Reading the marks

Page {{page}} of {{total}} · {{count}} results

Page 1 of 1 — all {{count}} results shown

Name

Title

Tell us about your facility, your menu and any inspection or review deadline.

Let’s talk about your next menu cycle.

Less time piecing things together.

Findings explained in context, including gaps in the information available and what needs further attention.

An audit with reasoning

The dietitian’s professional review, with its scope, conclusions and limitations documented.

A signed review letter

More than a list of things to fix.

A few practical questions.

Preparing for an inspection or updating your menu cycle?

A clearer picture of your menu.

A practical path forward.

Folio by NutraPlanner — menu review preview

Your cycle menu

From individual meals to the bigger picture.

The options offered at each meal and how clearly they are described.

The choices on the menu

The recipes, portions and other material available to inform the review.

Supporting information

Sandra considers the evidence, explains the findings and documents the limitations.

Professional judgement

How meals and ingredients recur from day to day.

Variety across the cycle

Your menu and review documents give your team a reference for understanding the findings and planning its next steps.

Receive a clear record

We organise the material, clarify questions with you, and carry out the dietitian-led review.

Share your menu for review

After your enquiry, we arrange a call to discuss your menu and deadline. Have your current menu ready; recipes are helpful but not required. We agree the scope, timing and fee before starting.

Start with a call

Start with the menu you already have.

Sandra Fraser is a registered dietitian in Alberta and British Columbia, with years of experience in long-term care and menu review. Through Fraser Nutrition, she reviews your menu and supporting information, explains her findings, and signs the professional review.

Sandra Fraser · Fraser Nutrition

Professional judgement. Personal accountability.

What your review brings

A week at the table.

Ready to try it?

Built in the open

A small team, on purpose

About NutraPlanner

Why we built this

The HARD/SOFT filter engine lets you express real nutrient constraints and food-group rules — not just diet tags — so recipes match what a client actually needs.

Encode the clinical detail

Deliver plans under your own brand as a shareable web link or printable PDF, with grocery lists generated automatically.

Branded, client-ready plans

No insurance-billing bloat — just the meal-planning and client tools a cash-pay RD actually uses, priced for a solo practice.

Built for cash-pay practice

Plan your next client in NutraPlanner

Clinically precise meal planning, without the multi-app stack

Frequently asked questions

Setting up the practice itself

Set nutrient and food-group rules for your own diet, and find recipes that fit them automatically.

Filter to your needs

Assemble a week of meals and get a consolidated grocery list so shopping is one trip, not a scramble.

Plan and shop

Personal use will be free — join the waitlist and we'll email you the moment it's ready.

Free when it opens

Start planning your meals

Plan your own meals around what your body needs

Build plans from the recipes you already use and deliver them under your own brand as a web link or PDF.

Your recipes, your brand

Match recipes to each client's preferences and restrictions with the dietary-filter engine — no spreadsheets.

Filtering that fits each client

Share a booking link so clients can self-schedule, synced to your calendar — no separate scheduling tool.

Scheduling built in

Build your first plan today

Branded meal plans your clients will actually follow

Ready to get started?

Send feedback

Get in touch

Follow along

Contact Us

1. What are cookies?

a secure, HTTP-only session cookie that keeps you signed in. This is a JWT-based token that expires after 24 hours. Without it, you would need to log in on every page.

when you book an appointment, your name and email are held briefly in your browser's sessionStorage so the confirmation screen can show them without putting them in the page address. This is cleared when you close the tab, and it is never sent anywhere other than the booking request you submitted. We use sessionStorage here specifically so these details do not end up in a URL that could be logged or shared.

stores the redirect URL during sign-in so you return to the correct page after authentication. HTTP-only, short-lived.

prevents cross-site request forgery attacks on authentication forms.

a first-party cookie holding your resolved display-unit settings and a keyed, pseudonymous hash of your account, so that pages are drawn in the right units before the app loads. It is readable by the page's scripts (not HTTP-only), is sent only to our own site (SameSite=Lax, and Secure on HTTPS), and lasts up to 400 days. It is cleared when you sign out or switch accounts. It is strictly functional: it is not used for analytics or tracking and is not shared with anyone.

stores your chosen language (English or French) so the site loads in the correct language on each visit.

part of the PKCE OAuth security flow used during Google sign-in. HTTP-only, expires after 15 minutes.

we store your sidebar collapse state in browser localStorage (not a cookie), but mention it here for transparency. The free private practice launch checklist also keeps your answers and ticks in localStorage so it remembers them on your next visit; they never leave your device, and its "Clear answers and ticks" button deletes them. The resources library likewise remembers the country you last filtered by, and the checklist starts on that country when you have not yet chosen one.

Sentry is currently DISABLED and receives nothing from this service. If we enable it, it would store a per-session identifier in your browser to group errors from the same browser session, and record a short trail of recent user-interface interactions (route changes, button clicks — never form values) that immediately precede an error, to help us reproduce and fix bugs. Session replay would not be enabled, and no client health data, passwords, or payment-card details would be transmitted. We describe it here so this page stays accurate about what the software can do, not only what it is doing today.

validates the OAuth state parameter to prevent cross-site attacks during Google sign-in. HTTP-only, short-lived.

if you pick a timezone on a booking page, we store that choice in your browser so a return visit does not ask again. It is a display preference only and is never sent to us as a tracking identifier.

2. How we use cookies

booking pages, sign-up, sign-in and password-reset forms load a bot-detection widget from Cloudflare. Cloudflare receives your IP address and basic device signals in order to tell a person from an automated script; this is strictly necessary to stop our booking pages and account forms from being abused. We use the standard widget without pre-clearance, so it does not place a cookie on your device. Cloudflare acts as our service provider and classifies these signals as strictly necessary security data.

3. What we do not use

4. Your choices

5. Users in the European Economic Area, United Kingdom, and Switzerland

6. Changes to This Policy

7. Contact Us

Cookies Policy

None. Every endpoint is anonymous and CORS is open, so you can call it from a server, a script or a browser. Send no credentials.

Authentication

Discovery

Errors

Use this address when an app asks for the server URL. Always use nutraplanner.ca without "www": a connection made through www is not accepted.

Server address

Connecting with sign-in shows an approval screen that lists what the app asked for. You approve with a code from your second factor (an authenticator app or an emailed code), so a hijacked session alone cannot connect an app. (NutraPlanner's own demo accounts for app-directory reviewers approve without a code; they can never be given client access.) A personal access token needs the same code when you create it. You can revoke any connection or token at any time under Connected apps.

Approval and second factor

How to connect

Each tool has a per-minute limit, and some have a daily limit per person and per practice. When a call is refused for going over a limit, the error says when the assistant can try again, and a well-behaved assistant waits and retries.

Limits

Calls are limited to your own account and workspace. We record each call so we can investigate misuse: when, which tool, with which credential and how it went, kept 12 months. The request and our response themselves are kept 90 days, and only when the assistant saves or analyses a recipe. Client information is not available to any connection yet: it is planned, and it will need each client's recorded consent. See the {{link}}.

Privacy

Read your practice's own totals for a calendar month, quarter or year, with no client named.

What an assistant can access

Questions about connecting, or a problem with a tool? Write to {{link}}.

Support

AI assistants (MCP)

Reads what an assistant may know about one client you selected in the practice panel, by a random code: dietary restrictions, rounded targets and plans — never a name, contact details, dates or notes. Available only when a connection is allowed to use client information.

Totals for your practice for a calendar month, quarter or year: appointments, new clients, plans, invoiced and paid amounts. No client is named.

Tools

The server is version 1.0.0. Changes are additive: new tools and new optional fields, with existing ones left as they are. ChatGPT keeps a copy of a connector's tool list, so after an update, open the connector in ChatGPT and press Refresh.

Versioning

Overview

Quick start

{{limit}} requests per minute per client IP address, shared across all endpoints. Over the limit, the API answers 429 with a Retry-After header giving the seconds to wait.

Rate limits

Endpoint reference

Free, read-only nutrition calculators over HTTP: the same formulas as our web calculators, returned as JSON. No sign-up and no API key.

NutraPlanner nutrition calculator API

Storage, retrieval, modification, deletion, indexing, filtering, scheduling, synchronisation with calendar services (when enabled by the Controller), subscription billing (through Stripe), issuing, delivering and retaining the invoices, receipts and credit notes the Controller raises against its own clients together with the payments recorded against them, accounting exports of those records, the automated accounts-receivable reminder ladder, transactional email including that billing mail (through Resend), object storage of uploaded content (through Cloudflare R2), and recipe-image generation (through OpenAI, where enabled). Error and reliability telemetry through Sentry is integrated but not currently active (see Annex C). Client records may be entered one at a time or in bulk from a file the Controller exported from another system; that file is read on the Controller's device and is never uploaded. Identifying details from it are compared with the Controller's existing client records, without being retained, to avoid duplicates; only the records the Controller chooses to import are stored.

Provision of the NutraPlanner nutrition-planning service to the Controller, including secure storage, retrieval, and processing of Personal Information entered by the Controller in the course of providing nutritional, dietary, and related professional services to clients.

Annex A — Subject Matter, Duration, and Nature of Processing

Identifying information (name, date of birth, sex assigned at birth where the client provides it, and contact details — the default intake form does not collect a provincial health-insurance number); identifying and contact details of third parties supplied by the client (an emergency contact's name, telephone number and relationship to the client; the client's family doctor or primary-care provider; the referring provider; and the name and relationship of a parent, guardian or caregiver who completes a form on the client's behalf); health information (medical history, allergens, dietary restrictions, nutritional deficiencies, body measurements, goals); self-reported health and lifestyle logs recorded by portal clients (meal and food diaries, symptom logs including digestive symptoms and their severity, mood, stress, sleep, energy, hydration, steps and exercise); photos clients attach to a meal log; message and comment threads exchanged between a client and their practitioner about those logs; appointment and scheduling information; clinical notes (free-text, may contain additional categories at the Controller's discretion); intake-form responses entered by the client or their guardian (including reproductive-health status where the Controller enables that section, and optional questions about eating patterns, which are held as the client's answers only and are not scored); electronic-signature consent evidence (typed legal name, date and time, IP address, browser user-agent, a frozen copy of the consent text presented, and where applicable per-purpose consent choices and language election); user-uploaded files (recipe images, client meal photos, optionally other documents); financial and billing information (the invoices, credit notes and receipts the Controller issues to a client and every fact printed on them — service date, duration, delivery modality, line descriptions, amounts and taxes; the name and email address of a nominated third-party payer, held on the document and optionally as a default on the care record; payments recorded against a document, including method, the date the money moved and a free-text reference note; a rate negotiated with an individual client under a sliding scale; whether automated payment reminders are suppressed for that client; and, where a balance is written off, a reason code with an optional free-text note that may describe the client's circumstances); claim information where the Controller issues a US superbill (the place of service; the name and National Provider Identifier of the referring provider; the diagnosis codes, ICD-10-CM, supplied by that provider; and per line a procedure code, modifiers and a count of timed units — the diagnosis codes and the referring provider’s name being health information about the client, encrypted at rest); and, where the Controller is an individual practitioner, that practitioner's own practice identity as printed on those documents (business address, telephone, business email, professional designation, association and college registration number, GST/HST and QST registration numbers, payment terms, the jurisdictions of registration, the billing currency, an uploaded signature image held in object storage, and for a US practice the individual and organization National Provider Identifiers, the Healthcare Provider Taxonomy code, the state licence number and the federal tax identifier with its kind — which for a sole proprietor who has never obtained an EIN is a Social Security Number, is encrypted at rest, and is never returned to the browser other than, for an EIN, on the documents it prints on — an EIN is printed in full on a document, because a payer cannot adjudicate a partial one, while an SSN is printed only as its last four digits. A copy of that practice identity, the tax identifier included, is frozen onto each document when it is issued and is kept with that document for the record-keeping period described in the Privacy Policy, section 7). NutraPlanner does not collect special categories of data (e.g. biometric, genetic, sexual-orientation data) beyond what the Controller elects to enter into free-text fields. Documents issued before 15 October 2026 keep the masked form they were issued with: an issued document prints what was frozen onto it.

Clients (including minors) of the Controller who receive nutritional, dietary, or related professional services from the Controller; prospective clients who complete an intake form sent by the Controller before any account or care relationship exists; a parent, guardian or caregiver who completes an intake form on a client's behalf; a third party nominated by the client or the Controller as the payer for that client's care — a parent, a guardian, or a contact at an employer plan — whose name and email address the Controller records and to whom the Processor delivers billing email, and who need have no account with the Processor and no care relationship with the Controller; third parties about whom a client supplies Personal Information rather than supplying it themselves — an emergency contact the client names, the client's family doctor or primary-care provider, and the provider who referred the client — from whom NutraPlanner collects nothing directly and with whom NutraPlanner has no relationship; and where applicable the Controller's own staff or representatives invited into a team workspace. Where a data subject supplies Personal Information about a third party, the Controller remains responsible for any notice to, or consent of, that third party required by Applicable Privacy Law.

Annex B — Categories of Data Subjects and Personal Information

Role-based access control; row-level multi-tenant isolation; least-privilege defaults; multi-factor authentication required for production-system administrative access; audit logging on all data-modifying API calls.

Backups retained on a 30-day rolling window for disaster recovery, stored on encrypted block storage, in addition to the managed database provider's own 7-day automated backups. The restore procedure has not yet been exercised; a scheduled restore drill is planned.

Mandatory code review on all production changes; automated dependency-vulnerability scanning; timely patching of identified vulnerabilities; principle-of-least-privilege deployment access.

TLS 1.2+ in transit. AES-256-GCM at rest for database storage; equivalent encryption at rest for object storage. Application-level authenticated encryption for designated PHI fields. Key rotation is performed by re-encryption migration rather than in place.

Centralised audit logging of all data-modifying API calls and of client-record reads. A connected AI application's reads of client records are recorded before anything is returned to it. A recipe it saves is stored in a separate database from the audit log, so that save's audit record is written immediately after it, retried once, and logged as an error for follow-up if it still cannot be written. Records of disclosure to connected applications are kept 10 years; before then, a database rule refuses ordinary changes to or deletions of them, and only a dedicated retention process, run after the retention period, is permitted to remove them. Automated security-event alerting is not yet in place; logs are reviewed on investigation. Third-party error and reliability telemetry via Sentry is integrated in the codebase but is not currently active and receives no data today; if enabled it will be configured to scrub form fields and sensitive headers, and only under a data-processing agreement covering health information. This matches section 5 of the Privacy Policy.

Passwords hashed with bcrypt; no plaintext credentials stored anywhere; secrets managed in a dedicated secrets store, never committed to source code.

User-account data and client health/nutrition data are stored in separate database instances with no cross-database foreign keys.

Annex C — Security Measures Summary

hosts the application servers and the managed PostgreSQL cluster in which all service data — including client health records entered by the Controller — is stored. Canadian data residency; encryption at rest and TLS enforced in transit. Engaged under DigitalOcean's data-processing agreement; SOC 2 attestation held by the provider.

calendar synchronisation and availability checking when explicitly enabled by the Controller. Receives appointment titles, times, and OAuth tokens for events NutraPlanner writes, and provides free/busy availability and the list of calendars from the connected account, which NutraPlanner reads to compute booking availability.

per-booking video room creation, when the Controller selects Google Meet as the location for a scheduling link. Receives a room-creation request attached to the Controller's synced Google Calendar event — the same event data described in the Google Calendar entry above, and nothing further. NutraPlanner does not join, record, transcribe or otherwise process the video session itself: the Controller and their client connect to Google directly. Engaged under Google's data processing terms, alongside the Google OAuth and Google Calendar entries above.

authentication of users who sign in with Google. Receives the authentication request only.

where enabled. Receives recipe title and ingredient list only. Contractually prohibited from training on API data.

Operated by NutraPlanner on its hosting infrastructure, not the Plausible Insights hosted service. Collects published public page paths, referring site origins, browser/device information and marketing clicks. Private application, portal, booking and authentication routes, URL queries, fragments and custom event properties are excluded. The hosting providers remain subject to the safeguards described in this agreement.

stores user-uploaded files (recipe images and, for portal clients, meal photos attached to meal logs and the files a client and practitioner attach to messages — photos, and documents such as lab results) and the whole-record export archives generated when a Data Subject exercises the access or portability right, and the whole-practice export archives a practitioner (as Controller) generates, which hold the charts of every client on their caseload. Receives the file contents and access-control metadata. Export archives are sealed before transmission under a key unique to that one export request, held only by NutraPlanner, so this Subprocessor receives ciphertext only and has no means of accessing the Personal Information within it; destruction of the export request destroys that key.

verification, password-reset, multi-factor sign-in code, security-activity notification, welcome/onboarding, free-trial reminder, client-portal invitation, portal-activity notification, secure-messaging notices in both directions (that the practitioner wrote to the client, and that the client wrote to the practitioner — headline and link only), intake-form invitation, form-reminder nudge, form-submitted notice, signed-consent copy, right-of-access export ready / unavailable notice, appointment confirmation/change (also to any additional participant a practitioner adds to the appointment), upcoming-appointment reminder (likewise to an additional participant), post-appointment outcome prompt carrying two single-use action links, video-appointment join-link follow-up, practitioner join-link failure notice, program-enrolment confirmation (carrying the participant's personal access link), program module-release notice, group-session reminder and group-session cancellation notices, program-waitlist place offer, group-program update (a notice the practitioner writes and sends to everyone enrolled in one run — its body is practitioner-authored free text and may therefore contain client health information), booking email-verification, and internal new-account / feedback notification emails (the last two are addressed to the Processor's own staff and name the data subject; the feedback one carries their free text. Subscription receipts are sent by Stripe, not Resend. Portal-activity notifications carry a headline and a deep link only — no client detail; appointment and booking emails carry the practitioner name and the appointment time, and a manually booked appointment's CONFIRMATION, CANCELLATION and RESCHEDULE mail — which has no manage link — sets the practitioner's own address as the reply-to so the recipient, including an additional participant, can reach them to change it; the remaining kinds reply to the platform address). Receives recipient email and email body. Also delivers practitioner-issued invoice, receipt and payment-reminder emails, which may be addressed to a third-party payer nominated by the data subject or the Controller and who may have no account with the Processor; these carry the document number, one amount (the total at issue, the balance owing on a reminder) and a portal link; they name neither the data subject nor the practitioner, and carry no service date, line description or other clinical detail.

application error and reliability telemetry. Not currently active — no data flows to Sentry today; listed for transparency because the integration exists in the codebase. If enabled, would receive stack traces, browser type, page URL, anonymous error-grouping identifiers, and interaction breadcrumbs (scrubbed of form fields and headers).

subscription billing. Receives billing contact details and payment-card data entered directly into Stripe's hosted form.

Annex D — Subprocessors

Preamble

10. Return and Deletion at Termination

11. Term and Effect

12. Changes to This DPA

13. Liability

14. Governing Law

15. Contact

1. Definitions

2. Scope and Roles

3. Personnel and Confidentiality

4. Security Safeguards

5. Subprocessors

6. Data Subject Rights

7. Breach Notification

8. International Transfers

9. Audit and Information Rights

Data Processing Agreement

The assistant sends the ingredients; NutraPlanner matches each line to a food, works out the nutrients per serving from the Canadian Nutrient File and checks the recipe against {{link}}. If a line can't be matched or measured, nothing is saved: the assistant gets candidate foods back to fix it, and no quantity is guessed. A saved recipe is a private draft in your library.

Recipes with calculated nutrients

Describe the template you want (days, meals, diet and allergy profiles, nutrition targets) and {{link}} fills it from the recipe library. Every placed recipe is checked against the template's restrictions as it is written, and a slot that can't be filled within the strict restrictions is reported as open instead of being filled by relaxing them. The assistant can then swap dishes, fill gaps or rebalance portions.

Meal-plan templates filled by NutraPlanner's engine

Everything an assistant writes is a draft for you to review in NutraPlanner. It cannot publish a recipe, activate a plan or acknowledge a safety warning; when a change needs that confirmation, it hands you a link instead.

Drafts only

For each diet or allergy profile, the assistant learns whether a recipe passes. The food-group rules and nutrient limits behind a profile are never sent to it.

Profile checks without your rules

Connecting takes a code from your second factor, and an assistant can never do more than your own account can. NutraPlanner logs every call. You can revoke any connection or token at any time under Settings > Connected apps, and the owners and admins of a team practice can turn AI assistants off for every member.

Revoke or switch off at any time

A connection works with your recipes, the food database, your diet and allergy profiles, your meal-plan templates and, if you allow it, your practice's own totals, with no client named. It does not read client records. Keep client details out of what you type into the assistant and out of recipe and template titles. Client-aware features are planned and will need each client's recorded consent. See {{link}}.

Client records stay out

How to connect Claude or ChatGPT

Connect Claude or ChatGPT to NutraPlanner

Record weight and other measurements over time and see them charted.

Measurements and trends

Capture client goals and session notes so the history travels with the client.

Goals and notes

Manage up to 3 clients free, 25 on Starter, or unlimited on Professional — the tools are identical at every tier.

Scales with your roster

Client management that keeps the context in one place

See it on your own clients

The rules behind this

Everything you need to plan, deliver, and manage — in one tool

Generate a full plan to the client's calorie and macro targets. Every plan comes with a fit report — how close each day landed, and an honest flag when the targets can't be met — instead of a black box that just says done. On a paid plan, you can also {{link}}: this same engine fills them, and you review the drafts.

Generation that shows its work

Prefer to choose? Guided picks walks the plan one meal at a time with suggestions ranked for the client's targets and the plan so far — from close-to-their-routine to something new. Every suggestion and swap is pre-screened against allergen and diet restrictions: hard guarantees, not filters.

Guided, manual, or both

Portions tune themselves to the day's targets, cook-once-eat-twice leftovers are tracked accurately across the week, and every plan ships with a consolidated grocery list — delivered as a branded web link or printable PDF on every plan, including Free.

Built for real kitchens

Meal plans that hit the prescription

Recipes, meal planning, the filter engine, branded delivery, and scheduling come together — so you can retire the two- or three-app stack most practitioners cobble together.

One subscription, not a stack

Most tools just let you tag a recipe 'vegan.' NutraPlanner lets you encode HARD and SOFT nutrient constraints and food-group rules, then matches recipes to each client automatically.

Menu standards self-check

Your home

9 questions for your home

Where your answers point

Want help with the gaps?