Privacy Policy

Last updated: July 28, 2026

Introduction & Data Controller

OptiPlate Health (“we,” “us,” or “our”) operates this website and services. This Privacy Policy explains how we collect, use, disclose, and protect your personal data and your rights.

Data Controller: OptiPlateHealth
Contact: [email protected]

1. Information We Collect

We collect:

  • Account details: email, hashed password, username
  • Profile & dietary data you provide: age, sex, height, weight, food allergies, dietary preferences, activity level, goals
  • Payment metadata: transaction ID, amount, date (payment card details are processed by our payment processor and are not stored by us)
  • Usage & technical data: IP address, browser user agent, device type, timestamps, log data
  • Communications: support correspondence, feedback

Data minimization: we collect only data required to deliver nutrition guidance and secure the platform. We do not require full name or postal address for standard service delivery.

2. Purposes & Legal Basis (EEA/UK users)

We process personal data for:

  • Performance of the contract (Art. 6(1)(b) GDPR) — to provide your purchased digital plan
  • Legitimate interests (Art. 6(1)(f) GDPR) — product improvement, fraud prevention, security; we perform a balancing test to ensure interests do not override your rights
  • Explicit consent (Art. 9(2)(a) GDPR) — for processing dietary and wellness information you provide. You will be asked to give explicit consent on the intake form before submitting personal preferences

We do not sell your data to third parties for marketing purposes.

3. Special Category Data (GDPR Art. 9)

To generate nutrition protocols we may process health-related information you provide, including biometrics, dietary restrictions, allergy data, and wellness indicators. Under GDPR this may qualify as special category personal data.

Legal basis: explicit consent under Art. 9(2)(a) GDPR, combined with Art. 6(1)(b) for service delivery. You may withdraw consent at any time by contacting support. Withdrawal does not affect lawful processing completed before withdrawal.

4. Automated Processing & Human Review (GDPR Art. 22)

Our service uses automated systems (including AI models) to generate meal structures and protocol recommendations from your submitted inputs. This is an automated decision-support process.

  • You may request human review of automated outputs by contacting [email protected].
  • You may request correction of inaccurate input data that affected generated outcomes.
  • You may object to processing and request account/data deletion where legally applicable.

5. Third-Party Processors

We share data only with providers necessary to operate the service and for which we have appropriate agreements:

  • OpenAI (AI model provider) — used to process inputs and generate plans
  • Lemon Squeezy (Lemon Squeezy, LLC) — payment processing; may act as merchant of record and process billing data under their privacy policy
  • Transactional email provider (e.g., Brevo) — for account emails and notifications
  • Meta Platforms (Facebook) — only if you accept the optional marketing pixel on pricing pages (see Section 10); no health or intake data is ever shared with Meta

Note: DPA (Data Processing Agreement) and transfer mechanism documentation available on request.

6. International Transfers (including U.S. sub-processors)

Some providers used to deliver the service are based in the United States, including OpenAI (AI processing) and Lemon Squeezy (payments). Where data is transferred outside the EEA/UK, we rely on lawful transfer mechanisms such as Standard Contractual Clauses (SCCs) and additional safeguards where required.

You can request information about transfer safeguards and processor agreements by contacting [email protected].

7. Data Retention

We retain account and plan data for as long as your account is active plus 2 years for legitimate business purposes, unless you request deletion. Dietary preferences and personal inputs used to generate a plan are retained for 2 years unless you request erasure.

8. Your Rights (EEA/UK)

You have the right to:

  • access your personal data
  • rectification of inaccurate data
  • erasure ("right to be forgotten") in limited circumstances
  • restriction of processing
  • data portability
  • object to processing based on legitimate interests
  • withdraw consent (where processing is based on consent)
  • lodge a complaint with a supervisory authority
  • request human intervention regarding automated decision support (Art. 22 GDPR)

To exercise rights contact: [email protected]. Provide identity proof and we will respond in accordance with GDPR timelines (generally within one month).

9. Security

We implement industry-standard security measures (encryption in transit, access controls, regular audits). However, no system is 100% secure — treat communications accordingly.

10. Cookies & Tracking

  • Essential/session cookies: login session, CSRF protection, and security controls.
  • Security cookies: abuse prevention and account protection workflows.
  • Optional marketing tracking (Meta Pixel): if enabled on pricing pages, the Meta (Facebook) Pixel runs only after you accept it via the on-page consent prompt. Declining does not affect the service.

We do not use cookies to sell personal data profiles.

11. Fraud Prevention

We process IP address and security telemetry strictly for abuse prevention, fraud defense, and service integrity monitoring.

12. US Privacy Rights (CCPA/CPRA)

California residents may request access, correction, deletion, and information about collected categories of personal information, subject to legal exceptions.

OptiPlate Health does not sell personal information.

13. Children

Our service is not intended for children under 16. We do not knowingly collect personal data from minors.

14. Changes & Contact

We will notify you of material changes to this Policy and post a new "Last updated" date.

Contact: [email protected]