Ready to try it?

Built in the open

A small team, on purpose

About NutraPlanner

Why we built this

The HARD/SOFT filter engine lets you express real nutrient constraints and food-group rules — not just diet tags — so recipes match what a client actually needs.

Encode the clinical detail

Deliver plans under your own brand as a shareable web link or printable PDF, with grocery lists generated automatically.

Branded, client-ready plans

No insurance-billing bloat — just the meal-planning and client tools a cash-pay RD actually uses, priced for a solo practice.

Built for cash-pay practice

Plan your next client in NutraPlanner

Clinically precise meal planning, without the multi-app stack

Frequently asked questions

Setting up the practice itself

Set nutrient and food-group rules for your own diet, and find recipes that fit them automatically.

Filter to your needs

Assemble a week of meals and get a consolidated grocery list so shopping is one trip, not a scramble.

Plan and shop

Personal use will be free — join the waitlist and we'll email you the moment it's ready.

Free when it opens

Start planning your meals

Plan your own meals around what your body needs

Build plans from the recipes you already use and deliver them under your own brand as a web link or PDF.

Your recipes, your brand

Match recipes to each client's preferences and restrictions with the dietary-filter engine — no spreadsheets.

Filtering that fits each client

Share a booking link so clients can self-schedule, synced to your calendar — no separate scheduling tool.

Scheduling built in

Build your first plan today

Branded meal plans your clients will actually follow

Ready to get started?

Send feedback

Get in touch

Follow along

Contact Us

1. What are cookies?

a secure, HTTP-only session cookie that keeps you signed in. This is a JWT-based token that expires after 24 hours. Without it, you would need to log in on every page.

when you book an appointment, your name and email are held briefly in your browser's sessionStorage so the confirmation screen can show them without putting them in the page address. This is cleared when you close the tab, and it is never sent anywhere other than the booking request you submitted. We use sessionStorage here specifically so these details do not end up in a URL that could be logged or shared.

stores the redirect URL during sign-in so you return to the correct page after authentication. HTTP-only, short-lived.

prevents cross-site request forgery attacks on authentication forms.

stores your chosen language (English or French) so the site loads in the correct language on each visit.

part of the PKCE OAuth security flow used during Google sign-in. HTTP-only, expires after 15 minutes.

we store your sidebar collapse state in browser localStorage (not a cookie), but mention it here for transparency.

Sentry is currently DISABLED and receives nothing from this service. If we enable it, it would store a per-session identifier in your browser to group errors from the same browser session, and record a short trail of recent user-interface interactions (route changes, button clicks — never form values) that immediately precede an error, to help us reproduce and fix bugs. Session replay would not be enabled, and no client health data, passwords, or payment-card details would be transmitted. We describe it here so this page stays accurate about what the software can do, not only what it is doing today.

validates the OAuth state parameter to prevent cross-site attacks during Google sign-in. HTTP-only, short-lived.

if you pick a timezone on a booking page, we store that choice in your browser so a return visit does not ask again. It is a display preference only and is never sent to us as a tracking identifier.

2. How we use cookies

booking pages, sign-up, sign-in and password-reset forms load a bot-detection widget from Cloudflare. Cloudflare receives your IP address and basic device signals in order to tell a person from an automated script; this is strictly necessary to stop our booking pages and account forms from being abused. We use the standard widget without pre-clearance, so it does not place a cookie on your device. Cloudflare acts as our service provider and classifies these signals as strictly necessary security data.

3. What we do not use

4. Your choices

5. Users in the European Economic Area, United Kingdom, and Switzerland

6. Changes to This Policy

7. Contact Us

Cookies Policy

For the term of the Controller's account, until terminated in accordance with the Terms of Service, plus the deletion and retention periods set out in section 10 of this DPA and section 7 of the Privacy Policy.

Storage, retrieval, modification, deletion, indexing, filtering, scheduling, synchronisation with calendar services (when enabled by the Controller), billing-related processing (through Stripe), transactional email (through Resend), object storage of uploaded content (through Cloudflare R2), and recipe-image generation (through OpenAI, where enabled). Error and reliability telemetry through Sentry is integrated but not currently active (see Annex C).

Provision of the NutraPlanner nutrition-planning service to the Controller, including secure storage, retrieval, and processing of Personal Information entered by the Controller in the course of providing nutritional, dietary, and related professional services to clients.

Annex A — Subject Matter, Duration, and Nature of Processing

Identifying information (name, date of birth, sex assigned at birth where the client provides it, and contact details — the default intake form does not collect a provincial health-insurance number); identifying and contact details of third parties supplied by the client (an emergency contact's name, telephone number and relationship to the client; the client's family doctor or primary-care provider; the referring provider; and the name and relationship of a parent, guardian or caregiver who completes a form on the client's behalf); health information (medical history, allergens, dietary restrictions, nutritional deficiencies, body measurements, goals); self-reported health and lifestyle logs recorded by portal clients (meal and food diaries, symptom logs including digestive symptoms and their severity, mood, stress, sleep, energy, hydration, steps and exercise); photos clients attach to a meal log; message and comment threads exchanged between a client and their practitioner about those logs; appointment and scheduling information; clinical notes (free-text, may contain additional categories at the Controller's discretion); intake-form responses entered by the client or their guardian (including reproductive-health status where the Controller enables that section, and optional questions about eating patterns, which are held as the client's answers only and are not scored); electronic-signature consent evidence (typed legal name, date and time, IP address, browser user-agent, a frozen copy of the consent text presented, and where applicable per-purpose consent choices and language election); user-uploaded files (recipe images, client meal photos, optionally other documents). NutraPlanner does not collect special categories of data (e.g. biometric, genetic, sexual-orientation data) beyond what the Controller elects to enter into free-text fields.

Clients (including minors) of the Controller who receive nutritional, dietary, or related professional services from the Controller; prospective clients who complete an intake form sent by the Controller before any account or care relationship exists; a parent, guardian or caregiver who completes an intake form on a client's behalf; third parties about whom a client supplies Personal Information rather than supplying it themselves — an emergency contact the client names, the client's family doctor or primary-care provider, and the provider who referred the client — from whom NutraPlanner collects nothing directly and with whom NutraPlanner has no relationship; and where applicable the Controller's own staff or representatives invited into a team workspace. Where a data subject supplies Personal Information about a third party, the Controller remains responsible for any notice to, or consent of, that third party required by Applicable Privacy Law.

Annex B — Categories of Data Subjects and Personal Information

Role-based access control; row-level multi-tenant isolation; least-privilege defaults; multi-factor authentication required for production-system administrative access; audit logging on all data-modifying API calls.

Backups retained on a 30-day rolling window for disaster recovery, stored on encrypted block storage, in addition to the managed database provider's own 7-day automated backups. The restore procedure has not yet been exercised; a scheduled restore drill is planned.

Mandatory code review on all production changes; automated dependency-vulnerability scanning; timely patching of identified vulnerabilities; principle-of-least-privilege deployment access.

TLS 1.2+ in transit. AES-256-GCM at rest for database storage; equivalent encryption at rest for object storage. Application-level authenticated encryption for designated PHI fields. Key rotation is performed by re-encryption migration rather than in place.

Centralised audit logging of all data-modifying API calls and of client-record reads. Automated security-event alerting is not yet in place; logs are reviewed on investigation. Third-party error and reliability telemetry via Sentry is integrated in the codebase but is not currently active and receives no data today; if enabled it will be configured to scrub form fields and sensitive headers, and only under a data-processing agreement covering health information. This matches section 5 of the Privacy Policy.

Passwords hashed with bcrypt; no plaintext credentials stored anywhere; secrets managed in a dedicated secrets store, never committed to source code.

User-account data and client health/nutrition data are stored in separate database instances with no cross-database foreign keys.

Annex C — Security Measures Summary

hosts the application servers and the managed PostgreSQL cluster in which all service data — including client health records entered by the Controller — is stored. Canadian data residency; encryption at rest and TLS enforced in transit. Engaged under DigitalOcean's data-processing agreement; SOC 2 attestation held by the provider.

calendar synchronisation and availability checking when explicitly enabled by the Controller. Receives appointment titles, times, and OAuth tokens for events NutraPlanner writes, and provides free/busy availability and the list of calendars from the connected account, which NutraPlanner reads to compute booking availability.

per-booking video room creation, when the Controller selects Google Meet as the location for a scheduling link. Receives a room-creation request attached to the Controller's synced Google Calendar event — the same event data described in the Google Calendar entry above, and nothing further. NutraPlanner does not join, record, transcribe or otherwise process the video session itself: the Controller and their client connect to Google directly. Engaged under Google's data processing terms, alongside the Google OAuth and Google Calendar entries above.

authentication of users who sign in with Google. Receives the authentication request only.

where enabled. Receives recipe title and ingredient list only. Contractually prohibited from training on API data.

cookieless, aggregate-only analytics on public pages. Receives page URL, referrer, browser and device type, and country-level location. No cookies, no cross-site identifiers, and no Personal Information of clients.

stores user-uploaded files (recipe images and, for portal clients, meal photos attached to meal logs). Receives the file contents and access-control metadata.

verification, password-reset, multi-factor sign-in code, security-activity notification, welcome/onboarding, free-trial reminder, client-portal invitation, portal-activity notification, intake-form invitation, form-reminder nudge, form-submitted notice, signed-consent copy, appointment confirmation/change, video-appointment join-link follow-up, video-appointment room could not be created notice, booking email-verification, and internal new-account / feedback notification emails (the last two are addressed to the Processor's own staff and name the data subject; the feedback one carries their free text. Billing receipts are sent by Stripe, not Resend. Portal-activity notifications carry a headline and a deep link only — no client detail; appointment and booking emails carry the practitioner name and the appointment time). Receives recipient email and email body.

application error and reliability telemetry. Not currently active — no data flows to Sentry today; listed for transparency because the integration exists in the codebase. If enabled, would receive stack traces, browser type, page URL, anonymous error-grouping identifiers, and interaction breadcrumbs (scrubbed of form fields and headers).

subscription billing. Receives billing contact details and payment-card data entered directly into Stripe's hosted form.

Annex D — Subprocessors

Preamble

10. Return and Deletion at Termination

11. Term and Effect

12. Changes to This DPA

13. Liability

14. Governing Law

15. Contact

1. Definitions

2. Scope and Roles

3. Personnel and Confidentiality

4. Security Safeguards

5. Subprocessors

6. Data Subject Rights

7. Breach Notification

8. International Transfers

9. Audit and Information Rights

Data Processing Agreement

Record weight and other measurements over time and see them charted.

Measurements and trends

Capture client goals and session notes so the history travels with the client.

Goals and notes

Manage up to 3 clients free, 25 on Starter, or unlimited on Professional — the tools are identical at every tier.

Scales with your roster

Client management that keeps the context in one place

See it on your own clients

The rules behind this

Everything you need to plan, deliver, and manage — in one tool

Generate a full plan to the client's calorie and macro targets. Every plan comes with a fit report — how close each day landed, and an honest flag when the targets can't be met — instead of a black box that just says done.

Generation that shows its work

Prefer to choose? Guided picks walks the plan one meal at a time with suggestions ranked for the client's targets and the plan so far — from close-to-their-routine to something new. Every suggestion and swap is pre-screened against allergen and diet restrictions: hard guarantees, not filters.

Guided, manual, or both

Portions tune themselves to the day's targets, cook-once-eat-twice leftovers are tracked accurately across the week, and every plan ships with a consolidated grocery list — delivered as a branded web link or printable PDF on every plan, including Free.

Built for real kitchens

Meal plans that hit the prescription

Mark a rule HARD (must pass) or SOFT (contributes to a score), so you can separate non-negotiables from preferences.

HARD and SOFT constraints

Filter on nutrient thresholds (less-than, greater-than, equal, between) and on food groups by direct, ancestor, or descendant scope.

Nutrient and food-group rules

Change a recipe's ingredients and matches re-evaluate in the background — no manual re-checking.

Matches recompute automatically

A dietary-filter engine that actually understands food

Create booking links clients can use to self-schedule — included on the Free tier and every paid plan.

Shareable scheduling links

Connect your calendar so availability stays accurate and bookings show up where you already work.

Calendar sync

Set your availability once and let NutraPlanner handle the work of finding a time.

Less back-and-forth

Choose Google Meet as a link's location and every booking mints its own room — a fresh, private link each time, not one pasted room reused forever. It goes out with the confirmation email, shows on the client's booking page, and survives a reschedule. Requires a connected Google Calendar.

Video appointments

Booking pages that live on your own terms

Recipes, meal planning, the filter engine, branded delivery, and scheduling come together — so you can retire the two- or three-app stack most practitioners cobble together.

One subscription, not a stack

Most tools just let you tag a recipe 'vegan.' NutraPlanner lets you encode HARD and SOFT nutrient constraints and food-group rules, then matches recipes to each client automatically.

A real dietary-filter engine

What makes NutraPlanner different

For individuals

For practitioners

Ready to start planning?

Try the filter engine

The full picture for every client

Everything at a glance

Plans built around each client

See every client's trajectory

Precision dietary filtering no other tool offers

Clinical meal planning, without the app stack.

meal planning.

client management.

dietary filtering.

progress tracking.

your practice.

One platform for

Manage your full client roster in one place.

Your schedule, clients, and activity — all on one screen.

Build day-by-day meal plans from filtered recipes.

Log and chart each client's weight trends over time.

Filter 20,000+ recipes by nutrients, food groups, and more.

Audit logging on client data

Encrypted in transit and at rest

Your data stays yours

Built around Canadian privacy law

Start free today

Questions

Every paid plan includes the full NutraPlanner toolkit — meal planning, your own recipes, the dietary-filter engine, branded plans, and scheduling. Paid plans differ only by how many active clients you manage.

One toolset. Pay for the clients you have.

10. Privacy Officer

11. Data Breach Notification

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we have collected, to delete it, to correct it, to opt out of any sale or sharing of personal information (we do not sell or share — see section 5), and to limit the use of sensitive personal information. We do not discriminate against you for exercising these rights. The categories we collect are listed in section 2; the purposes are listed in section 3; the third parties are listed in section 5. To exercise these rights, contact our Privacy Officer.

If you are located in the EEA, UK, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent laws apply. The lawful bases for our processing are: (a) performance of a contract with you (sections 2-3 above); (b) compliance with legal obligations (section 7 — tax retention); (c) our legitimate interests in operating, securing, and improving the service (section 5 — error monitoring); and (d) your consent for optional features (Google Calendar sync, billing). You have the right to access, rectify, erase, restrict, port, and object to processing of your data, and to lodge a complaint with your local supervisory authority. To exercise these rights, contact our Privacy Officer.

If your jurisdiction grants you specific privacy rights not enumerated above, we will honour those rights to the extent required by the law of your jurisdiction. Contact our Privacy Officer.

12. International Users

13. Children's Data

14. Practitioner Data Processing Agreement

1. Introduction

email address, first and last name, and a password (stored as a one-way hash — we never store or have access to your plain-text password). If you sign in with Google, we receive your name and email from Google; we do not access your Google password.

if you connect Google Calendar, we store OAuth tokens and sync appointments between NutraPlanner and your calendar. With your authorisation, we also read your calendars' free/busy availability and the list of calendars on your account, which we use to prevent double-booking when generating your public booking availability. We do not read the contents, titles, or attendees of events we did not create.

medical history, dietary preferences, allergens, aversions, nutritional deficiencies, body measurements, goals, clinical notes, and appointment records that you enter on behalf of your clients.

if your dietitian invites you to their client portal, you may create your own login (email and a hashed password) to view the care information they share with you, such as your appointments and meal plans, and to use the self-logging tools described below. You control your own credentials; your dietitian cannot see your password, and you can be unlinked from the portal at any time without your dietitian losing your care record.

if your dietitian sends you an intake form, we collect the answers you enter yourself through a secure, expiring link (no account required). Every intake form asks who you are: your name, your date of birth, optionally your sex assigned at birth, and who is filling the form in (you, or a parent, guardian, or caregiver, who gives their own name and relationship to you). It also offers optional fields for your family doctor or primary-care provider, the provider who referred you, and an emergency contact (name, phone number, and relationship to you). Depending on which sections your dietitian turns on, the form may also ask about health history, medications and supplements, allergies and intolerances, dietary practices, lifestyle information, and optional questions about eating patterns and your relationship with food. The form does not ask for your provincial health-insurance number, and we do not use NutraPlanner to bill any provincial health-insurance plan. Some of these fields ask about other people — your emergency contact, your family doctor, the provider who referred you, and anyone completing the form on your behalf. Please enter their details only where you are comfortable doing so, and let them know you have. Your dietitian holds that information to reach your emergency contact if the need arises and to identify the clinicians involved in your care; we store it on their behalf, use it for nothing else, and never contact those people for marketing. If someone you have named wants to know what we hold about them, or wants it corrected or deleted, they can contact our Privacy Officer (section 10) or the dietitian who sent you the form. When you sign a consent form electronically, we also record consent evidence: your typed legal name, the date and time, your IP address, your browser's user-agent string, and an exact frozen copy of the consent text you were shown (including, in Quebec, your per-purpose consent choices and any language election). Free-text answers and consent records are encrypted at rest and visible only to you and the practitioner who sent the form; they are never used for advertising or sold.

dietary preferences, meal plans, and recipe interactions.

credentials, specialisations, and licensing details you choose to add to your profile.

if you use the portal's logging features, we collect the information you choose to record: meal and food diaries (including photos you attach to a meal log), symptom logs including digestive symptoms and their severity, mood, stress, sleep, energy, hydration, steps and exercise, and comments you exchange with your practitioner about your logs. This is sensitive health information: it is encrypted at rest, visible only to you and the practitioner(s) responsible for your care, and is never used for advertising or sold.

2. Information We Collect

we collect basic usage information such as pages visited and actions taken to maintain and improve the service. We use session cookies for authentication.

if you ask to be notified while NutraPlanner is in private beta, we store the email address you submit so we can contact you when a place opens up. You don't need an account to join the waitlist, and we use the address for nothing else.

3. How We Use Your Information

4. Data Storage and Security

our cloud infrastructure provider. DigitalOcean hosts the application servers and databases where service data — including client health data — is stored, in Canadian data centres. DigitalOcean provides infrastructure only and does not access the data; sensitive health fields are additionally encrypted at the field level before storage (see section 4).

for appointment synchronisation and availability checking, only when you explicitly connect your account. NutraPlanner stores OAuth tokens to write the appointments it creates and to read your calendars' free/busy times and calendar list, so your booking availability reflects when you are already busy. You can disconnect at any time from your profile settings.

for video telehealth appointments, only when your practitioner chooses Google Meet as the location for a scheduling link. NutraPlanner asks your practitioner's connected Google account to create a meeting room on the calendar event described above — which carries any note you provided when booking. The join link is emailed to you and shown on your booking pages. NutraPlanner is not part of the call itself: you and your practitioner connect to Google directly, and we do not join, record or transcribe it.

for account sign-in. Google receives the authentication request only; we do not share any NutraPlanner content with Google as part of sign-in.

if recipe-image generation is enabled, we send the recipe title and ingredient list to OpenAI to produce an illustrative image. We do not send client health data, personal information, or identifiers. OpenAI is contractually prohibited from training its models on data sent via its API.

privacy-focused, cookieless web analytics. Plausible receives the page URL, referrer, browser and device type, and coarse location (country level) for visits to our pages, plus anonymous product events (e.g. "sign-up clicked"). It sets no cookies, does not track visitors across sites, and never receives names, email addresses, or any client health data. Data is aggregate-only and processed in the EU.

object storage for user-uploaded files (recipe images and, for portal clients, meal photos attached to meal logs). R2 receives the file contents and access-control metadata.

delivers transactional emails (account verification, password resets, multi-factor sign-in codes, security-activity notifications, welcome and onboarding messages, free-trial reminders, client-portal invitations, portal-activity notifications, intake-form invitations, reminders about a form you have not yet completed, the notice telling your dietitian that you completed a form, your own copy of a consent you signed, appointment confirmations and changes (booked, pending approval, approved, declined, rescheduled, cancelled — sent to whoever booked and to the practitioner), the join link for a video appointment when one is created after the confirmation has already gone out, a notice to the practitioner if a video-appointment room could not be created, the one-time code that verifies an email address at the moment of booking, and two notices addressed to our own staff rather than to you — that an account was created, naming you and your sign-in method, and that you submitted feedback, containing what you wrote). Billing receipts are sent by Stripe, not Resend. Resend receives the recipient email address and the email body. Four of these reach someone who may have no account with us: an intake-form invitation and its reminders are addressed to you even if you have no NutraPlanner account and have never become a client; the notice to your dietitian names you in its subject line; and your copy of a signed consent contains the frozen consent text, your typed legal name, and the date you signed; and a booking email — including the verification code — is addressed to whoever booked the appointment, names the practitioner, and states the appointment time. None of these emails carries your intake answers, appointment notes, or any other health information. It is used only for service-related communications, not marketing.

error monitoring is currently disabled in production and no data flows to Sentry today. We list it for transparency because the integration exists in our code; we will enable it only under a data-processing agreement covering health information. If enabled, Sentry would receive stack traces, browser type, page URL, anonymous error grouping identifiers, and breadcrumbs of user interaction (e.g. button clicked, route changed) that immediately precede an error. We configure Sentry to scrub form fields and headers; client health data and credentials would never be transmitted. Session replay is not enabled.

processes subscription payments. Stripe receives your name, email, billing address, and payment-card details (entered directly into Stripe's secure form — we never see or store full card numbers). Stripe acts as an independent controller for fraud prevention and tax-reporting purposes under its own privacy policy at stripe.com/privacy.

Sandra Fraser

Articles by this author

How NutraPlanner Hides Calories and Macros From a Client — NutraPlanner

How a Food Database Knows Worcestershire Sauce Contains Fish

Protein Requirements by Population (g/kg)

Protein: g/kg vs % of Calories

BMR Equations: Mifflin-St Jeor vs Katch-McArdle

Macro Allocation: The Protein-First Method

Prescribe it in NutraPlanner