Nutfit
Log in

Privacy policy

Last updated: October 28, 2026 (Instagram)

This is a translation for convenience. If there is any discrepancy, the Spanish version prevails.

1. Who is who

In Nutfit there are two types of data and two different roles:

  • Your data as a professional (email, name, credentials, license number, subscription details): the data controller is Affiliaction SL (Tax ID B87074787, Avenida de los Poblados 58, Local B-91, 28044 Madrid, david@affiliaction.net).
  • Your clients' data (profile, allergies, weight, water, meals and photos): you are the data controller, and Affiliaction SL acts as data processor under the GDPR Article 28 data processing agreement you sign when you register.

2. What we process and why

Your email, to send you your login link and manage your account; your name, credentials and license number, to sign the meal plans you generate; payment details, to charge the subscription when you purchase one. For your clients, only what you or they enter, to provide you with the meal planning and follow-up service.

3. Legal basis

For your account: performance of the contract you accept when you sign up. For your clients' health data (special category, Art. 9 GDPR): the legal basis is provided by the professional acting as data controller, who guarantees having obtained each client's explicit consent.

4. Service providers involved

  • Vercel Inc. (hosting of the website and the application).
  • Neon (database).
  • Amazon Web Services, SES service (sending the email with the login link; servers in the United States).
  • Anthropic (analysis of the meal photos taken by the client, whose image is not stored, and the client's chat assistant, which receives their messages, profile and meal plan in order to reply).
  • Browser notification services (Google, Apple, Mozilla), for notifications on the client's phone.
  • Stripe (subscription billing).
  • Meta Platforms Ireland Ltd. (Instagram), only if you connect your Instagram account to publish from Nutfit.

Some of them may involve transfers outside the European Economic Area, covered by standard contractual clauses. We do not share data with third parties for advertising purposes and we do not use it to train models.

5. Retention

For as long as your account is active. When you close it, or whenever you ask, your clients and their data are deleted. Login links expire after 30 minutes and are stored encrypted.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to david@affiliaction.net. Clients exercise theirs with their professional, who is the data controller. You can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Security

Encryption in transit, access to each client limited to their professional (or whoever runs the practice), and a log of who opens each profile.

8. If you request the free video call and weekly plan

If you fill in our Facebook or Instagram form to request the free video call with a registered dietitian, the controller of that data is Affiliaction SL (Tax ID B87074787, david@affiliaction.net).

  • What data: name, phone number, email, what you'd like to achieve and whether you prefer mornings or afternoons. We don't ask for health data in the form.
  • What for: so that a dietitian from the Nutfit network can call you to schedule the video call and prepare your weekly plan. Neither the video call nor the plan is charged, and there's no obligation.
  • Legal basis: your consent when you submit the form, and the steps you ask us to take before any contract.
  • Recipients: the dietitian who assists you, who may only use your data to contact you about this request. If you decide to continue with them, from then on they are the controller of your data as their client. Meta Platforms Ireland Ltd. collects the form on its platform.
  • Retention: 12 months from your request if you don't continue with any professional, unless you ask us to delete it sooner.
  • Your rights: you can withdraw your consent and exercise your other rights by writing to david@affiliaction.net.

9. If you connect your Instagram account

From Social Studio you can connect your Instagram professional account so that Nutfit publishes the content you choose on your behalf (for example, the reel of the recipe of the day). It's optional and only happens if you turn it on.

  • What Instagram data we use: the ID and username of your professional account (instagram_business_basic permission) and permission to publish content to it (instagram_business_content_publish). We don't read your messages, comments or followers.
  • What for: to show you in the dashboard which account is connected and to publish the pieces you choose, at the time you choose. We don't use this data for advertising or share it with third parties.
  • How we store it: the access token Instagram gives us is stored encrypted and expires after 60 days if not renewed. We also keep a log of what was published (date, recipe and the post ID) to avoid repeats and to show you your history.
  • Legal basis: performance of the contract, since you ask us for this feature.

10. How to delete your Instagram data

You can delete the Instagram data we store at any time:

  1. Go to your Nutfit dashboard → Social Studio → Instagram and click “Disconnect”. We immediately delete the access token and your Instagram account data.
  2. You can also remove the permission from Instagram: Settings → Apps and websites → NutriPanel-IG → Remove.
  3. If you also want us to delete your publishing history, or you don't have access to the dashboard, write to david@affiliaction.net from your account email and we'll delete it within 30 days at the latest.

11. Mobile app and health data (Apple Health and Health Connect)

The “Nutfit” app (still listed as “NutriPanel” on the App Store and Google Play) for iPhone and Android is the client app of a professional. If you allow it, it reads the following from Apple Health (HealthKit, including Apple Watch) or Health Connect (Android and compatible watches):

  • What we read: steps, active calories, hours of sleep, resting heart rate and weight, summarized per day. We only read: we never write or change anything in Health or Health Connect.
  • Why: so your nutritionist or trainer can see your activity and progress in their dashboard and in your app (activity rings, weekly averages). It is not used for advertising, it is never sold or shared with third parties, and it is not used to train AI models.
  • Who sees it: only you and the professional who gave you access to the app.
  • Legal basis: your explicit consent (GDPR art. 9.2.a), given in the system prompt, which you can withdraw at any time in Health or Health Connect settings.
  • Retention: while you remain a client of that professional. In the app you can tap “Delete my account”: we immediately delete your app access and the data that came from Health or Health Connect.
  • Security: data travels encrypted (HTTPS) and is stored with the providers listed in section 4, with restricted access.