Privacy policy

2. Who is responsible for which data

FitMeni is used by nutritionists and other professionals to work with clients, and by individuals tracking their own nutrition. That decides who the data controller is:

• Your account data (name, email, organization, settings): FitMeni is the controller.
• Client data entered by a professional (profile, measurements, health data, meal plans): the professional, or their organization, is the controller. FitMeni processes this data only on their instructions, as a processor, and uses it for nothing else.
• If you use FitMeni for yourself and enter your own health data: FitMeni is the controller, and we process that data based on your explicit consent.

3. What data we process

Account data

First and last name, email address, password (stored only as a salted hash; we never see it), organization name, chosen language, team roles and permissions, account creation date.

Client data

What a professional enters: name, contact details (email, phone), gender, year of birth, occupation, notes, measurements (weight, height, circumferences), goals, diagnoses, allergies and dietary restrictions, preferred foods, lifestyle and physical activity, eating habits, special conditions, nutrition targets and meal plans.

Content you create

Recipes, food items, meal plan templates and recipes you share with the community. Other users see a shared recipe, but never your clients or any other data.

AI assistant (Premium)

Messages you write to the assistant, its replies, conversation history and AI point usage. To do a task, the assistant may read data from your organization that the task needs, for example the profile of the client it is building a plan for.

Technical data

When you visit the site, the server logs your IP address, the time of the request, the page address and browser details. We use these records only for security, debugging and preventing abuse.

4. Why we process data and on what basis

We do not sell data, use it for advertising or build marketing profiles. We make no automated decisions that have legal effects on you.

5. Who else processes data

We store and process data ourselves. For infrastructure we use the following processors, under contracts that bind them to confidentiality and data protection:

When you use the AI assistant, your message and the data the task needs are sent to Anthropic for processing. Under its commercial API terms, Anthropic does not use this data to train models. The transfer to the USA is covered by appropriate safeguards, a data processing agreement with standard contractual clauses. If you don’t use the AI assistant, no data leaves the EU.

We disclose data to public authorities only when the law requires us to.

6. How long we keep data

• Account data and content: for as long as the account exists.
• Client data: until the professional deletes it or the account is deleted.
• When you ask us to delete your account, we delete it and the related data within 30 days, except data the law requires us to keep.
• Technical logs: only as long as needed for security and debugging, after which they are deleted.
• Backups are overwritten by newer ones; deleted data disappears from them when the backup’s retention period ends.

7. Your rights

For data where FitMeni is the controller, you have the right to:

• know what data we process about you and get a copy,
• correct inaccurate data or complete incomplete data,
• ask us to delete your data,
• ask us to restrict processing,
• receive your data in a structured, machine-readable format (portability),
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting earlier processing.

Send your request to contact@fitmeni.com. We may ask you to confirm your identity first, for example by writing from the email address linked to your account.

If you believe the processing is unlawful, you can complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, Belgrade (www.poverenik.rs). Users in the EU can also contact the supervisory authority in their country.

8. How we protect data

• All traffic uses an encrypted connection (HTTPS).
• Passwords are stored only as hashes.
• Each organization’s data is separated at the database level, so one organization cannot see another’s data.
• Inside an organization, access follows roles and permissions set by the administrator.
• Servers are in the EU, with a provider operating certified data centres.

If a personal data breach happens, we will notify affected users and, where the law requires it, the Commissioner, without undue delay.

9. Cookies and local storage

We only use cookies and browser storage that the application needs to work:

• cookies of the sign-in system (Keycloak), which keep your session,
• local storage for your chosen language, organization and display theme.

We use no advertising cookies and no third-party tracking cookies. We currently use no analytics either. If we add it, it will be a cookie-less solution that doesn’t track people across sites, and we will say so here.

10. Minors

People under 15 may use FitMeni only with the consent of a parent or guardian. If we learn that we collected a child’s data without such consent, we will delete it.

11. Changes to this policy

We may change this policy when the service or the law changes. The date of the last change is at the top of the page. We will tell you about important changes by email or in the app before they take effect.