Mindbody is a fitness/wellness class-booking platform (Mindbody App + business software, and the ClassPass marketplace) operated by MINDBODY, Inc., a private company owned by Vista Equity Partners since a $1.9 billion take-private acquisition completed February 15, 2019. Its own Privacy Policy (last updated March 30, 2026) collects broad account and activity data - including 'Health and fitness tracker data collected from heart rate monitors and other performance monitoring activities' and a distinct Sensitive Personal Information category - and self-declares that its use of ad and analytics cookies may constitute 'selling' or 'sharing' personal information under state privacy laws, alongside opt-out rights. Apple's App Store privacy label corroborates identity-linked collection of Health & Fitness, Location, Financial Info, and Identifiers used for the developer's own advertising/marketing, analytics, and product personalization, though the label does not self-declare a 'Data Used to Track You' cross-app tracking category. Track record includes a 2018 security incident in which FitMetrix, a fitness-tracking subsidiary Mindbody had just acquired, left database servers unprotected by any password, exposing an estimated 113.5 million customer records (names, contact info, workout locations, emergency contacts); Mindbody's CISO said no login credentials or health information were exposed, a characterization the researcher who found the exposed data disputed.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
7 ON FILE
COLLECTION
Apple's App Store privacy label for the Mindbody app self-declares that data linked to the user's identity - including Health & Fitness, Location, Contact Info, Financial Info, and User Content (Photos or Videos) - is collected for purposes including the developer's own Advertising or Marketing, Analytics, and Product Personalization.
Mindbody's Privacy Policy lists, among Personal Information collected, 'Health and fitness tracker data collected from heart rate monitors and other performance monitoring activities,' and separately defines a 'Sensitive Personal Information' category ('Sensitive Data') that the company says it generally does not collect or process except where necessary, subject to additional restrictions under applicable law.
MINDBODY, Inc.'s own press release states it 'has been acquired by Vista Equity Partners ("Vista"), a leading investment firm focused on software, data and technology-enabled businesses,' in an approximately $1.9 billion transaction completed February 15, 2019, after which Mindbody common stock 'ceased trading and will no longer be listed on the Nasdaq Stock Market.'
Mindbody's Privacy Policy states the company 'may be considered "selling" or "sharing" personal information in certain states due to our use of ad and analytics cookies and other tools,' and lists disclosure of Personal Information to Mindbody Group Companies and to service providers for purposes including 'targeted advertising' and 'financial and tax compliance.'
A report on the 2018 FitMetrix incident states that FitMetrix - a fitness-tracking company Mindbody had just acquired - left database servers unprotected by any password, exposing 'among 113.5 million customer records,' each including 'a name, gender, contact information, photos, workout locations, emergency contacts, and more'; Mindbody's Chief Information Security Officer said exposed accounts 'did not include any login credentials, passwords, credit card information, or personal health information,' a characterization the security researcher who found the exposure disputed.
Apple's App Store privacy label shows Identifiers (Device ID) collected, both linked and not linked to identity, for the developer's Advertising or Marketing, Analytics, and Product Personalization purposes; the label does not include a 'Data Used to Track You' category, meaning Mindbody has not self-declared cross-app/cross-site tracking as defined by Apple's framework.
Mindbody's Privacy Policy states that Mindbody and/or its service providers 'employ various tracking technologies, such as cookies, web beacons and analytics software' to manage content on the Mindbody Services and refers users to a separate Cookies Policy for opt-out instructions.