Privacy Notice

1. Data controller

Under Law no. 6698 on the Protection of Personal Data (the "KVKK"), Foodlex is the data controller for data about dietitian accounts, subscriptions and payments, and visitors to public pages. For client data that dietitians record on the platform, the dietitian is the data controller; Foodlex is the data processor that processes it on the dietitian's behalf and on their instructions. Clients can address requests under the KVKK to their dietitian in the first instance; Foodlex supports the dietitian in answering them.

2. Personal data processed

The following categories of personal data are processed through our platform:

• Identity data: full name, date of birth, gender
• Contact data: email address, phone number
• Health data: height, weight, body mass index, body fat, waist and hip measurements, health conditions, medications, allergies
• Dietary preferences: dietary restrictions, food preferences, cuisine preferences
• Financial data: payment details, processed through Polar. We do not store card details.
• Usage data: visits to the platform and public pages, sign-up and email verification funnel events, access times, referring page and browser details; Google tags load only after your choice

3. Purposes of processing

• Providing dietitians with client management services
• Producing personalised, AI-assisted nutrition plans
• Weekly progress tracking and reporting
• Managing subscriptions and payments
• Keeping the platform secure
• Meeting legal obligations
• Measuring and improving public pages; optional analytics runs only with your consent

4. Legal basis

Your personal data is processed under articles 5 and 6 of the KVKK, on the following bases:

• Your explicit consent, in particular for health data and optional site analytics
• The formation and performance of a contract
• Compliance with a legal obligation
• Our legitimate interests, namely keeping the platform secure

5. Retention period

Client data is kept while the dietitian's account is open and the dietitian keeps the client on the system. When a dietitian deletes a client, the client's record, measurements and nutrition plans are permanently deleted. When a dietitian closes their account, the account and all client data linked to it are deleted.

6. Data security

The following measures protect your data:

• Health data — conditions, medications, allergies, lab values — and contact details are encrypted with Fernet (AES-128-CBC + HMAC-SHA256) before they are written to the database
• All data in transit is encrypted with TLS
• Database access is confined by row-level security (RLS)
• Every access to and change of data is written to an audit log

6a. Where data is held, and transfers abroad

Foodlex's servers and database are hosted in the European Union, in Amsterdam, the Netherlands. So that the service can be provided, your personal data is transferred to the following processors:

• Railway (the Netherlands) — application and database hosting
• Netlify (United States) — serving the web interface
• OpenRouter / Google (United States) — producing nutrition plans. The client's name, email address and phone number are not sent in this transfer; names, email addresses and phone numbers appearing in free-text fields are removed before sending. Age, gender, measurements and health information are processed. Requests are routed only to endpoints that neither retain the data nor use it for model training (zero data retention).
• Mailjet (France) — sending email
• Polar (United States) — subscriptions and payments. This covers the dietitian's own billing details; no client data is transferred.
• Google Tag Manager and Google Analytics (Google) — loaded on public pages only if you allow analytics, and used to measure page views. Google may process the page visited, referring page, browser/device details and connection information; data may be transferred outside Türkiye through Google's service infrastructure. These tools do not load on sign-in, account or client-record pages.

Transfers of client data needed to provide the service are handled under the relevant notice and client consent. Your choice for optional analytics on public pages is collected separately: Google Tag Manager does not load if you reject it. You can change your choice using the Privacy settings button at the bottom of the page. This choice is separate from consent relating to client data.

7. Your rights

Under article 11 of the KVKK you have the following rights:

• To learn whether your personal data is being processed
• To request information about that processing where it has taken place
• To learn the purpose of processing and whether the data is used in keeping with it
• To learn whether the data is transferred within the country or abroad
• To request rectification where the data is incomplete or wrong
• To request erasure or destruction
• To object to a decision reached to your detriment purely through automated analysis of your data
• To claim compensation where unlawful processing has caused you loss

8. Data recipients

Your personal data may be passed to the following parties through our service providers:

• OpenRouter: producing AI-assisted nutrition plans (the client's name and contact details are not sent; only zero-data-retention endpoints are used)
• Polar: payment processing, as merchant of record
• Mailjet: email delivery
• Google: Google Tag Manager for public-page measurement only when allowed

9. Contact

To exercise your rights under the KVKK, reach us through either of these:

Email: kvkk@foodlex.co

10. If you are in the European Economic Area or the United Kingdom

For dietitian accounts, Foodlex is also the controller under the GDPR and the UK GDPR. For client data, the dietitian is the controller and Foodlex processes it on their behalf under the Data Processing Agreement, which includes the EU standard contractual clauses.

Legal bases under Article 6 of the GDPR: performing the contract for your account and subscription (6(1)(b)); meeting legal obligations such as keeping tax records (6(1)(c)); our legitimate interest in keeping the platform secure and preventing abuse (6(1)(f)); and your consent for optional site analytics (6(1)(a)), which you can withdraw at any time.

Foodlex is operated from Türkiye, and some of its service providers are in the United States. Transfers outside the EEA and the UK rely on the European Commission's standard contractual clauses, with the UK Addendum for the UK, or, where a provider is certified, on the EU-US Data Privacy Framework.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. Write to kvkk@foodlex.co. You also have the right to complain to the data protection authority of the country where you live or work.