1. Introduction

Welcome to Nutrinexa, a product of Kalonlife International India Private Limited. We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you about how we handle your personal data when you use our Service and tell you about your privacy rights.

2. Information We Collect

Nutrinexa is used by dietitians to care for their clients, so most health information here is entered by a dietitian about a client rather than by the person it describes. Where this policy says "your data", it means the account holder's own details if you are a dietitian, and your health record if you are a client. A dietitian is responsible for the records they enter; we process them on that dietitian's behalf.

We collect several types of information to provide and improve our Service:

Personal Information: Name, email address, and account credentials
Health Data: Nutrition information, meal logs, dietary preferences, and health goals you choose to track
Usage Data: Information about how you use the Service, including pages visited and features accessed
Device Information: Device type, operating system, browser type, and IP address

3. How We Use Your Information

We use the collected information for various purposes:

To provide and maintain our Service
To personalize your nutrition tracking experience
To improve and optimize our Service
To communicate with you about updates, features, and support
To monitor usage and detect technical issues
To ensure the security of our Service

4. Data Storage and Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Your data is stored on secure servers and encrypted both in transit and at rest.

Specifically, we apply the following safeguards:

Encryption: All data is encrypted in transit (HTTPS/TLS) and at rest.
Strict access isolation: Row-level security ensures your dietitian can only ever access their own clients' records, and you can only access your own.
Authenticated, rate-limited access: Every request is authenticated, and sensitive operations are rate-limited to prevent abuse.
No medical data in logs: Health report contents are not written to our server logs.
AI processing: To read lab reports and draft plans and notes, some information is sent to OpenAI. Section 4a sets out exactly what, and what is not.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee its absolute security.

4a. What is sent to OpenAI, and what is not

Nutrinexa uses OpenAI to read uploaded lab reports and to draft clinical notes, meal plans and report text. A dietitian chooses when this happens; it is not continuous background processing. Nothing is sent to OpenAI to train a model by us, and the numbers on a plan — energy, protein, exchanges — are calculated by Nutrinexa itself, not by the model.

What is sent:

Clinical details, as text. Age, sex, height, weight and body-composition measurements, medical conditions, allergies, medications and supplements, dietary preferences, stated health goals, and laboratory values. This is what the model needs to answer a clinical question.
Uploaded documents and photographs, as files. When a lab report is uploaded it is sent as the document itself — the photograph or PDF — because that is how the values are read from it. Lab reports usually carry the patient's name, age, sex, the referring doctor and the laboratory printed on them, and anything else printed on the page is sent with it. The same applies to a photograph of a meal or of a supplement label. We cannot remove printed details from an image without risking the values being misread.
What a dietitian types into the assistant. The in-app assistant sends the recent conversation so it can follow the thread. If a dietitian types a client's name or another identifying detail into it, that is sent too.

What is not sent:

Names, telephone numbers, email addresses and postal addresses are not placed into the text of any request to OpenAI. Prompts refer to "the client". The two exceptions above — what is printed on an uploaded document, and what a dietitian types into the assistant — are stated plainly because they are real.
Login credentials and payment details are never sent to OpenAI.

A dietitian who does not want a document sent can enter lab values by hand instead of uploading the report.

5. Data Sharing and Disclosure

We do not sell your personal data. We may share your information only in the following circumstances:

With your consent: When you explicitly authorize us to share specific information
Service providers. We name them rather than describe them:
- Supabase — stores the database, accounts and uploaded files.
- OpenAI — reads uploaded reports and drafts text, as set out in section 4a.
- Resend — sends email such as client invitations and confirmations; it receives the name and email address of the person being written to.
- Vercel — hosts and serves the application.
- Razorpay — processes payments where a payment is taken. Card details are handled by Razorpay and are never stored by Nutrinexa.
Legal Requirements: When required by law or to protect our rights and safety
Business Transfers: In connection with any merger, sale, or acquisition of our company

6. Your Privacy Rights

You have the following rights regarding your personal data:

Access: Request access to your personal data
Correction: Request correction of inaccurate or incomplete data
Deletion: Request deletion of your personal data
Data Portability: Request a copy of your data in a machine-readable format
Opt-out: Unsubscribe from marketing communications
Withdraw Consent: Withdraw your consent at any time

If you are in India, these rights are provided in line with the Digital Personal Data Protection Act, 2023 (DPDP). To exercise any right — including receiving a copy of your data or having it deleted — contact your assigned dietitian or email us (below); your dietitian can export or permanently delete your data on request.

Grievance Officer: For any privacy concern or complaint, contact our Grievance Officer at privacy@nutrinexa.in.

7. Cookies and Tracking

We use cookies and similar tracking technologies to track activity on our Service and store certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some features of our Service.

8. Children's Privacy

Our Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us.

9. How long we keep data

We keep records for as long as the account they belong to exists. Nothing is deleted automatically on a schedule — a clinical record is not something to discard on a timer while a dietitian may still need it, so deletion happens when it is asked for.

One client's records. A dietitian can permanently delete a client from within Nutrinexa. This is real deletion, not a hidden flag: the record and everything held under it — assessments, lab reports, plans, notes and journals — are removed.
A whole account. A dietitian can delete their account, which removes the records held under it.
Archiving is not deletion. Archiving takes a client off the working list and keeps every record. If you want data destroyed, ask for deletion rather than archiving.
What survives a deletion. We keep a deletion log so that a deletion can be accounted for afterwards. For each deleted client it records the client's full name as it was, the internal ID of the deleted record, the dietitian whose record it was, who carried out the deletion, the reason given and the date and time. It does not keep any of the clinical record — no assessments, lab reports, plans, notes, measurements or messages. The dietitian can see their own practice's deletion log, and it is included when they export their account's data. We may also keep records we are separately required by law to keep, such as invoices and tax records.

Information already sent to a provider named in section 5 is then subject to that provider's own handling. Deleting a record in Nutrinexa removes it from Nutrinexa; it does not by itself reach into a third party's systems. To ask about that, write to the address in section 12.

10. International Data Transfers

Some of the providers named in section 5 process data outside India — OpenAI, Resend and Vercel operate from infrastructure outside the country, so information sent to them, including the uploaded documents described in section 4a, is processed abroad. Where a transfer happens we rely on the contractual terms offered by that provider. If you would rather clinical documents were not processed outside India, lab values can be entered by hand rather than uploaded.

11. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

Email: privacy@nutrinexa.in