Version: 1.0
Effective date: 1 August 2026
Last updated: 19 July 2026
This Privacy Notice explains how *, trading as GET NUTRIA (“GetNutria”, “we”, “us” or “our”), handles personal data when nutritionists, clinics, clients and website visitors use GetNutria.
1. Who we are
Controller for GetNutria account and business data:
* trading as GET NUTRIA, a registered business name in the Republic of Cyprus
Business Name Registration No. ΕΕ 63204 α
Business address: 10 Nikou Karantoni, Akropoli, 2013 Nicosia, Cyprus
Privacy email: *
Support email: *
For client records entered by a nutritionist or clinic, the relevant nutritionist or clinic normally determines why and how those records are used. In that context, the nutritionist or clinic is normally the data controller and GetNutria acts as its data processor.
2. Scope of this notice
This notice applies to personal data GetNutria handles for its own platform operations, including:
• nutritionist, clinic and client account registration;
• authentication and account security;
• subscription, invoicing and payment administration;
• support requests and service communications;
• platform performance, security and abuse prevention;
• legal-document acceptance records;
• website use and cookies; and
• compliance with legal obligations.
Clinical and practice records, including client profiles, body measurements, diet plans, appointments, messages and uploaded reports, are generally processed by GetNutria on behalf of the relevant nutritionist or clinic. Clients should also read their nutritionist's or clinic's privacy notice.
3. Personal data we collect
Depending on how GetNutria is used, we may process:
Account and identity information
Name, email address, telephone number, role, clinic or business name, account identifiers, preferred language and profile settings.
Authentication and security information
Password hashes, sign-in timestamps, session information, security logs, device/browser information, failed login events and records needed to prevent misuse.
Subscription and billing information
Subscription plan, billing contact information, invoice records, payment status and transaction references. Payment card details should be handled directly by the selected payment provider where possible.
Support and communications
Messages sent to support, issue descriptions, attachments voluntarily provided, appointment and account notifications, and records of our responses.
Legal and compliance records
The versions of Terms, DPAs or other documents accepted, acceptance timestamps and records needed to demonstrate compliance.
Website and cookie information
Necessary cookie identifiers and, only where permitted and enabled, analytics or preference information. See the GetNutria Cookie Policy (GDPR and ePrivacy).
Client and clinical content processed for nutritionists
GetNutria may host or transmit client contact details, health and body-composition measurements, diet information, appointments, communications, imported reports and other practice records. GetNutria processes this content to provide the service on the instructions of the relevant nutritionist or clinic, except where processing is independently required for security, legal compliance or establishment of legal claims.
4. Why we process personal data and our legal bases
We process personal data where necessary:
• to create and perform the GetNutria service contract;
• to provide authentication, support, subscriptions and requested features;
• to comply with tax, accounting, legal and regulatory obligations;
• for legitimate interests such as securing the platform, preventing fraud, improving reliability and protecting legal rights, where those interests are not overridden by individual rights;
• with consent, where consent is specifically requested for an optional purpose; or
• to protect vital interests or establish, exercise or defend legal claims where applicable.
For client clinical content, GetNutria generally relies on the instructions and Article 28 processing arrangement with the relevant nutritionist or clinic. The nutritionist or clinic is responsible for selecting and documenting the appropriate legal basis and special-category condition for its professional use of health data.
5. How we use personal data
We use personal data to:
• create, administer and secure accounts;
• provide diet, measurement, messaging, appointment, import and related platform functions;
• deliver essential service communications;
• manage subscriptions and billing;
• investigate errors, support requests and security incidents;
• maintain audit and acceptance records;
• comply with legal obligations; and
• improve service reliability using appropriately limited information.
GetNutria does not sell client health data or use it for third-party advertising. GetNutria will not use client clinical content to train general-purpose artificial-intelligence models unless a separate, lawful, transparent and expressly enabled arrangement is introduced.
6. Artificial intelligence and document processing
Certain optional GetNutria features may use external AI or document-processing providers, for example to extract structured information from a report or generate non-clinical recipe imagery. When an optional feature may transmit personal or health information to an external provider, the feature, relevant provider and safeguards must be identified in the Subprocessor List and the nutritionist or clinic must be informed.
The nutritionist or clinic is responsible for deciding whether to use optional AI-assisted processing for its clients and for providing any additional information or obtaining any consent required for that use.
7. Who receives personal data
Personal data may be available to:
• authorised GetNutria personnel with a need to perform support, security, maintenance, billing or legal functions;
• hosting, database, storage, email, monitoring, payment, messaging, AI or document-processing providers used to operate enabled features;
• professional advisers and authorities where legally required; and
• a purchaser or successor in connection with a lawful corporate transaction, subject to appropriate safeguards.
Current service providers are described in the GetNutria Subprocessor List (GDPR).
8. International transfers
GetNutria's production database/storage region is * pending verification. The deployment architecture and Vercel contractual position for special-category health data are also * pending verification. GetNutria will publish confirmed locations and transfer safeguards before relying on them in a production notice.
Some providers used for support functions, particularly transactional email, may process information in the United States or other countries. Where personal data is transferred outside the EEA, GetNutria will rely, as applicable, on:
• an adequacy decision adopted by the European Commission, including the EU–US Data Privacy Framework where the recipient is currently certified;
• the European Commission's 2021 Standard Contractual Clauses;
• binding processor and subprocessor data-protection terms; and
• supplementary safeguards such as encryption, access restrictions, data minimisation and limits on message content.
GetNutria will not enable an external AI feature to receive identifiable client health data unless the provider's contract expressly supports that intended special-category processing and the required data-residency, retention and transfer safeguards have been verified. At launch, OpenAI may be used only for non-personal recipe-image generation; AI-assisted health-report extraction must remain disabled until separately approved.
The current providers, purposes, locations and safeguards are listed in the GetNutria Subprocessor List (GDPR).
9. Data retention
We keep personal data only for as long as needed for the purposes described above, including contractual, security, tax, accounting and legal requirements.
The standard GetNutria retention periods are:
• active account data and customer content: for the duration of the active account or until the relevant controller issues a valid deletion instruction;
• post-termination access and export: 30 calendar days;
• deletion from active production systems: within 30 calendar days after the export period ends;
• encrypted backup copies: allowed to expire through the normal cycle within a further 30 calendar days and no later than 90 calendar days after termination;
• security and audit logs: 12 months, unless a shorter operational period applies or a documented incident or legal hold requires longer retention;
• routine application diagnostic logs: 30 days;
• invoices, tax and accounting records: 7 years from the end of the relevant financial year or longer where law requires;
• support records: 2 years after the request is closed;
• legal-document acceptance records: for the account duration and 6 years after termination; and
• expired or revoked invitations: 30 days after expiry or revocation.
A documented legal, security or regulatory hold may temporarily extend a period. Data retained under a hold will be isolated, access-restricted and deleted when the hold ends.
Where GetNutria processes client records for a nutritionist or clinic, return and deletion follow the DPA and the controller's documented instructions, subject to applicable legal restrictions.
10. Security
GetNutria applies technical and organisational measures intended to protect personal data against unauthorised access, accidental loss, alteration or disclosure. Measures are summarised in the GetNutria Security and Data Protection Overview (GDPR). No online system can guarantee absolute security.
11. Individual rights
Subject to GDPR conditions and exceptions, individuals may have rights to:
• receive information about processing;
• request access to personal data;
• request correction of inaccurate data;
• request deletion;
• request restriction;
• object to certain processing;
• receive portable data where applicable;
• withdraw consent for future processing where consent is the legal basis; and
• lodge a complaint with a supervisory authority.
For clinical information controlled by a nutritionist or clinic, requests should normally be directed to that nutritionist or clinic. GetNutria will assist the controller as required by the DPA.
For GetNutria account, security, billing or support data, contact: *.
12. Complaints
Individuals may lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or another competent EEA supervisory authority. We encourage contacting us first so that we can try to resolve the concern.
13. Children
GetNutria is not intended to allow a child to independently create a nutritionist account. Where a nutritionist processes information about a child, the nutritionist or clinic is responsible for confirming the appropriate authority, notices, safeguards and consent arrangements under applicable law.
14. Changes to this notice
We may update this notice to reflect legal, technical or service changes. We will publish the current version and effective date and provide additional notice where a change materially affects individuals.
15. Contact
Privacy enquiries: *
Support: *
Postal address: 10 Nikou Karantoni, Akropoli, 2013 Nicosia, Cyprus