Privacy policy
Version 1.0 — effective [to be completed: Effective date of the privacy policy (LEGAL_PRIVACY_EFFECTIVE_DATE)]
This page is a translation of the French original, provided for information. In case of discrepancy, the French version prevails (« En cas de divergence, la version française prévaut »).
This policy explains how [to be completed: Company name or name of the sole trader (LEGAL_COMPANY_NAME)] (“Metabolis”, “we”) processes your personal data when you use the website https://metabolis.chtara.com, buy a programme, an e-book or a session, fill in your questionnaire, use your client area, exchange with your nutrition advisor or subscribe to our newsletter. It is drawn up in accordance with Regulation (EU) 2016/679 (“GDPR”) and Spanish Organic Law no. 3/2018 of 5 December 2018 on the protection of personal data and the guarantee of digital rights (“LOPDGDD”).
Key information
- Controller: [to be completed: Company name or name of the sole trader (LEGAL_COMPANY_NAME)] (NIF [to be completed: NIF (LEGAL_NIF)]), [to be completed: Street of the business address (LEGAL_ADDRESS_STREET)], [to be completed: Postal code (LEGAL_ADDRESS_POSTAL_CODE)] [to be completed: Town (LEGAL_ADDRESS_CITY)] ([to be completed: Province (LEGAL_ADDRESS_PROVINCE)]), Spain; contact: [to be completed: E-mail for GDPR requests (LEGAL_PRIVACY_EMAIL)].
- Purposes: managing your account and purchases, supporting you (questionnaire, menus, sessions, messaging), sending you the useful e-mails and, if you asked for it, our newsletter.
- Legal bases: the contract; your explicit consent for health data; our legal obligations; our legitimate interest in the security of the Site.
- Recipients: our host and our processors (payment, e-mails, video calls, maintenance), bound by contract; your data is never sold.
- Your rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to a supervisory authority; from your client area or at [to be completed: E-mail for GDPR requests (LEGAL_PRIVACY_EMAIL)].
- Automated calculations: your nutritional needs are pre-calculated by formulas then reviewed by your nutrition advisor; no decision is based solely on automated processing.
- The details are in the sections below.
1. Data controller
[to be completed: Company name or name of the sole trader (LEGAL_COMPANY_NAME)], [to be completed: Legal form (LEGAL_FORM)], NIF [to be completed: NIF (LEGAL_NIF)], [to be completed: Street of the business address (LEGAL_ADDRESS_STREET)], [to be completed: Postal code (LEGAL_ADDRESS_POSTAL_CODE)] [to be completed: Town (LEGAL_ADDRESS_CITY)] ([to be completed: Province (LEGAL_ADDRESS_PROVINCE)]), Spain.
Contact for any question about your data: [to be completed: E-mail for GDPR requests (LEGAL_PRIVACY_EMAIL)] (or by post to the address above).
2. Health data: what you should know
To build personalised nutritional support, we ask you for information about your health: conditions already diagnosed by a doctor, current treatments, allergies and intolerances, body measurements (weight, height, circumferences), eating habits, physical activity, sleep, cycle, contraception, pregnancy plans, menopause, as well as information exchanged during sessions and in the messaging. This is “sensitive” data within the meaning of article 9 GDPR.
- Legal basis: your explicit consent (article 9.2.a GDPR), given on a dedicated screen, through an unticked box separate from accepting the Terms of Sale and the Terms of Use, before you fill in the health questionnaire; it is recorded with its date and the version of this policy. Until it is given, the questionnaire, the menus, the measurements, the tracking and the sessions stay unavailable.
- Why it is needed: without this data we cannot offer personalised and safe support (for example respecting an allergy). Some questions are optional.
- Who can access it: your nutrition advisor and, strictly as needed for technical maintenance and under a confidentiality obligation, our technical provider and our host. This data is never sold nor used for advertising; Stripe only receives what is needed for payment (including the name of the offer bought), never your questionnaire or your exchanges.
- Couple offer: each member of the couple has their own account and gives their own consent. The buyer invites their partner by e-mail (invitation link valid 7 days). Once both accounts are linked, each partner can read the other’s menus and plans. Either partner can ask to break this link at any time, by writing to [to be completed: E-mail for GDPR requests (LEGAL_PRIVACY_EMAIL)] or through the messaging.
- Withdrawing consent: you can withdraw your consent at any time, in one click from the “Privacy” section of your client area, by writing to [to be completed: E-mail for GDPR requests (LEGAL_PRIVACY_EMAIL)] or through the messaging. Withdrawal does not affect processing already carried out. It ends the personalised support at once, which cannot be provided without this data (questionnaire, menus, measurements, tracking and sessions are no longer available), and your nutrition advisor is informed. Your data are no longer used for your follow-up: they are kept for the periods set out in article 3, then anonymised, unless you ask for their erasure. You can give your consent again at any time. The financial consequences are set out in the Terms of sale (article 10.3).
- Hosting: your health data is hosted by the Site host listed in section 4 (location: [to be completed: Country of the data centre (HOST_DATA_LOCATION)]), with the security measures described in section 6.
3. Purposes, legal bases and retention periods
The periods below are maximum retention periods: your data is not kept beyond them.
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Creating and managing your client account | identity, e-mail, phone, encrypted password, language | performance of the contract (art. 6.1.b) | duration of the relationship; an account opened without any purchase is kept at most 6 months without activity |
| Sale of programmes, sessions and e-books; payment; invoicing; refunds | identity, e-mail, billing address if you give one, product, price, payment status and identifier (never card numbers, handled only by Stripe) | performance of the contract (6.1.b); Spanish accounting and tax obligations (6.1.c: Commercial Code, article 30; General Tax Law) | 10 years |
| Proof of acceptance of the terms and of requests or waivers relating to the right of withdrawal | e-mail, date and time, version of the accepted text, order, keyed hash of the IP address; for an online withdrawal, the request and its acknowledgement | legal obligation and legitimate interest in keeping proof of the contract (6.1.c and 6.1.f; article L. 213-1 of the French Consumer Code and article 28 of the LSSI-CE) | 10 years, including after the account is erased |
| Personalised nutritional support: questionnaire, measurements, calculations, menus, reports, sessions, documents and photos you upload | health data described in section 2, food preferences | explicit consent (art. 9.2.a); performance of the contract (6.1.b) | 3 years after your last contact (login, message, appointment, payment or end of programme), then anonymised |
| Log of changes to your nutrition file | date, author and nature of the change | legitimate interest (traceability of calculations, 6.1.f); security (art. 32) | same period as the file it relates to |
| Appointments and video sessions, reminders | date, time, status, session link, nutrition advisor’s notes | performance of the contract; explicit consent for health notes | as the follow-up file (3 years after your last contact) |
| Messaging with your nutrition advisor | content of messages and attachments | performance of the contract; explicit consent (health content) | 3 years after they are sent |
| Notifications and reminders (client area and e-mail) | notification type, date, read status | performance of the contract | 1 year after they are created |
| E-book delivery | e-mail, e-book bought, download links, download dates | performance of the contract (6.1.b) | links valid 30 days; purchase kept 10 years; links and download traces erased with your data upon an erasure request |
| Newsletter and free guides | name, e-mail, chosen guide, date and version of consent or withdrawal | sending the requested guide: steps taken at your request (6.1.b); newsletter, optional box: consent (6.1.a; article 21 of the LSSI-CE and, for recipients in France, article L. 34-5 of the French Postal and Electronic Communications Code); for our clients, legitimate interest in presenting similar offers, unless they object | guide requested without subscribing: address used for sending, not kept afterwards; newsletter: until you unsubscribe (one-click unsubscribe link in every e-mail, or withdrawal from the “Privacy” section of the client area) |
| Contact form | name, e-mail, message | legitimate interest in answering your requests (6.1.f) | the time needed to handle and follow up your request |
| Exercising your rights (export, erasure, withdrawal of consent) | identity, request, answer, export file | legal obligation (6.1.c) | export file available 30 days, then deleted; request kept as long as needed to prove it |
| Security of the Site, prevention of fraud and abuse | IP address, login and access logs, security tokens, anti-bot | legitimate interest (6.1.f); security (art. 32) | [to be completed: retention period of technical logs (config/privacy.php, retention_days)] |
When your data must be erased or rectified, the data still needed to answer possible liabilities is blocked (article 32 of the LOPDGDD): it is no longer used and is only available to authorities and courts, for the limitation periods, then deleted.
4. Recipients and processors
Your data is intended for [to be completed: Company name or name of the sole trader (LEGAL_COMPANY_NAME)] and your nutrition advisor. It may be shared, only as far as necessary, with:
| Recipient | Role | Data concerned | Location and safeguards |
|---|---|---|---|
| [to be completed: Host name (HOST_NAME)] | hosting of the Site and databases | all Site data | [to be completed: Country of the data centre (HOST_DATA_LOCATION)] |
| [to be completed: Backup storage provider (HOST_BACKUP_PROVIDER)] | encrypted backup storage | all Site data (encrypted) | [to be completed: Backup location (HOST_BACKUP_LOCATION)] |
| Stripe Payments Europe, Ltd. (Ireland) and its affiliates | secure online payment, refunds, fraud prevention | identity, e-mail, amount; card data entered directly with Stripe | European Union; possible transfers to the United States under the Data Privacy Framework or standard contractual clauses. Stripe also acts as a controller for its own obligations (fraud and money-laundering prevention). |
| [to be completed: E-mail delivery provider (SMTP_PROVIDER)] | sending e-mails (confirmations, reminders, notifications, newsletter) | e-mail, name, content of the e-mails | [to be completed: Location of the e-mail provider (SMTP_LOCATION)] |
| [to be completed: Video conferencing tool (VISIO_PROVIDER)] | video sessions | image, voice, display name, technical connection data | [to be completed: Location of the video conferencing servers (VISIO_LOCATION)]; sessions are never recorded |
| BunnyWay d.o.o. (fonts.bunny.net) | fonts | IP address, browser | Slovenia (European Union) |
| [to be completed: Technical provider with server access (LEGAL_TECH_PROVIDER)] | development and technical maintenance of the Site | occasional access to data, limited to maintenance needs, under a confidentiality obligation | contract compliant with article 28 GDPR |
| Tax and accounting adviser (gestoría), lawyer, authorities, courts | legal obligations, defence of our rights | invoicing data; strictly necessary data | Spain; France where applicable |
We neither sell nor rent your data. Our processors act on our instructions under contracts compliant with article 28 GDPR.
5. Transfers outside the European Union
When data is transferred outside the European Economic Area (in particular to the United States), the transfer relies on an adequacy decision (Data Privacy Framework for certified companies) or on the European Commission’s standard contractual clauses. You can obtain a copy of these safeguards by writing to [to be completed: E-mail for GDPR requests (LEGAL_PRIVACY_EMAIL)].
6. Security
We apply technical and organisational measures suited to the sensitivity of the data: encrypted connection (HTTPS), hashed passwords, access control on every file, logging of sensitive access and changes, encrypted backups, content security policy, anti-bot protection without third-party trackers. In the event of a data breach presenting a risk, we notify the Spanish Data Protection Agency (AEPD) within 72 hours and, if the risk is high, we inform you.
7. Your rights
You have the rights of access, rectification, erasure, restriction, portability, objection (in particular, at any time and without reason, to direct marketing), withdrawal of your consent at any time, and the right to set instructions regarding your data after your death (article 3 of the LOPDGDD and, for people residing in France, article 85 of French law no. 78-17 of 6 January 1978).
- from your client area, “Privacy” section: export of your data (file downloadable for 30 days), erasure request, withdrawal of newsletter consent and of the consent to the processing of your health data;
- by e-mail to [to be completed: E-mail for GDPR requests (LEGAL_PRIVACY_EMAIL)] or by post to [to be completed: Street of the business address (LEGAL_ADDRESS_STREET)], [to be completed: Postal code (LEGAL_ADDRESS_POSTAL_CODE)] [to be completed: Town (LEGAL_ADDRESS_CITY)] ([to be completed: Province (LEGAL_ADDRESS_PROVINCE)]), Spain.
We answer within one month, which may be extended by two months for a complex request (you will be informed). We may ask you to prove your identity in case of reasonable doubt. Erasure does not cover data the law requires us to keep (invoices, payments, proof of acceptance of the terms of sale): it is kept with restricted access for the legal period only.
Complaint: the supervisory authority competent for Metabolis, established in Spain, is the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You can also lodge a complaint with the supervisory authority of the Member State where you live or work; in France: French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
8. Automated decision-making
Nutritional needs and menus are pre-calculated by formulas, then reviewed and validated by your nutrition advisor. No decision producing legal effects or significantly affecting you is based solely on automated processing.
9. Minors
The services are reserved for adults. We do not knowingly collect data about minors.
10. Cookies
The trackers used are described in the Cookie policy.
11. Changes
We may update this policy. In the event of a substantial change, in particular of purpose, we will inform you by e-mail or in your client area and, where necessary, ask for your consent again.