Privacy policy

Who we are

MealSync is a meal-planning platform that dietitians use with their clients. It is operated by [legal name, address, VAT number], contact: [privacy email].

If you are a client, your dietitian decides which data is kept about you and why: they are the data controller. MealSync processes that data on the dietitian's behalf (data processor), under a data processing agreement. For dietitians' own account data, MealSync is the controller.

What data we process

Account data: name, email, language, password (stored only as a secure hash), sign-in times.

Client data entered by your dietitian: phone, age, height, weight history, body measurements, goals, daily calorie target, meal plans, notes, and the shopping-list items you tick. Weight, measurements and goals are health data, a special category under Article 9 GDPR.

We don't use your data for advertising, don't sell it, and don't track you across other websites.

Why and on what legal basis

To provide the service your dietitian offers you: a contract with you (Art. 6(1)(b) GDPR) and, for health data, your explicit consent or the provision of health care by a health professional bound by confidentiality (Art. 9(2)(a) or (h) GDPR), as your dietitian determines.

To keep the service secure and working (legitimate interest, Art. 6(1)(f) GDPR), for example sign-in records and error logs.

Who can see your data

Only your dietitian and you. Each dietitian's data is kept apart from every other dietitian's by access rules in the database, and this is tested automatically. The platform operator can open a dietitian's account in a logged, read-only support view, only to help with a problem.

Sub-processors: Supabase (database, sign-in and file storage; [EU region, to be confirmed]) and [hosting provider, e.g. Hetzner Online GmbH, Germany] (application server). Email for sign-in and password resets is sent through [email provider]. All within the EU/EEA or covered by EU Standard Contractual Clauses.

How long we keep it

As long as your dietitian keeps you as a client. When your dietitian deletes your record, your data and login are deleted. When a dietitian closes their account, their clients' data is deleted with it. Backups are overwritten within [N] days.

Your rights

You can ask for access to, a copy of, correction or deletion of your data, restrict or object to its processing, and withdraw consent at any time. Please contact your dietitian first; you can also write to [privacy email]. You can complain to the Hellenic Data Protection Authority (www.dpa.gr).

Security and cookies

Connections are encrypted (HTTPS), passwords are hashed, and access is limited by role. The app stores only what's needed to keep you signed in and remember your language in your browser; there are no advertising or analytics cookies.