Nutrix Privacy Policy

Delete your Nutrix account and personal data

You can request permanent deletion without installing the app, signing in or reactivating a deactivated account.

1. Email [email protected] from the email address registered to your Nutrix account. Use the subject “Nutrix account deletion request”.
2. Say that you want your entire account and associated personal data deleted. If you only want specific data removed, identify it and tell us to keep your account open.
3. We verify account ownership before deletion and confirm the outcome by email. If you no longer have access to your registered email, contact the same address so we can arrange another proportionate verification method.

This opens your email app with a draft. Review and send it to submit your request. You can also write directly to [email protected].

Full deletion requests cover your profile and contact details, account credentials and sessions, dietary and allergy information, food and water logs, wellbeing logs, habits, goals, measurements, check-ins, progress photos, messages, attachments and other personal content associated with your account. Personal data is deleted or irreversibly anonymised, subject to the limited retention explained below.

Deactivation, signing out and uninstalling the app do not delete your account. Deletion is permanent; request a copy of any data you want to keep before it is completed.

Some transaction, invoice, security or dispute records may need to be retained to meet legal obligations, prevent fraud or resolve a specific claim. We explain any applicable exception, the records concerned and their retention period when handling your request. Backup and processor copies are included in the deletion review; a deactivated account is not treated as completed erasure.

We handle requests without undue delay and within the deadlines that apply to your request. If verification, legal retention or additional processing is needed, we explain the reason and expected timing rather than marking an incomplete request as finished.

Deleting Nutrix does not automatically cancel an Apple App Store or Google Play subscription. Manage or cancel it in your Apple or Google account settings to prevent future renewal. Contact us about a subscription purchased directly from Nutrix. You can request deletion even while a subscription is active.

1. Information we collect

Account and profile: name, email, password hash, account identifier and role, optional date of birth, gender, phone number, Instagram handle, profile photo, coaching biography, language, units and preferences. We receive this information from you or, where relevant, from a coach who invites or manages you.

Nutrition, health and fitness: meal plans and diary entries, foods and nutrition estimates, dietary preferences and allergies, weight and body measurements, progress photos, water intake, activity information you enter, goals, habits, supplements, daily wellbeing and weekly check-ins. This can include sensitive health information.

Communications and content: coach messages, photos and attachments, reviews, recipes, plans, support correspondence and any information you choose to include in them. Trainer profiles, published offers and reviews may be visible to other users; private coaching records are shared with the relevant coach and authorised service staff.

Purchases and technical information: product and transaction identifiers, subscriptions, entitlements, purchase history and billing status; device push tokens, notification preferences, app/browser information, request and security logs, IP addresses processed by our servers and diagnostic errors. Payment providers handle payment-card details; Nutrix does not store full card numbers or card security codes.

Website and enquiries: waitlist or studio-contact name, email, client-count or gym/team details, preferred plan and language, consent record, timestamps, browser user-agent and correspondence. We also record website page-view and button-click events without a cross-site advertising identifier.

2. How and why we use information

We use account and coaching data to provide sign-in, plans, nutrition tracking, coach communication, progress displays and features you request; purchase data to provide paid access and handle billing; and technical data to deliver notifications, maintain security, diagnose errors and operate the service.

Where the GDPR applies, our bases are performing our contract with you, complying with legal obligations, legitimate interests in running and securing Nutrix, and consent for optional marketing or other processing that requires it. Where health information requires explicit consent under applicable law, that consent is necessary before processing. You can withdraw consent by contacting us; this may prevent the related feature from being provided but does not affect earlier lawful processing.

Waitlist updates and marketing emails use the consent you provide. You can unsubscribe using the email link or contact us. We do not sell personal data or use health information for third-party advertising.

3. Device permissions and local storage

Camera and photo access let you choose or capture a profile, meal, progress or chat image. Only the content you choose to upload is sent for that feature. Notification permission lets us send reminders and coaching updates. You can change these permissions in device settings; refusing an optional permission does not stop unrelated features.

The app stores session credentials using the device's secure storage and may cache plan data and preferences locally. The website uses local storage for language and privacy-notice preferences, session storage to avoid duplicate page-view events, and necessary session cookies for signed-in areas. Clearing browser or app data removes local preferences but does not delete the server account.

Where enabled, our self-hosted Umami website analytics uses no tracking cookies or cross-site advertising identifiers. Website analytics is separate from nutrition and coaching records.

The website loads Sora and Inter fonts from Google Fonts. Your browser connects to Google to download those files, which exposes connection information such as your IP address and browser headers to Google.

4. Sharing and service providers

Your connected coach receives the client information needed for coaching, including shared plans, logs, measurements, check-ins, photos and messages. A coach may also have independent legal responsibilities for their own records; contact them about copies they hold outside Nutrix.

Our hosting, database and file-storage infrastructure processes the data needed to operate Nutrix. Brevo delivers website emails; our configured email delivery provider sends account and service messages. Expo's push-notification service and Apple/Google notification systems process device tokens and notification content to deliver messages. Notification text may be visible on a lock screen, depending on your device settings.

Stripe processes direct web payments. When native store purchasing is enabled, Apple or Google processes the purchase and RevenueCat processes a Nutrix customer identifier, product and transaction information to manage access, subscriptions and restores. These services also process data under their own applicable privacy notices.

Where configured, Sentry receives diagnostic errors and technical context. Our server monitoring removes request bodies, cookies and request headers before sending events and disables default personal-information collection. Optional AI services are explained separately below.

We require providers processing data on our behalf to protect it for the agreed purposes, with protections consistent with this policy and applicable law. We may also disclose information when legally required, to protect rights and security, or in a business transfer subject to applicable safeguards. We do not share data with advertising networks.

5. Optional AI features

If you or your coach use AI meal scanning or generation, the submitted meal photo, text brief, language, nutrition targets and relevant dietary constraints are processed by OpenAI or Anthropic, depending on the configured provider. AI cover generation sends the submitted recipe, meal or plan description to OpenAI. A scan photo is sent for analysis rather than saved as a progress photo; estimates you choose to log become part of your diary.

Do not include unrelated personal information in AI prompts or images. These features involve external processing and may include sensitive information you choose to submit. Contact us to identify the provider used for a particular request or to exercise your rights. You can avoid this transfer by not using optional AI features; contact us to withdraw consent or request deletion of information already submitted.

For business enquiries, our website's optional automated outreach tools may use DeepSeek to draft correspondence from professional contact details and message history. This is separate from mobile nutrition records. AI output is an estimate or draft and can be inaccurate.

6. Security and international processing

We use HTTPS for service connections, hashed account passwords, authenticated access and role-based restrictions. Authorised staff and providers receive access needed for their work. No system can guarantee absolute security; never send us your password or full payment-card details in a privacy request.

Our operator is in Cyprus. External providers may process data in other countries, including outside the EEA. Where applicable law requires safeguards for a transfer, an appropriate legal transfer mechanism and contractual protections are required. Contact us for information about the recipients, locations and safeguards relevant to your data.

7. Retention and deletion

Account and coaching records are retained while needed to provide your account and requested services, unless you request deletion sooner. Retention depends on the purpose, the type of data and any applicable legal obligation. Merely stopping use or deactivating the account does not trigger full deletion.

Waitlist data is kept until launch and your decision whether to become a customer, or until you ask for deletion, whichever comes first. We may keep a minimal unsubscribe/suppression record so that we respect your choice not to receive marketing.

Accounting, invoice and payment evidence required by Cyprus company law must be kept for six years after the end of the calendar year concerned. For records supporting tax returns, the tax rules effective from 2026 require at least six years from the latest applicable filing deadline or actual filing date of the original or amended return. A qualifying tax audit can extend that period. These periods run from the legally specified date, not from account deletion or necessarily from the purchase date.

Where a transaction is subject to the EU VAT One Stop Shop record-keeping rules, the relevant records must be kept for ten years from the end of the transaction year. This applies only when that scheme applies; it is not a ten-year retention rule for all Nutrix data. Financial retention concerns required billing, transaction and tax evidence, not your entire nutrition or health history.

Financial records that law requires, records needed for a specific dispute or fraud investigation, and limited proof of a privacy request may be retained only for their applicable purpose and period, with restricted use. Backups and provider-held copies must also be considered when completing erasure. Ask us for the retention period applying to a particular record; any retained data and expected deletion timing will be explained in our response.

8. Your choices and privacy rights

Depending on applicable law, you can request access, a copy or portability of your data, correction, deletion, restriction or objection to processing, and withdrawal of consent. Email [email protected]. We may need proportionate proof of account ownership; do not send a password. You can request deletion of specific data while keeping your account, or full account deletion using the instructions above.

You can change device permissions, unsubscribe from marketing and contact us about notification preferences. You may complain to the Cyprus Commissioner for Personal Data Protection or your local data-protection authority. Withdrawing consent does not affect processing that was lawful before withdrawal.

9. Children's information

If you believe a child has supplied personal information without the consent or authority required by applicable law, contact us. We will assess the request and remove information or obtain the required authorisation as appropriate. Coaches must have the authority needed to supply a client's information.

10. Changes and contact

We update this policy when our practices change and show the revision date above. Where required, material changes will also be communicated through the service or email. Privacy and deletion requests: [email protected]. Postal contact: DISHA SOLUTIONS LTD, Efesou 9, 5280 Paralimni, Cyprus.