This privacy policy explains which personal data the Nutritom app and the nutritom.app website process, why, for how long, and what rights you have. We keep it as simple as we can.
In short
- Your weight, your food and your steps are health data. We only use them to make the app work for you, and only with your explicit consent.
- We don't sell your data and we don't show ads.
- Your data is stored on servers in the EU, at bootload.io. For a calorie estimate, your photo or description is sent through the bootload.io AI gateway to the GLM-5.2 AI model, without your name or e-mail address.
- A Nutritom coach can see your intake, your plan and your food diary to check your plan.
- If you get personal coaching, your coach also stores your body measurements (such as skinfold measurements) and any progress photos. You see your measurements in the app; only your coach sees your progress photos.
- You can always download or delete your data in the app.
1. Who is responsible
Nutritom.app is a partnership between two companies, each responsible for its own part:
- Devout BV, Begoniastraat 28, 9920 Lievegem, Belgium, enterprise number 0643.596.186, operates the app and provides the technology. Devout BV is the controller for the data in the app.
- NutriTom BV, Eglantier 34, 9920 Lievegem, Belgium, enterprise number 1012.205.193, provides the coaching and advice. NutriTom BV is the controller for what the coaches do: checking your plan and, with personal coaching, keeping your measurements, progress photos and notes.
Where this policy says "we", it means both companies, each for its own part. For all questions and requests about privacy, whichever company they concern: admin@devout.eu.
Data protection officer: admin@devout.eu
2. What data we process
| Type | Examples | Source |
|---|---|---|
| Account data | E-mail address, password (stored only in hashed form), or your Apple ID if you sign in with Apple; your language | You |
| Profile and intake | Goal, pace, age, sex, height, weight, units | You |
| Health and food | Food diary (descriptions, photos, estimated calories and nutrients, time), weight history, BMI, steps and activity, your nutrition plan and choices, notes about your energy and hunger | You, Apple Health (with your permission), calculations in the app |
| Coaching | The plan the app suggests, the coach's review and notes | The app and the coach |
| Body measurements (personal coaching only) | Skinfold measurements, body fat percentage, fat mass and lean mass, calculated energy needs, progress photos and your coach's notes on a measurement | Your coach, during an appointment |
| Subscription | Type of subscription, start and end date, store transaction number. We never see your card details: they stay with Apple or Google. | Apple, Google, the app |
| Technical data | Push notification token, app version, device type, error reports, server logs with IP address | Your device |
| Contact | Your messages if you e-mail us | You |
3. Health data and your consent
Data about your weight, your food, your activity and your body measurements, and progress photos, are health data. The GDPR gives it extra protection as a special category of personal data (Article 9). We only process it with your explicit consent. We ask for it with a separate box when you create your account, apart from the terms. If you sign up with Apple, or already had an account, we ask right after you sign in, before you enter any data. We keep a record of when you gave consent and for which version of this text.
You can withdraw that consent at any time, by deleting your account or by e-mailing us. Processing carried out until then remains lawful. Without this data, however, the app cannot work.
4. What we use your data for
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running your account and the app: budget, diary, weight, plans | Account, profile, health and food | Contract (Art. 6(1)(b)) and, for health data, explicit consent (Art. 9(2)(a)) |
| Estimating calories and creating recipes and tips with AI | Photo or description, meal, notes about your day | Contract and explicit consent |
| Having your nutrition plan checked by a coach | Intake, suggested plan, food diary | Contract and explicit consent |
| Personal coaching: recording your measurements, following your progress and showing them in the app | Body measurements, progress photos, food diary, weight | Contract and explicit consent |
| Reading steps from Apple Health | Steps | Consent (Art. 6(1)(a) and 9(2)(a)), which you also give in iOS |
| Sending reminders and notifications | Push token, your notification preferences | Consent (your device asks for it) |
| E-mails about your account, such as confirmation or a new password | E-mail address | Contract |
| Managing your subscription | Subscription data | Contract |
| Security, preventing misuse, fixing errors | Technical data and logs | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations | What is needed for that | Legal obligation (Art. 6(1)(c)) |
We don't use your data for advertising and we don't build marketing profiles. We only send news or tips by e-mail if you switch that on yourself. We also don't take decisions with legal effects that are made entirely automatically: the plan the app suggests is checked by a person.
5. Who else sees your data
Within Nutritom
Only people who need it for their work: at NutriTom BV, the coach who checks your plan or coaches you; at Devout BV, whoever provides technical support. Devout BV only gives NutriTom BV the data needed for the coaching. Everyone is bound by confidentiality.
Processors working for us
We have a data processing agreement with these parties. They may only use your data to provide their service to us.
| Party | What | Where |
|---|---|---|
| bootload.io | Hosting of the database, files (such as photos) and the website | EU ([LAND HOSTING]) |
| bootload.io (AI gateway), with the AI model GLM-5.2 | AI processing: calorie estimates from photos and descriptions, recipes and tips. We don't send your name or e-mail address. | [LAND AI-MODEL] |
| Mailgun | Sending e-mails about your account | EU servers; parent company in the United States, with standard contractual clauses |
| Expo (650 Industries) | Forwarding push notifications to Apple and Google | United States, with standard contractual clauses |
Independent parties
- Apple and Google distribute the app and process payments and subscriptions. Apple also provides Sign in with Apple and Apple Health. They do this under their own privacy policies.
- Open Food Facts: when you scan a barcode, we look up the product information using only the barcode number. No personal data is sent.
We don't sell your data. We only share it with authorities when the law requires us to.
6. Apple Health
On iPhone you can give the app access to your steps in Apple Health. You choose what you share and can withdraw it at any time in the iOS settings. We only use data from Apple Health to make the app work for you. We never use it for advertising and we don't sell it or share it with third parties for marketing.
7. How long we keep data
- As long as your account exists, we keep your account, profile and health data.
- If you delete your account, we immediately remove your data from our active systems. Backups are overwritten within [30 days].
- Accounts you haven't used for [24 months] are deleted after a warning by e-mail.
- Server logs are kept for at most [30 days].
- The bootload.io AI gateway and the AI model keep what we send [BEWAARTERMIJN AI].
- E-mails with us are kept until your question has been handled, and for at most [2 years].
- Data we are legally required to keep is kept for as long as the law requires.
8. Security
We protect your data with appropriate technical and organisational measures: encrypted connections (HTTPS), passwords stored only in hashed form, access rules so that each user only sees their own data, and limited access for staff. If a data breach does occur that puts you at risk, we will report it to the Belgian Data Protection Authority and, where required, to you.
9. Your rights
You have the right to:
- access your data and get a copy of it;
- have incorrect data corrected;
- have your data erased;
- have processing restricted;
- take your data with you in a common format (portability);
- object to processing based on our legitimate interest;
- withdraw your consent at any time.
Much of this you can do yourself in the app: download your data under Settings > Download Personal Data, and erase everything under Settings > Erase Data and Account. For anything else, e-mail admin@devout.eu. We reply within one month and may ask you to confirm who you are.
10. Making a complaint
If you are not happy with how we handle your data, please tell us first. You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be, or with the supervisory authority in the EU country where you live.
11. Minors
The app is intended for adults aged 18 and over. If we find that an account belongs to a minor, we delete it.
12. The nutritom.app website
The website sets no cookies, uses no analytics tools and loads nothing from third parties, not even fonts. Our web server does keep technical logs (IP address, time, requested page and browser) to keep the site secure. We keep these for at most [30 days]. More in the cookie statement.
13. Changes
We update this policy when the app or the law changes. We announce important changes in the app or by e-mail. The date at the top shows the version in force.