Nutricity ProPrivacy Policy
Last updated: September 2026
This document is provided as a starting point and should be reviewed by legal counsel before commercial launch.
1. Scope
This Privacy Policy explains how Nutricity Pro collects, uses, and protects personal data when you use our platform, whether as a Studio (nutrition professional) or as a Client of a Studio.
2. Roles: controller and processor
For account and billing data of Studios, Nutricity Pro acts as the data controller. For the health and dietary data a Studio enters or collects about its Clients (weight, measurements, protocol assignments, and similar), the Studio is the data controller and Nutricity Pro acts as a data processor, processing that data only on the Studio's instructions and for the purpose of operating the Service.
3. What we collect
Account data: name, email, password (hashed), role. Studio data: studio name, billing details, settings. Client health data (entered by the Studio or the Client): weight, body measurements, optional glycemia and other tracked metrics, dietary protocol history, and consent records. Usage data: log data, device/browser information, and audit logs of actions taken in the Service. When enabled for a production environment, we use PostHog for aggregate product analytics, such as the pages visited; we do not send form contents or health metrics.
4. Why we process it
To provide and operate the Service (contract performance); to process payments where enabled (contract performance, via Stripe); to secure accounts and prevent abuse (legitimate interest); to comply with legal obligations; and, where a Client has given explicit consent, to process health-category data for the purpose of nutritional coaching.
5. Client health data and consent
Health data is a special category of personal data. We only process a Client's health-related metrics after that Client has given explicit consent through their own account, separate from account creation. A Client may withdraw consent, export their data, or request deletion of their account at any time from their dashboard.
6. Sharing and sub-processors
We do not sell personal data. We share data with sub-processors strictly to operate the Service: our hosting/infrastructure provider, PostHog for aggregate product analytics where enabled, our payment processor (Stripe) for billing and Studio-to-Client payments, and our transactional email provider (Resend) for account and notification emails. These providers are bound by data-processing agreements.
7. International transfers
Where a sub-processor is located outside the European Economic Area, we rely on appropriate safeguards (such as Standard Contractual Clauses) to protect transferred data.
8. Retention
We retain personal data for as long as the associated account is active, and for a reasonable period afterward to comply with legal, accounting, or dispute-resolution obligations. A Client may request earlier deletion of their own data at any time.
9. Security
We use industry-standard measures — encrypted connections, hashed passwords, access controls, and tenant data isolation — to protect personal data. No system is completely secure, and we encourage you to use a strong, unique password and enable two-factor authentication where available.
10. Your rights
Subject to applicable law (including the GDPR for users in the EU/EEA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Clients can exercise most of these rights directly from their account; Studios can contact us for account-level requests.
11. Cookies
We use only the cookies strictly necessary to keep you signed in and to operate the Service (such as a refresh-token cookie). Where product analytics is enabled, PostHog stores a pseudonymous identifier in local storage to measure aggregate usage. We do not use third-party advertising cookies.
12. Newsletter
If you opt in to receive newsletter or product-update emails at signup, we use your email address for that purpose only, until you unsubscribe. You can withdraw this consent at any time.
13. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified through the Service or by email.
14. Contact
Questions about this Privacy Policy, or requests relating to your personal data, can be sent to the contact address published on our website.