How BodyRelay protects your measurements

A transfer service, not a medical record

BodyRelay moves selected measurements from one provider account to another. It produces no diagnosis, clinical score or medical advice. The service keeps only information required for the account, connections, transfer, security and support.

Account and connection protection

• BodyRelay passwords are hashed and cannot be retrieved in plain text.
• Withings tokens and provider sessions are encrypted before storage.
• The Garmin password is used only to establish the session and is not written to the database.
• Session cookies and CSRF protection are strictly technical.

Encryption and hosting

Public exchanges use HTTPS. Processing under BodyRelay’s direct control is hosted in France on OVHcloud infrastructure. Database backups are encrypted with Restic and restored only through incident procedures.

Data minimisation and retention

Pending measurements are kept for processing and then deleted according to the periods published in the privacy policy. Detailed values are not retained indefinitely after a successful transfer. A minimal technical state prevents duplicates and explains the result.

Application logs exclude measurements and secrets. They support error, abuse and incident detection with limited retention.

Deletion and revocation

You can disconnect Withings or Garmin, withdraw consent, export data and delete your account from your space. Deletion removes active data; residual copies expire with the encrypted backup rotation.

Provider limitations

BodyRelay uses the official Withings API for reading. Garmin writes depend on an unofficial interface that Garmin may change, limit or remove without notice. BodyRelay monitors that dependency and may pause automation to protect accounts.

Report a problem

For privacy questions or security reports, email support@bodyrelay.com. Never send a password, MFA code or provider token. You can also read the full privacy policy.

Last public review: August 9, 2026.