NutriCoach Privacy Policy and Consents

Version dated August 26, 2026.

1. Controller

NutriCoach is operated by Individual Entrepreneur ARKADII FATIKHOV, registered in Georgia on June 19, 2026, identification number 300474500.

Legal address: Georgia, Tbilisi, Nadzaladevi district, Davit Guramishvili avenue, N23a, entrance 2, floor 4, apartment N96, block "A".

Support and privacy contact: arkadui74@gmail.com.

2. Scope

The service is intended for users aged 18 or older in Russia. This Policy applies to clients, independent specialists, and platform administrators.

3. Data processed

NutriCoach may process:

• name, email, profile details, and age confirmation;
• specialist profile and professional information;
• questionnaires, symptoms, history, and wellbeing information;
• laboratory files and recognized values;
• meal photographs, comments, and journal entries;
• nutrition, movement, stress, hydration, and nutraceutical records;
• body measurements, recommendations, and completion history;
• appointments, messages, and notifications;
• purchases, subscriptions, accruals, and payouts;
• device push token, IP address, and security events.

Health information is sensitive and is used only for user-selected support functions.

4. Purposes

Data is used for account registration and security, communication with an assigned specialist, recommendations and tracking, appointment booking, file recognition, AI drafts for specialist review, payments, support, and abuse prevention.

Health data is not used for advertising, advertising profiles, or sale to third parties.

5. Legal basis and consents

Acceptance of the Terms, personal data processing, and client health data processing are requested separately during registration. AI processing and marketing consent are optional.

The backend records the user identifier, document version, and acceptance date and time. Email verification links registration to the supplied address.

6. Access and recipients

Clients can access their own data. Independent specialists can access assigned clients only. Administrators receive access required for support, security, and platform management.

NutriCoach uses Yandex Cloud infrastructure, including PostgreSQL, Object Storage, Cloud Functions, OCR, YandexGPT, and Postbox. Apple processes data related to iOS distribution, notifications, and purchases under Apple's terms.

When explicitly connected by the user, Aura may access Google Calendar only to create, update, and delete consultation events. Aura sends the consultation time, duration, and a neutral event title; questionnaires, laboratory results, symptoms, and other health data are not sent to Google Calendar. The connection token is stored encrypted. Users can disconnect Google Calendar in Aura and revoke access in their Google Account settings.

7. AI processing

With separate consent, AI may recognize documents and photographs, compare questionnaire and laboratory information, and generate a draft report. Drafts are intended for specialist review, may be inaccurate, and are not diagnoses. Clients receive only recommendations reviewed and published by a specialist.

8. Retention

Active account data is retained while needed for the service. After a client is marked as having completed support, working and health data is retained for no more than one year unless a longer period is legally required.

Technical retention:

• unverified registration - 7 days;
• expired codes and revoked tokens - 7 days;
• read notifications and stale push tokens - 180 days;
• security events - 365 days.

Deleted information may remain in a protected backup until that backup expires and is not used in ordinary service operations.

9. User rights

Users may request access, correction, or restriction, withdraw optional consent, unsubscribe from marketing, and delete their account in the app. Requests are accepted at arkadui74@gmail.com.

Account deletion removes associated data unless retention is required by law. App Store subscriptions must be cancelled separately in Apple ID settings.

10. Security

NutriCoach uses role-based access, password hashing, sign-in rate limits, security logging, protected cloud secrets, and Object Storage deletion. Users are responsible for protecting their password.

11. Marketing and referral links

Marketing is sent only with separate consent. Unsubscribing does not restrict core functions. Specialists may publish clearly disclosed referral links. Compensation must not compromise recommendation safety or justification.

12. Changes

Material changes to purposes, data categories, or recipients require a new document version and renewed acceptance.

Separate consents

Personal data

The user authorizes collection, recording, organization, storage, correction, use, role-based disclosure, anonymization, and deletion for the purposes stated in this Policy.

Health data

The client voluntarily authorizes processing of questionnaires, symptoms, history, laboratory information, nutrition, movement, stress, hydration, nutraceuticals, and measurements for support by an assigned specialist. The service does not provide medical diagnosis.

AI

The client separately authorizes automated recognition and preparation of AI drafts for specialist review. Refusal does not prevent manual specialist work.

Marketing

The user separately authorizes news and offers by email or notification and may withdraw that consent at any time.