Privacy Notice
Last updated: May 30, 2026
1. Who processes your data (Controller)
Controller: ARENA Centrum s.r.o., Company ID: 06753051, registered office at Palackého 717/11, 110 00 Prague 1, email: info@mojeinbody.cz, phone: +420 228 225 751 (reception).
GDPR contact email: info@mojeinbody.cz.
2. What data we process
We mainly process:
- identification and contact data (for example email, name, phone number, date of birth, gender, height, and account language),
- account login and security data (one-time PINs/verification, sign-in records, and security logs),
- body composition measurement data (InBody outputs), measurement history over time, imported historical results, result sheet files, optional measurement notes, and AI reports if you request them,
- account settings and recorded consents,
- data about results-sharing lifecycle between users (who shares with whom, request status, acceptance or termination timestamps),
- data about vouchers, referral and retention offers, extended-results access, memberships, and other benefits if you use these features,
- data about orders and payments related to the Service (ordered items, price, payment status, variable symbol, applied voucher or discount, invoice or receipt, and data needed for payment matching),
- data from communication with us (for example personal-data change requests, replies to our emails, or other support communication).
This data may include a special category of personal data (health-related data).
3. Processing purposes and legal basis
a) Account creation and management, storage and access to measurement history including imported results: based on your explicit consent.
b) Operational and security communication related to the account and the Service (for example login PIN, security notices, information about a new result, sharing status, or an order): performance of a contract and/or necessity for service provision; optional notifications also according to your settings and consent.
c) On-demand AI report: based on your explicit consent granted when enabling the AI report feature.
d) Results sharing with another registered user explicitly selected by you: based on your explicit consent / active action in the Service, while sharing becomes active only after recipient confirmation.
e) Processing orders, payments, vouchers, extended-results upgrades, and displaying related documents in the account: performance of a contract.
f) Compliance with legal obligations, especially accounting and tax documentation: compliance with a legal obligation.
g) System security and operations (logs, abuse prevention, rate limiting, bank payment matching, and protection of legal claims): legitimate interest in securing and properly operating the Service.
h) Handling your requests for data change, deletion, support, or the exercise of GDPR rights: compliance with a legal obligation and/or our legitimate interest in properly resolving the request.
i) Sending information about vouchers, referral offers, and retention offers (if these features are active in the Service): based on your email communication consent and/or in connection with your use of these Service features.
4. Who has access to the data (Recipients / Processors)
- hosting and technical infrastructure provider in the EU: netcup GmbH,
- email notification providers: ZeptoMail (Zoho) and Mailtrap.io,
- AI processing provider for AI reports: primarily OpenAI (API), with automatic fallback processing via Anthropic (Claude API) (depending on current service configuration and availability),
- Fio banka, a.s. and related technical infrastructure used by us for receiving, matching, and recording payments and issuing documents,
- Google (Google Tag Manager) for analytics and marketing storage in consent mode (see Section 12),
- another registered user explicitly selected by you for Results Sharing (within the scope described in Section 11 below).
5. Transfers outside the EU/EEA
Where necessary for the AI report feature or another integrated third-party service, data may be transferred outside the EU/EEA.
Such transfers are made under appropriate GDPR safeguards (for example Standard Contractual Clauses or other mechanisms according to contractual arrangements).
6. How long we retain data
Measurement and account data is retained for the duration of your account unless you request deletion earlier or withdraw the relevant consent.
Results-sharing relationship data (including status history) is retained for the period necessary for service operation, security, evidence of consent or actions taken, and protection of legal claims.
Order, payment, invoice, and receipt data is retained for the period required by applicable laws, especially accounting and tax regulations.
Security logs, login records, and communication or request records are retained for the period necessary to secure the Service, resolve the request, and protect legal claims.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, to object (for processing based on legitimate interest), and to withdraw consent at any time.
You also have the right to lodge a complaint with the supervisory authority (UOOU - Czech Data Protection Authority).
8. Withdrawal of consent
You can withdraw consent in your account settings or by email at info@mojeinbody.cz.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
9. Security
We apply technical and organizational measures appropriate to risk (access management, encrypted communication, access logging, regular updates, backups, and internal procedures).
10. Automated evaluation (AI report)
The AI report is generated only at your request.
The output is for informational purposes and does not replace professional medical assessment.
11. Results sharing between users
Sharing can be created only for an email address of a user already registered in the Service.
Sharing becomes active only after recipient confirmation. Until then, results are not visible to the recipient.
Once active, the recipient can access all historical and future measurements of the sharing user, including result sheet images and existing AI reports.
The sharing user's personal measurement notes are not made available to the recipient in shared mode.
Sharing can be terminated at any time by both the sharing user and the recipient; after termination, the recipient loses access to shared results.
12. Cookies and analytics (GTM)
The Service uses technical cookies necessary for website operation and a cookie used to store your cookie consent choice.
For analytics and marketing storage through Google Tag Manager (GTM), we use consent mode: these categories are activated only after you grant the relevant consent in the cookie banner.
Your consent choice is stored in the mojeinbody.cookie-consent cookie for up to 12 months, or until you change your choice.
You can change your preference at any time by reopening cookie settings in the Service interface.