سياسة الخصوصية

1. Introduction

Vita Sustena (hereinafter "Vita Sustena", "we", "us", or "our") respects the privacy of its users and is committed to protecting the personal data collected through the Vita Sustena website (vitasustena.com), the Vita Sustena mobile app for Android, and related services (together, the "service").

This policy applies to both the website and the mobile app. Where something applies only to one of them, we say so explicitly.

This Privacy Policy explains how we collect, use, store, and protect your personal data, in accordance with Regulation (EU) 2016/679 (GDPR).

2. Data controller

Vita Sustena is operated by Lucian George Necula, a natural person (individual), who is the data controller for the personal data processed through the website and the mobile app.

• Contact email: [email protected]

3. Personal data we collect

3.1 Data you provide directly

When you create an account and complete the onboarding questionnaire, we collect:

• Identification data: name (pseudonym) and email address
• Demographic data: age, sex
• Body measurements: height, current weight, target weight
• Lifestyle data: physical activity level, number of meals per day
• Food preferences: preferred cuisines, foods you do not eat
• Health-related data (special category): food allergies, intolerances
• Health-related data (special category), optional: medical / laboratory analyses you choose to upload (PDF files or photos). You must anonymize them before uploading, and every file is automatically checked for personal identifiers (see section 4). Accepted files contain no identity data, are associated only with your account, and are stored on our server until you delete them or your account is deleted

3.2 Data collected automatically

When you use the site or the app, we automatically collect:

• IP address (anonymized)
• Browser type and operating system
• Pages visited and time spent on the site
• Referral source (referer)
• Device identifiers (cookies, local storage)

In the mobile app, your sign-in session is stored securely on your device. The app does not use an advertising ID and does not include advertising or third-party analytics SDKs.

3.3 Data generated by using the service

• Menus generated for you
• History of changes and regenerations
• Food, meal and ingredient photos, and voice recordings you submit (for recipe suggestions, ingredient recognition and meal analysis). These are processed in memory, sent to OpenAI for analysis, and are not stored on our servers; only the result (for example, the recognised ingredients) is saved to your account
• Medical / laboratory analysis files you upload for meal planning, after you have anonymized them and they have passed the automatic check for personal identifiers (accepted files are stored on our server, see sections 4 and 7)
• Usage metrics (when you sign in, which features you use)

3.4 Mobile app permissions

The Android app asks for the following permissions only when you use the feature that needs them. You can refuse or revoke them at any time from your device settings; the rest of the app keeps working.

• Camera: to photograph food, meals and ingredients, or a medical analysis you want to upload
• Microphone: to dictate ingredients or requests by voice
• Photos and files: to choose an existing image or PDF (for example, a laboratory analysis) from your device

3.5 Payment data

If you buy a subscription, the payment is processed by Creem (on the website) or by Google Play Billing (in the Android app installed from Google Play). We do not receive or store your full card details. We receive only what is needed to manage your subscription: subscription status and period, the purchase or subscription identifiers (for example, the Google Play purchase token or the Creem customer and subscription ID) and the email address associated with the purchase.

4. Special category data and explicit consent

Data about food allergies and intolerances is special category data under GDPR Article 9. It is processed only with your explicit consent, given by ticking the dedicated checkbox during onboarding.

Medical / laboratory analyses are also health data. Uploading them is optional: you choose whether to upload them, and they are used only to personalise your meal plan.

Before uploading, you must anonymize every file: remove or cover your name, national ID number (CNP), ID card or passport series and number, home address, phone number, email address, patient file number, and any other details that could identify you. You confirm this when you upload.

Every uploaded file is automatically checked by AI (using OpenAI, see section 6) for personal identifiers as part of the upload, before anything is saved. If any are found, the upload is rejected and the file is never saved on our server and is not used for your meal plan. If the check cannot be performed (for example, the AI service is unavailable), the file is also not saved and you can try again later. This automatic check is a safeguard and may not detect every identifier, so it does not replace your own anonymization.

Accepted analyses contain no identity data and are associated only with your account. Because they remain linked to your account, they are pseudonymized (not anonymous) data, and we continue to treat them as health data protected under GDPR Article 9. You can delete them at any time from your nutritional plan, and they are deleted together with your account.

You may withdraw this consent at any time from your account settings or by emailing [email protected].

• [email protected]

5. Purposes of processing

We use your data for:

6. Who we share data with

We do not sell or rent your personal data. We share it only with the following processors, strictly to operate the service:

Processors we use

For payments, Creem and Google also process your payment details under their own privacy policies; we only receive the subscription information described in section 3.5.

All processors are contractually required to comply with the GDPR and to process data only on our instructions.

Transfers outside the EU

To use OpenAI and Google services, some data may be transferred to the United States. Transfers are based on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• the EU–US Data Privacy Framework (DPF)

Data sent to OpenAI is limited to what a feature needs: nutrition profile (age, weight, goal, preferences, allergies), recipe and meal photos, voice recordings, and anonymized laboratory files you upload. Menus, translations, photos, lab files, and voice recordings are processed by OpenAI. Each uploaded lab file (for PDF files, the whole document) is first sent to OpenAI for the automatic check for personal identifiers described in section 4; the name of your file is not sent and is not stored (accepted files are saved under a generic name). Accepted files are then used to personalise your meal plan. Photos and voice recordings are processed in memory and are not stored on our servers. We do not send your email address to OpenAI.

7. How long we keep data

8. Your rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — you can obtain a copy of the data we hold about you
• Right to rectification (Art. 16) — you can correct inaccurate data
• Right to erasure / “to be forgotten” (Art. 17) — you can request complete deletion
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20) — export in JSON/CSV format
• Right to object (Art. 21) — you can object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

How to exercise your rights

Send a request to [email protected] with the subject “GDPR request”. We will respond within 30 days (this may be extended by a further 60 days for complex requests, with notice).

• Send a GDPR request

Many rights can be exercised directly from your account settings:

• View data: User data
• Edit data: Nutritional plan
• Delete account: User data → Delete account on the website, or Delete account in the mobile app (kept for 30 days, then deleted automatically)

You can also find instructions and request account deletion at vitasustena.com/delete-account.

• vitasustena.com/delete-account

If you believe your rights have been infringed, you may lodge a complaint with a data protection supervisory authority in the EU. The European Data Protection Board publishes the list of EU supervisory authorities and guidance on how to complain.

• European Data Protection Board (EDPB)

9. Data security

We implement technical and organisational measures to protect data:

• Encrypted HTTPS connection (TLS 1.3) across the site and between the app and our servers
• Passwords stored hashed (we do not store passwords in plain text)
• Restricted access to data (authorised personnel only)
• Encrypted automated backups
• Continuous monitoring for security incidents
• Strict internal access and confidentiality policies

If a security breach may affect you, we will notify you within 48 hours, in line with GDPR Articles 33 and 34.

10. Cookies

The site uses cookies. Full details are in the Cookie Policy.

سياسة ملفات تعريف الارتباط

11. Minors

Vita Sustena is NOT intended for people under 16. We do not knowingly collect data from minors under 16. If you become aware that a minor has provided data, contact us for immediate deletion.

12. Changes to this policy

We may update this policy to reflect legal or operational changes. The current version will always be available on this page. Material changes will be notified by email at least 30 days in advance.

13. Contact

For any questions about data processing:

• Email: [email protected]