1. Introduction

NutraPlanner is a nutrition planning platform for Canadian healthcare practitioners and individuals. We are committed to protecting your personal information and your right to privacy in accordance with Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), and applicable provincial health-information legislation. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have in relation to it.

2. Information We Collect

We collect information that you provide directly when creating an account, joining our beta waitlist, or using the service:

  • Account information: email address, first and last name, and a password (stored as a one-way hash — we never store or have access to your plain-text password). If you sign in with Google, we receive your name and email from Google; we do not access your Google password.
  • Professional information (practitioners): credentials, specialisations, and licensing details you choose to add to your profile.
  • Practice and billing identity (practitioners): if you issue invoices to your clients through NutraPlanner, we also store the practice details that get printed on those documents: your business address, telephone number and business email, the professional designation, association and college registration number that appear on a receipt, your GST/HST and QST registration numbers where you hold them, your payment terms and invoice-number prefix, and a signature image you upload (kept in object storage and referenced by key). We also store the jurisdictions where you are registered to practise (provinces, territories or countries), because that is what decides how long a client's financial records must be kept and whether Quebec's receipt rules apply to them.
  • Client health data (practitioners): medical history, dietary preferences, allergens, aversions, nutritional deficiencies, body measurements, goals, clinical notes, and appointment records that you enter on behalf of your clients.
  • Billing records (practitioners and their clients): when your practitioner bills you through NutraPlanner, we store the invoices, receipts and credit notes they issue and the facts printed on them: your name and email address, the date, length and delivery method of the service, a description and amount for each line, and any tax. Where someone other than you pays, we store that payer's name and email address (for example a parent, or a contact at an employer plan), and your practitioner can save them on your record so they are not retyped onto every document. We store each payment recorded against a document: the method (cash, cheque, e-transfer, or a payment handled outside NutraPlanner), the date the money actually moved, and an optional free-text reference note. We also store a rate agreed for you specifically where your practitioner offers a sliding scale (a fixed fee, or a percentage off), whether automated payment reminders are switched off for you, and, if your practitioner writes an unpaid balance off, the reason code they choose together with an optional free-text note explaining why, which can describe your circumstances. Names, email addresses, line descriptions, reference notes and write-off notes in these records are encrypted at rest.
  • Client portal accounts (invited clients): if your dietitian invites you to their client portal, you may create your own login (email and a hashed password) to view the care information they share with you, such as your appointments and meal plans, and to use the self-logging tools described below. You control your own credentials; your dietitian cannot see your password, and you can be unlinked from the portal at any time without your dietitian losing your care record.
  • Intake forms and e-signature consent (clients and prospective clients): if your dietitian sends you an intake form, we collect the answers you enter yourself through a secure, expiring link (no account required). Every intake form asks who you are: your name, your date of birth, optionally your sex assigned at birth, and who is filling the form in (you, or a parent, guardian, or caregiver, who gives their own name and relationship to you). It also offers optional fields for your family doctor or primary-care provider, the provider who referred you, and an emergency contact (name, phone number, and relationship to you). Depending on which sections your dietitian turns on, the form may also ask about health history, medications and supplements, allergies and intolerances, dietary practices, lifestyle information, and optional questions about eating patterns and your relationship with food. The form does not ask for your provincial health-insurance number, and we do not use NutraPlanner to bill any provincial health-insurance plan. Some of these fields ask about other people — your emergency contact, your family doctor, the provider who referred you, and anyone completing the form on your behalf. Please enter their details only where you are comfortable doing so, and let them know you have. Your dietitian holds that information to reach your emergency contact if the need arises and to identify the clinicians involved in your care; we store it on their behalf, use it for nothing else, and never contact those people for marketing. If someone you have named wants to know what we hold about them, or wants it corrected or deleted, they can contact our Privacy Officer (section 10) or the dietitian who sent you the form. When you sign a consent form electronically, we also record consent evidence: your typed legal name, the date and time, your IP address, your browser's user-agent string, and an exact frozen copy of the consent text you were shown (including, in Quebec, your per-purpose consent choices and any language election). Free-text answers and consent records are encrypted at rest and visible only to you and the practitioner who sent the form; they are never used for advertising or sold.
  • Self-reported health and lifestyle data (portal clients): if you use the portal's logging features, we collect the information you choose to record: meal and food diaries (including photos you attach to a meal log), symptom logs including digestive symptoms and their severity, mood, stress, sleep, energy, hydration, steps and exercise, and the messages and files (photos, and documents such as lab results) you exchange with your practitioner. This is sensitive health information: it is encrypted at rest, visible only to you and the practitioner(s) responsible for your care, and is never used for advertising or sold.
  • Nutrition data (individuals): dietary preferences, meal plans, and recipe interactions.
  • Calendar data: if you connect Google Calendar, we store OAuth tokens and sync appointments between NutraPlanner and your calendar. With your authorisation, we also read your calendars' free/busy availability and the list of calendars on your account, which we use to prevent double-booking when generating your public booking availability. We do not read the contents, titles, or attendees of events we did not create.
  • Beta waitlist: if you ask to be notified while NutraPlanner is in private beta, we store the email address you submit so we can contact you when a place opens up. You don't need an account to join the waitlist, and we use the address for nothing else.
  • Usage data: we collect basic usage information such as pages visited and actions taken to maintain and improve the service. We use session cookies for authentication. The free public calculator API computes each result from the values in the request without storing those values in the application; the caller's IP address is used briefly for rate limiting, and server access logs of those requests record the requested address, including those values.

3. How We Use Your Information

We use the information we collect to:

  • Authenticate your identity and maintain your session
  • Provide the core service: client management, meal planning, recipe filtering, and appointment scheduling
  • Sync appointment data with Google Calendar when you have connected your account
  • Enforce subscription limits and role-based access control
  • Send service-related communications (e.g. password resets)
  • Monitor and improve the reliability and performance of the service
  • Enable portal clients to record self-reported meal, symptom, and lifestyle logs, and enable the practitioner responsible for their care to review those logs for adherence and symptom tracking
  • Produce and deliver the invoices, receipts and credit notes a practitioner issues to their own clients, record the payments made against them, and build the accounting export a practitioner needs for bookkeeping and tax filing (that export carries the client's name and the amounts, never the line descriptions)
  • Send automated payment reminders on a practitioner's behalf, where that practice has turned them on: a daily job finds invoices that are past the payment terms printed on the document and emails the client, or whoever was nominated to pay, at most three times — at 7, 21 and 45 days overdue — and never after 120 days. A practitioner can switch reminders off for an individual client, and no reminder is sent once the balance has been paid, credited or written off

We do not sell your data. We do not use your data for advertising. We do not share client health data with third parties beyond the sub-processors listed in section 5. That limit is deliberate for billing: a client's name on a dietitian's invoice discloses that they receive dietetic care, so we treat billing documents, and the email that carries them, as health information.

4. Data Storage and Security

Your data is stored in separate databases — user account data and client health/nutrition data are isolated by design. All data is encrypted in transit (TLS). Passwords are hashed using bcrypt and are never stored in plain text.

Multi-tenant isolation ensures that practitioners in team workspaces can only access data they are authorised to see, governed by role-based permissions.

No method of electronic storage is 100% secure. While we implement industry-standard protections, we cannot guarantee absolute security.

NutraPlanner is a Canadian company and handles all personal and client health data in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

5. Third-Party Service Providers (Subprocessors)

We rely on the following third-party subprocessors to operate the service. Each receives only the data necessary for its function and is contractually bound to handle that data in accordance with applicable privacy law. Several of these providers are located in the United States, which constitutes a cross-border transfer of personal information; by using the service you consent to such transfers, and we apply contractual and technical safeguards (encrypted transport, scoped access) to protect the data in transit and at rest.

  • DigitalOcean (Canada): our cloud infrastructure provider. DigitalOcean hosts the application servers and databases where service data — including client health data — is stored, in Canadian data centres. DigitalOcean provides infrastructure only and does not access the data; sensitive health fields are additionally encrypted at the field level before storage (see section 4).
  • Google OAuth (United States): for account sign-in. Google receives the authentication request only; we do not share any NutraPlanner content with Google as part of sign-in.
  • Google Calendar (United States): for appointment synchronisation and availability checking, only when you explicitly connect your account. NutraPlanner stores OAuth tokens to write the appointments it creates and to read your calendars' free/busy times and calendar list, so your booking availability reflects when you are already busy. You can disconnect at any time from your profile settings.
  • Google Meet (United States): for video telehealth appointments, only when your practitioner chooses Google Meet as the location for a scheduling link. NutraPlanner asks your practitioner's connected Google account to create a meeting room on the calendar event described above — which carries any note you provided when booking. The join link is emailed to you and shown on your booking pages. NutraPlanner is not part of the call itself: you and your practitioner connect to Google directly, and we do not join, record or transcribe it.
  • Stripe (United States): processes subscription payments. Stripe receives your name, email, billing address, and payment-card details (entered directly into Stripe's secure form — we never see or store full card numbers). Stripe acts as an independent controller for fraud prevention and tax-reporting purposes under its own privacy policy at stripe.com/privacy.
  • Resend (United States): delivers transactional emails (account verification, password resets, multi-factor sign-in codes, security-activity notifications, welcome and onboarding messages, free-trial reminders, client-portal invitations, portal-activity notifications, the notice telling you that your dietitian wrote to you in secure messaging, and the one telling your dietitian that you wrote to them (a headline and a link only — never the message itself), intake-form invitations, reminders about a form you have not yet completed, the notice telling your dietitian that you completed a form, your own copy of a consent you signed, the two right-of-access export notices telling you that the copy of your information you asked for is ready to download or that we could not deliver it as a single file, appointment confirmations and changes (booked, pending approval, approved, declined, rescheduled, cancelled — sent to whoever booked, to any additional participant a practitioner adds to the appointment, and to the practitioner), reminders before an upcoming appointment sent to the same people, a prompt after the appointment asking whoever booked whether it went ahead — which carries two single-use action links that record the answer without signing in, the join link for a video appointment when one is created after the confirmation has already gone out, the notice telling a practitioner that a video appointment's join link could not be created at all — addressed to them, naming the client and the appointment time, the emails you receive as a participant in a group program (your program-enrolment confirmation carrying your personal access link, a notice when new program content — a module — is released to you, a reminder before a group session, a notice if a group session is cancelled, the offer of a place when a spot opens on a program waitlist, and an update your practitioner writes and chooses to send to everyone in your group — its text is theirs, so it can say whatever they put in it), the one-time code that verifies an email address at the moment of booking, and two notices addressed to our own staff rather than to you — that an account was created, naming you and your sign-in method, and that you submitted feedback, containing what you wrote). Subscription receipts — the ones for what you pay NutraPlanner — are sent by Stripe, not Resend. Resend receives the recipient email address and the email body. Seven of these reach someone who may have no account with us: an intake-form invitation and its reminders are addressed to you even if you have no NutraPlanner account and have never become a client; the notice to your dietitian names you in its subject line; and your copy of a signed consent contains the frozen consent text, your typed legal name, and the date you signed; and a booking email — including the verification code — is addressed to whoever booked the appointment, names the practitioner, and states the appointment time; and appointment mail — the confirmation and its calendar attachment, any reschedule or cancellation, and the reminders — is addressed to anyone a practitioner adds to an appointment as an additional participant, who may never have booked anything and may hold no account, and which names the practitioner and states the appointment time; and every group-program email is addressed to you as an enrolled participant even if you never create an account, and carries the program name, session times, and your personal access link; and a billing email — an invoice, receipt or payment reminder your practitioner issues — is addressed to a third-party payer you or your practitioner nominated, for example a parent or an employer plan, who may hold no NutraPlanner account of their own. An appointment email addressed to YOU names the appointment type your practitioner chose for it, which appears as the subject line and as the title of the calendar attachment; where a practitioner has named a reason for the visit, that is health information about you, sent to you. It is severed from mail to an additional participant, along with the notes. Beyond that — and apart from a group-program update, which carries whatever text your practitioner writes in it — none of these emails carries your intake answers, appointment notes, or any other health information. It is used only for service-related communications, not marketing. We also use Resend to deliver the invoices, receipts and payment reminders your practitioner issues to you through NutraPlanner. A billing email carries the document number, one amount — the total on the document when it is issued, the balance still owing on a reminder — and a link to sign in to the portal. The message does not name you and does not name your practitioner, and it carries no service date, no line descriptions and no other clinical detail, because the document itself stays behind portal sign-in. What it does reveal, to anyone who can read that mailbox, is that a practitioner is billing the recipient through NutraPlanner.
  • Cloudflare R2 (global, Canadian region preferred): object storage for user-uploaded files (recipe images and, for portal clients, meal photos attached to meal logs and the files you and your practitioner attach to messages — photos, and documents such as lab results) and for the archives we build when you ask for a copy of your data. R2 receives the file contents and access-control metadata. Export archives are handled differently from the other files listed here: each one is sealed before it leaves our servers under a key created for that single export request and kept only in our own database, so Cloudflare receives ciphertext it has no means of reading. Deleting the export request destroys that key, and with it the archive.
  • OpenAI (United States): if recipe-image generation is enabled, we send the recipe title and ingredient list to OpenAI to produce an illustrative image. We do not send client health data, personal information, or identifiers. OpenAI is contractually prohibited from training its models on data sent via its API.
  • Self-hosted Plausible Analytics: NutraPlanner operates Plausible Community Edition on its own hosting infrastructure for cookieless statistics about published public pages and marketing clicks. Events include public page paths, referring site origins and browser/device information. IP addresses are processed to derive approximate location and daily visitor identifiers. We exclude private application, portal, booking and authentication routes, URL queries, fragments and custom event properties. Plausible Insights does not host this instance or receive its analytics events.
  • Sentry (United States or EU — not currently active): error monitoring is currently disabled in production and no data flows to Sentry today. We list it for transparency because the integration exists in our code; we will enable it only under a data-processing agreement covering health information. If enabled, Sentry would receive stack traces, browser type, page URL, anonymous error grouping identifiers, and breadcrumbs of user interaction (e.g. button clicked, route changed) that immediately precede an error. We configure Sentry to scrub form fields and headers; client health data and credentials would never be transmitted. Session replay is not enabled.

We do not use advertising or behavioural-tracking services, and our only analytics tool (Plausible, above) is cookieless and provides aggregate reports. We do not sell or rent personal information. Apart from the subprocessors above (each of which acts on our instructions or as a regulated payment processor), we do not share client health data with anyone.

We will update the list above before engaging any new subprocessor that receives personal information. Material changes are communicated via the effective-date update on this page; substantial changes affecting practitioner-held client data are additionally communicated by email to the account holder.

6. Your Rights

You have the right to:

  • Access the personal data we hold about you, subject to the limited exceptions described below
  • Request correction of inaccurate data
  • Request deletion of your account and associated data — or, if you joined the beta waitlist without creating an account, removal of your email address from that list
  • Object to or restrict certain processing of your data
  • Export your data in a portable format, subject to the same limited exceptions
  • Withdraw consent for optional features (e.g. Google Calendar sync) at any time

To exercise any of these rights, contact us at hello@nutraplanner.com.

Limits on access and export

In a small number of cases we cannot include everything in a self-serve access or export request. Where you are a client receiving care through a practitioner using NutraPlanner: (a) internal safety flags your care team uses to co-ordinate your care are withheld, because disclosing them outside a care conversation could reasonably be expected to cause serious harm; (b) unsigned draft notes your practitioner has not finalised are withheld as unfinished professional work product — every finalised note is included; (c) where your practitioner has set your account to hide quantitative nutrition figures for clinical reasons, those figures and the related nutrition targets are temporarily withheld, and are released as soon as your practitioner changes that setting; and (d) where your record names another provider, such as a family doctor or a referring professional, their contact details are included but any private remarks your practitioner recorded about that person are severed, because they are information about a third party. Each of these four is flagged inside the file itself, with the ground relied on and where to take it if you disagree. These exceptions are recognised by PIPEDA (s. 9) and by Quebec Law 25 / P-39.1 (s. 37 and s. 40). Beyond them, a self-serve file is not guaranteed to contain every technical and administrative record we hold that relates to you — for example, entries you or your practitioner have already deleted, answers to a form you began but never submitted, internal delivery metadata about messages we sent about you, and the day-by-day contents of a meal plan you were assigned — the file names the plan, its dates, its status and your practitioner's notes on it, but not each day's meals and dishes. These are not withheld on any legal ground; they are simply outside what the self-serve export assembles. If you think something is missing from your file, write to our Privacy Officer at sam@nutraplanner.com and we will send it to you or tell you the specific ground on which it is being withheld.

Every export file states, inside the file itself, which categories were withheld and on what ground. If you disagree with anything withheld, contact our Privacy Officer (section 10). If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Quebec residents, to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

If your practitioner has set your account to hide quantitative nutrition figures and you export your own data, we notify your practitioner that you downloaded a copy, so they can follow up with you about anything the file leaves out. That notification contains no figures and no part of the file's contents. Practitioners can turn it off in their notification settings.

7. Data Retention

We retain your data only as long as we have a legitimate purpose for keeping it. Specifically:

  • Account and profile data: retained while your account is active. Upon account deletion, data is removed from production databases within 30 days.
  • Client health data (entered by practitioners): retained while the practitioner's account is active. Upon practitioner account deletion, the client records the practitioner entered are removed within 30 days, unless the practitioner has exported them. The one exception is invoices and receipts issued to you, which are held to the retention floor described under billing records above — a professional college and the Income Tax Act both require them to outlive the account.
  • Data export archives: when you ask for a copy of your data, the archive we build is available to download for 7 days. At the end of that window we destroy that archive's encryption key — a key created for that one request and held only by us — so the archive can no longer be opened by us, by our storage provider, or by anyone else. Two things follow that we would rather state than leave you to discover. The sealed file itself stays in our storage provider's system until our scheduled deletion process removes it; without the key it cannot be opened. And a copy of the key can survive in a backup taken before we destroyed it, until that backup is overwritten on the rolling window described below. The record of a request we completed is deleted 30 days after it finishes. The record of a request that FAILED is not deleted on a timer: it is the only record that you asked for a copy and did not get one, and we keep it so the request can be followed up. Either record is removed with your account if you delete your account, and you can ask our Privacy Officer to remove a failed request's record sooner.
  • Whole-practice export archives (requested by a practitioner, not by you): a practitioner can export their entire caseload — every one of their clients' complete charts — as one archive. This is the file a college record transfer or a departure from a group clinic is discharged with. It holds client charts, and the practitioner's own recipe and meal-plan-template library (structure and titles, not the per-meal notes that stay in each client's chart). It does not include the practitioner's intake form templates or their own account record, which is why it does not on its own discharge the sale of a practice. It is available to that practitioner to download for 7 days, after which we destroy that archive's key on the same terms as the entry above, including the caveats there about the sealed file and about backups. Two consequences follow that we would rather state than let you discover. First, if you were one of that practitioner's clients at the moment the archive was built, your chart is inside it — and ending your relationship with that practitioner, or asking us to remove your record, does not reach inside an archive that already exists. What those requests do is destroy the separate per-client copy we hold and keep you out of every archive built afterwards; the archive that already exists stops being openable at its own 7-day deadline, which is always within the 30 days in which we commit to removing your record. Second, once the practitioner has downloaded the archive, the copy on their own equipment is theirs: how it is kept, and for how long, is governed by their professional obligations and by the privacy law that applies to their practice, not by us. Ask them, or contact our Privacy Officer (section 10).
  • Backups: encrypted backups are retained for 30 days on a rolling window for disaster recovery, after which they are overwritten.
  • Billing and tax records: retained after account deletion to meet record-keeping obligations. Two kinds of record are covered. Our own subscription billing records (what you paid us) are kept 7 years under the Income Tax Act (s. 230) and contain only invoice amounts, dates and business identifiers. Separately, where your practitioner uses NutraPlanner to invoice you directly, those invoices and receipts are kept for the longer of their professional college's requirement and 6 years under the Income Tax Act — in Ontario the College of Dietitians requires at least 10 years after your last visit. Because a receipt has to satisfy your insurer, those records necessarily contain your name and contact details, the date, length and delivery method of each service, a description of the service provided, and the amounts charged and paid. They are encrypted at rest, and are retained even if you ask us to erase your data — the retention floor set by your practitioner's regulator overrides an erasure request for these specific records, and we will tell you when that applies.
  • Beta waitlist emails: retained until the private beta ends or you ask us to remove your address, whichever comes first. When the beta programme closes, the list is deleted.
  • Audit and security logs: retained for 12 months for security monitoring and incident response, then deleted.
  • Breach records: retained for 24 months as required by the PIPEDA Breach of Security Safeguards Regulations.
  • Data subject to a legal hold (active litigation, regulatory request, or law-enforcement order) is retained until the hold is lifted.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date above. For substantial changes affecting how we use or share personal information, we will additionally notify account holders by email at least 30 days before the change takes effect.

9. Contact Us

If you have any questions about this Privacy Policy or how we handle your information, please contact us at hello@nutraplanner.com.

10. Privacy Officer

In accordance with PIPEDA Principle 4.1 and Quebec Law 25 s. 3.1, we have designated an individual accountable for our compliance with this Privacy Policy and applicable privacy law. You may contact our Privacy Officer regarding any privacy-related question, complaint, request to exercise your rights, or report of a suspected breach:

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Quebec residents, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

11. Data Breach Notification

We maintain administrative, technical, and physical safeguards to protect personal information. In the event of a breach of security safeguards involving personal information under our control that creates a real risk of significant harm, we will:

  • Report the breach to the Office of the Privacy Commissioner of Canada (and the Commission d'accès à l'information du Québec for Quebec residents) as soon as feasible;
  • Notify affected individuals as soon as feasible, by email to the address on file, with sufficient information to understand the significance of the breach and the steps they can take to mitigate harm;
  • Notify practitioners holding client records affected by a breach so they can fulfil their own notification obligations under provincial health-information legislation;
  • Maintain a record of every breach involving personal information, regardless of severity, for at least 24 months.

If you become aware of an actual or suspected breach involving your account or data you have entered, please contact our Privacy Officer immediately at sam@nutraplanner.com.

12. International Users

NutraPlanner is operated from and primarily serves Canada. If you access the service from outside Canada, the following additional terms apply:

  • European Economic Area, United Kingdom, and Switzerland: If you are located in the EEA, UK, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent laws apply. The lawful bases for our processing are: (a) performance of a contract with you (sections 2-3 above); (b) compliance with legal obligations (section 7 — tax retention); (c) our legitimate interests in operating, securing, and improving the service (section 5 — error monitoring); and (d) your consent for optional features (Google Calendar sync, billing). You have the right to access, rectify, erase, restrict, port, and object to processing of your data, and to lodge a complaint with your local supervisory authority. To exercise these rights, contact our Privacy Officer.
  • California (United States): If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we have collected, to delete it, to correct it, to opt out of any sale or sharing of personal information (we do not sell or share — see section 5), and to limit the use of sensitive personal information. We do not discriminate against you for exercising these rights. The categories we collect are listed in section 2; the purposes are listed in section 3; the third parties are listed in section 5. To exercise these rights, contact our Privacy Officer.
  • Other regions: If your jurisdiction grants you specific privacy rights not enumerated above, we will honour those rights to the extent required by the law of your jurisdiction. Contact our Privacy Officer.

13. Children's Data

NutraPlanner is not directed at children. We do not knowingly create direct user accounts for individuals under 16. If we learn that we have collected personal information from a child under 16 in a direct-account context without verifiable parental consent, we will delete that information promptly.

Practitioners may legitimately enter health and dietary information about minor clients in the course of providing nutritional care. In that case the practitioner is responsible for obtaining consent from the minor's parent or legal guardian (or from the minor where they are of an age of consent under applicable health legislation) before entering data. For practitioners serving Quebec residents, Quebec Law 25 imposes heightened consent requirements for personal information of persons under 14. NutraPlanner stores this data on the practitioner's behalf and applies the same safeguards as for adult client data.

14. Practitioner Data Processing Agreement

Practitioners using NutraPlanner to manage client health information act as the custodian or controller of that information under provincial health-information legislation (such as Alberta's Health Information Act, Ontario's Personal Health Information Protection Act, and Quebec's Act respecting health and social services information). NutraPlanner acts as the practitioner's information manager / processor with respect to that data.

A Data Processing Agreement (DPA) describing our respective obligations — including security safeguards, subprocessor management, breach notification, and instructions for processing — is published at /policies/dpa and is incorporated by reference into our Terms of Service. By using NutraPlanner to enter or manage client health information, you agree to the terms of that DPA. To request a countersigned copy or to discuss specific provincial requirements, contact our Privacy Officer at sam@nutraplanner.com.