Privacy Policy – Naturforma app

Effective: 17 August 2026
Last updated: 17 August 2026

This Privacy Policy applies to the Naturforma mobile application (Google Play / App Store, package ID: com.naturforma) and the related service. It explains what personal data we process, why, who we share it with, how long we keep it, and what rights you have.

1. Who we are (data controller)

Name: Naturforma S.R.L.
Registration number: J14/261/2021
Tax ID (CUI): 44520048
Registered address: Bodoc no. 49, Covasna County, Romania
Email: office@naturforma.com
Phone: +40 784 842 842

For any privacy question, or to exercise your rights, contact us at office@naturforma.com.

2. What data we process

2.1. Account data

Name
Email address
Password – stored only as a one-way cryptographic hash; we never know and cannot recover your password
The language you selected in the app (Hungarian / Romanian / English)
The platform you registered from (Android or iOS)
A 6-digit email verification code during registration, kept for a maximum of 10 minutes and then automatically deleted

2.2. Health and body data (special category data)

The purpose of the service is personalised nutrition, so we also process data that qualifies as health data under Article 9 GDPR:

Age
Gender
Height and weight
Occupation / type of physical activity at work (optional)
The goal you set (e.g. weight loss, weight maintenance, athletic goal)
Diseases, health conditions, sensitivities and intolerances you report

2.3. Values calculated from the data you provide

Basal metabolic rate and maximum daily calorie intake
Daily protein, fat and carbohydrate requirements
Calorie surplus / deficit
Recommended daily nutrients and quantities
List of ingredients not recommended for you
Athlete status

2.4. Data generated by using the app

The meal plans (menus) assigned to you and their individual days
The plan days you marked as completed
Your requests for a new meal plan and their status
In-app messages exchanged with Naturforma staff (content and timestamps)
The text of professional evaluations our specialists write about you
Your appointment bookings: requested date and time, booking status, and the reason if a booking is declined
In-app notifications and their read status

2.5. Purchase data

If you buy a paid service inside the app (e.g. requesting a new meal plan), payment is handled by Google Play or the Apple App Store. In that case we receive and store the purchase receipt (token) issued by the store, the platform identifier and the product ID, so that we can verify the purchase is valid.

We never see, receive or store your card or payment details – these are handled exclusively by Google or Apple under their own privacy policies.

2.6. Technical data

An access token that identifies you to our server
Server and error logs (e.g. IP address, request timestamp, error message) used to operate and secure the service and to fix problems

3. What we explicitly do NOT do

We do not use advertising identifiers and we do not show ads.
We have not embedded any analytics, behavioural tracking or profiling SDK in the app (no Google Analytics, Firebase Analytics, Meta/Facebook SDK or similar).
We do not request or collect your location, contacts, photos, SMS messages or call logs.
We do not sell or rent your personal data, and we do not share it with third parties for advertising or marketing purposes.
We do not make decisions about you based solely on automated processing that would have legal effects on you. Your meal plan is prepared or approved by a human specialist.

4. Purposes and legal bases

Purpose	Data used	Legal basis (GDPR)
Creating your account, authentication, login	Name, email, password, verification code, language, platform	Performance of a contract – Art. 6(1)(b)
Building your personalised meal plan and nutrient targets	Body and health data, goal, diseases, calculated values	Explicit consent – Art. 9(2)(a), together with performance of a contract – Art. 6(1)(b)
Communication: messages, evaluations, notifications, bookings	Messages, evaluations, booking data	Performance of a contract – Art. 6(1)(b)
Verifying purchases and meeting accounting obligations	Purchase token, platform, product ID, transaction data	Performance of a contract – Art. 6(1)(b); legal obligation – Art. 6(1)(c)
Security, troubleshooting, fraud prevention	Technical logs, error data	Legitimate interest – Art. 6(1)(f)

You give explicit consent to the processing of your health data during registration, by accepting the terms. You may withdraw this consent at any time (see section 9). Because the service – a personalised meal plan – cannot meaningfully be provided without this data, withdrawing consent means deleting your account.

5. Data stored on your device

The app keeps your access token, a cached copy of your profile and your selected language in your phone’s own protected app storage (SharedPreferences), so you do not have to log in every time you open it. This data is removed from the device when you log out or uninstall the app. The app does not use web cookies.

6. Who we share your data with

6.1. Naturforma staff

Your meal plan and evaluation are prepared by specialists (dietitian/advisor staff) of Naturforma S.R.L., who therefore have access to your profile, health data, messages and bookings. Our staff are bound by confidentiality and only see the data they need to do their work.

6.2. Processors

We use service providers that process data on our instructions, under a contract:

Server and hosting provider – operating the admin.naturforma.com server and the database.
Email delivery provider – sending verification codes, password reset messages and system emails. Your email address and name are transferred for this purpose.
Error monitoring service (Bugsnag / SmartBear) – detecting outages and software faults. Error reports contain technical data and the circumstances of the error.
Google LLC (Google Play Billing) and Apple Inc. (App Store) – processing in-app purchases and validating purchase receipts. These companies act as independent controllers with respect to payments.

6.3. Legal obligations

We may disclose data in response to a lawful request from a court, authority or other competent body, or where necessary to protect our rights.

6.4. External link

On food detail pages we cite the public USDA FoodData Central database (fdc.nal.usda.gov). This is a citation only: we send no personal data there. If you open the link, your browser leaves the app and that site’s own privacy policy applies.

7. International transfers

Your data is primarily stored and processed within the European Union / European Economic Area. Some providers we use (for example the error monitoring service or the app store payment providers) are established outside the EEA, typically in the United States. In such cases transfers are made on the basis of the European Commission’s Standard Contractual Clauses (SCCs) or another appropriate safeguard under Chapter V of the GDPR.

8. How long we keep your data

Account and health data, meal plans, messages, bookings: for as long as your account exists. They are removed when you delete your account.
Email verification code: maximum 10 minutes.
Access tokens: revoked when you log out or delete your account.
Purchase and accounting data: retained for the period required by Romanian accounting and tax law (typically 10 years), even if you have deleted your account in the meantime. In that case we keep only the minimum data needed to evidence the transaction.
Technical and error logs: typically no longer than 12 months.

9. Deleting your account and data

You can delete your account and its data at any time:

In the app: open the side menu, select Delete profile and confirm. Deletion takes effect immediately, your access tokens are revoked, and the action cannot be undone.
By email: write to office@naturforma.com from the email address linked to your account. We fulfil such requests within 30 days at the latest.

Deletion removes your profile, health data, meal plans, messages, evaluations, bookings and notifications. The only exception is accounting data subject to the statutory retention obligation described in section 8.

10. Security

All traffic between the app and our server is encrypted (HTTPS/TLS).
Passwords are stored only as modern one-way hashes.
Access is token-based, and tokens can be revoked on logout or deletion.
Only staff who need the data for their work can access it.

While we take all reasonable technical and organisational measures, no transmission over the internet can be 100% secure. Please do not share your password with anyone.

11. Your rights

Under the GDPR you have the right to:

Be informed and to access your data – you may request a copy of the data we hold about you.
Rectification – ask us to correct inaccurate data; you can also edit most of your profile data yourself in the app.
Erasure (“right to be forgotten”) – see section 9.
Restriction of processing.
Data portability – receive your data in a structured, machine-readable format.
Object to processing based on legitimate interest.
Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Send your request to office@naturforma.com. We respond within 30 days at the latest. Please write from the email address linked to your account so that we can identify you.

12. Complaints

If you believe we process your data unlawfully, you may lodge a complaint with the Romanian data protection authority:

Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, Romania
Email: anspdcp@dataprotection.ro · Phone: +40 318 059 211
Web: www.dataprotection.ro

If you do not live in Romania, you may also contact the data protection authority of your country of residence. You also have the right to a judicial remedy.

13. Children

The Naturforma app is not intended for people under 16, and we do not knowingly collect data about children under 16. If we become aware that we hold such data, we delete it without delay. Parents and legal guardians can notify us at office@naturforma.com.

14. Important health notice

The Naturforma app is a lifestyle and nutrition support service. It is not a medical device and does not replace medical diagnosis, treatment or professional medical advice. The meal plans and suggestions shown in the app are provided for information purposes. If you have an existing medical condition, are pregnant or breastfeeding, take medication, or have any health concern, please consult your doctor before changing your diet.

15. Changes to this policy

We may update this policy from time to time, for example when the app gains new features or the law changes. We publish the updated version on this page with a new effective date at the top. We will also notify you in the app or by email about material changes. Please review this page occasionally.

16. Contact

Naturforma S.R.L.
Bodoc no. 49, Covasna County, Romania
Email: office@naturforma.com
Phone: +40 784 842 842

Services