This Privacy Policy explains how Nutrifieds ("Nutrifieds", "we", "us") collects, uses, discloses, and protects personal information when you use Nutrifieds. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.
1. Information we collect
- Account details: your name, email address, and password (stored only as a secure hash — we never store it in plain text).
- Profile and health-related information you provide: timezone, dietary preferences, allergies, goals, and lifestyle notes. This is sensitive information and we treat it accordingly.
- Program and activity data: your schedule, completion history, feedback, notes, and messages with your coach.
- Billing information: your subscription status and invoices. Card details are handled by our payment processor and are not stored on our servers.
- Communication preferences: which channels (email, WhatsApp, push) you have opted into, and separately whether you have consented to marketing.
- Technical information needed to keep the service secure, such as rate-limiting counters tied to sign-in attempts.
2. How we use it
- To deliver your program: build and run your schedule, send reminders, and let your coach support you.
- To operate your account and process payments.
- To keep the service secure and prevent abuse.
- To send service messages (reminders, receipts, security notices). These are necessary to provide the service and are separate from marketing.
- To send marketing only where you have given separate, withdrawable consent.
We do not sell your personal information, and we never use your health-related information for advertising.
3. Consent
By providing information and using Nutrifieds, you consent to the handling described here. You can withdraw consent for optional processing (such as marketing or a notification channel) at any time in Settings; withdrawing consent for processing that is necessary to run the service may mean we can no longer provide it.
4. Who we share it with
We share personal information only with service providers who help us operate Nutrifieds, under agreements that require them to protect it and use it only for that purpose. These include:
- A payment processor, to take payments and manage subscriptions.
- Email and messaging providers, to deliver the notifications you have chosen.
- Hosting and infrastructure providers, to run the service and store data securely.
We may also disclose information where required by law, to protect our rights or the safety of others, or as part of a business transfer, in which case we will give notice where the law requires it.
5. Where your information is processed
Your information may be processed or stored by our service providers outside your province or outside Canada. Where that happens, it remains subject to safeguards and may be accessible to courts and authorities in those jurisdictions as their law requires.
6. How long we keep it
We keep personal information for as long as your account is active and as needed to provide the service. Completed-program data is retained for up to 24 months unless you ask us to delete it sooner. We keep certain records (such as invoices) for longer where tax or legal obligations require it. When information is no longer needed, we delete or de-identify it.
7. Your rights
- Access and portability: you can export a copy of your data from Settings at any time.
- Correction: you can update your profile and preferences in Settings, or ask us to correct information.
- Deletion: you can request account deletion from Settings; we will delete your information subject to any records we must keep by law.
- Complaints: you may contact us, and you have the right to complain to the Office of the Privacy Commissioner of Canada or your provincial regulator.
8. Security
We protect information with role-based access (staff see only the clients assigned to them), hashed passwords, encrypted backups stored offsite, and rate-limiting and other controls against abuse. No system is perfectly secure, but we work to protect your information proportionately to its sensitivity.
9. Children
Nutrifieds is intended for adults. We do not knowingly collect information from children without the consent of a parent or guardian. If you believe a child has provided information to us, contact us and we will address it.
10. If you are in the UK or the European Economic Area
Nutrifieds is operated from Canada, but it is available internationally. Where the UK GDPR or the EU GDPR applies to you, the following also applies and prevails over anything above that conflicts with it.
Our lawful bases. We rely on performance of a contract to run your account, deliver your programme and take payment; on legitimate interests to keep the service secure, prevent abuse and keep our records; on legal obligation for tax and accounting records; and on your consent for marketing and for optional notification channels, which you may withdraw at any time in Settings without affecting the service itself.
Health information. Dietary requirements, allergies, goals, check-ins, progress notes and photographs are special category data under Article 9. We process them only on the basis of your explicit consent, given when you provide them, and only to deliver coaching to you. Withdrawing that consent means we can no longer run a programme for you, because the programme is built from it. We never use health information for marketing or advertising, and we do not sell personal information.
International transfers. Our infrastructure providers are located in the United States: application hosting, the database, email delivery and payment processing. Transfers outside the UK/EEA are made under the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, together with the providers' own certifications where they hold them. You may request a copy of the relevant safeguards from privacy@nutrifieds.com.
Your rights. In addition to the rights in section 7, you may object to processing based on legitimate interests, ask us to restrict processing while a dispute is resolved, request erasure, and withdraw consent at any time. Access and portability are available immediately and without asking — Settings exports your data as a file. We answer other requests within one month.
Complaints. You have the right to complain to your local supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, the authority for the country you live or work in. We would rather you told us first at privacy@nutrifieds.com so we can put it right.
Automated decisions. We do not make decisions with legal or similarly significant effects about you by automated means alone. Where the service suggests a plan or filters recipes against your restrictions, a person reviews and issues it.
11. Changes and contact
We may update this policy; meaningful changes will be announced before they take effect. For privacy questions or to exercise your rights, contact our privacy contact at privacy@nutrifieds.com.