Privacy policy
Who we are
NutriPlatform provides practice-management software for nutritionists and their clients. In this policy, “we” means NutriPlatform.
Our role
When a nutritionist or practice (“the practice”) uses NutriPlatform to keep records about their clients, the practice is the data controller for that client data and we process it on the practice’s behalf. If you are a client, please contact your practice first about your data. They can act on your request directly in the platform.
For the account details of practitioners who sign up with us, and for visitors to this website, we are the controller.
What we collect
- Account data: name, email address, password (stored only as a secure hash), professional role and practice details. If you sign in with Google or Apple, we receive your name and email address from them.
- Client records entered by a practice: contact details, health and nutrition information, measurements, consultation notes, plans, journal entries, form answers, messages, documents and photos, appointments and invoices.
- Consent records: what a client consented to, which version, and when it was given or withdrawn.
- Contact form: your name, email address, practice name and message. They are emailed to our team so we can reply, and are removed from our systems once delivered.
- Technical data: IP address, browser details, logs and error reports needed to keep the service secure and working. We do not put health data into logs.
How we use it
- To provide the service: accounts, client records, plans, scheduling, messaging, invoicing and the client portal.
- To send service emails such as verification, password resets, invitations, appointment reminders and new-message alerts.
- To keep the service secure, prevent abuse and fix problems.
- To answer your questions and support requests.
- To meet our legal obligations.
We do not sell personal data, and we do not use it for advertising.
Our legal basis
Under the Personal Data Protection Act we rely on:
- Contract: to provide the service to practices that sign up;
- Consent: for client health data, collected and recorded by the practice;
- Legal obligation: for example, keeping financial records;
- Legitimate interests: to keep the service secure and to answer enquiries.
Health data
Health information is sensitive personal data. It is processed only to provide the service to the practice and its client, on the basis of the client’s recorded consent. It is never sold or used for advertising.
How we protect it
- Each practice’s data is kept logically separate, and access is checked on every request.
- Within a practice, roles and permissions limit which staff can see which clients.
- Data is encrypted in transit (HTTPS).
- Passwords are stored only as secure hashes. Logs and error reports are filtered to remove personal and health data.
Service providers
We use carefully chosen providers to run the service:
- Railway: application hosting and database (Singapore region).
- Cloudflare R2: storage for documents and photos.
- Resend: sending transactional email such as invitations and reminders.
- Sentry: error reporting, with personal data removed.
- Google and Apple: sign-in, only if you choose to use them.
- Edamam and USDA FoodData Central: food search. Only the search term is sent, never client details.
We may also disclose data if the law requires it, for example to comply with a court order.
International transfers
Some of these providers store or process data outside Sri Lanka, including in Singapore. We choose providers with appropriate security safeguards and share only what each one needs to do its job.
How long we keep data
Client records are kept for as long as the practice uses NutriPlatform, or until the client asks for erasure. When a practice closes its account, it has 30 days to request an export. After that we delete its data, or anonymise it where financial records must be kept. Backups are overwritten on their normal cycle.
Account data is kept while your account is open and deleted after it closes.
Your rights
You can ask to access, correct or erase your personal data, or withdraw your consent.
When a client asks to be erased, their health data, messages, documents and files are deleted and their personal details are removed from their record. Invoices and appointment records are kept, without identifying details, where the law requires financial records to be retained.
Clients should make requests through their practice. Practitioners and anyone else can contact us at hello@nutriplatformapp.com. If you are unhappy with how your data is handled, you can also complain to Sri Lanka’s Data Protection Authority.
Children
Practitioner accounts are for adults. A practice may keep records about a client under 18 only with the consent of a parent or guardian.
Cookies and browser storage
This marketing website does not use tracking or advertising cookies. It loads fonts from Google Fonts.
The NutriPlatform app stores a sign-in token in your browser so you stay logged in. It is removed when you log out. The app does not use analytics or advertising trackers.
Changes
We will post any changes here and update the date at the top of this page. For important changes, we will also email account owners.