEA
Where necessary for the AI report feature or another integrated third-party service, data may be transferred outside the EU/EEA.
Such transfers are made under appropriate GDPR safeguards (for example Standard Contractual Clauses or other mechanisms according to contractual arrangements).
6. How long we retain data
Measurement and account data is retained for the duration of your account unless you request deletion earlier or withdraw the relevant consent.
Results-sharing relationship data (including status history) is retained for the period necessary for service operation, security, evidence of consent or actions taken, and protection of legal claims.
Order, payment, invoice, and receipt data is retained for the period required by applicable laws, especially accounting and tax regulations.
Security logs, login records, and communication or request records are retained for the period necessary to secure the Service, resolve the request, and protect legal claims.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, to object (for processing based on legitimate interest), and to withdraw consent at any time.
You also have the right to lodge a complaint with the supervisory authority (UOOU - Czech Data Protection Authority).
8. Withdrawal of consent
You can withdraw consent in your account settings or by email at info@mojeinbody.cz.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
9. Security
We apply technical and organizational measures appropriate to risk (access management, encrypted communication, access logging, regular updates, backups, and internal procedures).
10. Automated evaluation (AI report)
The AI report is generated only at your request.
The output is for informational purposes and does not replace professional medical assessment.
11. Results sharing between users
Sharing becomes active only after recipient confirmation. Until then, results are not visible to the recipient.
If you enter the email address of someone who is not yet registered in the Service, we store that address and send them an invitation to register. The invitation is valid for 30 days and is deleted afterwards; sharing is created once the invited person registers and confirms it. We handle email addresses you enter for a referral or for gift voucher delivery in the same way. You are responsible for having a reason to enter someone else's email address and for that person expecting it.
Once active, the recipient can access all historical and future measurements of the sharing user, including result sheet images and existing AI reports.
The sharing user's personal measurement notes are not made available to the recipient in shared mode.
Sharing can be terminated at any time by both the sharing user and the recipient; after termination, the recipient loses access to shared results.
12. Public measurement link
You can create a public link to a specific measurement yourself. Anyone who knows such a link can view selected values from that measurement (and, depending on your choice, a trend chart or the AI report) without signing in and without any further verification. The link does not contain your name or contact details, but it does contain health data — so consider carefully who you pass it to.
The link remains valid until you disable it in your account; it does not expire on its own. We record the number of views and the time it was last opened so that you can see how it is being used. The linked page is excluded from search engine indexing.
13. Cookies and analytics
The Service uses technical cookies necessary for website operation and sign-in: the login session, language preference, remembered device (up to 12 months), and storage of your cookie consent choice (up to 12 months).
For analytics and marketing storage through Google Tag Manager, we use consent mode: these categories are activated only after you grant the relevant consent in the cookie banner.
We also use cookies to determine which campaign or link brought you to the website (up to 6 months). We use them on the basis of our legitimate interest in evaluating the effectiveness of our own promotion; we do not share them with third parties and do not combine them with profiling for advertising.
We measure website traffic with our own tool on our own infrastructure, which stores no cookies and does not identify individual visitors.
You can change your preference at any time by reopening cookie settings in the website footer.