Privacy Policy

1. Data controller

The controller of personal data processed in connection with DietCoach is Jacek Grecki, a natural person responsible for the DietCoach project and residing in the Netherlands. Privacy contact: jacgre1981@gmail.com.

2. Categories of data we collect

Depending on how you use DietCoach, we may process the following categories of data:

• Contact data — e-mail address (used to identify your plan, deliver access links and prevent duplicate free plans).
• Health, body and lifestyle data — sex, age, height, weight, physical activity level, dietary goal, dietary preferences, excluded products and intolerances. This is special-category (health) data under Art. 9 GDPR.
• Trainer account data — for trainers who register an account: name, e-mail and authentication credentials (managed by our authentication provider), and subscription status.
• Client data entered by trainers — where a trainer manages clients, the trainer enters client data (e.g. name, body and health parameters, check-ins). See sections 6–7.
• Technical data — a derived (hashed) identifier used to rate-limit free plan generation and prevent abuse. It is not used to identify you.
• Consent records — the type of consent, document version, timestamp and locale, kept to demonstrate lawful processing.
• Payment and transaction data — processed by Lemon Squeezy as Merchant of Record (see section 8). We do not receive or store your full payment card data.

3. Purposes and legal bases

• Performance of a contract — Art. 6(1)(b) GDPR — ordinary data needed to create an account and provide the service (account, plan delivery, paid packages), and transactional messages relating to your account or the service.
• Explicit consent — Art. 6(1)(a) and Art. 9(2)(a) GDPR — health data, body parameters, intolerances and information allowing conclusions about health, processed to calculate your requirements and generate a personalised plan.
• Legitimate interest — Art. 6(1)(f) GDPR — security, abuse prevention and rate limiting.

We do not process your data for e-mail marketing and therefore rely on no marketing legal basis.

4. Health data and explicit consent

Health, body and lifestyle data is special-category data. We process it solely on the basis of your explicit consent, given via a separate, unticked consent option before a plan is generated. You may withdraw this consent at any time (see section 12); withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Automatic personalisation of plans

DietCoach uses automated processing of the parameters provided by the user to calculate energy and macronutrient targets and to generate a personalised meal plan. This may constitute profiling under the GDPR. It does not produce legal effects or similarly significant effects for the user and does not replace the judgement of a physician or clinical dietitian. Plans are generated by the application's own formulas and rules; your data is not sent to any external AI model.

6. Trainer account data

For trainers who register an account, we act as the controller of the trainer account data (name, e-mail, authentication and subscription status) for the purposes of providing the trainer panel, security and application billing status. This data is retained while the account exists (see section 10).

7. Client data entered by trainers

Where a trainer uses the trainer panel to manage client data, the trainer acts as an independent controller of their clients' personal data, and the DietCoach operator acts as a processor on the trainer's behalf with respect to that client data. The terms of this processing are set out in the Data Processing Agreement accepted by the trainer.

8. Infrastructure providers and data recipients

We do not sell, rent or trade your personal data. We rely on the following providers:

• Supabase — database and authentication provider (stores account, plan, client and consent data).
• Vercel — hosting, deployment and execution of application functions.
• Resend — delivery of transactional e-mails (e.g. verification codes, plan and purchase access links, support replies).
• Lemon Squeezy — Paid transactions are concluded and processed by Lemon Squeezy acting as Merchant of Record. Lemon Squeezy handles, among other things, checkout, payment processing, sales taxes, transaction documents, refunds and chargebacks. Payment data is processed by Lemon Squeezy under its own privacy terms.

Diet plans are generated by the application's own logic; no external AI provider receives your data. We do not use third-party analytics, advertising or tracking services.

9. Transfers outside the EEA

Some technology providers may process data outside the European Economic Area. In such cases the transfer is carried out using appropriate legal mechanisms, such as an adequacy decision or standard contractual clauses, depending on the provider.

10. Data retention

• Free (anonymous) plans — retained for 3 days from generation, then automatically expired and deleted.
• Paid (anonymous) plans — retained for 365 days from purchase, then automatically expired and deleted.
• Trainer accounts and the client data entered by trainers — retained for as long as the trainer account exists; deleted upon account deletion (see section 13). We do not apply an automatic time-based deletion to active trainer accounts.
• Subscription data — retained while the account exists to manage access and prevent abuse.
• Rate-limiting identifiers — retained only briefly for the duration of the rate-limit window and routinely purged.
• Consent records — retained for as long as the related data exists, to demonstrate lawful processing.

11. Your rights

Under the GDPR you have the right to:

• access your personal data;
• rectify inaccurate data;
• request erasure (the right to be forgotten);
• restrict processing;
• object to processing based on legitimate interest;
• data portability;
• withdraw consent (see section 12).

To exercise these rights, contact us at jacgre1981@gmail.com. We will respond without undue delay and, in principle, within one month.

12. Withdrawal of consent

You may withdraw consent to the processing of your health data at any time by contacting jacgre1981@gmail.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may mean we can no longer generate or maintain a personalised plan based on that data.

13. Account and data deletion

Trainers can delete their account from the account settings; deletion removes the trainer account together with the associated clients, plans, targets, check-ins, subscription record and consent records. You can also request deletion at any time by contacting jacgre1981@gmail.com.

14. Cookies

DietCoach uses only essential cookies required for the application to function (authentication/session state and language preference). We do not use advertising trackers, third-party analytics or marketing cookies. Because only essential cookies are used, no consent is required; we show a brief informational cookie notice on your first visit.

15. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or loss. Data is transmitted over HTTPS, and access to the database is restricted by row-level security policies scoped to the owning account. Health data is not written to application logs.

16. Complaints

You have the right to lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority (autoriteitpersoonsgegevens.nl), or with the supervisory authority competent for your place of residence.

17. Contact

For any questions or requests regarding your personal data, contact: jacgre1981@gmail.com.

18. Document history

Version 2.0, effective 11 July 2026. This version replaces the previous version 1.0 and updates the operator identity (a natural person based in the Netherlands), the competent supervisory authority (AP), data recipients and retention information.