Privacy policy

1. Data controller

Rod is operated by [company name, registration number, address: to be completed]. For any question about your data, write to gdpr@rodapp.ro.

A note on roles: in the relationship with clients, the specialist (dietician or nutritionist) determines the purpose of processing and Rod provides the platform. The exact allocation of responsibilities (controller, joint controller or processor) will be set out in the final text.

2. What data we process

2.1 Specialists

• Account data: name, email, password (hashed), professional title, practice name, phone, tax ID.
• Billing and subscription data (Stripe identifiers; we do not store card numbers).
• Content you create: recipes, meal plans, comments, messages, foods submitted for approval.

2.2 Clients

• Account data: name, email.
• Health data (special category, GDPR art. 9): date of birth, sex, height, weight, goal, allergies, notes, meal photos, the meal diary, meal plans, the specialist’s comments and your conversations.
• Technical data: push notification token, device type, access logs.

2.3 Waitlist (before launch)

If you join the waitlist on the website, we keep your first name, last name and profession (specialists only), email address and page language. We use them once, to write to you at launch (specialists get the first-month-free offer), based on your consent. We don’t send newsletters. You can ask us to delete them at any time at gdpr@rodapp.ro; otherwise we delete the list 6 months after launch.

3. Legal basis

• For health data: the client’s explicit consent, given when joining the app (GDPR art. 9(2)(a)). Consent can be withdrawn at any time in the app; withdrawal ends processing and the data is deleted as described in section 6.
• For account and subscription data: performance of a contract (art. 6(1)(b)).
• For invoicing and audit logs: legal obligation (art. 6(1)(c)).
• For platform security: legitimate interest (art. 6(1)(f)).

4. Who can access client data

Only the specialist the client works with, and only for data recorded during the collaboration. After it ends, the specialist keeps read-only access to that period and cannot see anything recorded later. Access to history after the end is recorded in the audit log.

5. Where data is stored and who processes it for us

The database and the photos are stored in the European Union. Photos are kept in private storage, reachable only through signed links that expire after a few minutes. For hosting, photo storage, AI processing, notifications and payments we use providers bound to us by data processing agreements. The full list is available on request at gdpr@rodapp.ro.

Text sent for AI processing (the description of a meal) contains no name or other identifying data of the client and is not used to train models.

6. How long we keep data

• Account data: while the account is active, then [30 days: to be confirmed].
• Health data: until consent is withdrawn or the account is deleted.
• Tax documents: 10 years, as required by accounting law.
• Backups: [30 days: to be confirmed], encrypted.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent and the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP). To exercise your rights, write to gdpr@rodapp.ro. We reply within 30 days at most.

8. Security

Encrypted connections (TLS), databases not exposed to the internet, role-based access, daily encrypted backups and an audit log for sensitive actions (export, deletion, viewing history).

9. Cookies

This website uses no cookies. Fonts are served from our own servers, with no third-party requests. The web account uses a single session cookie, strictly necessary for signing in.

10. Changes

We will announce important changes by email and in the app at least 15 days before they take effect.