01
Security by default
Customers should not have to find a hidden setting to receive reasonable protection.
PrimeFormAI’s approach is to minimise personal information, separate environments, protect credentials and restrict access to the people and services that genuinely need it.
Security applies to the whole service: browser code, accounts, administrative tools, providers, domains, releases, backups and support access.
- Keep private keys and service credentials out of browser code.
- Separate customer-facing systems from development and preview environments.
- Record sensitive administrative actions in proportion to their risk.
02
Accounts and personal data
Authentication and fitness information need protection throughout their full lifecycle.
Customer accounts should use secure sessions, protected recovery, abuse controls and server-side authorisation for every sensitive record and action.
The same access and retention rules should follow fitness, recovery, nutrition and connected-device information through storage, support tools, backups, exports and deletion.
- Test that one account cannot access another account’s information.
- Limit staff access and review privileged actions.
- Make export, deletion, recovery and revoked access behave consistently.
03
AI and connected services
Every model, wearable, payment or messaging provider becomes part of the security boundary.
PrimeFormAI should send each provider only the information needed for the selected feature, protect provider credentials and validate external responses before they affect a plan or account.
Connections should use narrowly scoped permissions, verified callbacks and a clear way to remove access. If a provider fails, the product should favour a safe, understandable and reversible state.
- Keep untrusted content away from unrelated records and privileged instructions.
- Use timeouts and safe defaults when an integration is unavailable.
- Review the security and privacy role of each material provider.
04
Safe, reliable changes
Security includes how new versions are tested, monitored and recovered.
Updates should be tested before customers receive them and monitored for unexpected behaviour after release. Access to production changes should remain restricted and traceable.
If a problem threatens customer information or service integrity, PrimeFormAI should be able to identify the affected change, contain it and return to a safe state.
- Detect material failures promptly and communicate when customers may be affected.
- Keep a safe way to reverse a harmful change.
- Test data recovery and incident response regularly.
05
Reporting a security concern
A security report should reach a protected channel with clear handling expectations.
Use only the security route published on the official Contact page. That route will explain safe testing boundaries and how reports are handled.
An initial report should describe the affected page or behaviour without including passwords, access tokens, health information or exploit details through an unverified channel.