Privacy Policy

NutriConsulte is a digital nutrition practice that connects people with qualified dietitians. This policy explains what personal data we collect when you use the platform, why we hold it, and what you can ask us to do with it.

The platform is operated by KRYON KNOWLEDGEWORKS, with its registered office at Ground Floor, 25 Kaveri Street, Ram Nagar, Ambattur, Chennai, Tamil Nadu 600053. Under India's Digital Personal Data Protection Act, 2023, that entity is the Data Fiduciary for your personal data and you are the Data Principal.

This policy covers the NutriConsulte website and the customer, consultant and administrator areas of the application. It does not cover anything a consultant does outside the platform.

We collect only what the service needs in order to work.

We use your personal data for these purposes and no others:

• · To let you find a consultant, book a consultation and attend it.
• · To give your consultant the clinical context they need to advise you safely.
• · To show you your own records, diet plans and prescriptions.
• · To sign you in and keep your account secure.
• · To send you transactional messages about your bookings — not marketing.
• · To verify that consultants are who and what they claim to be.
• · To keep an audit trail for safety, accountability and dispute resolution.

We do not sell your personal data, and we do not use your health information for advertising or profiling.

We process your data on the consent you give when you create an account and when you enter health information. That consent is limited to the purposes listed in section 3.

You can withdraw it at any time by contacting us at section 12. Withdrawing is as easy as giving it. If you withdraw consent for us to hold your health information, we will stop processing it and delete it subject to section 7 — but we will not be able to offer you consultations, because a consultant cannot advise safely without it.

Access is deliberately narrow:

• · You — everything we hold about you.
• · Consultants you have actually booked with — a consultant can see the records of their own customers only. They cannot browse or search customers who have not booked with them. This boundary is enforced by the application and covered by our automated tests.
• · Platform administrators — for support, verification and safety investigations.

We do not share your health information with insurers, employers, advertisers or data brokers. We will disclose personal data to a public authority only where the law requires it.

The complete list of outside services involved in running this platform:

• · Google Fonts — our pages load typefaces from Google's servers, which means loading a page discloses your IP address and browser to Google. No account or health data is shared.
• · Email delivery — transactional email about your bookings is sent through ZeptoMail (Zoho). This carries your email address and the content of the message.
• · Hosting — the application and database run on Microsoft Azure, in Indian regions only.

There are no analytics, advertising, session-recording or tracking services on this site.

Your account details are kept for as long as your account is open.

Consultation records are kept for 60 days. That covers the notes from a visit, prescriptions and diet plans issued to you, and reports you uploaded. Sixty days after a consultation, its records are deleted.

Download anything you want to keep. You can export your record at any time from your account, and we would encourage you to do so — once a consultation passes 60 days we cannot recover it for you, and neither can your consultant.

If you close your account or ask us to erase your data, we delete it within 60 days of the request. Audit trail entries are also kept for 60 days.

• · Passwords are stored only as bcrypt hashes, never as text we can read.
• · Signing in issues a short-lived access token rather than a long-lived session. We do not use cookies to authenticate you — your token is held in your browser's local storage and is discarded when you sign out.
• · Every request for customer data is checked against the account making it, so customer records are reachable only by that customer, their own consultant, or an administrator.
• · Uploaded reports are never served from a public URL; each download is authorised individually.
• · Administrator and consultant areas are separately role-gated and excluded from search engines.
• · Traffic to the site is served over HTTPS in production.

No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board of India as the DPDP Act requires.

Under the Digital Personal Data Protection Act, 2023 you may:

• · Access — obtain a summary of the personal data we hold about you and what we do with it.
• · Correct — have inaccurate or incomplete data corrected, completed or updated.
• · Erase — have your personal data deleted where we no longer need it for the purpose you gave it for.
• · Withdraw consent — at any time, as described in section 4.
• · Nominate — name another person to exercise these rights on your behalf if you die or become incapacitated.
• · Complain — raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied with our answer.

Much of this you can do yourself from your account. For anything else, write to the Grievance Officer in section 12; we will respond within 30 days.

Pediatric nutrition is one of the specialties offered on this platform, so we expect to hold data about children. An account for a person under 18 must be created and managed by a parent or legal guardian, who gives consent on the child's behalf. We do not knowingly let a child create their own account.

As the DPDP Act requires, we do not use children's personal data for tracking, behavioural monitoring or targeted advertising, and we do not process it in any way likely to harm a child's wellbeing.

If we change this policy we will update the date at the top of the page. Where a change materially affects how we use your data, we will tell you directly and, where the law requires it, ask for your consent again rather than assume it.

The DPDP Act requires us to publish a Grievance Officer for questions about your data and complaints about how we handle it.