Privacy policy

Last updated 22 October 2026

Baseform (getbaseform.app and the Baseform iPhone app) helps you understand your recovery, sleep and training from the devices and apps you connect. Health data is sensitive, so this policy says exactly what Baseform collects, why, who processes it and how you stay in control. Baseform is free and has no ads, no tracking and no data sales.

Who is responsible

Baseform is run by Sebastian Sjöqvist, a private individual in Sweden, who is the data controller. Contact: privacy@getbaseform.app.

What Baseform collects

• Account: your email address (to sign in with a one-time code), first name and, if you add one, a profile picture.
• Health and fitness data from sources you connect: WHOOP (recovery, HRV, heart rate, sleep, strain, workouts, body measurements), Apple Health via the iPhone app (heart rate, HRV, sleep, activity, workouts with their heart-rate curves, nutrition, mindfulness, mood, and more), Withings (body composition and related measurements) and Strava (activities) — only what you authorize, and only while connected.
• Workout routes: GPS routes of outdoor workouts. The first and last 200 metres, and anything within 200 metres of where a workout started or ended, are removed on your iPhone before upload; those parts never reach Baseform.
• What you enter: check-ins, intake (caffeine, alcohol, water, supplements, medications), morning check-ins, journal notes, goals, experiments and lab results.
• Calendar context (optional): per day only the hours spent in events and when the first starts and the last ends. Titles, places and attendees never leave your iPhone.
• Location for weather: the city you choose in Settings (not your GPS position).
• Technical data: paired device names, hashed device tokens, sync status, AI usage counts and short-lived server logs that never contain health values.

Why, and on what legal basis

• To provide Baseform to you — your account, syncing and the dashboards (performance of the agreement, GDPR art. 6(1)(b)).
• Health data is processed on your explicit consent (GDPR art. 9(2)(a)), which you give when you connect a source or log something, and can withdraw at any time by disconnecting it or deleting the data.
• The AI coach, morning brief, weekly review and lab-report import send the data they need to an AI provider (Anthropic, USA). This happens only after you turn the AI coach on, a separate explicit consent you can turn off at any time in Settings.
• Security and abuse prevention, such as rate limits on sign-in (legitimate interest, art. 6(1)(f)).

Baseform never sells your data, never uses it for advertising or marketing, and never shares Apple Health data except as described here to run the service you use.

Who processes the data

Baseform uses a few service providers (processors) under data processing terms: database and sign-in, hosting, sign-in email and, with your consent, the AI provider. See the full list on Subprocessors. Services you connect (WHOOP, Apple, Withings, Strava) are independent; their own privacy policies apply to the data they hold.

Data is stored in the EU (Frankfurt). Where a provider is based outside the EU/EEA, transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the EU Standard Contractual Clauses.

How long it is kept

As long as you have an account. Disconnecting a source stops new data; deleting your account deletes everything immediately from the live database, and from backups within the database provider's backup cycle. Server logs are kept for a short period.

Security

Encrypted connections everywhere, encrypted storage, connection tokens encrypted with AES-256-GCM, device tokens stored only as hashes, and a database that only Baseform's own server can read. Logs never contain health values.

Your rights and controls

• Download everything: Settings → Your data → Export my data.
• Delete everything: Settings → Account → Delete account (web or iPhone).
• Stop a source: Integrations → Disconnect, or turn off access in the Health app.
• Turn the AI coach off: Settings → AI coach.
• You also have the right to access, rectify, restrict and object, and to complain to the Swedish Authority for Privacy Protection (IMY, imy.se). Write to privacy@getbaseform.app for anything else.

Children

Baseform is not intended for anyone under 16.

Changes

If this policy changes in a way that matters, you'll be told in the app before it applies; if it changes what is sent to the AI provider, you'll be asked to turn the AI coach on again.