My Diet Plan · data protection
Privacy policy
Version 2026-07-18. This policy covers personal and health-related data processed by My Diet Plan as a self-tracking tool, separate from clinical care.
1. Data controller
The controller for data collected through My Diet Plan is Daniele Gabrovec, Italian VAT number 02957880301, acting as the software provider. To exercise your rights or ask about your data, email info@nutrizionistagabrovec.it or use Support in your account, where the message history is retained.
2. What My Diet Plan is and how it differs from clinical care
My Diet Plan is personal software for organizing nutrition, training, logs, measurements and progress. This policy covers the app as a self-tracking tool chosen and managed by the user. It is separate from any clinical nutrition care provided by Dr Gabrovec: data in My Diet Plan is not processed for clinical assessment or care, and the professional does not access it in that capacity.
3. Data we process
Account and contact data: email, name, login credentials, language and preferences. App data: body measurements, circumferences, skinfolds and body composition, food and training logs including loads, repetitions and perceived exertion, goals and personal notes. Billing data: legal name, address, tax identifier and VAT number where applicable. Technical data: IP address and session information for security. We do not require advertising profiling and do not sell your data.
4. Purposes and legal bases
We process data to provide and synchronize the service between your devices under performance of the contract (GDPR Art. 6(1)(b)); manage payments, subscriptions and tax documents under contract and legal obligation (Arts. 6(1)(b) and (c)); maintain security, prevent abuse and ensure continuity under legitimate interests (Art. 6(1)(f)); and answer support requests. Health-related data is covered below.
5. Health-related data
Measurements, skinfolds, body composition and logs may be special-category health data under GDPR Art. 9. We process them solely to let you self-track progress in the app, based on your explicit consent (Art. 9(2)(a)) when you choose to enter them. You may choose not to enter them, edit them or delete them at any time. Withdrawal of consent does not affect processing that was lawful before withdrawal.
6. Service providers and processors
We use processors including Supabase for database, authentication and app storage; Vercel for hosting and delivery; Stripe for payment processing; and Resend for transactional emails and receipts. These providers may involve transfers outside the EEA under safeguards required by GDPR Arts. 44 and following. An updated processor list is available through Support.
7. Data retention
Account data and app content are retained while your account is active. When you delete the account, data is deleted or anonymized except where retention is legally required. Tax and accounting documents are generally retained for ten years under applicable Italian law. Technical and security records are kept only as long as necessary for their purpose.
8. Your rights
You may access, correct, erase, restrict or object to processing of your data and request portability under GDPR Arts. 15–22. You can export your data and request account deletion from your account or through Support. Where processing relies on consent, you may withdraw it at any time. You may also complain to the Italian Data Protection Authority or your competent supervisory authority.
9. Security
We use appropriate technical and organizational safeguards, including row-level database access controls, role separation and encrypted transport. No system is absolutely secure: protect your credentials and report suspected account access promptly through Support.
10. Children
My Diet Plan is intended for adults. We do not knowingly collect children’s data. If you believe a child has provided data without authorization, contact Support so it can be removed.
11. Changes to this policy
We may update this policy for changes to the service or law. Updated versions appear on this page with their date, and material changes receive appropriate notice.
This page describes actual data processing and is not individual legal advice. Mandatory applicable law prevails in case of conflict.