Privacy policy

Data controller

NutriPlan, [company name, address and company number to be completed]. Contact: contact@nutriplan.be.

Data we collect

Account: name, email address, password (stored only as a hash).

Health profile: sex, age, height, weight, physical activity, goal, allergies and dietary restrictions.

Generated plans, checked meals, and tracking: weight, measurements, performance and progress photos (private).

Your conversation with the assistant and, if you use it, voice input audio, sent for transcription and not kept by NutriPlan.

Purposes and legal bases

Providing the service (account, needs calculation, plan generation, tracking): performance of the contract.

Health data is processed only with your explicit consent, given at sign-⁠up (Art. 9(2)(a) GDPR). You can withdraw it at any time by deleting your account.

Security and abuse prevention (request limits per IP address): legitimate interest.

Recipients and processors

Vercel (hosting, photo storage, anonymous audience measurement), Neon (database), Anthropic, and depending on configuration OpenAI, Google or Groq (AI plan generation), Deepgram (voice transcription), Resend (emails), Sentry (technical error monitoring, without request content or health data), PostHog, hosted in the EU (journey measurement: sign-⁠up, plan creation and download, linked to the account's internal ID and the originating campaign, without health data).

Some are based outside the European Union; transfers rely on the European Commission's standard contractual clauses.

If you join a coach through an invitation, that coach can see your profile, plans and tracking. Your data is never sold.

Retention

Your data is kept as long as your account exists, then deleted. Password reset links expire after one hour; abuse counters after a few minutes.

Cookies and local storage

NutriPlan only uses strictly necessary cookies: the session cookie (sign-⁠in) and your language choice. Audience measurement (Vercel Analytics, PostHog) works without cookies or browser storage; once you are signed in, PostHog links your journey to your account's internal ID, never to your name or email. No advertising trackers are used, so no consent is required.

Your browser's local storage keeps checked shopping list items, and plans created before an account was required until you import them into your account; it never leaves your device.

Your rights

You have the right to access, rectify, erase and port your data, to object, and to withdraw consent. Write to contact@nutriplan.be; we reply within one month.

You can lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).