Privacy Policy

1. Who we are

This website and the Nutrissues service are operated by Nutrissues by Georgia Papalli. Georgia Papalli is a Clinical Dietitian based in Nicosia, Cyprus.

For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Georgia Papalli is the data controller for personal data processed through Nutrissues unless otherwise stated.

2. Personal data we may collect

The information we collect depends on how you interact with Nutrissues and which services you use.

It may include:

• Identity information, such as your name or account username.
• Contact information, such as your telephone number, email address and billing or delivery address.
• Appointment and enquiry information that you provide when contacting Nutrissues or requesting an appointment.
• Client and clinical information provided in connection with nutrition consultations and follow-up care.
• Order and transaction information, including products or services purchased and related order details.
• Payment-related information required to complete a transaction. Payment processing is handled through the relevant payment provider.
• Account information connected with website or My Nutrissues access.
• My Nutrissues information, which may include nutrition journal entries, meals, photographs, notes, weight entries, documents, practitioner feedback and progress-related information.
• Technical information, such as IP address, browser, device and security-related information.
• Website usage information, where permitted through cookies or analytics technologies.
• Communication preferences, including consent or preferences relating to marketing communications.

3. How we collect your information

Personal information may be collected when you:

• complete a contact or appointment form;
• contact Nutrissues by telephone, email or another communication channel;
• attend or receive a nutrition consultation or follow-up service;
• place an order or purchase a service through the website;
• create or use a website or My Nutrissues account;
• add information, photographs, notes, weight entries or documents through My Nutrissues;
• receive practitioner feedback or documents through My Nutrissues;
• subscribe to communications where this option is offered;
• interact with the website and its cookie or analytics technologies.

We may also receive limited information from service providers involved in payments, order fulfilment, website hosting, communications, analytics, security or other functions necessary to operate Nutrissues and its digital services.

4. How we use your personal data

We may use personal information to:

• respond to enquiries and appointment requests;
• communicate with you about Nutrissues services;
• provide appropriate clinical nutrition care and agreed follow-up;
• create and manage My Nutrissues client access;
• review information provided through My Nutrissues as part of your agreed nutrition follow-up;
• share nutrition plans, documents, practitioner feedback and progress information with you;
• process purchases, payments and orders;
• provide products or services you have requested;
• maintain financial, tax, professional and business records;
• protect accounts, the website and My Nutrissues, prevent fraud and maintain security;
• understand and improve website performance and usability;
• send marketing communications where you have provided the necessary consent;
• comply with legal, regulatory and professional obligations.

5. Legal bases for processing

Under the GDPR, personal data must be processed on a valid legal basis. Depending on the particular activity, Nutrissues may rely on:

• Contract — where processing is necessary to provide a product or service you have requested or to take steps at your request before entering into a contract.
• Legal obligation — where information must be processed or retained to comply with applicable law, including accounting, tax or other legal requirements.
• Consent — where you have freely provided consent for a specific purpose, such as certain marketing or non-essential cookies.
• Legitimate interests — where necessary for appropriate business, security, fraud-prevention or website-administration purposes and where those interests do not override your data-protection rights.

Where consent is the legal basis, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

6. Health-related information

Because Nutrissues provides clinical nutrition services, information you provide in connection with your care may include information concerning your health, dietary needs, medical history, diagnoses, symptoms, medication, weight, measurements and other relevant health or nutrition information.

Health information is considered a special category of personal data under the GDPR. Where such information is processed, Nutrissues will do so only where both an appropriate lawful basis and a valid condition for processing special-category data apply.

Depending on the circumstances, this may include processing that is necessary in connection with the provision of health or nutrition care, or another condition permitted under applicable data-protection law.

7. My Nutrissues

My Nutrissues is a private client service used to support agreed nutrition follow-up between appointments.

Access is created for authorised Nutrissues clients. Public self-registration is not available.

Information processed through My Nutrissues

Depending on the service being provided, My Nutrissues may process:

• your name, email address and account-access information;
• nutrition journal entries;
• meal information and meal photographs;
• notes you choose to add to journal entries;
• weight and progress entries;
• nutrition plans and other documents shared with you;
• documents or information submitted by you;
• personalised practitioner feedback;
• progress summaries and follow-up information;
• technical and security information related to account access.

Who can access My Nutrissues information

Client information is intended to be accessible only to the authorised client and authorised Nutrissues personnel or technical service providers where access is reasonably necessary to operate, maintain or secure the service.

Technical providers that may process information on behalf of Nutrissues are required to handle personal information in accordance with applicable data-protection obligations.

Account access and security

Clients are responsible for keeping their login credentials confidential and for taking reasonable steps to prevent unauthorised access to their account or device.

If you believe someone else has gained access to your My Nutrissues account, please contact Nutrissues as soon as reasonably possible.

Access expiry

My Nutrissues access may be provided for a defined period connected with the agreed nutrition service. Client access may expire, be extended or be reactivated depending on the arrangement with the client.

Expiry of account access does not necessarily mean that all information connected with the client is immediately deleted. Relevant records may need to be retained in accordance with professional, healthcare, legal, accounting, security or dispute-resolution requirements.

8. Payments and online purchases

Nutrissues uses third-party payment services, including Viva Wallet, for eligible online transactions.

Payment providers process payment information in accordance with their own privacy and security obligations. Nutrissues does not need to receive or store your full payment-card details where those details are entered directly into the payment provider's system.

We retain the order, payment-status and transaction information reasonably necessary to fulfil purchases, manage customer service and comply with financial and legal obligations.

9. When we share personal information

Personal information is not sold to third parties.

Where necessary, information may be shared with appropriate service providers involved in operating Nutrissues, such as:

• payment processors;
• delivery or fulfilment providers where a physical order requires delivery;
• website hosting, database and technical-support providers;
• providers required to operate or support My Nutrissues;
• email and communication service providers;
• analytics providers where permitted by your cookie choices;
• professional advisers, accountants or authorities where reasonably necessary or legally required.

Service providers are given only the information reasonably necessary for the relevant purpose and are expected to protect personal information in accordance with applicable data-protection law.

10. International data transfers

Some technology or service providers may process information outside Cyprus or the European Economic Area.

Where personal data is transferred internationally and GDPR transfer rules apply, appropriate safeguards will be used as required by applicable law.

Depending on the circumstances, these may include an adequacy decision issued by the European Commission or approved contractual safeguards such as Standard Contractual Clauses.

11. How long we keep your information

Personal data is kept only for as long as reasonably necessary for the purpose for which it was collected, together with any period required to meet legal, accounting, tax, professional, healthcare, security or dispute-resolution obligations.

Different categories of information may therefore have different retention periods.

Factors used to determine retention include:

• the reason the information was collected;
• whether an ongoing client or contractual relationship exists;
• applicable healthcare, professional, accounting, tax or legal obligations;
• the sensitivity and amount of the information;
• security, fraud-prevention and dispute-resolution requirements.

Information that is no longer required will be securely deleted, anonymised or otherwise disposed of as appropriate.

12. Cookies and analytics

Nutrissues uses cookies and similar technologies for website functionality, security and, where permitted, analytics.

Non-essential technologies are controlled through the website's cookie-consent mechanism where required. Your choices can be changed through the available cookie settings.

Analytics services, including Google Analytics where enabled through the site's consent configuration, may collect information about how visitors interact with the website.

More detailed information about the cookies used on the website and your available choices is provided through the website's cookie notice or cookie settings.

13. Data security

Nutrissues uses appropriate technical and organisational measures intended to protect personal information from accidental loss, unauthorised access, alteration, disclosure or destruction.

Access to personal and client information is restricted according to need and appropriate confidentiality and security requirements.

My Nutrissues is designed as a private client service with authenticated access and server-side access controls intended to prevent unauthorised access to protected client information, photographs and documents.

No internet-based system can be guaranteed to be completely secure. Security measures are therefore maintained and reviewed according to the nature and sensitivity of the information processed.

14. Your data-protection rights

Subject to the circumstances and limitations set by the GDPR, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete information;
• request deletion of your personal data;
• request restriction of processing;
• object to certain processing;
• receive certain personal data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with a data-protection supervisory authority.

These rights are not absolute in every situation. For example, certain information may need to be retained where Nutrissues has a legal, healthcare, professional or other lawful reason to keep it.

Making a privacy request

To ask a question or exercise a data-protection right, please contact Nutrissues using the details at the end of this policy.

We may need to verify your identity before responding to a request in order to protect personal information from unauthorised disclosure.

Complaints

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.

Official information and complaint procedures are available at www.dataprotection.gov.cy .

15. Children's personal data

Nutrissues may provide nutrition services involving children where appropriate, but the public website is not designed to invite children to independently create accounts, make purchases or submit personal information.

Where information concerning a child is required in connection with clinical nutrition care, it should be provided and managed through the appropriate parent, guardian and professional-care process.

Where My Nutrissues is used in connection with a child or young person, access and handling of information will be managed in accordance with the appropriate client, parent or guardian arrangement and applicable legal requirements.

16. Changes to this Privacy Policy

We may update this Privacy Policy when our services, website, technologies, My Nutrissues functionality or legal obligations change.

The latest version will be published on this page and the “Last updated” date at the top of the policy will be revised when material changes are made.

Where an important change directly affects active clients or the way significant personal information is handled, additional notice may be provided where appropriate.

17. Contact us

For questions about this Privacy Policy, the use of your personal information or a request concerning your data-protection rights, please contact: