This Privacy Notice explains how Andreas Kalvaris, trading as GET NUTRIA (“GetNutria”, “we”, “us” or “our”), handles personal data when nutritionists, clinics, clients and website visitors use GetNutria.
1. Who we are
Controller for GetNutria account and business data:
Andreas Kalvaris, trading as GET NUTRIA, a registered business name in the Republic of Cyprus
Business Name Registration No. ΕΕ 63204 α
Business address: 10 Nikou Karantoni, Akropoli, 2013 Nicosia, Cyprus
Privacy enquiries: privacy@getnutria.com
Security matters: security@getnutria.com
Support: support@getnutria.com
For client records entered by a nutritionist or clinic, the relevant nutritionist or clinic normally determines why and how those records are used. In that context, the nutritionist or clinic is normally the data controller and GetNutria acts as its data processor.
2. Scope of this notice
This notice applies to personal data GetNutria handles for its own platform operations, including:
- nutritionist, clinic and client account registration;
- authentication and account security;
- subscription, invoicing and payment administration;
- support requests and service communications;
- platform performance, security and abuse prevention;
- legal-document acceptance records;
- website use and cookies; and
- compliance with legal obligations.
Clinical and practice records, including client profiles, body measurements, diet plans, appointments, messages and uploaded reports, are generally processed by GetNutria on behalf of the relevant nutritionist or clinic. Clients should also read their nutritionist's or clinic's privacy notice.
3. Personal data we collect
Depending on how GetNutria is used, we may process:
Account and identity information
Name, email address, telephone number, role, clinic or business name, account identifiers, preferred language and profile settings.
Authentication and security information
Password hashes, sign-in timestamps, session information, security logs, device/browser information, failed login events and records needed to prevent misuse.
Subscription and billing information
Subscription plan, billing contact information, invoice records, payment status and transaction references. Payment card details are handled directly by the selected payment provider.
Support and communications
Messages sent to support, issue descriptions, attachments voluntarily provided, appointment and account notifications, and records of our responses.
Legal and compliance records
The versions of Terms, DPAs or other documents accepted, acceptance timestamps and records needed to demonstrate compliance.
Website and cookie information
Necessary cookie identifiers and the language and appearance preferences you choose. See the GetNutria Cookie Notice (GDPR and ePrivacy).
Client and clinical content processed for nutritionists
GetNutria may host or transmit client contact details, health and body-composition measurements, diet information, appointments, communications, imported reports and other practice records. GetNutria processes this content to provide the service on the instructions of the relevant nutritionist or clinic, except where processing is independently required for security, legal compliance or establishment of legal claims.
4. Why we process personal data and our legal bases
We process personal data where necessary:
- to create and perform the GetNutria service contract;
- to provide authentication, support, subscriptions and requested features;
- to comply with tax, accounting, legal and regulatory obligations;
- for legitimate interests such as securing the platform, preventing fraud, improving reliability and protecting legal rights, where those interests are not overridden by individual rights;
- with consent, where consent is specifically requested for an optional purpose; or
- to protect vital interests or establish, exercise or defend legal claims where applicable.
For client clinical content, GetNutria generally relies on the instructions and Article 28 processing arrangement with the relevant nutritionist or clinic. The nutritionist or clinic is responsible for selecting and documenting the appropriate legal basis and special-category condition for its professional use of health data.
5. How we use personal data
We use personal data to:
- create, administer and secure accounts;
- provide diet, measurement, messaging, appointment, import and related platform functions;
- deliver essential service communications;
- manage subscriptions and billing;
- investigate errors, support requests and security incidents;
- maintain audit and acceptance records;
- comply with legal obligations; and
- improve service reliability using appropriately limited information.
GetNutria does not sell client health data or use it for third-party advertising. GetNutria does not use client clinical content to train general-purpose artificial-intelligence models.
6. Artificial intelligence and document processing
GetNutria includes optional features that rely on external AI and document-processing providers, for example rendering and reading an uploaded report, extracting structured information from it, or generating recipe and diet content.
Where an AI-assisted feature is used, information necessary for that feature may be sent to the relevant AI provider. Depending on the feature, this may include document content, extracted report text, client context or health-related information.
Uploaded PDF documents may also be processed by GetNutria's PDF rendering, text-extraction and OCR service in order to display them and read their contents. Those documents may contain identifiable health information.
The nutritionist or clinic is responsible for deciding whether to use optional AI-assisted processing for its clients and for providing any additional information or obtaining any consent required for that use.
The providers used for these features are listed in the GetNutria Subprocessor List (GDPR).
7. Who receives personal data
Personal data may be available to:
- authorised GetNutria personnel with a need to perform support, security, maintenance, billing or legal functions;
- hosting, database, storage, email, messaging, backup, AI and document-processing providers used to operate enabled features;
- professional advisers and authorities where legally required; and
- a purchaser or successor in connection with a lawful corporate transaction, subject to appropriate safeguards.
Current service providers are described in the GetNutria Subprocessor List (GDPR).
8. Infrastructure and international transfers
GetNutria's primary production PostgreSQL database is hosted with Supabase in Ireland (eu-west-1). The production application is hosted on Vercel, with server-side compute currently configured in Dublin (dub1). Some feature-specific service providers may process information in other locations depending on the service used and its applicable terms. See the GetNutria Subprocessor List (GDPR) for the providers used by GetNutria.
Vercel provides application hosting and server-side compute. Personal data, including health-related information where required to serve an application request, may be processed through Vercel-hosted server-side services. GetNutria's primary application database is hosted separately with Supabase.
Supabase hosts the primary production database and selected object storage, including recipe images, avatars, practice and business branding, and branding used in PDF headers and footers.
Database backups are produced by GetNutria's backup automation and stored on separate backup infrastructure provided by Cloudflare R2. The backup workflow runs on GitHub-hosted automation, which transiently handles a database dump while the backup is produced.
Some providers used for supporting functions, particularly transactional email and AI-assisted features, may process information in the United States or other countries. Where personal data is transferred outside the EEA, GetNutria relies, as applicable, on:
- an adequacy decision adopted by the European Commission, including the EU–US Data Privacy Framework where the recipient is currently certified;
- the European Commission's 2021 Standard Contractual Clauses;
- binding processor and subprocessor data-protection terms; and
- supplementary safeguards such as encryption in transit, access restrictions, data minimisation and limits on message content.
The current providers, purposes, locations and safeguards are listed in the GetNutria Subprocessor List (GDPR).
9. Data retention
We keep personal data only for as long as needed for the purposes described above, including contractual, security, tax, accounting and legal requirements.
The standard GetNutria retention periods are:
- active account data and customer content: for the duration of the active account or until the relevant controller issues a valid deletion instruction;
- post-termination access and export: 30 calendar days;
- deletion from active production systems: within 30 calendar days after the export period ends;
- backup copies: held on separate backup infrastructure and removed in accordance with GetNutria's operational backup-retention controls after deletion from active systems;
- security and audit logs: retained for a limited period appropriate to their security purpose, unless a documented incident or legal hold requires longer retention;
- routine application and platform diagnostic logs: retained for a short operational period determined by the relevant hosting platform's log-retention behaviour;
- invoices, tax and accounting records: 7 years from the end of the relevant financial year or longer where law requires;
- support records: 2 years after the request is closed;
- legal-document acceptance records: for the account duration and 6 years after termination; and
- expired or revoked invitations: 30 days after expiry or revocation.
A documented legal, security or regulatory hold may temporarily extend a period. Data retained under a hold will be isolated, access-restricted and deleted when the hold ends.
Where GetNutria processes client records for a nutritionist or clinic, return and deletion follow the DPA and the controller's documented instructions, subject to applicable legal restrictions.
10. Security
GetNutria applies technical and organisational measures intended to protect personal data against unauthorised access, accidental loss, alteration or disclosure. Measures are summarised in the GetNutria Security and Data Protection Overview (GDPR). No online system can guarantee absolute security.
11. Individual rights
Subject to GDPR conditions and exceptions, individuals may have rights to:
- receive information about processing;
- request access to personal data;
- request correction of inaccurate data;
- request deletion;
- request restriction;
- object to certain processing;
- receive portable data where applicable;
- withdraw consent for future processing where consent is the legal basis; and
- lodge a complaint with a supervisory authority.
For clinical information controlled by a nutritionist or clinic, requests should normally be directed to that nutritionist or clinic. GetNutria will assist the controller as required by the DPA.
For GetNutria account, security, billing or support data, contact privacy@getnutria.com.
12. Complaints
Individuals may lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or another competent EEA supervisory authority. We encourage contacting us first so that we can try to resolve the concern.
13. Children
GetNutria is not intended to allow a child to independently create a nutritionist account. Where a nutritionist processes information about a child, the nutritionist or clinic is responsible for confirming the appropriate authority, notices, safeguards and consent arrangements under applicable law.
14. Changes to this notice
We may update this notice to reflect legal, technical or service changes. We will publish the current version and effective date and provide additional notice where a change materially affects individuals.
15. Contact
Privacy enquiries: privacy@getnutria.com
Security matters: security@getnutria.com
Support: support@getnutria.com
Postal address: 10 Nikou Karantoni, Akropoli, 2013 Nicosia, Cyprus