Privacy policy

For patient data (records, measurements, meal plans, documents), each clinic registered on Nutrios is the data controller: the practitioner decides what data to enter and why. Nutrios acts as a technical processor: the platform hosts and processes this data solely on the clinic's behalf and under its instructions.

For account data (practitioners, assistants, patients invited to the portal) and platform-operation data, Nutrios is the data controller.

Account data: name, e-mail address, password (stored only as a hash), role, clinic, preferences (language, theme).

Patient data entered by the clinic: identity, contact details, medical history and allergies, body measurements (weight, body composition…), consultations, meal plans, appointments, uploaded documents (including analysis reports such as InBody), clinic billing.

Technical data: connection and sensitive-action logs (audit log: who did what and when — never the medical content), IP address at the server-log level, data strictly required for the session to work.

Providing the service: patient records, agenda, consultations, meal plans, patient portal, internal messaging, clinic billing.

Securing the platform: authentication, login-attempt rate limiting, audit log of sensitive actions, backups.

Communicating: transactional e-mails (verification codes, invitations, notifications). No data is ever sold or used for advertising.

Data is hosted on dedicated servers located in the European Union (OVHcloud). Transactional e-mails are sent through a mail provider (Zoho Mail).

Nutrios shares no data with third parties for commercial purposes. The only technical accesses are those strictly required to operate the service (hosting, e-mail) — each bound by confidentiality commitments.

A clinic's data is kept for as long as its account is active. When an account is closed, data is deleted after a reasonable period allowing the clinic to export its records, unless a longer legal retention obligation applies to health data.

Technical backups are kept on a short rolling window, then overwritten automatically. Audit logs are kept separately for security and traceability purposes.

Encryption in transit (HTTPS/TLS across the whole platform), hashed passwords, strict per-clinic data isolation, role-based access control, automatic login rate limiting, audit log of sensitive actions, regular backups, automatic server security updates.

Access to health data is restricted to the authorized members of the clinic concerned. Nutrios accesses a clinic's data only when indispensable for technical support, and at the clinic's request.

You have the right to access, rectify, object to and delete your personal data.

Patients: your data is managed by your practitioner — address your requests to them directly; Nutrios will assist them technically in answering. Account holders: you can exercise your rights by contacting Nutrios through the contact page; some billing or audit data may have to be retained where the law requires it.

Personal-data processing is governed by Tunisian organic law no. 2004-63 of 27 July 2004 on the protection of personal data, under the supervision of the National Authority for Protection of Personal Data (INPDP).

Health data enjoys reinforced protection: it is processed only within the care relationship managed by the practitioner, who remains responsible for the authorizations and declarations required by the regulations applicable to their activity.

Nutrios uses no advertising cookies and no third-party trackers. Browser storage is used only to make the service work: login session, chosen language, light/dark theme.

No third-party analytics tool is embedded in the application's pages.

This policy may evolve with the platform. The last-updated date is shown at the top of the page; in case of a substantial change, clinics will be informed through the platform or by e-mail.

For any question about this policy or your data, use the contact section of the home page: the platform's contact details (e-mail, phone, address) are published there.