Nutrifit — Privacy Policy

1. Who we are

Nutrifit is a private, invite-only client companion mobile app operated by Nakul Garg (the developer), delivered to clients of the Nutrifit dietetics practice. The app is built on the NutriCRM platform and runs on its infrastructure. References to "we", "our", or "us" in this policy refer to the developer and the practice operating Nutrifit.

This policy complies with the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 of India.

2. Information we collect

2.1 Account information

Your Nutrifit account is created by your supervising dietitian. The information stored against your account includes:

• Name, email and phone number
• Date of birth, sex and basic demographics
• Password (stored in encrypted hashed form)

2.2 Health information

Because Nutrifit is a dietetics service, we process health data that you and your dietitian add to your record:

• Weight, height, body measurements
• Blood pressure, blood sugar and other vitals you log
• Meal logs, water logs, mood logs and adherence to your plan
• Period and cycle logs, if you choose to record them
• Photos you choose to upload (profile / progress / meals)
• Diet plans, recipes, and consultation notes shared with you

2.3 Messages and files

If your practice enables in-app chat, we store the messages you exchange with your care team so they can be delivered and shown in your conversation history. This includes text messages, photos, voice notes you record and documents you choose to attach. They are visible only to you and the care team at Nutrifit.

2.4 Health Connect and Apple Health

Connecting Health Connect (Android) or Apple Health (iOS) is optional and only happens after you grant permission in the app. With your permission, Nutrifit reads the following data:

• Steps
• Sleep sessions
• Active calories burned
• Resting heart rate
• Weight

We use this data only to show your activity and progress to you and your dietitian and to tailor your diet plan. We do not write data to Health Connect or Apple Health. We do not sell this data, share it with third parties, or use it for advertising, and it is never used to build profiles unrelated to your care. You can revoke access at any time in the Health Connect app or in iOS Settings, Health, Data Access & Devices.

Our use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

2.5 Device information

We collect minimal device data needed to operate the app: app version, OS version, device model, and a push notification token. We do not collect advertising identifiers and do not use advertising or tracking SDKs.

2.6 Permissions

The app asks for each permission only when you use the feature that needs it:

• Notifications, for meal, water and follow-up reminders
• Camera and photo library, only when you choose to take or upload a photo
• Microphone, only while you record a voice note in chat
• Files, only when you choose a document to attach
• Health Connect or Apple Health, only if you choose to connect them (see 2.4)
• Network access, to reach our server

The app does not request location, contacts, SMS, call logs, calendar or Bluetooth access.

3. How we use your information

• To deliver your personalised diet plan and reminders
• To show your vitals and progress to you and your dietitian
• To deliver messages, voice notes and files between you and your care team
• To send transactional notifications related to your care
• To respond to support requests and improve the service
• To comply with legal and regulatory obligations

We do not sell your personal or health information, and we do not use it for advertising.

4. Data sharing

Your information is visible to your assigned dietitian and the Nutrifit practice operating your account. We use a small set of processors to run the service:

• Cloud hosting: Google Cloud (server, database, storage), located in Asia.
• Email delivery: Resend for transactional emails (e.g. password reset, deletion confirmation).
• Push notifications: Apple Push Notification service and Firebase Cloud Messaging for reminder delivery.
• Legal authorities: When required by law or to protect our rights and the safety of users.

5. Data security

• Encryption in transit (TLS) and at rest
• Secure password hashing
• Auth tokens kept in iOS Keychain / Android Keystore
• Role-based access controls on the server

6. Data retention

We retain your account data while your account is active. When you delete your account (see Section 7), personal and health data is removed within 30 days. Invoices and payment records may be retained for up to 7 years to meet tax and accounting obligations. De-identified aggregate analytics may be retained.

7. Your rights & deletion

You can request access, correction, export or deletion of your data at any time. Two ways to delete:

• In-app: open Nutrifit → More → Privacy & data → Delete account. Deletion is processed immediately on confirmation.
• From the web: visit nutricrm.co/apps/nutrifit/account-deletion and submit the form. We process the request within 7 business days.

8. Children's privacy

Nutrifit is not intended for users under 18. We do not knowingly create accounts for, or collect data from, children. If you believe a minor has an account, contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page.

10. Contact

Privacy questions: [email protected].
Support: [email protected].