Privacy Policy

1. Who this policy is from

This policy applies to Nutrition Simplified (“the practice”, “we”, “us”), to this website, and to the client app the practice provides to its clients. The practice is the entity responsible for the personal data described here — in the language of India’s Digital Personal Data Protection Act, 2023, it is the Data Fiduciary.

Nutrition consultation necessarily involves health information, which is sensitive. The whole of this policy is written on that basis.

2. What we collect

We collect only what a nutrition consultation actually requires.

Information you give us

• Identity and contact details — your name, phone number, email address, date of birth and gender.
• Health and lifestyle information — height, weight and body measurements, your medical and family history, current diagnoses, medicines and supplements, allergies, your routine, your food preferences, and the goals you want to work towards. Much of this is collected through the new-patient assessment form before your first consultation.
• Laboratory reports — blood reports and similar investigations that you or the practice upload, both as the original file and as the individual test values read out of it.
• Photographs — meal photographs taken when you check a meal off in the app, and progress photographs if you choose to upload them.
• Payment information — the amount, date and reference of programme fees, and the payment screenshot you upload. We do not collect or store your card, UPI PIN or banking credentials.

Information the app records as you use it

• Which meals you marked done or skipped, and on what date; the weights and measurements you log; and when you last opened the app.
• Technical information needed to keep your account secure — your login session and standard server logs.

We do not run advertising trackers or third-party analytics on this site, and we do not build advertising profiles.

3. Who else sees your information

We do not sell your personal or health information, and we do not share it for anyone else’s marketing. Within the practice, your records are visible to your nutritionist. Beyond that, information reaches only these service providers, and only for the purpose named:

• Hosting — the practice’s own server and database, where your records and uploaded files are stored.
• Email delivery — a transactional email provider (Resend) delivers account emails such as verification and password reset. It receives your email address, not your health records.
• Laboratory report reading — when a report is uploaded, the system first tries to read it on the practice’s own server, which involves no third party at all. Only if a report cannot be read that way — typically a scanned image rather than a digital PDF — may its contents be sent to an external AI provider (OpenAI) to extract the test values. In that case the report’s contents leave the practice’s server. Tell your nutritionist if you would prefer your reports were only ever entered by hand.
• Messaging — if you opt in to WhatsApp notifications, your phone number and the notification text are sent through WhatsApp’s platform (Meta). This is optional and off unless you choose it.
• Payments — where an online payment gateway (Razorpay) is used, it processes the payment under its own privacy policy. Card and bank details go to the gateway and never to us.

We may also disclose information where the law requires it, or where it is necessary to protect someone’s life or safety.

4. Why we use it

To assess your nutritional needs and build your plan; to track your progress and adjust that plan; to communicate with you about your consultations and programme; to take and record payment; and to keep the records a health practice is expected to keep. We use your information for these purposes and not for unrelated ones.

5. Photographs

Meal photographs are taken with your camera at the moment you check a meal off, so that your nutritionist sees the actual plate. Progress photographs are uploaded only if you choose to, and you choose whether each one is kept private to your nutritionist or marked shareable. You can delete your progress photographs yourself. We do not publish any photograph of you, or use one in marketing, without asking you first and getting your agreement.

6. How your information is protected

• Passwords are stored using a modern one-way hashing algorithm (argon2id) and are never readable, including by us.
• Login sessions are stored only as a hash, so a copy of the database does not yield a usable session.
• Uploaded files — reports and photographs — are not publicly addressable. Access requires a logged-in session belonging to the account the file belongs to.
• Each practice’s records are isolated from every other practice’s at the database query level.

No system is perfectly secure, and we do not claim otherwise. If a breach affecting your personal data occurs, we will notify you and the Data Protection Board as the DPDP Act requires.

7. How long we keep it

We keep your records for as long as you are a client of the practice, and afterwards for as long as we are required to by professional and legal record-keeping obligations. You can ask us at any time how long your particular records will be kept. You may ask for erasure sooner — see the next section.

8. Your rights

Under the DPDP Act 2023 you have the right to:

• Access — ask for a copy of the personal data we hold about you, and a summary of how it is being processed.
• Correction — have inaccurate or incomplete information corrected or completed.
• Erasure — ask us to delete your personal data, except where we are legally required to retain it.
• Withdraw consent — including turning off WhatsApp notifications, or asking that reports never be sent for automated reading.
• Grievance redressal — raise a complaint with us first, and escalate to the Data Protection Board of India if you are not satisfied with our response.
• Nominate — name someone to exercise these rights on your behalf if you are unable to.

9. Children

Where a client is under 18, the account is set up and consented to by a parent or legal guardian, and we process the child’s information on that basis. We do not undertake tracking or behavioural advertising directed at children.

10. Contact us

A dedicated contact address for privacy requests has not yet been published on this site. In the meantime, please raise any question about your data directly with your nutritionist, who will pass it on.

11. Changes to this policy

If this policy changes, the revised version will be published on this page with a new effective date. Where a change materially affects how your health information is handled, we will tell existing clients directly rather than relying on you to check.

See also our Terms of Service.