Nutrition AI logo

Privacy Policy

This Privacy Policy outlines how Nutrition AI ("we", "our", or "us") collects, uses, and protects your personal data when you use our progressive web app to receive customized nutrition plans. Our services are designed with your privacy in mind, and we are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable laws.

Data Controller Contact Information:

Evalest Ltd
1 Derwent Business Centre, Clarke Street, Derby, England, DE1 2BU
tech@evalest.com

Types of Data Collected:

  • Personal identifiers from the sign-in method you choose - Google, Facebook, or an email link (e.g., name, email address)
  • Personal details (e.g., age, gender, weight, height, activity level)
  • Health information you provide (e.g., allergies, dietary requirements, stated goals and medical conditions)
  • The nutrition plans generated for you, and which meals you mark as eaten
  • If you turn on meal reminders, a notification subscription for that device and the times you choose

We do not collect or store your card details. Payments are handled by Stripe on their own checkout page.

Purpose and Legal Basis for Processing:

We process your data to provide personalized nutrition plans based on the information you provide. The legal basis for processing your personal data includes your explicit consent and the necessity of the data for the performance of our contract with you.

Information about allergies, dietary requirements and medical conditions is special category data under Article 9 of the GDPR. We process it only on the basis of your explicit consent, given when you enter it, and only to produce the nutrition plan you have asked for. You can withdraw that consent at any time by deleting your account.

Data Recipients and Third-Party Processors:

We share data with the following processors, each only to the extent needed to run the service:

  • OpenAI - generates your nutrition plan from the details you provide. Your name and email address are never sent.
  • Supabase - stores your account and your plans.
  • Stripe - takes payment and holds your card details.
  • Vercel - hosts the website and app.
  • Time4VPS - hosts the server that generates plans and sends reminders.
  • Google - Analytics for usage statistics, and Firebase Cloud Messaging to deliver notifications.

We ensure that all third-party processors are compliant with GDPR and other privacy regulations. Where a processor is outside the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

Data Transfer and Storage:

Your data may be stored and processed within the EU or in countries that ensure an adequate level of data protection as determined by the European Commission.

Retention Period:

We keep your account and your plans for as long as your account exists, so that you can return to plans you have paid for. If you delete your account, your plans and personal details are deleted with it. Records we are required to keep for tax and accounting purposes, such as proof of payment, are retained by Stripe and by us for as long as the law requires.

Your Data Protection Rights:

Under GDPR, you have the right to access, rectify, erase, restrict processing, and object to processing of your personal data. You also have the right to data portability and to withdraw your consent at any time.

Automated Decision-Making and Profiling:

We do not use automated decision-making processes that would have a legal effect on you without human intervention.

Cookies and Tracking Technologies:

We use cookies and similar tracking technologies to track activity on our service and hold certain information.

Google Analytics:

We have taken steps to ensure that any data processing is lawful and transparent.

Security Measures:

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including but not limited to encryption, access controls, and security training for our staff.

Data Breach Notification:

In the event of a data breach, we will notify you and any applicable regulator when we are legally required to do so.

Changes to This Privacy Policy:

We may update our Privacy Policy from time to time, and we will notify you of any changes by posting the new Privacy Policy on this page.

For any questions or concerns regarding this Privacy Policy or our privacy practices, please contact us at tech@evalest.com.