Privacy policy

thenutritionist processes personal data in compliance with GDPR. Health data is hosted in France by an HDS-certified provider (OVHcloud).

Data controller

The registered healthcare professional is the data controller for their patients' data. thenutritionist acts as a data processor.

Data collected

• Professional: name, email, hashed password (Argon2id), SIRET/ADELI optional.
• Patient: name, first name, email/phone optional, anamnesis, measurements, plans, logs.

Retention period

Patient data: 5 years after last interaction (HAS recommendation for healthcare professionals), unless an earlier deletion is requested.

Your rights

You have the rights of access, rectification, deletion, objection, and portability. To exercise them: dpo@thenutritionist.app.

Sub-processors

• OVHcloud (HDS hosting, France)
• Brevo (transactional email, France)
• Mistral AI (plan generation, EU)
• Stripe (payment, US, payment data only)