Last updated: August 15, 2026
This Privacy Policy explains what personal data the NutriLab.ge platform collects, why, how it is protected, and what rights you have as a data subject. The data controller is შ.პ.ს ვებსფეის.
Our Platform processes health-related data (a special category of data) because it is necessary to build a personalized and safe nutrition/workout plan. For this reason, we have given particular care to this policy.
Account data: name, email, phone number, password (hashed).
Survey data: sex, age, height, current and target weight, body fat percentage (optional), activity level, goal, allergies, dietary preferences, disliked ingredients, physical limitations.
Special health data: pregnancy/breastfeeding status, history of eating disorders, cardiovascular conditions, uncontrolled hypertension, acute injury, diabetes, as well as free-text medical notes, if you choose to provide them.
Workout preferences: fitness level, available equipment, preferred session length.
Payment data: the name and email required to prepare an invoice. We do not store card data or full bank account details — payment is made directly via bank transfer.
Technical data: IP address, browser type, and page usage statistics (see Section 5, Google Tag Manager).
Survey and health data are used to generate a personalized nutrition and workout plan, and for safety screening — the system checks factors such as age, pregnancy, history of eating disorders, and cardiovascular conditions to avoid unsuitable or unsafe recommendations. Some answers automatically block plan generation; others require manual review by a dietitian.
Account data is used for authentication, communication (for example, notices about subscription activation or expiry), and support.
Payment data is used to prepare invoices and to manually activate subscriptions.
Free-text medical notes are stored in the database in encrypted form (application-level encryption) — they cannot be searched or filtered directly; decryption occurs only when a specific record is retrieved. Administrative medical alert notes are encrypted on the same principle.
Only limited, authorized personnel (the administrator role) may view decrypted health data, for the purpose of dietitian review.
We never sell health data and never share it with advertisers.
Artificial intelligence (Anthropic API / Claude): we use Anthropic's API to prioritize ingredients within the weekly menu and to clarify preferences in the menu chat. In this process, Anthropic receives only your stated allergies, disliked ingredients, and goal (or your chat text) — we never send free-text medical notes or diagnosed-condition flags (pregnancy, cardiac condition, etc.). Anthropic acts as an independent data processor under its own terms.
Email delivery: emails related to your account, subscription, and notifications are sent via our SMTP provider.
Hosting and infrastructure: data is stored on servers provided by our hosting provider.
We do not sell or rent your personal data to third parties for marketing purposes.
The Platform uses Google Tag Manager (GTM), which collects anonymized statistical information about page views, button clicks, and subscription purchase events — including the subscription amount and currency. This information is used to improve the product and evaluate marketing effectiveness.
GTM can be disabled by our administrators at any time. You can block cookies or tracking scripts in your browser settings — this will not restrict your ability to use the Platform's core functionality (plan generation, your account).
We retain account and survey data for as long as your account is active. After a deletion request, we delete personal and health data within a reasonable period, except where retention is required by law (for example, accounting or tax records).
Under Georgian law, you have the right to: request a copy of the data we process about you; request correction of inaccurate data; request deletion of your data; object to processing; and withdraw any consent previously given (for example, at the time you completed the Survey).
To exercise these rights, contact us at the email address listed on the Platform. You also have the right to lodge a complaint with the Personal Data Protection Service of Georgia.
The Platform is intended only for individuals 18 years of age or older and does not knowingly collect data about minors. If you become aware that a minor has managed to create an account, please contact us.
We may update this Privacy Policy from time to time. In the event of material changes, we will notify you on the Platform or by email.
For privacy-related questions, please contact us at the email address listed on the Platform.