Privacy Policy

This policy explains how Misi Ltd (“Misi”, “we”, “us”) handles personal data when you use the Misi BioLabs web app at www.misibiolabs.com, the Misi BioLabs Android app, and this website (get.misibiolabs.com). Together these are “the Service”.

1. Who we are

Misi Ltd is the data controller. We are a company registered in England and Wales (company number 10207321), registered office 3 St Paul’s Road, Salford M7 3NY, United Kingdom. For any privacy question or request, email support@misibiolabs.com.

2. The data we collect

Data you give us

• Account data — name, email address, password (stored only as a salted hash), and your consent records.
• Profile and health questionnaire — date of birth, sex, height, weight and body measurements, goals, training history, equipment, dietary preferences and allergies, medical conditions, medications, injuries, health-screening (PAR-Q) answers, and lifestyle and wellbeing information such as sleep, stress and hormonal status.
• Logs and tracking — workouts, cardio sessions, meals and nutrition, custom meals and recipes, favourites, habits and daily protocol, weekly check-ins, body composition and progress notes.
• Biomarkers — blood-test results you enter or upload (including lab report images or PDFs that we read with AI to extract values).
• Photos — progress photos (stored privately) and meal photos.
• Camera and voice — if you use exercise form analysis or a body scan, the frames or images you capture are sent to our AI provider for analysis and are not kept by us beyond the result. Voice input is converted to text by your device’s speech service (on Android, Google’s speech recognition) and only the text reaches us.
• AI coach conversations — the messages you exchange with the AI coach.
• Coach sharing — the name and role of any coach you invite, the sections you let them see, and messages between you and your coach.
• Community content — meals you choose to share publicly with other Misi BioLabs users, with your display name, and your likes and ratings.
• Support and feedback — anything you send us by email.

Data from connected services

• Health Connect (Android) — only if you connect it. See section 5.
• Our payment processor — when you subscribe, it gives us your subscription status, plan, billing period and a customer reference. We never see or store your full card number.

Data collected automatically

• Security and technical data — IP address, browser or device type, sign-in times and security events (for example failed logins), and error reports.
• Usage analytics — aggregated, cookieless page-view statistics, and on this website only, Google Analytics if you accept analytics cookies (see section 11).

3. How we use your data and our legal bases

Health data is “special category” data under the UK and EU GDPR. We process it only with your explicit consent (Article 9(2)(a)), which you give during sign-up and can withdraw at any time by deleting your account or the relevant data.

We do not sell your personal data, use it for advertising, or share it with data brokers.

4. AI processing

Misi BioLabs uses Google Gemini (via the Gemini API), but the AI works inside content and rules we have built. It does not search the internet or invent your plan from scratch.

• Nutrition plans — every meal comes from our built-in, curated database of nutritionally verified meals. We first filter it for your allergies and dietary choices; the AI then selects and arranges meals from that filtered list into a 7-day plan that meets your calorie and macro targets. Any meal the AI returns that is not in our database is discarded, and portion sizes are scaled by our own code, not by the AI.
• Training plans — exercises are chosen from our built-in exercise library, pre-filtered for your equipment. Each library exercise carries its primary and secondary muscles, coaching tips, performance instructions, body mechanics and demonstration videos. The AI sequences these exercises into sessions and sets the sets, reps, rest and progression. Cardio sessions are described by time or distance (for example, “5 km easy run”).
• Targets — calorie and macro targets are based on established equations (Mifflin-St Jeor) applied to your profile, within safety limits we set.
• Other AI features — the AI coach answers using your own data in the app. Gemini also reads values from lab reports you upload, analyses exercise form and body-scan images you capture, writes warm-up drills and exercise-swap suggestions, and produces spoken audio.

To do this, the relevant parts of your profile, logs, biomarkers, wearable summaries, photos or camera frames are sent to Google for processing. Google processes this data on our behalf under its paid Gemini API terms, which means Google does not use it to train or improve its models. Google may keep it for a limited period only to detect abuse, as those terms allow.

AI output can be wrong. It is information, not medical advice (see our Terms of Service). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Health Connect (Android)

If you choose to connect Health Connect, the Android app asks for read-only access to: steps, distance, active calories burned, sleep, resting heart rate, heart rate variability, weight, body fat, VO2 max and exercise sessions. We never write data to Health Connect.

How we use it

• To show your activity, sleep and recovery trends in the app.
• To import workouts into your training log (outdoor rides are imported only after you confirm them) and steps and sleep into your Daily Protocol.
• To personalise your plans and AI coach answers: summaries of this data are sent to Google Gemini as described in section 4.

Storage, sharing and disconnecting

• We keep a rolling 60-day window of Health Connect data, on your device and on our servers.
• Workouts, steps and sleep that have been imported into your logs become part of your logs. A coach you have invited can see them if you gave that coach access to the matching section.
• You can disconnect at any time in the app. Disconnecting deletes the stored Health Connect data from your device and our servers. Items already imported into your logs stay until you delete them or your account. You can also revoke permissions in Android Settings → Health Connect.

6. Who we share data with

We use the following types of service provider (processors). They act only on our instructions, under contract, and may not use your data for their own purposes.

You can ask for the current list of named providers by emailing support@misibiolabs.com.

We also share data:

• With coaches you invite — only the sections you select. You can change or revoke access at any time.
• With other users — only meals you choose to share to the community, shown with your display name.
• When required by law — to comply with a legal obligation, or to protect the rights and safety of our users or others.
• In a business transfer — if Misi Ltd is reorganised, merged or sold, in which case this policy continues to protect your data.

7. International transfers

Some providers process data outside the UK and EEA, mainly in the United States. Where they do, we rely on adequacy regulations (including the UK–US Data Bridge where the provider is certified) or on the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses.

8. How long we keep data

Full details of what account deletion removes are on our account deletion page.

9. Security

Data is encrypted in transit (HTTPS/TLS) and at rest by our hosting providers. Passwords are hashed, sessions use secure HttpOnly cookies, sensitive actions require your password again, progress photos are kept in a private bucket and served through short-lived signed links, and access to production systems is restricted. No system is perfectly secure; if a breach affects you we will notify you and the regulator as the law requires.

10. Your rights

Under UK and EU data protection law you have the right to:

• access your data and receive a copy (Settings → Data Management → Download Backup);
• correct inaccurate data (edit your profile, or contact us);
• erase your data (Settings → Delete Account, or see this page);
• data portability (the export is a machine-readable JSON file);
• restrict or object to processing based on legitimate interests;
• withdraw consent at any time, without affecting earlier processing.

US residents (including California under the CCPA/CPRA) have the right to know, access, correct and delete personal information, and not to be discriminated against for using these rights. We do not sell or “share” personal information for cross-context behavioural advertising, and we use sensitive personal information only to provide the Service.

To use any right, use the in-app tools or email support@misibiolabs.com from your account email. We reply within one month. You can complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local data protection authority if you are in the EU.

11. Cookies and local storage

• The app uses strictly necessary HttpOnly cookies to keep you signed in, and your browser’s or device’s local storage to remember settings and work offline. It uses a cookieless analytics service that does not track you across sites.
• This website uses Google Analytics cookies to measure visits only if you accept them in the cookie banner. If you reject them, no analytics cookies are set. You can change your choice at any time using Cookie settings (also in the footer). We store your choice in your browser’s local storage.

12. Children

The Service is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child has given us data, email us and we will delete it.

13. Changes to this policy

We will post any update here with a new version number and date. If the changes are significant, we will tell you in the app or by email before they take effect.

14. Contact

Misi Ltd, 3 St Paul’s Road, Salford M7 3NY, United Kingdom · support@misibiolabs.com