Privacy Policy

Bo — Your Health & Life Assistant Last Updated: May 21, 2026

Bo Labs, Inc. ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Bo health, fitness & life assistanting service ("Service"). Please read this Privacy Policy carefully.

1. Definitions

Personal Data means information that identifies or can reasonably be linked to an individual, including identifiable health information.

Health Data means information you provide or that we collect relating to your physical characteristics, health, nutrition, fitness goals, or activity. Health Data includes weight, height, body measurements, dietary preferences, allergies, medical conditions, activity levels, exercise history, food logs, and any biometric or health-related information imported from Third-Party Health Applications (defined below). Health Data is a subset of Personal Data and receives elevated protections as described in this Privacy Policy.

Third-Party Health Applications means third-party applications, platforms, and connected devices from which you permit us to import Health Data, including Apple Health (HealthKit), WHOOP, Oura Ring, Garmin, and other fitness trackers or health services you choose to connect to the Service.

Message Content means all messages you send to and receive from Bo via SMS or iMessage, including meal descriptions, workout reports, questions, feedback, and coaching conversations.

Usage Data means data collected automatically through use of the Service, including interaction patterns, message frequency, response times, feature usage, engagement metrics, device information, and log data.

Aggregated Data means data that has been combined, anonymized, or de-identified such that it cannot reasonably be used to identify you.

2. Information We Collect

We collect several types of information from and about users of our Service:

2.1 Information You Provide Directly

● Account Information: Name, email address, phone number, date of birth, and payment information.

● Health and Fitness Data: Weight, height, body measurements, fitness goals, dietary preferences, allergies, medical conditions, activity levels, and exercise history.

● Message Content: All messages you send to Bo via SMS or iMessage, including meal descriptions, workout reports, questions, and feedback.

● Profile Preferences: Communication preferences, notification settings, and coaching style preferences.

2.2 Information Collected Automatically

● Usage Data: Interaction patterns, message frequency, response times, feature usage, and engagement metrics.

● Device Information: Device type, operating system, mobile carrier, phone number, and unique device identifiers.

● Location Data: General location information based on IP address. We do not track precise GPS location.

● Log Data: Timestamps, message delivery status, error logs, and system diagnostics.

2.3 Third-Party Health Information

With your express permission, our Service connects to Third-Party Health Applications to import certain Health Data about you. We connect to these applications solely for the purpose of importing health information to enhance your coaching experience.

Examples of Health Data we may import from Third-Party Health Applications include:

● Heart rate and heart rate variability (HRV)

● Sleep duration, sleep stages, and sleep quality scores

● Movement and exercise activity, including steps, calories burned, and workout data

● Recovery scores, strain, and readiness metrics

● Blood oxygen levels and respiratory rate

● Height, weight, and body composition data

You control which Third-Party Health Applications are connected and which categories of Health Data are shared with the Service. You may disconnect any Third-Party Health Application at any time. Disconnecting will stop future data imports but will not automatically delete Health Data previously imported. To request deletion of previously imported Health Data, please contact us at privacy@trybo.ai.

2.3.1 Apple HealthKit-Specific Disclosures

In addition to the general practices described in Section 2.3, the following disclosures apply specifically to Health Data imported from Apple Health (HealthKit) on your iOS device, in accordance with Apple's App Store Review Guideline 5.1.3:

● We access HealthKit data only with your explicit, per-category permission granted through the iOS Health app, and you may grant or revoke access to each category independently in iOS Settings → Privacy & Security → Health → Bo, or in the Health app.

● We do not use HealthKit data for advertising or marketing, or for any other use-based data mining purpose other than for the purpose of improving your health, fitness, or wellness management within the Service. The Service does not display advertising.

● We do not disclose HealthKit data to any third party for that party's own advertising, marketing, or data-mining purposes, and we do not sell HealthKit data.

● We do not store HealthKit data, or any data derived from HealthKit, in iCloud.

● We do not write data back to HealthKit.

● Revoking HealthKit access stops further reads but does not automatically delete data Bo has already received. To delete previously imported HealthKit data, contact us at privacy@trybo.ai.

2.4 Information from Third Parties

We may receive information about you from third-party services such as payment processors, SMS delivery providers (e.g., LINQ Corporate Solutions Private Limited), and analytics services.

3. Where Your Information Is Stored

3.1 Personal Data and Account Information

Contact information (such as name, email, phone number, and profile data) and non-biometric user-generated data (such as coaching preferences, fitness goals, and activity history) are stored using secure third-party cloud hosting providers to support your use of the Service.

3.2 Health Data

Health Data imported from Third-Party Health Applications is transmitted to and stored on our secure cloud infrastructure to enable AI-powered coaching. Unlike app-based services where biometric data can remain on-device, the SMS-native architecture of Bo requires cloud processing to deliver coaching responses. Health Data is encrypted in transit and at rest.

3.3 Message Content and AI Processing

All Message Content, including conversations with Bo, is stored on our cloud infrastructure. Messages are transmitted through our third-party SMS service provider (LINQ Corporate Solutions Private Limited) for delivery. To generate personalized coaching responses, your Message Content and relevant Health Data are de-identified and transmitted to our third-party AI technology provider (Anthropic, via the Claude API). See Section 5 (AI and Language Model Processing) for details on how this data is handled.

4. How We Use Your Information

We use the information we collect to:

● Provide personalized health, fitness & life assistanting recommendations

● Create customized meal plans and workout programs

● Track your progress and provide accountability

● Send you text messages, notifications, and service updates

● Send you marketing emails, product updates, and service communications. You may opt out of marketing emails at any time by clicking the unsubscribe link in any email we send

● Process payments and manage your subscription

● Improve our AI algorithms and Service functionality

● Conduct research and analytics to understand user behavior and preferences

● Detect, prevent, and address technical issues and security threats

● Comply with legal obligations and enforce our Terms of Service

● Communicate with you about your account and respond to your inquiries

Restrictions: We do not use Health Data for advertising or marketing purposes.

5. AI and Language Model Processing

Bo uses artificial intelligence to provide conversational health and fitness coaching. To deliver this functionality, we leverage third-party AI technology from our language model partner (currently Anthropic, via the Claude API). This section explains how your data flows through our AI systems.

5.1 What Data Is Processed

When you send a message to Bo, the following information may be transmitted to our AI provider to generate a coaching response:

● Your current message and relevant conversation history

● Your profile information (e.g., fitness goals, dietary preferences, allergies)

● Relevant Health Data from connected Third-Party Health Applications (e.g., sleep scores, recovery metrics)

We transmit only the minimum information necessary to generate a relevant, personalized response. Before transmitting data to our AI provider, we de-identify your information by stripping out personally identifiable details such as your name, phone number, and other direct identifiers. We share only de-identified data with our AI provider. Please avoid including sensitive personal identifiers (such as your full name, Social Security number, or financial account information) in your messages to Bo.

5.2 How AI-Processed Data Is Handled

● Our AI provider processes your de-identified data strictly to generate coaching responses on our behalf.

● We have ensured that our AI provider maintains a "Zero-Retention/Zero-Training Policy" with respect to your data, meaning that our AI provider will not store or retain any of the data it receives through your use of the Service, and our AI provider will not use any data it receives for training any algorithms or language model technology.

● Bo retains conversation history on our own infrastructure so that Bo can provide continuity and context across interactions. You may request deletion of your conversation history at any time.

● Bo Labs employees and authorized customer support personnel will only access your conversations when required to provide services and support, to respond to your inquiries, or to assess and improve the performance of the Service. Access is limited to the specific conversation or data relevant to the support request or quality assurance purpose.

5.3 Important Limitations

Bo generates responses based on your inputs and Health Data. Those responses may be inaccurate, incomplete, or inconsistent. Bo does not provide medical advice and should never be relied upon as a substitute for professional medical care, diagnosis, or treatment. Always consult a qualified healthcare provider with questions about your health or medical conditions.

6. Anonymized and Aggregated Data for Service Improvement

We may use anonymized or aggregated conversation data and Health Data to improve our AI algorithms, coaching quality, and overall Service functionality. When data is used for these purposes:

● Data is stripped of all personally identifiable information before use.

● Anonymized data cannot reasonably be used to identify you.

● We do not associate anonymized data with your identity when used for internal development, research, or model training.

We may share Aggregated Data that cannot reasonably be used to identify you for industry research, health trends analysis, product development partnerships, or academic studies.

7. We Do Not Sell Your Personal Data

We do not sell, rent, or trade your Personal Data, including Health Data, to any third party for monetary or other valuable consideration. This applies to all categories of data we collect, without exception. We only share your Personal Data with trusted service providers and partners as described in this Privacy Policy to operate the Service and improve your experience.

8. How We Share Your Information

8.1 Service Providers

We share information with trusted third-party service providers who perform services on our behalf, including:

● LINQ Corporate Solutions Private Limited (SMS and iMessage delivery and telecommunications infrastructure)

● Anthropic (Claude API for AI-powered conversational coaching)

● Customer.io (email marketing and transactional email delivery)

● Stripe (subscription billing and payment processing)

● Cloud hosting providers (data storage and computing infrastructure)

● Analytics providers (usage statistics and performance monitoring)

These service providers are contractually obligated to use your information only to provide services to us and are prohibited from using or disclosing your information for any other purpose. Each service provider is required to provide the same or equal protection of user data as stated in this Privacy Policy.

8.2 Aggregated and De-Identified Data

We may share Aggregated Data that cannot reasonably be used to identify you. This may include industry research, health trends analysis, product development partnerships, or academic studies.

8.3 Legal Requirements and Protection

We may disclose your information if required to do so by law or if we believe such action is necessary to: (a) comply with legal process or government requests; (b) enforce our Terms of Service; (c) protect our rights, property, or safety, or that of our users or the public; or (d) detect, prevent, or address fraud, security, or technical issues.

8.4 Business Transfers

If Bo Labs, Inc. is involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

9. Consent for Health Data Collection

9.1 Health Data You Provide Directly

By voluntarily providing Health Data through your conversations with Bo (e.g., describing your meals, reporting your workouts, sharing your weight), you consent to our collection and use of that information as described in this Privacy Policy.

9.2 Third-Party Health Application Data

Before importing any Health Data from Third-Party Health Applications, we will request your express permission. You will be asked to authorize the specific connection and the categories of data to be imported. You may revoke this permission at any time by disconnecting the relevant Third-Party Health Application.

9.3 Withdrawing Consent

You may withdraw your consent to the collection and processing of your Health Data at any time by: (a) disconnecting Third-Party Health Applications through the Service; (b) requesting deletion of your Health Data by contacting us at privacy@trybo.ai; or (c) deleting your account entirely. You may opt out of marketing emails at any time by clicking the unsubscribe link in any email we send. You may also text "STOP" to our service number to opt out of all text message communications. Please note that withdrawing consent may limit our ability to provide certain features of the Service.

10. Data Retention

10.1 Personal Data

We retain your Personal Data for as long as your account is active or as needed to provide you the Service. We will retain and use your information to comply with legal obligations, resolve disputes, enforce our agreements, and for legitimate business purposes.

10.2 Health Data

Health Data is retained until you delete it or delete your account. You may request deletion of specific Health Data categories at any time by contacting us at privacy@trybo.ai.

10.3 Message Content

Conversation history with Bo is retained for as long as your account is active to enable continuity in coaching. You may request deletion of your conversation history at any time.

10.4 Account Deletion

You may delete your account at any time by contacting us at privacy@trybo.ai. After account deletion, we will delete or anonymize your Personal Data within 30 days, except where we are required to retain certain information for legal, tax, or regulatory purposes. Aggregated or anonymized data that cannot identify you may be retained indefinitely.

11. Data Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

● Encryption of data in transit (TLS/SSL) and at rest

● Regular security assessments and penetration testing

● Access controls and authentication mechanisms

● Employee training on data protection and privacy

● Monitoring and logging of system access and activities

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

12. Your Rights and Choices

Depending on your location, you may have certain rights regarding your Personal Data:

● Access: Request a copy of the Personal Data we hold about you.

● Correction: Request correction of inaccurate or incomplete information.

● Deletion: Request deletion of your Personal Data, including Health Data.

● Portability: Request a copy of your data in a machine-readable format.

● Opt-out: Unsubscribe from marketing emails by clicking the unsubscribe link in any email we send, or opt out of text messages by texting "STOP" to our service number.

● Object: Object to processing of your information for certain purposes.

● Restrict Processing: Request restriction of processing of your Personal Data.

● Withdraw Consent: Withdraw consent for Health Data processing at any time.

To exercise these rights, please contact us at privacy@trybo.ai. We will respond to your request within 30 days. You may also opt out of text messages at any time by texting "STOP" to our service number, or opt out of marketing emails by clicking the unsubscribe link in any email we send.

13. HIPAA and Health Information

Bo is not a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA). The health and fitness information you provide to Bo is not protected health information (PHI) under HIPAA. By using the Service, you acknowledge that the privacy protections of HIPAA do not apply to your use of Bo. We recommend that you do not share sensitive medical information, diagnoses, or treatment details through Bo. For medical advice and treatment, please consult with a qualified healthcare provider.

14. U.S. State-Specific Privacy Rights

14.1 California (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

● Right to know what Personal Data is collected, used, and shared.

● Right to delete Personal Data.

● Right to opt-out of the sale of Personal Data. We do not sell Personal Data.

● Right to non-discrimination for exercising your privacy rights.

● Right to correct inaccurate Personal Data.

● Right to limit use and disclosure of sensitive Personal Data.

To exercise these rights, contact us at privacy@trybo.ai.

14.2 Washington My Health My Data Act and Nevada Consumer Health Data Privacy Law

In connection with the Service, Bo Labs may process health-related data that constitutes "Consumer Health Data," as defined by applicable U.S. state laws, including the Washington My Health My Data Act and the Nevada Consumer Health Data Privacy Law. To provide you with more detail about how we handle this type of information, we have created a supplemental Consumer Health Data Privacy Notice, which is appended below in Section 20 of this Privacy Policy.

To exercise your rights under these laws, contact us at privacy@trybo.ai.

14.3 Other States

If you reside in Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may be entitled to specific rights under applicable state data privacy laws, including the right to access, correct, delete, and port your Personal Data, as well as the right to opt out of targeted advertising and profiling. To exercise these rights, contact us at privacy@trybo.ai.

15. Information for European Economic Area Residents

If you are a resident of the European Economic Area ("EEA"), the United Kingdom, or Switzerland, you have certain rights and protections under the General Data Protection Regulation ("GDPR") and applicable local laws regarding the processing of your Personal Data.

15.1 Legal Bases for Processing

We process your Personal Data only when we have a lawful basis for doing so. Depending on the context, these legal bases include:

● Consent: Where you have given explicit consent, particularly for Health Data processing and connections to Third-Party Health Applications.

● Contract Performance: Where processing is necessary to provide the Service under our agreement with you.

● Legitimate Interests: Where processing is necessary for our legitimate interests (e.g., improving the Service, ensuring security), provided those interests are not overridden by your rights.

● Legal Obligations: Where processing is necessary to comply with applicable law.

15.2 Your GDPR Rights

You have the following rights with respect to your Personal Data:

● Access: Request information about and a copy of the Personal Data we hold about you.

● Rectification: Request correction of inaccurate or incomplete Personal Data.

● Erasure: Request deletion of your Personal Data from our systems.

● Withdrawal of Consent: Withdraw consent at any time where processing is consent-based.

● Portability: Request a copy of your Personal Data in a machine-readable format.

● Objection: Object to the processing of your Personal Data for certain purposes.

● Restriction: Request restriction of processing of your Personal Data.

● Complaint: Lodge a complaint with your local Data Protection Authority.

15.3 International Data Transfers

Your information is transferred to and processed in the United States, where Bo Labs, Inc. is based. We implement appropriate safeguards for international data transfers as required by law, including standard contractual clauses approved by the European Commission. By using the Service, you understand and consent to having your Personal Data transferred to and processed in the United States. The United States may not provide the same level of data protection as the laws in your country.

To exercise any of these rights, please contact us at privacy@trybo.ai. We will respond within the timeframes required by applicable law.

16. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect Personal Data from children. If you are a parent or guardian and believe your child has provided us with Personal Data, please contact us at privacy@trybo.ai, and we will delete that information.

17. Third-Party Links and Services

The Service may contain links to third-party websites or services. Their privacy practices are their own, and we do not control or endorse them. Your interactions with those services are subject to their own terms and policies.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date. We may also send you a text message notification. Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

19. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Bo Labs, Inc.

Attn: Privacy Officer

Email: privacy@trybo.ai

Website: beta.trybo.ai

For data subject requests under GDPR, CCPA, or state consumer health data laws, please include "Privacy Request" in the subject line.

© 2026 Bo Labs, Inc. All rights reserved.

Consumer Health Data Privacy Notice

Effective Date: May 2, 2026

20. Supplemental Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Notice (the "Consumer Health Notice") supplements the Bo Labs Privacy Policy above and explains how Bo Labs, Inc. ("Bo Labs," "we," "us," or "our") collects, uses, discloses, and otherwise processes Consumer Health Data of residents of the state of Washington or Nevada, or individuals whose Consumer Health Data is collected in those states, through the Bo health and fitness coaching service (the "Service").

This Consumer Health Notice does not address privacy practices relating to Bo Labs job applicants, employees, or other personnel. This Consumer Health Notice is not a contract and does not create any legal rights or obligations not otherwise provided by law.

20.1 Definition of Consumer Health Data

The term "Consumer Health Data" as used in this Consumer Health Notice means any personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status, as defined in the Washington My Health My Data Act or the Nevada Consumer Health Data Privacy Law (collectively, the "Consumer Health Privacy Laws"). Consumer Health Data does not include information that is considered deidentified under the Consumer Health Privacy Laws.

20.2 Consumer Health Data We Collect

The Consumer Health Data we collect depends on the context of your interactions with us and, in most cases, is information that you decide to share with us. This includes information collected through your SMS conversations with Bo, consultation questionnaires, your communications with us, or from your other interactions with the Service. Examples of Consumer Health Data that we may collect include:

● Information you share about your health-related conditions, symptoms, experiences, diagnoses, or goals.

● Information you share about your bodily functions, vital signs, symptoms, or measurements.

● Health-related information shared through your conversations with Bo via SMS or iMessage.

● Health Data imported from Third-Party Health Applications such as Apple Health (HealthKit), WHOOP, Oura Ring, and Garmin.

● Any health-related information shared with our customer support services.

● Other information that may be used to infer or derive data related to the above or other health-related information.

20.3 How We Use Consumer Health Data

We may process and/or use your Consumer Health Data (including with your consent where required by the Consumer Health Privacy Laws) for the following purposes:

● To provide, manage, and deliver the Service, including personalized health, fitness & life assistanting via SMS.

● To respond to your questions, concerns, and other requests for assistance.

● To improve our AI coaching algorithms and overall Service quality using anonymized or de-identified data.

● To customize your coaching experience based on your health and fitness goals.

We do not use Consumer Health Data for advertising or marketing purposes, nor do we sell such data to third parties.

20.4 How We Share Consumer Health Data

We may share Consumer Health Data with the following categories of third parties, solely for the purposes described in this Consumer Health Notice and the Privacy Policy:

● AI Technology Provider (Anthropic): De-identified Consumer Health Data is transmitted to Anthropic via the Claude API solely for the purpose of generating coaching responses. Anthropic maintains a Zero-Retention/Zero-Training Policy with respect to your data.

● SMS Service Provider (LINQ Corporate Solutions Private Limited): Message Content, which may contain Consumer Health Data, is transmitted through LINQ for SMS and iMessage delivery.

● Cloud Hosting Provider (Supabase): Consumer Health Data is stored on secure third-party cloud infrastructure for data storage and Service operation.

● Payment Processor (Stripe): Stripe processes payment and subscription information only. Stripe does not receive Consumer Health Data.

These service providers are contractually obligated to use your information only to provide services to us and are prohibited from using or disclosing your information for any other purpose. Each service provider is required to provide the same or equal protection of user data as stated in this Privacy Policy.

20.5 Consent

We will obtain your consent before collecting or sharing Consumer Health Data as required by the Consumer Health Privacy Laws. You have the right to withdraw your consent at any time by contacting us at privacy@trybo.ai. We do not sell or share Consumer Health Data except as described in this Consumer Health Notice and the Privacy Policy.

20.6 Your Rights

Under the Consumer Health Privacy Laws, you may have the right to:

● Confirm whether we are collecting, sharing, or selling your Consumer Health Data.

● Access your Consumer Health Data.

● Request deletion of your Consumer Health Data.

● Withdraw your consent to the collection and sharing of your Consumer Health Data.

To exercise any of these rights, please contact us at privacy@trybo.ai. We will respond to your request within the timeframes required by applicable law.

20.7 Contact Us

If you have questions or concerns about this Consumer Health Data Privacy Notice, please contact us at privacy@trybo.ai.