Skip to content
BMI Corner

Privacy policy

This policy explains what data BMI Corner collects, why, for how long, and how you can exercise your rights over it. It is written in line with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679).

1. Data controller

The controller for the data processed on this site is the publisher identified in our legal notice. For any question or request about your data, contact us through our contact page or at contact@bmicorner.com.

2. The data we process

Depending on how you use the site, we may process three categories of data:

  • Browsing data: pages viewed, device type, and technical information set by cookies and similar trackers, including those from Google and Google AdSense (see section 4).
  • Account data: if you create an account to track your BMI over time, your email address is used to authenticate you through a magic link (no password).
  • Health data: if you turn on weight tracking, your height, your weight, your calculated BMI, and, where provided, your birth year and sex. This processing has a dedicated section below (section 7), because it falls under a special category of data under the GDPR.

3. Legal basis and retention period

Each processing activity rests on its own legal basis, with its own retention period:

  • Measurement and advertising cookies: legal basis = your consent (GDPR Article 6(1)(a)). The choice you make through our banner is stored in your browser (local storage) until you clear it, wipe this site’s data, or switch browsers: it has no automatic expiry date set by our code. Cookies Google itself sets once consent is given follow Google’s own retention periods (see section 4).
  • User account (email, session): legal basis = performance of steps taken at your request before entering into a contract (creating the account) and consent for turning on tracking. Retention: for as long as the account exists, permanently deleted when the account is closed.
  • Health data (weight / height / BMI measurements): legal basis = your explicit consent (GDPR Article 9(2)(a)). Retention: for as long as tracking stays active, or until manually deleted, with immediate and permanent deletion of the history if the account is deleted.

4. Third-party cookies, Google, and Google AdSense

This site may display ads served by Google, through the Google AdSense service. Google and its advertising partners may set cookies or use similar identifiers on your device to measure audience and personalise the ads shown to you, including on sites other than this one. How these technologies work, the list of Google’s partners, and your options for managing them are described in detail on Google’s official page: policies.google.com/technologies/partner-sites. Our cookie policy lists the categories of cookies used on this site and how to change your choice at any time.

No advertising or measurement cookie is set before you make a choice through the consent banner shown on your first visit: by default, every signal sent to Google (ad storage, ad user data, ad personalisation, analytics storage) is set to “denied”, in line with Google Consent Mode v2.

5. Your rights

Under the GDPR, you have the following rights over your data:

  • Right of access: obtain confirmation that your data is being processed, and receive a copy of it.
  • Right to rectification: have inaccurate or incomplete data corrected.
  • Right to erasure: request deletion of your data, in the cases provided for by the GDPR.
  • Right to data portability: receive your data in a structured, commonly used format.
  • Right to object: object to processing based on legitimate interest, including for personalised advertising.
  • Right to withdraw consent: at any time, as easily as you gave it, without affecting the lawfulness of processing carried out before that withdrawal.

To exercise any of these rights, use our contact page. If your account is active, exporting your data and deleting your account are also available directly from the tracking area. You also have the right to lodge a complaint with your local data protection supervisory authority.

6. Data security

Account and tracking data is hosted with Supabase and protected by row-level security rules: each user can technically only read or modify their own data, regardless of the request sent. Traffic to and from the site is encrypted (HTTPS).

7. Dedicated section: health data

This data is only ever recorded if you deliberately turn on the tracking feature and check a dedicated, distinct, not pre-ticked consent box: no measurement is ever saved without this explicit action on your part. The legal basis for this processing is exclusively your explicit consent (GDPR Article 9(2)(a)).

You can withdraw this consent at any time, by turning off tracking from your personal area: from the moment you do, no new measurement and no change to an existing one is accepted by our database. You still keep, even after withdrawing consent, the right to access the history already recorded and to delete it permanently — these are your rights of access and erasure, which do not depend on consent to the processing itself. Exporting your measurements as JSON and permanently and completely deleting your account (profile and history) are both available directly from the tracking area.

8. Use by minors

The calculator can be used without an account, including to place a child’s or teenager’s BMI with an adult’s guidance. Creating an account to track measurements over time, however, assumes the ability to give valid consent: we recommend that a minor only turn on this feature with the agreement and under the supervision of a parent or legal guardian, as the site has no age-verification mechanism.

9. Changes to this policy

This policy may be updated to reflect changes to the site or to applicable regulation. The date it was last updated appears at the bottom of this page; please check back from time to time.

Last updated: 26 August 2026.