Privacy Policy

Last updated: September 20, 2026

NutriOrbit (“NutriOrbit”, “we”, “us”) operates a practice-management platform for dietitians and nutrition professionals. This policy explains what personal data and health data we handle, why, who we share it with, and the rights available to you under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Who this policy covers

NutriOrbit has two categories of people whose data we process, on different bases:

• Dietitians — professionals who create an account, subscribe to NutriOrbit, and use it to manage their practice. Dietitians control their own account data directly.
• Clients — a dietitian’s patients. Clients create their own free account, log their own health, lifestyle, and lab data, and grant their own consent for how it’s processed. Their linked dietitian can view that data to guide their care. A client can also reach NutriOrbit directly over WhatsApp for specific self-service features described below, before or without ever creating a full account.

2. What we collect

From dietitians: name, email, phone number, professional details (qualifications, specialization), and billing/subscription information processed by our payment provider.

About clients, entered by the client themselves: name, contact details, date of birth, gender, height, weight, medical history, current medication, allergies, lab report results, lifestyle information (diet, activity, sleep, smoking/alcohol use), meal plans assigned by their dietitian, and appointment records. This is health data under the DPDP Act and is encrypted at rest.

Via WhatsApp, when a client messages NutriOrbit directly: phone number, message content, and any file (such as a lab report PDF) sent to us, only for the specific purpose the client initiated — for example logging a weight, viewing a meal plan, asking to be connected with a dietitian, or completing a short health questionnaire. A client who has not yet been matched to a dietitian can only use WhatsApp to request one; every other feature requires an existing dietitian relationship.

3. How we use this data

• To provide the core service: meal planning, health and lab tracking, appointment scheduling, and the WhatsApp features described above.
• To read a client-submitted blood report and return a summary. Before any report content is sent to an external AI provider for this, we strip identifying details (name, date of birth, address, phone number, patient/record IDs) from it on our own servers — the AI provider only ever receives de-identified clinical text.
• To bill dietitians for their subscription and send account-related communications.
• To maintain security, an audit trail of who accessed or changed a record, and to meet our legal obligations.

We do not use client health data for advertising, and we do not sell personal data or health data to any third party.

4. Who we share data with

We share data only with the service providers necessary to run NutriOrbit, each acting under their own terms as a data processor on our instructions:

• Meta / WhatsApp Business Platform — to send and receive WhatsApp messages. A client’s phone number and the content of messages exchanged with our WhatsApp number necessarily pass through Meta’s infrastructure as part of how WhatsApp delivery works.
• Our AI provider — only de-identified blood report text (see Section 3), to extract structured lab values.
• Payment processor — to process a dietitian’s subscription payment. We do not store card details ourselves.
• Email delivery provider — to send transactional emails (invoices, account notifications).
• Cloud infrastructure provider — to host the application and database, in India.

We may also disclose data if required by law or a valid legal process.

5. Data security

Health data fields are encrypted at rest. A client’s data is accessible to the client themselves and their linked dietitian; every create, update, and delete on sensitive records is written to an audit log. WhatsApp webhook traffic is cryptographically signature-verified before we process it.

6. Consent and your rights (DPDP Act)

A client grants their own consent from inside their account before we process their health data, and can withdraw it at any time from the same place. A client’s WhatsApp interactions with NutriOrbit (for the specific features above) constitute their own direct consent to that limited processing, ahead of creating a full account.

Under the DPDP Act, a data principal (dietitian or client) has the right to:

• Request a summary of what personal data we hold about them;
• Request correction or completion of inaccurate or incomplete data;
• Request erasure of their data, unless we’re required to retain it by law;
• Withdraw consent for a specific processing purpose at any time;
• Raise a grievance with us, and escalate to the Data Protection Board of India if unresolved.

A client can exercise these rights directly from their account’s Privacy settings, or contact us directly. We retain data only for as long as needed for the purpose it was collected, or as required by applicable law.

7. Children’s data

NutriOrbit is intended for use by adult dietitians managing their practice. Where a client is a minor, their account is operated and their consent given by a parent or lawful guardian, consistent with the DPDP Act’s requirements for processing a child’s personal data.

8. Changes to this policy

We may update this policy as the product changes. Material changes will be reflected by updating the date at the top of this page.

9. Contact us

For any privacy question, data request, or grievance, contact us at himanshu@siyatechsolutions.in.