Privacy Policy

Please read this Policy carefully before using DietIQ Services.

You must be 16 years or older to use our Services.

For DietIQ ("DietIQ", "us", "our" or "we"), it is vitally important that our users feel secure when using our products and services.

What this Privacy Policy covers

This privacy policy (the "Privacy Policy"), together with our Terms & Conditions at dietiq.io/ Terms & Conditions | DietIQ , sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed. Please read this Privacy Policy carefully to understand the types of data we collect, how we use it, the circumstances under which we share it with third parties, and your rights regarding your personal data.

For users based in the US, DietIQ’s services, except for the DietIQ App, are provided by our US subsidiary, subject to dedicated Privacy Policies and Terms

& Conditions.

Our Website may contain links to third-party websites. If you follow a link to any third-party website, please note that they have their own privacy policies, and we do not accept any responsibility or liability for their policies or processing of your personal data. Please check these policies before submitting any personal data to such third-party websites.

DietIQ Service

DietIQ offers its nutrition assessment and other diet-related features in its DietIQ App (the "App"), on its own website, or embedded in a partner platform ("DietIQ Assess"). The App and DietIQ Assess are designed to provide users with personalized dietary recommendations based on their input. However, they may not be regulated as medical devices in the region where you use them. Additionally, DietIQ operates the website dietiq.io and any additional features it may include (the "Website").

This Privacy Policy describes our data processing practices when using the App, DietIQ Assess, the Website, or any service and/or product we may provide to you (collectively, the "Services"). Where certain processing activities relate only to a specific product, this will be clearly indicated.

You are not obligated to provide personal information to DietIQ. However, many functionalities rely on information about yourself, specifically your dietary habits, health conditions, and preferences. Without providing this information, you might not be able to use certain features, or they may be limited. The accuracy of recommendations may also be impacted. This will be indicated in the description of individual processing activities in Section 3 below.

Using our Services on behalf of a third party is only permitted where you are legally competent to give or authorize consent on behalf of that person. All other third parties should use DietIQ’s services directly for themselves. For clarity, any reference in this Privacy Policy to “your data” shall include

data about other individuals that you have provided to us.

Automated Decision-Making

When using DietIQ’s Services, you are not subject to a decision based solely on automated processing that produces legal effects concerning you or significantly affects you (automated decision-making, Art. 22 GDPR). While your nutrition assessment report is the result of automated processing, it is only intended for informational purposes and does not determine any medical treatment. You may choose to share your assessment report with a healthcare or nutrition professional, but any dietary or health-related decisions will be theirs, not those of DietIQ.

Please note that if you use DietIQ Assess through our business partners, they may make automated decisions based on the outcome of your assessment. DietIQ’s business partners are solely responsible for such decisions. Any rights under Art. 22 GDPR must be asserted against them.

1. Who We Are This Privacy Policy applies to any personal data processed by Gourmet Bot ("we," "our," "us"), the data controller of all processing activities in connection with the services provided by DietIQ, our nutrition-simplified app.

Questions, comments, and requests regarding this Privacy Policy are welcome and should be addressed via email to Info@Dietiq.io

2. General Overview of Data Processing in Connection with the Services Before using our services, please read this Privacy Policy carefully. In order to provide personalized nutrition insights and meal recommendations, you will need to consent to DietIQ analyzing the personal health and dietary data

you voluntarily share.

This section provides a high-level overview of our data processing activities. For a more detailed understanding, please refer to:

Where we store your personal data (section 4)
When we may disclose your personal data (section 5)
Our retention policy (section 6)
Your data subject rights (section 7)
Your specific rights under certain international data protection laws (section 8)
Our changes policy (section 9)

Information You Provide to Us: We may collect and process personal data that you provide when you:

Fill in forms on our website or app, apply for a job, or otherwise correspond with us;
Create a DietIQ account, subscribe to our newsletter, or receive promotional emails;
Use our services, such as logging dietary habits, meal preferences, or nutrition goals;
Report a problem with our services;
Complete surveys or provide feedback for research and service improvement (participation is optional).

The information we may request includes, but is not limited to:

Name, gender, date of birth, email address, and phone number;
Dietary preferences, nutritional goals, and food allergies;
Medical history related to nutrition (optional);
Any additional information required to verify your identity.

Information We Collect About You: Although we do not use this data to identify you personally, we may collect the following information when you use our services:

Usage Data: Technical information about your device, including hardware model, operating system version, unique device identifiers, and mobile network information; details of your interactions with our services, including visited pages, date and time of access, and food logs.
Analytics Data: Your IP address, browser type, app download source, length of visits to specific pages, and interaction data (such as scrolling, clicks, and screen gestures).

We use this data to enhance your experience, improve our services, and ensure the functionality of DietIQ.

For a complete understanding of how we process and protect your data, please review the following sections of this Privacy Policy in detail.

3. Personal Data We Collect and Process, Why, and for How Long

3.1 When You Access Our Services

Types of Data: IP address of the requesting device, date and time of access, country, name and URL of the requested file, website from which access is obtained ("Referrer URL"), browser used, device operating system, access provider identity, traffic routing data, system configuration information, and

other technical data about traffic to and from our app and website.

Purpose of Processing: We use this data to provide you with access to our services, ensure smooth connectivity and usability, analyze system security and stability, and for additional administrative purposes. For system security, we engage Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107,

United States, as our data processor. Your IP address and other technical data may be processed outside the European Union, particularly in the United States. We have entered into a Data Protection Agreement with Cloudflare, which is certified under the EU-US Data Privacy Framework to ensure an adequate level of data protection.

Use Justification: Legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is based on ensuring secure and effective service access. We do not use this data to personally identify you. Providing this data is necessary for accessing our website; failure to do so will prevent access.

Storage Duration: Data is removed after 15 days unless a security-relevant event occurs (e.g., a DDoS attack). In such cases, server log files are stored until the event is resolved. Cloudflare retains data for six months.

3.2a When You Register a User Account or Create a Profile

Types of Data: Email address, password, account ID, device ID, profile name, gender, date of birth, dietary preferences, food allergies, health-related information (optional, such as diabetes, hypertension, pregnancy status), and location at the time of registration.

Purpose of Processing: We use this data to create and manage your user account and provide access to our app. Health-related data is used for personalized nutrition recommendations. Providing mandatory data is necessary to access our services.

Use Justification: Contract performance (Article 6(1)(b) GDPR) and consent (Article 9(2)(a) GDPR) for processing health-related data.

Storage Duration: We process data until you request account deletion or delete your account. Termination or deletion requests do not guarantee immediate removal, as some data may be retained per Section 3.18.

3.2b When You Use DietIQ’s Personalized Nutrition Features

Types of Data: Account ID, dietary preferences, health data (optional, such as allergies, pregnancy status, diabetes, or high blood pressure), technical identifiers, Single-Sign-On data (if applicable), and previously collected partner data necessary for seamless integration.

Purpose of Processing: We use this data to offer personalized nutrition plans and recommendations through our app or business partner platforms. If you use DietIQ’s services through a business partner, we may facilitate data exchange to enhance your experience. Some integrations require optional or mandatory data sharing with our partners, in which case we will inform you in advance. We may request consent to share pseudonymized usage data (excluding personal health data) with business partners.

Use Justification: Contract performance (Article 6(1)(b) GDPR) and consent (Article 9(2)(a) GDPR) for processing and sharing health data, along with legitimate interest (Article 6(1)(f) GDPR) to provide a seamless integration experience.

Storage Duration: If provided through a business partner, data is retained as long as the user account exists or until deletion is requested. If used without an account, assessments are stored according to applicable medical safety retention regulations and DietIQ’s legitimate interests.

3.3 Health Profile

Types of Data: Height, weight, daily calorie intake, nutritional goals, medications (optional), and allergies.

Purpose of Processing: This feature allows you to create a comprehensive health profile to manage your nutrition and dietary data within our app. When you update weight, calorie intake, or nutritional goals, previous entries are stored to track progress. Currently, these inputs do not affect symptom assessments but contribute to personalized nutrition recommendations.

Use Justification: Consent (Article 9(2)(a) GDPR). Using this feature is voluntary, and you may withdraw consent by deleting health profile data at any time.

Storage Duration: Data is stored until manually deleted by the user or upon account termination.

3.4 Third Party Login

Types of data: Third-party ID (e.g., Facebook-/Apple-/Google-ID), email address (if authorized), time and date of login.

Purpose of processing: If you choose to log in using a third-party provider such as Apple, Facebook, or Google, we will receive the specified data with your approval to populate your user data in DietIQand verify your identity. Please note that these third-party providers may also process your data independently, and we do not control such processing. Refer to Apple's, Facebook’s, or Google’s Privacy Policy for more details.

Use justification: Legitimate interest (Article 6(1)(f) GDPR), contract performance (Article 6(1)(b) GDPR), or consent (Article 6(1)(a) GDPR).

Storage duration: Data retention follows section 3.2. Third-party providers may retain your data independently. If you delete your third-party account, you will need to sign in using an alternative login method.

3.5 Nutrition Assessment and Health-Related Features

Types of data: Profile ID, profile name (if applicable), and personal health data relevant to nutrition assessments, such as age, gender, dietary habits, food allergies, medical conditions (e.g., diabetes, high blood pressure), geographic location, and time and date of assessment.

Purpose of processing: When using DietIQ's features, we process your health data to provide nutritional guidance and meal recommendations. Our assessment relies on user-provided data to suggest personalized dietary plans, highlight potential nutritional deficiencies, and offer healthy food alternatives. We do not share your health data with any third party without explicit consent.

Use justification: Contract performance (Article 6(1)(b) GDPR) and consent (Article 9(2)(a) GDPR). You may withdraw your consent at any time, but doing so will limit the functionality of DietIQ.

Storage duration: Data retention follows section 3.2. Users may request deletion of specific assessments, after which we will delete or anonymize the data within one month.

3.6 Partner Recommendations

Types of data: Age, gender, dietary preferences, nutrition goals, and health conditions.

Purpose of processing: DietIQ may offer recommendations from partners, such as nutritional supplements, diet plans, or informational resources. These options are based on assessment results and user preferences. DietIQ determines partner recommendations independently, and users may choose whether to view them. No personal data is shared with partners without consent.

Use justification: Consent (Article 9(2)(a) GDPR). You may revoke your consent by exiting the partner recommendation section. Aggregated, anonymized data on usage trends may still be shared with partners.

Storage duration: Data is processed only while viewing partner recommendations. However, event tracking data on viewing partner content may be retained for analytics purposes.

3.7 Research Participation

Types of data: Email address, account ID, profile name, dietary habits, nutrition goals, food preferences, geographic location, and app usage data.

Purpose of processing: If you consent, we may invite you to participate in research projects aimed at improving DietIQ’s services. Research topics may range from dietary trends to user experience optimization. Invitations may be based on health and nutrition data, but participation is entirely optional. If you consent to a research study, only the data necessary for the study will be used.Use justification: Consent (Article 6(1)(a) and Article 9(2)(a) GDPR). You may withdraw consent at any time (refer to section 8 for details on data rights).

Storage duration: Data is retained as per section 3.2. If a user deletes their case or account, research-related data will no longer be used for this purpose.

3.8 Use of Nutrition and Health Data for Statistical and Research Purposes

Types of data: Account ID (when applicable), case ID, profile ID (when applicable), age, gender, dietary preferences, nutritional intake, geographic location, health conditions, and assessment results related to nutrition and wellness.

Purpose of processing: We process pseudonymized data to generate aggregate statistics on dietary habits, nutritional deficiencies, and wellness trends. These insights help analyze the impact of nutrition on health conditions and identify dietary patterns across different demographics and geographies. We present such anonymized statistics to our research partners to contribute to nutritional science and public health research. We use Tableau by Tableau Software, LLC ("Tableau") to process these statistics. Before sharing any data with Tableau, we ensure that all personally identifiable information is removed. Data for U.S. residents is processed in the U.S., while data for others is processed within the EU.

Use justification: The processing is necessary for statistical and research purposes, and we only provide our partners with anonymized and summarized statistics that cannot be linked to any individual (Article 9(2)(j) GDPR; Sec. 27 (1) BDSG). Our legitimate interest in processing this data is to support advancements in nutritional research and wellness, contributing to improved dietary recommendations and public health insights. You may object to such processing at any time by contacting us (more details in Section 8).

Storage duration: The storage duration of your data for statistical purposes corresponds to theperiod of processing as outlined in section 3.2. If you request deletion of a specific case or delete a case in the app, your data will no longer be used for this purpose. All statistics remain anonymous.

3.9 Use of Nutrition and Health Data for Public Health Purposes

Types of data: Account ID (when applicable), profile name (when applicable), case ID, device ID, age, gender, dietary habits, geographic location, health risks, nutritional deficiencies, assessment results, allergies, and time and date of assessment.

Purpose of processing: We analyse pseudonymized data for public health purposes (as defined by GDPR recital 54) to track trends in dietary patterns, nutritional deficiencies, and their impact on wellness. This helps in identifying deficiencies across different regions, analyzing the prevalence of diet-related conditions, and improving public health recommendations. We may share anonymized reports with public health institutions, research partners, and policymakers to help improve global nutrition and dietary guidelines.

Use justification: The processing is necessary for reasons of public interest in the area of public health (Article 9(2)(i) GDPR, Article 22(1)(1)(c) BDSG). Our legitimate interest is to contribute to public health advancements by analyzing trends in nutrition and wellness. You may object to such processing at any time by contacting us (details in Section 8).

Storage duration: The storage duration of your pseudonymized data for this purpose corresponds to the period of processing as per Section 3.2. If you delete a case in the app, it will no longer be used for public health analysis. All published statistics remain anonymous.

3.10 Post-Market Surveillance and Nutritional Safety

Types of data: Account ID (when applicable), profile name and ID (when applicable), case ID, time and date of assessment, dietary intake records, allergies, health goals, medical conditions, user feedback on nutritional recommendations, and technical data (such as app version and device type).

Purpose of processing: To ensure the accuracy and safety of our nutrition assessments and dietary recommendations, we systematically monitor their quality and effectiveness. This includes tracking feedback on personalized meal plans, identifying potential inaccuracies in nutritional assessments, and assessing usability issues. If you voluntarily provide feedback regarding your dietary outcomes, we may use this information to improve our service and enhance nutritional recommendations.

Use justification: The processing is required to comply with our legal obligation to ensure the accuracy and safety of our nutritional recommendations (Article 9(2)(i) GDPR, Article 83 et seq. and Annex III of the EU Medical Devices Regulation 2017/745/EU).

Storage duration: We retain this data as long as necessary to maintain quality and safety standards. If you delete your account or specific cases, they will no longer be used for these purposes.

3.11 Limited Data Sharing for Outreach and Impact Analysis

Types of data: Advertiser ID, app download and installation status, referral sources (e.g., social media, online articles), registration success, user engagement data, geographic location, and app store ratings.

Purpose of processing: We analyze user acquisition trends to optimize our outreach and ensure that we reach individuals who may benefit from our nutrition and wellness services. This helps us tailor our marketing efforts and avoid showing irrelevant ads to users who have already downloaded the app. We process only pseudonymized usage data through our contract processor Adjust GmbH (Saarbrucker Str. 38a, 10405 Berlin, Germany). We do not share personal health data with advertisers.

Use justification: Consent (Article 6(1)(a) GDPR).

Storage duration: Data is retained for up to 45 days before deletion.

3.12 Data Security Measures

Data categories: Any data mentioned in this Privacy Policy.

Purpose of processing: DietIQ implements strict security measures to protect your data. These measures are required by law under Article 32 GDPR and are part of our ISO 27001 certification. Our security protocols include encrypted data storage, secure authentication, and continuous system monitoring. We also conduct external security audits and bug bounty programs to identify and mitigate vulnerabilities. While our bug bounty program does not involve direct processing of personal data, there is a possibility that security researchers may access pseudonymized data. In such cases, we have strict agreements in place to ensure compliance with Article 28 GDPR.

Legal basis: Compliance with legal obligations (Article 6(1)(c) GDPR, Article 9(2)(g) GDPR), as well as our legitimate interest in maintaining high data security standards (Article 6(1)(f) GDPR).

Storage period: Data is stored as long as necessary to implement security measures and ensure

system integrity.

3.13 Direct Marketing

Types of Data: Email address, profile name, dietary preferences.

Purpose of Processing: We process your data to send you direct marketing communications related to nutrition, wellness tips, and personalized meal recommendations. These messages will not contain any sensitive health information. You can modify your marketing settings at any time using the link at the bottom of each marketing email or by requesting to unsubscribe.

Use Justification: Consent (Article 6(1)(a) GDPR) and our legitimate interest (Article 6(1)(f) GDPR) to inform you about similar products and services.

Storage Duration: Until you revoke your consent or object to the processing based on our legitimate interest.

3.14 Optimizing Our Marketing Initiatives

Types of Data: Device ID, IP address, operating system, browser type, page visit length, page interactions (scrolling, clicks, gestures), geographic location, time, and date.

Purpose of Processing: We track your interactions within the app to analyze and improve our marketing strategies. This does not include personal health data.

Use Justification: Consent (Article 6(1)(a) GDPR). You can customize your tracking settings in the privacy section of the app.

Storage Duration: Data is stored until it is no longer needed or you revoke consent. Tracking data is deleted within 45 days.

3.15 Monitoring

Types of Data: Error logs, crash reports (device, app, and incident details), IP address, geographic location, browsing behavior within the app, and time stamps.

Purpose of Processing: To ensure the proper functioning, maintenance, and security of our services. We use pseudonymized data via third-party services for error tracking and performance monitoring.

Use Justification: Legitimate interest (Article 6(1)(f) GDPR) to provide secure and functional services.

Storage Duration: Data is removed after 60 days unless a security-related incident requires extended

retention.

3.16 Feedback / Surveys

Types of Data: Feedback provided by users, contact details (if applicable), app usage data.

Purpose of Processing: We use feedback and survey responses to improve DietIQ’s features and user experience. Any health-related data provided will only be processed with explicit consent.

Use Justification: Consent (Article 6(1)(a) GDPR) and legitimate interest (Article 6(1)(f) GDPR) to enhance user experience.

Storage Duration: Data is retained as long as necessary for evaluation and improvement, with identifying details anonymized where possible.

3.17 Push Notifications

Types of Data: DietIQ ID, usage data, email, first name, language, country, signup source.

Purpose of Processing: With your consent, we send push notifications about meal planning, reminders, and wellness updates.

Use Justification: Consent (Article 6(1)(a) GDPR). You can disable push notifications in your device settings.

Storage Duration: Until no longer necessary or you revoke consent.

3.18 Legal Claims

Types of Data: Any stored data relevant to a legal claim.

Purpose of Processing: If necessary, we will process your data to exercise or defend against legal claims.

Use Justification: Legitimate interest (Article 6(1)(f) GDPR).

Storage Duration: Retained for up to seven years after account deletion for legal purposes, with access restricted.

3.19 Sharing with Law Enforcement

Types of Data: Any data requested by a legitimate law enforcement inquiry.

Purpose of Processing: We will share data only if required by law, court order, or to prevent harm.

Use Justification: Compliance with legal obligations (Article 6(1)(c) GDPR) and legitimate interest (Article 6(1)(f) GDPR).

Storage Duration: Retained for up to four years following data transfer.

Your Rights As a user, you have the right to access, correct, delete, or restrict processing of your personal data. You may also object to processing and withdraw consent at any time.

For any privacy-related inquiries, please contact us at: Info@dietiq.io

4. Where Do We Store Your Personal Data

The personal data we collect from you is stored on secure cloud servers hosted by Amazon Web Services (AWS) and Google Cloud Platform (GCP) within the European Union (EU). Limited data may be processed by sub-processors operating outside the European Economic Area (EEA) based on a data processing agreement, ensuring compliance with Article 44 et seq. of the General Data Protection Regulation (GDPR). Sensitive health-related data will always remain within the EU.

Sensitive information transmitted between your browser and our platform is encrypted using Transport Layer Security (TLS). Always verify our certificate when transmitting sensitive data.

For further details on the specific safeguards applied to the export of your personal data outside the EEA, please contact us.

5. Disclosure of Your Personal Data

DietIQ shares your personal data with third parties solely for the purpose of providing its services or as required for business operations. We do not share your data for third-party commercial interests without your explicit consent.

Service Providers: We engage technical service providers to operate and maintain our services under data processing agreements in accordance with Article 28 GDPR. If data is processed outside the EEA, appropriate safeguards are in place, including Standard Contractual Clauses and the EU-US Data Privacy Framework.
Business Transfers: In case of a sale or transfer of our business or assets, your personal data may be transferred to the buyer in compliance with applicable laws.
Affiliate Partners: If we participate in affiliate programs, we may share non-identifiable data with affiliate partners for billing purposes. If you register through an affiliate, they may request identifiable information separately.

6. How Long Do We Retain Your Personal Data

We retain your personal data only as long as necessary for the purposes outlined in this policy or as required by law. Specific retention periods depend on the processing activity and are in compliance with the data minimization principle.

If your personal data serves multiple purposes, it will be retained until the longest retention period expires.
Post-Market Surveillance data, including health-related data, will be retained as per medical device laws.
Data related to your use of our services is stored for up to seven years for legal and business purposes.
If data retention is no longer necessary, it will be irreversibly anonymized or securely deleted.

7. Your Data Subject Rights

Under GDPR, you have the following rights concerning your personal data:

Right to Withdraw Consent: You can withdraw your consent for data processing at any time without affecting prior lawful processing.
Right to Object: You can object to processing based on legitimate interests, statistical purposes, or public health reasons, subject to conditions in Article 21 GDPR.
Right to Be Informed: You have the right to request details about our data processing practices as per Article 15 GDPR.
Right to Erasure ('Right to Be Forgotten'): You may request the deletion of your data under Article 17 GDPR, except where processing is required for legal compliance or defense of claims.
Right to Restriction of Processing: You may request restrictions on processing under certain conditions, such as contesting the accuracy of data (Article 18 GDPR).
Right to Data Portability: You can request your data in a structured format and transfer it to another service provider (Article 20 GDPR).
Right to Rectification: You may request corrections to inaccurate or incomplete personal data (Article 16 GDPR).
Right to Complain: You have the right to file a complaint with a relevant data protection authority if you believe your data rights are violated.

If you request the deletion of your data, it may impact your ability to use DietIQ services.

For any inquiries regarding your data rights, please contact us at Info@dietiq.io

8. International Data Protection

For residents of countries outside the EU, the following additional information applies in accordance with respective local data protection laws.

These rights apply in addition to your rights under the General Data Protection Regulation (GDPR) as explained in Section 8 above. Where you exercise both your GDPR and local data protection rights simultaneously, DietIQ will guarantee those rights in addition to each other.

The additional information can always be found in this English version of the privacy policy as well as the respective national language version (where available).

8.2 Canada

DietIQ guarantees your rights under Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial laws where applicable.

8.2.1 PIPEDA

Under PIPEDA, you have the right to:

Access your personal information (Schedule 1, Sec. 4.9)
Request corrections to your data (Schedule 1, Sec. 4.9.5)
Challenge compliance with the regulation by contacting DietIQ's DPO at privacy@dietiq.com

If you reside in Alberta, British Columbia, or Quebec, provincial privacy laws apply, superseding

PIPEDA.

8.2.2 Alberta & British Columbia

Additional rights under Personal Information Protection Act (PIPA) include:

Right to access and information (Alberta: Sec. 24, BC: Sec. 23)
Right to request corrections (Alberta: Sec. 25, BC: Sec. 24)

Your consent under GDPR is also valid under these laws.

8.3 United States (CCPA & MHMDA)

8.3.1 California (CCPA)

As a California resident, you have rights under the California Consumer Privacy Act (CCPA), including:

Right to request disclosure of collected personal information (CCPA Sec. 1798.100(a))
Right to request deletion of personal information (CCPA Sec. 1798.105)
Right to know about data sales (DietIQ does not sell personal information)

You can exercise your CCPA rights by contacting Info@Dietiq.io.com or using our online request form.

83.2 Washington (MHMDA)

Under the My Health My Data Act (MHMDA), you have rights to:

Confirm whether we collect, share, or sell your health data
Withdraw consent from data collection and sharing
Request deletion of health-related data

9. Changes to This Policy

Any changes to this privacy policy will be posted on this page, with notifications via email, app notifications, or other available means. We encourage you to review it periodically to stay informed about how we handle your data.

10.For any Queries Contact us - Info@Dietiq.io