Privacy Policy

Last updated: August 27, 2026

NutriOrbit (“NutriOrbit”, “we”, “us”) operates a practice-management platform for dietitians and nutrition professionals. This policy explains what personal data and health data we handle, why, who we share it with, and the rights available to you under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Who this policy covers

NutriOrbit has two categories of people whose data we process, on different bases:

• Dietitians — professionals who create an account, subscribe to NutriOrbit, and use it to manage their practice. Dietitians control their own account data directly.
• Clients — a dietitian’s patients. Clients do not have their own login or account. All client data is entered and managed by their dietitian, who is responsible for obtaining the client’s consent before adding their information to NutriOrbit. A client can also reach NutriOrbit directly over WhatsApp for specific self-service features described below, without ever creating an account.

2. What we collect

From dietitians: name, email, phone number, professional details (qualifications, specialization), and billing/subscription information processed by our payment provider.

About clients, entered by their dietitian: name, contact details, date of birth, gender, height, weight, medical history, current medication, allergies, lab report results, lifestyle information (diet, activity, sleep, smoking/alcohol use), meal plans, and appointment records. This is health data under the DPDP Act and is encrypted at rest.

Via WhatsApp, when a client messages NutriOrbit directly: phone number, message content, and any file (such as a lab report PDF) sent to us, only for the specific purpose the client initiated — for example logging a weight, viewing a meal plan, asking to be connected with a dietitian, or completing a short health questionnaire. A client who has not yet been matched to a dietitian can only use WhatsApp to request one; every other feature requires an existing dietitian relationship.

3. How we use this data

• To provide the core service: meal planning, health and lab tracking, appointment scheduling, and the WhatsApp features described above.
• To read a client-submitted blood report and return a summary. Before any report content is sent to an external AI provider for this, we strip identifying details (name, date of birth, address, phone number, patient/record IDs) from it on our own servers — the AI provider only ever receives de-identified clinical text.
• To bill dietitians for their subscription and send account-related communications.
• To maintain security, an audit trail of who accessed or changed a record, and to meet our legal obligations.

We do not use client health data for advertising, and we do not sell personal data or health data to any third party.

4. Who we share data with

We share data only with the service providers necessary to run NutriOrbit, each acting under their own terms as a data processor on our instructions:

• Meta / WhatsApp Business Platform — to send and receive WhatsApp messages. A client’s phone number and the content of messages exchanged with our WhatsApp number necessarily pass through Meta’s infrastructure as part of how WhatsApp delivery works.
• Our AI provider — only de-identified blood report text (see Section 3), to extract structured lab values.
• Payment processor — to process a dietitian’s subscription payment. We do not store card details ourselves.
• Email delivery provider — to send transactional emails (invoices, account notifications).
• Cloud infrastructure provider — to host the application and database, in India.

We may also disclose data if required by law or a valid legal process.

5. Data security

Health data fields are encrypted at rest. Access to a client’s data is restricted to their own dietitian; every create, update, and delete on sensitive records is written to an audit log. WhatsApp webhook traffic is cryptographically signature-verified before we process it.

6. Consent and your rights (DPDP Act)

Because a client does not have their own login, they cannot grant consent themselves inside the product — their dietitian is responsible for obtaining the client’s consent before entering their data, and attests to that consent on the client’s behalf, recorded against their record. A client’s WhatsApp interactions with NutriOrbit (for the specific features above) constitute their own direct consent to that limited processing.

Under the DPDP Act, a data principal (dietitian or client) has the right to:

• Request a summary of what personal data we hold about them;
• Request correction or completion of inaccurate or incomplete data;
• Request erasure of their data, unless we’re required to retain it by law;
• Withdraw consent for a specific processing purpose at any time;
• Raise a grievance with us, and escalate to the Data Protection Board of India if unresolved.

A client should route any such request through their dietitian, or contact us directly and we will coordinate with the relevant dietitian. We retain data only for as long as needed for the purpose it was collected, or as required by applicable law.

7. Children’s data

NutriOrbit is intended for use by adult dietitians managing their practice. Where a client is a minor, their data is entered and consented to by their dietitian in coordination with a parent or lawful guardian, consistent with the DPDP Act’s requirements for processing a child’s personal data.

8. Changes to this policy

We may update this policy as the product changes. Material changes will be reflected by updating the date at the top of this page.

9. Contact us

For any privacy question, data request, or grievance, contact us at himanshu@siyatechsolutions.in.