Ready to try it?

Built in the open

A small team, on purpose

About NutraPlanner

Why we built this

The HARD/SOFT filter engine lets you express real nutrient constraints and food-group rules — not just diet tags — so recipes match what a client actually needs.

Encode the clinical detail

Deliver plans under your own brand as a shareable web link or printable PDF, with grocery lists generated automatically.

Branded, client-ready plans

No insurance-billing bloat — just the meal-planning and client tools a cash-pay RD actually uses, priced for a solo practice.

Built for cash-pay practice

Plan your next client in NutraPlanner

Clinically precise meal planning, without the multi-app stack

Frequently asked questions

Setting up the practice itself

Set nutrient and food-group rules for your own diet, and find recipes that fit them automatically.

Filter to your needs

Assemble a week of meals and get a consolidated grocery list so shopping is one trip, not a scramble.

Plan and shop

Personal use will be free — join the waitlist and we'll email you the moment it's ready.

Free when it opens

Start planning your meals

Plan your own meals around what your body needs

Build plans from the recipes you already use and deliver them under your own brand as a web link or PDF.

Your recipes, your brand

Match recipes to each client's preferences and restrictions with the dietary-filter engine — no spreadsheets.

Filtering that fits each client

Share a booking link so clients can self-schedule, synced to your calendar — no separate scheduling tool.

Scheduling built in

Build your first plan today

Branded meal plans your clients will actually follow

Ready to get started?

Send feedback

Get in touch

Follow along

Contact Us

1. What are cookies?

a secure, HTTP-only session cookie that keeps you signed in. This is a JWT-based token that expires after 24 hours. Without it, you would need to log in on every page.

when you book an appointment, your name and email are held briefly in your browser's sessionStorage so the confirmation screen can show them without putting them in the page address. This is cleared when you close the tab, and it is never sent anywhere other than the booking request you submitted. We use sessionStorage here specifically so these details do not end up in a URL that could be logged or shared.

stores the redirect URL during sign-in so you return to the correct page after authentication. HTTP-only, short-lived.

prevents cross-site request forgery attacks on authentication forms.

stores your chosen language (English or French) so the site loads in the correct language on each visit.

part of the PKCE OAuth security flow used during Google sign-in. HTTP-only, expires after 15 minutes.

we store your sidebar collapse state in browser localStorage (not a cookie), but mention it here for transparency.

Sentry is currently DISABLED and receives nothing from this service. If we enable it, it would store a per-session identifier in your browser to group errors from the same browser session, and record a short trail of recent user-interface interactions (route changes, button clicks — never form values) that immediately precede an error, to help us reproduce and fix bugs. Session replay would not be enabled, and no client health data, passwords, or payment-card details would be transmitted. We describe it here so this page stays accurate about what the software can do, not only what it is doing today.

validates the OAuth state parameter to prevent cross-site attacks during Google sign-in. HTTP-only, short-lived.

if you pick a timezone on a booking page, we store that choice in your browser so a return visit does not ask again. It is a display preference only and is never sent to us as a tracking identifier.

2. How we use cookies

booking pages, sign-up, sign-in and password-reset forms load a bot-detection widget from Cloudflare. Cloudflare receives your IP address and basic device signals in order to tell a person from an automated script; this is strictly necessary to stop our booking pages and account forms from being abused. We use the standard widget without pre-clearance, so it does not place a cookie on your device. Cloudflare acts as our service provider and classifies these signals as strictly necessary security data.

3. What we do not use

4. Your choices

5. Users in the European Economic Area, United Kingdom, and Switzerland

6. Changes to This Policy

7. Contact Us

Cookies Policy

None. Every endpoint is anonymous and CORS is open, so you can call it from a server, a script or a browser. Send no credentials.

Authentication

Discovery

Errors

Overview

Quick start

{{limit}} requests per minute per client IP address, shared across all endpoints. Over the limit, the API answers 429 with a Retry-After header giving the seconds to wait.

Rate limits

Endpoint reference

Free, read-only nutrition calculators over HTTP: the same formulas as our web calculators, returned as JSON. No sign-up and no API key.

NutraPlanner nutrition calculator API

Storage, retrieval, modification, deletion, indexing, filtering, scheduling, synchronisation with calendar services (when enabled by the Controller), subscription billing (through Stripe), issuing, delivering and retaining the invoices, receipts and credit notes the Controller raises against its own clients together with the payments recorded against them, accounting exports of those records, the automated accounts-receivable reminder ladder, transactional email including that billing mail (through Resend), object storage of uploaded content (through Cloudflare R2), and recipe-image generation (through OpenAI, where enabled). Error and reliability telemetry through Sentry is integrated but not currently active (see Annex C).

Provision of the NutraPlanner nutrition-planning service to the Controller, including secure storage, retrieval, and processing of Personal Information entered by the Controller in the course of providing nutritional, dietary, and related professional services to clients.

Annex A — Subject Matter, Duration, and Nature of Processing

Identifying information (name, date of birth, sex assigned at birth where the client provides it, and contact details — the default intake form does not collect a provincial health-insurance number); identifying and contact details of third parties supplied by the client (an emergency contact's name, telephone number and relationship to the client; the client's family doctor or primary-care provider; the referring provider; and the name and relationship of a parent, guardian or caregiver who completes a form on the client's behalf); health information (medical history, allergens, dietary restrictions, nutritional deficiencies, body measurements, goals); self-reported health and lifestyle logs recorded by portal clients (meal and food diaries, symptom logs including digestive symptoms and their severity, mood, stress, sleep, energy, hydration, steps and exercise); photos clients attach to a meal log; message and comment threads exchanged between a client and their practitioner about those logs; appointment and scheduling information; clinical notes (free-text, may contain additional categories at the Controller's discretion); intake-form responses entered by the client or their guardian (including reproductive-health status where the Controller enables that section, and optional questions about eating patterns, which are held as the client's answers only and are not scored); electronic-signature consent evidence (typed legal name, date and time, IP address, browser user-agent, a frozen copy of the consent text presented, and where applicable per-purpose consent choices and language election); user-uploaded files (recipe images, client meal photos, optionally other documents); financial and billing information (the invoices, credit notes and receipts the Controller issues to a client and every fact printed on them — service date, duration, delivery modality, line descriptions, amounts and taxes; the name and email address of a nominated third-party payer, held on the document and optionally as a default on the care record; payments recorded against a document, including method, the date the money moved and a free-text reference note; a rate negotiated with an individual client under a sliding scale; whether automated payment reminders are suppressed for that client; and, where a balance is written off, a reason code with an optional free-text note that may describe the client's circumstances); and, where the Controller is an individual practitioner, that practitioner's own practice identity as printed on those documents (business address, telephone, business email, professional designation, association and college registration number, GST/HST and QST registration numbers, payment terms, the jurisdictions of registration, and an uploaded signature image held in object storage). NutraPlanner does not collect special categories of data (e.g. biometric, genetic, sexual-orientation data) beyond what the Controller elects to enter into free-text fields.

Clients (including minors) of the Controller who receive nutritional, dietary, or related professional services from the Controller; prospective clients who complete an intake form sent by the Controller before any account or care relationship exists; a parent, guardian or caregiver who completes an intake form on a client's behalf; a third party nominated by the client or the Controller as the payer for that client's care — a parent, a guardian, or a contact at an employer plan — whose name and email address the Controller records and to whom the Processor delivers billing email, and who need have no account with the Processor and no care relationship with the Controller; third parties about whom a client supplies Personal Information rather than supplying it themselves — an emergency contact the client names, the client's family doctor or primary-care provider, and the provider who referred the client — from whom NutraPlanner collects nothing directly and with whom NutraPlanner has no relationship; and where applicable the Controller's own staff or representatives invited into a team workspace. Where a data subject supplies Personal Information about a third party, the Controller remains responsible for any notice to, or consent of, that third party required by Applicable Privacy Law.

Annex B — Categories of Data Subjects and Personal Information

Role-based access control; row-level multi-tenant isolation; least-privilege defaults; multi-factor authentication required for production-system administrative access; audit logging on all data-modifying API calls.

Backups retained on a 30-day rolling window for disaster recovery, stored on encrypted block storage, in addition to the managed database provider's own 7-day automated backups. The restore procedure has not yet been exercised; a scheduled restore drill is planned.

Mandatory code review on all production changes; automated dependency-vulnerability scanning; timely patching of identified vulnerabilities; principle-of-least-privilege deployment access.

TLS 1.2+ in transit. AES-256-GCM at rest for database storage; equivalent encryption at rest for object storage. Application-level authenticated encryption for designated PHI fields. Key rotation is performed by re-encryption migration rather than in place.

Centralised audit logging of all data-modifying API calls and of client-record reads. Automated security-event alerting is not yet in place; logs are reviewed on investigation. Third-party error and reliability telemetry via Sentry is integrated in the codebase but is not currently active and receives no data today; if enabled it will be configured to scrub form fields and sensitive headers, and only under a data-processing agreement covering health information. This matches section 5 of the Privacy Policy.

Passwords hashed with bcrypt; no plaintext credentials stored anywhere; secrets managed in a dedicated secrets store, never committed to source code.

User-account data and client health/nutrition data are stored in separate database instances with no cross-database foreign keys.

Annex C — Security Measures Summary

hosts the application servers and the managed PostgreSQL cluster in which all service data — including client health records entered by the Controller — is stored. Canadian data residency; encryption at rest and TLS enforced in transit. Engaged under DigitalOcean's data-processing agreement; SOC 2 attestation held by the provider.

calendar synchronisation and availability checking when explicitly enabled by the Controller. Receives appointment titles, times, and OAuth tokens for events NutraPlanner writes, and provides free/busy availability and the list of calendars from the connected account, which NutraPlanner reads to compute booking availability.

per-booking video room creation, when the Controller selects Google Meet as the location for a scheduling link. Receives a room-creation request attached to the Controller's synced Google Calendar event — the same event data described in the Google Calendar entry above, and nothing further. NutraPlanner does not join, record, transcribe or otherwise process the video session itself: the Controller and their client connect to Google directly. Engaged under Google's data processing terms, alongside the Google OAuth and Google Calendar entries above.

authentication of users who sign in with Google. Receives the authentication request only.

where enabled. Receives recipe title and ingredient list only. Contractually prohibited from training on API data.

Operated by NutraPlanner on its hosting infrastructure, not the Plausible Insights hosted service. Collects published public page paths, referring site origins, browser/device information and marketing clicks. Private application, portal, booking and authentication routes, URL queries, fragments and custom event properties are excluded. The hosting providers remain subject to the safeguards described in this agreement.

stores user-uploaded files (recipe images and, for portal clients, meal photos attached to meal logs and the files a client and practitioner attach to messages — photos, and documents such as lab results) and the whole-record export archives generated when a Data Subject exercises the access or portability right, and the whole-practice export archives a practitioner (as Controller) generates, which hold the charts of every client on their caseload. Receives the file contents and access-control metadata. Export archives are sealed before transmission under a key unique to that one export request, held only by NutraPlanner, so this Subprocessor receives ciphertext only and has no means of accessing the Personal Information within it; destruction of the export request destroys that key.

verification, password-reset, multi-factor sign-in code, security-activity notification, welcome/onboarding, free-trial reminder, client-portal invitation, portal-activity notification, secure-messaging notices in both directions (that the practitioner wrote to the client, and that the client wrote to the practitioner — headline and link only), intake-form invitation, form-reminder nudge, form-submitted notice, signed-consent copy, right-of-access export ready / unavailable notice, appointment confirmation/change (also to any additional participant a practitioner adds to the appointment), upcoming-appointment reminder (likewise to an additional participant), post-appointment outcome prompt carrying two single-use action links, video-appointment join-link follow-up, practitioner join-link failure notice, program-enrolment confirmation (carrying the participant's personal access link), program module-release notice, group-session reminder and group-session cancellation notices, program-waitlist place offer, group-program update (a notice the practitioner writes and sends to everyone enrolled in one run — its body is practitioner-authored free text and may therefore contain client health information), booking email-verification, and internal new-account / feedback notification emails (the last two are addressed to the Processor's own staff and name the data subject; the feedback one carries their free text. Subscription receipts are sent by Stripe, not Resend. Portal-activity notifications carry a headline and a deep link only — no client detail; appointment and booking emails carry the practitioner name and the appointment time, and a manually booked appointment's CONFIRMATION, CANCELLATION and RESCHEDULE mail — which has no manage link — sets the practitioner's own address as the reply-to so the recipient, including an additional participant, can reach them to change it; the remaining kinds reply to the platform address). Receives recipient email and email body. Also delivers practitioner-issued invoice, receipt and payment-reminder emails, which may be addressed to a third-party payer nominated by the data subject or the Controller and who may have no account with the Processor; these carry the document number, one amount (the total at issue, the balance owing on a reminder) and a portal link; they name neither the data subject nor the practitioner, and carry no service date, line description or other clinical detail.

application error and reliability telemetry. Not currently active — no data flows to Sentry today; listed for transparency because the integration exists in the codebase. If enabled, would receive stack traces, browser type, page URL, anonymous error-grouping identifiers, and interaction breadcrumbs (scrubbed of form fields and headers).

subscription billing. Receives billing contact details and payment-card data entered directly into Stripe's hosted form.

Annex D — Subprocessors

Preamble

10. Return and Deletion at Termination

11. Term and Effect

12. Changes to This DPA

13. Liability

14. Governing Law

15. Contact

1. Definitions

2. Scope and Roles

3. Personnel and Confidentiality

4. Security Safeguards

5. Subprocessors

6. Data Subject Rights

7. Breach Notification

8. International Transfers

9. Audit and Information Rights

Data Processing Agreement

Record weight and other measurements over time and see them charted.

Measurements and trends

Capture client goals and session notes so the history travels with the client.

Goals and notes

Manage up to 3 clients free, 25 on Starter, or unlimited on Professional — the tools are identical at every tier.

Scales with your roster

Client management that keeps the context in one place

See it on your own clients

The rules behind this

Everything you need to plan, deliver, and manage — in one tool

Generate a full plan to the client's calorie and macro targets. Every plan comes with a fit report — how close each day landed, and an honest flag when the targets can't be met — instead of a black box that just says done.

Generation that shows its work

Prefer to choose? Guided picks walks the plan one meal at a time with suggestions ranked for the client's targets and the plan so far — from close-to-their-routine to something new. Every suggestion and swap is pre-screened against allergen and diet restrictions: hard guarantees, not filters.

Guided, manual, or both

Portions tune themselves to the day's targets, cook-once-eat-twice leftovers are tracked accurately across the week, and every plan ships with a consolidated grocery list — delivered as a branded web link or printable PDF on every plan, including Free.

Built for real kitchens

Meal plans that hit the prescription

Mark a rule HARD (must pass) or SOFT (contributes to a score), so you can separate non-negotiables from preferences.

HARD and SOFT constraints

Filter on nutrient thresholds (less-than, greater-than, equal, between) and on food groups by direct, ancestor, or descendant scope.

Nutrient and food-group rules

Change a recipe's ingredients and matches re-evaluate in the background — no manual re-checking.

Matches recompute automatically

A dietary-filter engine that actually understands food

Create booking links clients can use to self-schedule — included on the Free tier and every paid plan.

Shareable scheduling links

Connect your calendar so availability stays accurate and bookings show up where you already work.

Calendar sync

Set your availability once and let NutraPlanner handle the work of finding a time.

Less back-and-forth

Choose Google Meet as a link's location and every booking mints its own room — a fresh, private link each time, not one pasted room reused forever. It goes out with the confirmation email, shows on the client's booking page, and survives a reschedule. Requires a connected Google Calendar.

Video appointments

Booking pages that live on your own terms

Recipes, meal planning, the filter engine, branded delivery, and scheduling come together — so you can retire the two- or three-app stack most practitioners cobble together.

One subscription, not a stack

Most tools just let you tag a recipe 'vegan.' NutraPlanner lets you encode HARD and SOFT nutrient constraints and food-group rules, then matches recipes to each client automatically.

A real dietary-filter engine

What makes NutraPlanner different

For individuals

For practitioners

Ready to start planning?

Try the filter engine

The full picture for every client

Everything at a glance

Plans built around each client

See every client's trajectory

Precision dietary filtering no other tool offers

Clinical meal planning, without the app stack.

meal planning.

client management.

dietary filtering.

progress tracking.

your practice.

One platform for

Manage your full client roster in one place.

Your schedule, clients, and activity — all on one screen.

Build day-by-day meal plans from filtered recipes.

Log and chart each client's weight trends over time.

Filter 20,000+ recipes by nutrients, food groups, and more.

Audit logging on client data

Encrypted in transit and at rest

Your data stays yours

Privacy-first by design

Start free today

Questions

Every plan includes meal planning, your own recipes, the dietary-filter engine, scheduling and client messaging. Paid plans add more clients, branding, intake forms and client meal swaps; Professional adds programs and group cohorts.

One toolset. Pay for the clients you have.

10. Privacy Officer

11. Data Breach Notification

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we have collected, to delete it, to correct it, to opt out of any sale or sharing of personal information (we do not sell or share — see section 5), and to limit the use of sensitive personal information. We do not discriminate against you for exercising these rights. The categories we collect are listed in section 2; the purposes are listed in section 3; the third parties are listed in section 5. To exercise these rights, contact our Privacy Officer.

If you are located in the EEA, UK, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent laws apply. The lawful bases for our processing are: (a) performance of a contract with you (sections 2-3 above); (b) compliance with legal obligations (section 7 — tax retention); (c) our legitimate interests in operating, securing, and improving the service (section 5 — error monitoring); and (d) your consent for optional features (Google Calendar sync, billing). You have the right to access, rectify, erase, restrict, port, and object to processing of your data, and to lodge a complaint with your local supervisory authority. To exercise these rights, contact our Privacy Officer.

If your jurisdiction grants you specific privacy rights not enumerated above, we will honour those rights to the extent required by the law of your jurisdiction. Contact our Privacy Officer.

12. International Users

13. Children's Data

14. Practitioner Data Processing Agreement

1. Introduction

email address, first and last name, and a password (stored as a one-way hash — we never store or have access to your plain-text password). If you sign in with Google, we receive your name and email from Google; we do not access your Google password.

if you connect Google Calendar, we store OAuth tokens and sync appointments between NutraPlanner and your calendar. With your authorisation, we also read your calendars' free/busy availability and the list of calendars on your account, which we use to prevent double-booking when generating your public booking availability. We do not read the contents, titles, or attendees of events we did not create.

when your practitioner bills you through NutraPlanner, we store the invoices, receipts and credit notes they issue and the facts printed on them: your name and email address, the date, length and delivery method of the service, a description and amount for each line, and any tax. Where someone other than you pays, we store that payer's name and email address (for example a parent, or a contact at an employer plan), and your practitioner can save them on your record so they are not retyped onto every document. We store each payment recorded against a document: the method (cash, cheque, e-transfer, or a payment handled outside NutraPlanner), the date the money actually moved, and an optional free-text reference note. We also store a rate agreed for you specifically where your practitioner offers a sliding scale (a fixed fee, or a percentage off), whether automated payment reminders are switched off for you, and, if your practitioner writes an unpaid balance off, the reason code they choose together with an optional free-text note explaining why, which can describe your circumstances. Names, email addresses, line descriptions, reference notes and write-off notes in these records are encrypted at rest.

medical history, dietary preferences, allergens, aversions, nutritional deficiencies, body measurements, goals, clinical notes, and appointment records that you enter on behalf of your clients.

if your dietitian invites you to their client portal, you may create your own login (email and a hashed password) to view the care information they share with you, such as your appointments and meal plans, and to use the self-logging tools described below. You control your own credentials; your dietitian cannot see your password, and you can be unlinked from the portal at any time without your dietitian losing your care record.

if your dietitian sends you an intake form, we collect the answers you enter yourself through a secure, expiring link (no account required). Every intake form asks who you are: your name, your date of birth, optionally your sex assigned at birth, and who is filling the form in (you, or a parent, guardian, or caregiver, who gives their own name and relationship to you). It also offers optional fields for your family doctor or primary-care provider, the provider who referred you, and an emergency contact (name, phone number, and relationship to you). Depending on which sections your dietitian turns on, the form may also ask about health history, medications and supplements, allergies and intolerances, dietary practices, lifestyle information, and optional questions about eating patterns and your relationship with food. The form does not ask for your provincial health-insurance number, and we do not use NutraPlanner to bill any provincial health-insurance plan. Some of these fields ask about other people — your emergency contact, your family doctor, the provider who referred you, and anyone completing the form on your behalf. Please enter their details only where you are comfortable doing so, and let them know you have. Your dietitian holds that information to reach your emergency contact if the need arises and to identify the clinicians involved in your care; we store it on their behalf, use it for nothing else, and never contact those people for marketing. If someone you have named wants to know what we hold about them, or wants it corrected or deleted, they can contact our Privacy Officer (section 10) or the dietitian who sent you the form. When you sign a consent form electronically, we also record consent evidence: your typed legal name, the date and time, your IP address, your browser's user-agent string, and an exact frozen copy of the consent text you were shown (including, in Quebec, your per-purpose consent choices and any language election). Free-text answers and consent records are encrypted at rest and visible only to you and the practitioner who sent the form; they are never used for advertising or sold.

dietary preferences, meal plans, and recipe interactions.

if you issue invoices to your clients through NutraPlanner, we also store the practice details that get printed on those documents: your business address, telephone number and business email, the professional designation, association and college registration number that appear on a receipt, your GST/HST and QST registration numbers where you hold them, your payment terms and invoice-number prefix, and a signature image you upload (kept in object storage and referenced by key). We also store the jurisdictions where you are registered to practise (provinces, territories or countries), because that is what decides how long a client's financial records must be kept and whether Quebec's receipt rules apply to them.

credentials, specialisations, and licensing details you choose to add to your profile.

if you use the portal's logging features, we collect the information you choose to record: meal and food diaries (including photos you attach to a meal log), symptom logs including digestive symptoms and their severity, mood, stress, sleep, energy, hydration, steps and exercise, and the messages and files (photos, and documents such as lab results) you exchange with your practitioner. This is sensitive health information: it is encrypted at rest, visible only to you and the practitioner(s) responsible for your care, and is never used for advertising or sold.

2. Information We Collect

we collect basic usage information such as pages visited and actions taken to maintain and improve the service. We use session cookies for authentication. The free public calculator API computes each result from the values in the request without storing those values in the application; the caller's IP address is used briefly for rate limiting, and server access logs of those requests record the requested address, including those values.

if you ask to be notified while NutraPlanner is in private beta, we store the email address you submit so we can contact you when a place opens up. You don't need an account to join the waitlist, and we use the address for nothing else.

3. How We Use Your Information

4. Data Storage and Security

our cloud infrastructure provider. DigitalOcean hosts the application servers and databases where service data — including client health data — is stored, in Canadian data centres. DigitalOcean provides infrastructure only and does not access the data; sensitive health fields are additionally encrypted at the field level before storage (see section 4).

for appointment synchronisation and availability checking, only when you explicitly connect your account. NutraPlanner stores OAuth tokens to write the appointments it creates and to read your calendars' free/busy times and calendar list, so your booking availability reflects when you are already busy. You can disconnect at any time from your profile settings.

for video telehealth appointments, only when your practitioner chooses Google Meet as the location for a scheduling link. NutraPlanner asks your practitioner's connected Google account to create a meeting room on the calendar event described above — which carries any note you provided when booking. The join link is emailed to you and shown on your booking pages. NutraPlanner is not part of the call itself: you and your practitioner connect to Google directly, and we do not join, record or transcribe it.

for account sign-in. Google receives the authentication request only; we do not share any NutraPlanner content with Google as part of sign-in.

if recipe-image generation is enabled, we send the recipe title and ingredient list to OpenAI to produce an illustrative image. We do not send client health data, personal information, or identifiers. OpenAI is contractually prohibited from training its models on data sent via its API.

NutraPlanner operates Plausible Community Edition on its own hosting infrastructure for cookieless statistics about published public pages and marketing clicks. Events include public page paths, referring site origins and browser/device information. IP addresses are processed to derive approximate location and daily visitor identifiers. We exclude private application, portal, booking and authentication routes, URL queries, fragments and custom event properties. Plausible Insights does not host this instance or receive its analytics events.

object storage for user-uploaded files (recipe images and, for portal clients, meal photos attached to meal logs and the files you and your practitioner attach to messages — photos, and documents such as lab results) and for the archives we build when you ask for a copy of your data. R2 receives the file contents and access-control metadata. Export archives are handled differently from the other files listed here: each one is sealed before it leaves our servers under a key created for that single export request and kept only in our own database, so Cloudflare receives ciphertext it has no means of reading. Deleting the export request destroys that key, and with it the archive.

delivers transactional emails (account verification, password resets, multi-factor sign-in codes, security-activity notifications, welcome and onboarding messages, free-trial reminders, client-portal invitations, portal-activity notifications, the notice telling you that your dietitian wrote to you in secure messaging, and the one telling your dietitian that you wrote to them (a headline and a link only — never the message itself), intake-form invitations, reminders about a form you have not yet completed, the notice telling your dietitian that you completed a form, your own copy of a consent you signed, the two right-of-access export notices telling you that the copy of your information you asked for is ready to download or that we could not deliver it as a single file, appointment confirmations and changes (booked, pending approval, approved, declined, rescheduled, cancelled — sent to whoever booked, to any additional participant a practitioner adds to the appointment, and to the practitioner), reminders before an upcoming appointment sent to the same people, a prompt after the appointment asking whoever booked whether it went ahead — which carries two single-use action links that record the answer without signing in, the join link for a video appointment when one is created after the confirmation has already gone out, the notice telling a practitioner that a video appointment's join link could not be created at all — addressed to them, naming the client and the appointment time, the emails you receive as a participant in a group program (your program-enrolment confirmation carrying your personal access link, a notice when new program content — a module — is released to you, a reminder before a group session, a notice if a group session is cancelled, the offer of a place when a spot opens on a program waitlist, and an update your practitioner writes and chooses to send to everyone in your group — its text is theirs, so it can say whatever they put in it), the one-time code that verifies an email address at the moment of booking, and two notices addressed to our own staff rather than to you — that an account was created, naming you and your sign-in method, and that you submitted feedback, containing what you wrote). Subscription receipts — the ones for what you pay NutraPlanner — are sent by Stripe, not Resend. Resend receives the recipient email address and the email body. Seven of these reach someone who may have no account with us: an intake-form invitation and its reminders are addressed to you even if you have no NutraPlanner account and have never become a client; the notice to your dietitian names you in its subject line; and your copy of a signed consent contains the frozen consent text, your typed legal name, and the date you signed; and a booking email — including the verification code — is addressed to whoever booked the appointment, names the practitioner, and states the appointment time; and appointment mail — the confirmation and its calendar attachment, any reschedule or cancellation, and the reminders — is addressed to anyone a practitioner adds to an appointment as an additional participant, who may never have booked anything and may hold no account, and which names the practitioner and states the appointment time; and every group-program email is addressed to you as an enrolled participant even if you never create an account, and carries the program name, session times, and your personal access link; and a billing email — an invoice, receipt or payment reminder your practitioner issues — is addressed to a third-party payer you or your practitioner nominated, for example a parent or an employer plan, who may hold no NutraPlanner account of their own. An appointment email addressed to YOU names the appointment type your practitioner chose for it, which appears as the subject line and as the title of the calendar attachment; where a practitioner has named a reason for the visit, that is health information about you, sent to you. It is severed from mail to an additional participant, along with the notes. Beyond that — and apart from a group-program update, which carries whatever text your practitioner writes in it — none of these emails carries your intake answers, appointment notes, or any other health information. It is used only for service-related communications, not marketing. We also use Resend to deliver the invoices, receipts and payment reminders your practitioner issues to you through NutraPlanner. A billing email carries the document number, one amount — the total on the document when it is issued, the balance still owing on a reminder — and a link to sign in to the portal. The message does not name you and does not name your practitioner, and it carries no service date, no line descriptions and no other clinical detail, because the document itself stays behind portal sign-in. What it does reveal, to anyone who can read that mailbox, is that a practitioner is billing the recipient through NutraPlanner.

error monitoring is currently disabled in production and no data flows to Sentry today. We list it for transparency because the integration exists in our code; we will enable it only under a data-processing agreement covering health information. If enabled, Sentry would receive stack traces, browser type, page URL, anonymous error grouping identifiers, and breadcrumbs of user interaction (e.g. button clicked, route changed) that immediately precede an error. We configure Sentry to scrub form fields and headers; client health data and credentials would never be transmitted. Session replay is not enabled.

processes subscription payments. Stripe receives your name, email, billing address, and payment-card details (entered directly into Stripe's secure form — we never see or store full card numbers). Stripe acts as an independent controller for fraud prevention and tax-reporting purposes under its own privacy policy at stripe.com/privacy.