Data Protection & GDPR Compliance

Privacy Policy & Health Data

We treat your medical privacy with clinical sanctity. Learn how your personal and sensitive health data is encrypted, processed, and safeguarded under the highest global standards.

GDPR Compliant • Health Data Safeguarded • ISO/TLS Encrypted

1Introduction & Scope 2Data We Collect (Special Category Health Data)3Lawful Basis for Processing under GDPR 4How We Use Your Medical Data 5Data Security & Technical Safeguards 6Third-Party Processors & Payments (Stripe)7Your Rights under GDPR (Data Subject Rights)8Cookies & Data Retention Periods

1Introduction & Scope

Nutri-Shift Clinics ("we", "our", or "the Clinic") is committed to protecting the privacy, integrity, and confidentiality of our subscribers. Because our services revolve around functional medicine, therapeutic nutritional planning, and chronic disease management, we hold ourselves to the most rigorous ethical and legal standards, including the European Union General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and applicable regional health privacy regulations.

2Data We Collect (Special Category Health Data)

To formulate evidence-based personalized nutrition programs, we process two categories of data:

Basic Personal Identifiers

Full name and preferred title
Email address for communications and plan delivery
Phone / WhatsApp number for direct clinical messaging
Age, biological sex, and country of residence

Special Health Data (GDPR Art. 9)

Medical history & chronic diagnoses (PCOS, Diabetes, IBS, etc.)
Laboratory analyses (HTMA mineral panels, CBC, lipid profiles)
Current prescribed medications and supplements
Anthropometric measurements (weight, height, body circumferences)
Optional progress photographs (strictly encrypted, never public)

3Lawful Basis for Processing under GDPR

Under the GDPR, processing of special category data (health data) is prohibited unless specific exceptions are met. We process your data exclusively under:

Explicit Consent (GDPR Article 9(2)(a)): You give explicit, freely given consent when completing the clinical intake assessment to allow our medical physicians to evaluate your health status.

Performance of Contract (GDPR Article 6(1)(b)): Processing is necessary to deliver the subscribed personalized dietary plan, consultation sessions, and follow-ups.

4How We Use Your Medical Data

Your health metrics are utilized strictly within clinical operations:

Designing personalized nutrition protocols with high precision
Evaluating clinical lab tests & metabolic biomarkers
Conducting 1-on-1 virtual medical consultations
Direct clinical follow-up via official Telegram and website chat

Zero Marketing Disclosure: We NEVER sell, rent, or trade your health data or progress photographs to third parties or advertisers under any circumstances.

5Data Security & Technical Safeguards

We implement industry-leading technical and organizational security controls to protect your health records:

Encryption in Transit & Rest

TLS 1.3 in transit and AES-256 at rest

Strict Role-Based Access

Only your assigned physician can access files

Hardened Cloud Servers

ISO/IEC 27001 & GDPR certified data centers

6Third-Party Processors & Payments (Stripe)

All financial transactions are handled via Stripe Inc., a PCI-DSS Level 1 certified payment processor. Nutri-Shift does NOT view, process, or store credit card numbers or banking passwords on its servers. Only the transaction status, timestamp, and customer email are communicated to us to activate your subscription.

7Your Rights under GDPR (Data Subject Rights)

As an individual whose data is processed by Nutri-Shift, you have full control over your personal information:

• Right of Access (Art. 15):Request a full copy of your clinical nutrition file.

• Right to Rectification (Art. 16):Update any inaccurate measurements, labs, or contacts.

• Right to Erasure / Forgotten (Art. 17):Request complete deletion of your files upon package completion.

• Right to Withdraw Consent (Art. 7(3)):Revoke health data processing consent at any given moment.

To exercise any of these rights, contact our Data Protection Officer at support@nutri-shift.com with your registered email.

8Cookies & Data Retention Periods

We use strictly necessary functional cookies solely to maintain your active browser session and preserve your country/currency preferences. We do not use intrusive cross-site behavioral tracking cookies. Your clinical records are retained for the duration of active subscription plus statutory medical compliance periods (up to 3 years), after which they are securely expunged unless you request archival retention.

Data Protection Officer (DPO) Contact

For inquiries regarding your personal data, GDPR rights execution, or data deletion requests, please contact:

support@nutri-shift.com