Legal information
Privacy
Last updated: October 6, 2026
This English translation is provided for convenience only. The Bulgarian version is the legally binding text.
1. Who we are
My Better You - LIFE is a digital platform for personalized health and an active lifestyle, created mainly for women; men use it too — as clients and as trainers. It provides a health assessment, individual nutrition and workout plans, the digital personal coach Personal Coach, a supplement shop, and specialized health modules, including “My Cycle” for tracking the menstrual cycle and symptoms in women.
The controller of your personal data is AM TWINS EOOD, company ID (EIK) 204987438, 29-V Vasil Levski St, Veliko Tarnovo, Bulgaria — the company operating the My Better You - LIFE platform. For questions about this policy, write to contact@mybetteryou-life.com.
This policy is drawn up in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act. The supervisory authority in Bulgaria is the Commission for Personal Data Protection (CPDP, cpdp.bg).
2. What data we collect
Profile data: name, email, age, weight, height, activity level, and goals, entered at sign-up and in the assessment questionnaire.
Health data (a “special category” under Art. 9 GDPR):menstrual cycle dates, phase (perimenopause, menopause), symptoms, hormonal status, and health conditions that you enter voluntarily in the “My Cycle” module and in the assessment — see the full section below.
Order and payment data: delivery address and payment details, processed directly by our payment partner — we do not store bank card numbers.
Technical data: cookies, IP address, and platform usage data.
3. Health data from “My Cycle” and symptoms — a special category under Art. 9 GDPR
3.1 Why this data is a “special category”
The data about your menstrual cycle, the phase of your hormonal transition, and the symptoms you enter qualify as health data within the meaning of Art. 4(15) and Art. 9(1) GDPR — a category of data the Regulation prohibits processing, unless one of the exceptions in Art. 9(2) applies. Because of the sensitive nature of this type of data — and women’s health apps worldwide are subject to heightened regulatory attention — we process it with the additional care described below.
3.2 Legal basis — explicit, separate consent (Art. 9(2)(a) GDPR)
We process your health data solely on the basis of your explicit consent. Unlike the general acceptance of the Terms of Use, this consent is:
- Separate — it is not tied to the general terms and is never pre-ticked (the checkbox is never checked by default).
- Specific — it concerns precisely the cycle, symptom, and hormonal status data, not data in general.
- Informed — before you give it, we explain what is collected and why.
- Freely given and revocable — you can decline or withdraw your consent at any time, without affecting your use of the platform features that do not require health data.
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR). After withdrawal, the “My Cycle” module stops generating predictions and personalized recommendations tied to your hormonal stage until the data is entered again.
3.3 What we use this data for — and what we never use it for
The data from “My Cycle” and your symptoms is used solely for:
- predicting your cycle and the phase of your hormonal transition;
- personalizing your nutrition and workout plan according to your phase and symptoms;
- the Personal Coach recommendations and tracking your symptoms over time.
3.4 Minimization and retention
We collect only the data necessary for the stated purposes (Art. 5(1)(c) GDPR). Health data is stored for as long as you maintain an active account with consent given; when your account is deleted or consent is withdrawn, it is erased within 30 days, except for restricted-access backups, which are overwritten on a fixed cycle.
3.5 Security
Health data is stored encrypted in a database hosted in the European Union (Frankfurt, Germany), with access restricted to personnel bound by a duty of confidentiality under Art. 9(3) GDPR. We apply access controls, encrypted connections (TLS), and regular reviews of access rights.
3.6 Automated recommendations
Plans and recommendations are generated automatically from the data you enter and from rules based on clinical guidelines (see “Scientific basis”). This is not automated decision-making with legal or similarly significant effects within the meaning of Art. 22 GDPR — the recommendations are informative, not binding, and you can request human review at any time by writing to contact@mybetteryou-life.com.
3.7 Accountability and proof of consent
In line with the accountability principle under GDPR, we keep the information and technical records needed to demonstrate compliance with the Regulation when processing personal data.
Where processing is based on consent, including explicit consent to the processing of health data, we keep proof of the consent given in accordance with GDPR. For this purpose, we may store information about when and how the consent was given, its scope, and the version of the text by which the User was informed at that time.
The withdrawal of consent is recorded in a way that makes it possible to establish when it was withdrawn. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
Proof that consent was given or withdrawn may be kept even after the relevant processing has ended, for the period necessary to fulfil the Controller’s obligations and for the establishment, exercise or defence of legal claims, after which it is deleted or anonymised.
4. Who we share data with
We share data only with processors acting on our instructions under a data processing agreement (Art. 28 GDPR), never for their own marketing purposes:
| Data processor | Role | Location |
|---|---|---|
| Supabase | Database hosting and authentication | EU (Frankfurt, Germany) |
| Stripe | Payment processing | EU / international, with certified safeguards |
| Resend | Transactional email delivery | Outside the EEA, with contractual safeguards |
| Vercel | Application hosting | International, with contractual safeguards |
| Anthropic (Claude API) | The personal messages in your daily plan — receives your profile, plan and progress only to compose them; not used to train models | USA, under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
Trainer.If you accept a trainer’s invitation on the platform, you explicitly consent to giving them access to: your name and email, goal and target calories and macros, the tomorrow menu you submit for approval, weight and measurements, the weekly reports and recovery data (sleep, energy, pain) you share, and the messages and videos between you. The trainer sees data only from the date of linking and only while the link is active — you can end it at any time from “Settings” → “End the coach’s access”. Trainers are bound by the trainer terms, including a confidentiality obligation, and receive no health data beyond the above.
If you are a trainer/partner. We process your name and email, your bank account (IBAN) and its holder, the recorded commissions, your payout history, your acceptance of the partner terms, and the email addresses you send invitations to (used only for the invitation itself). The legal basis is our contract with you (Art. 6(1)(b) GDPR) and, for payout records, a legal obligation (Art. 6(1)(c)). We keep those records for as long as accounting and tax law requires (up to 10 years); everything else while your partner profile is active. Commission details are in the Partner terms.
Where a processor is located outside the EU/EEA, we ensure appropriate safeguards under Art. 46 GDPR — Standard Contractual Clauses approved by the European Commission, or a transfer under an adequacy decision (e.g. the EU-U.S. Data Privacy Framework).
5. Legal basis for the remaining data
We process profile and order data on the basis of contract performance (Art. 6(1)(b) GDPR). We send marketing messages only with your consent (Art. 6(1)(a)), which you can withdraw at any time. We retain accounting documents on the basis of a legal obligation (point (c)).
5.1 Retention periods
We keep your personal data only for as long as necessary to achieve the purposes for which it was collected, unless applicable law requires or permits a longer retention period.
Profile data is kept for as long as your account is active and is deleted within 30 days of its final closure, unless there is another legal basis for further retention of certain data.
Data relating to orders, payments, invoicing and accounting documents is kept for the periods laid down in applicable tax and accounting legislation.
Data processed on the basis of consent is kept until the consent is withdrawn or the purpose for which it was given no longer applies, unless another applicable legal basis exists for its further retention. Proof of consent given or withdrawn may be kept for the period necessary to demonstrate compliance with our obligations under GDPR and for the establishment, exercise or defence of legal claims.
Technical data and system logs are kept for the period necessary to ensure the security and normal functioning of the Platform, to prevent and detect abuse and to resolve technical incidents, after which they are deleted or anonymised.
Where a specific retention period cannot be determined in advance, it is set according to the purpose of the processing, the nature and sensitivity of the data, the need to keep it, applicable legal obligations and the time limits for the establishment, exercise or defence of legal claims. Once the basis for retention no longer applies, the data is securely deleted or anonymised.
6. Your rights
At any time, for all categories of data, you have the right to:
- Access — receive a copy of your data (Art. 15).
- Rectification of inaccurate data (Art. 16).
- Erasure (“the right to be forgotten”, Art. 17).
- Restriction of processing (Art. 18).
- Objection to processing based on legitimate interest (Art. 21).
- Portability of your data in a structured format (Art. 20).
- Withdrawal of consent — at any time, without affecting past processing (Art. 7(3)).
You can exercise part of your rights yourself, with one click: Manage consents — to withdraw your health data consent and change your cookie choice. The link is in the site footer and, in the trainer and client dashboards, in “Settings”. Marketing emails are stopped via the unsubscribe button in every email; subscribers can also stop them from Settings → Notifications. For a copy of your data (Art. 20), write to us — we send it in a machine-readable format within the statutory period.
Closing your account (Art. 17): found in My account → Notifications and consents, at the bottom of the page, under “Need anything else?”. You can also go directly: close your account. If you prefer, just write to us at contact@mybetteryou-life.com— we’ll do it for you.
You can also exercise your rights in writing at contact@mybetteryou-life.com. We reply within 30 days. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg) or with the supervisory authority in the country where you live.
6.1 Identity verification when exercising your rights
To protect your personal data from unauthorised access, disclosure, alteration or deletion, when we receive a request to exercise a right under GDPR we may ask for additional information needed to confirm your identity where we have reasonable doubts about the identity of the person making the request. We will only ask for information that is necessary and proportionate for the verification.
Exercising your rights is free of charge. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may, in the cases provided for by GDPR, charge a reasonable fee taking into account the administrative costs, or refuse to act on the request.
7. Children
The platform is intended for adult users. We do not knowingly collect data of persons under 18. If we learn that we have received data of a minor without parental/guardian consent, we delete it immediately.
8. In the event of a data breach
In the event of an incident threatening the security of personal data, we will notify the CPDP within 72 hours of becoming aware (Art. 33 GDPR), and — where there is a high risk to your rights and freedoms — you personally, without undue delay (Art. 34 GDPR).
8.1 Data kept after account closure
Closing your account or deleting your personal data does not affect data we are required to keep for a certain period under applicable law, including accounting and payment documents, or data whose limited retention is necessary for the establishment, exercise or defence of legal claims.
In these cases, the data will not be used to provide the services, for personalisation or for marketing purposes, and access to it will be restricted in line with the purpose of the retention. The data is erased or anonymised once the relevant legal basis no longer applies and the applicable retention period has expired.
Residual copies of certain data may temporarily remain in secure backups until they are automatically overwritten according to the established backup cycle; during this period they are not used for any other purpose and access to them is restricted.
9. Cookies
A plain visit sets no cookies at all. They appear only once you do something specific — sign in, switch language, or arrive through a partner link. Here is the full list:
| Cookie | What it does | Lifetime | Consent |
|---|---|---|---|
| sb-…-auth-token | Keeps you signed in. | while signed in | not required |
| mbyl-lang | Remembers the language you use. | 1 year | not required |
| mbyl-units, mbyl-currency | Remember the units and currency you chose. | 1 year | not required |
| mbyl-acct-lang | Remembers your account language, so you see the site in it from abroad too. | 1 year | not required |
| mbyl-role | Remembers whether you are a subscriber, a coach’s client or a coach, so your own pages open for you. | until you close the browser | not required |
| mbyl-app | Marks that you opened the site from the mobile app, so it can show you the way back. | until you close the browser | not required |
| mbyl_consent | Remembers your choice in this banner. | 1 year | not required |
| mby_aff | Records which partner you came through, so their commission is credited. | 60 days | required |
| mby_ref | The same, for the “invite a friend” link. | 30 days | required |
| _fbp, _fbc (Meta) | Measures our Facebook and Instagram ads. | up to 90 days | required |
| Stripe | Payment security. Set by Stripe on their own page. | per Stripe’s policy | not required |
The cookies marked “required” are not set before you allow them — with “Accept” in the banner or with the checkbox at sign-up. If you decline, partner links still work — the connection to the partner is simply remembered for your current visit only, not for 60 days.
You can change your choice at any time from Manage consents — the link is in the site footer and, in the trainer and client dashboards, in “Settings”.
10. Changes to this policy
If we change the way we process personal data — especially special-category health data — we will update this page and notify active users by email before the change takes effect.
11. Contact
For questions about your personal data, write to us at contact@mybetteryou-life.com.