This document is not ready to publish.
Fill in lib/legal/organization.ts before launch. Still unset: legalName, address, supportEmail, dataProtectionOfficer, retentionPeriod.
Have a lawyer review these documents. They describe how this application actually behaves, which is a starting point, not legal advice.
Effective 27 August 2026
This policy explains what WellPlate collects when you fill in the nutrition questionnaire, why we need it, who can see it, and what you can ask us to do with it.
[REGISTERED NAME], trading as WellPlate, of [REGISTERED ADDRESS], is the personal information controller for the data described here.
Our Data Protection Officer is [DPO NAME AND EMAIL]. Contact them with any question about this policy or about your data.
When you complete the questionnaire we collect the answers you give us. Some of these are sensitive personal information under the Data Privacy Act of 2012 (Republic Act No. 10173):
We do not currently store uploaded lab-result files. If you attach one it is not retained, and it is not sent to us. We will update this policy before that changes.
To prepare a personalized meal plan for you, and to let a nutritionist review your answers before doing so. We ask about conditions, medications, and allergies specifically so that a plan does not recommend food that would be unsafe for you.
We process sensitive personal information on the basis of your consent, which you give explicitly before submitting the questionnaire. You can withdraw that consent at any time — see Your rights below.
We do not sell your information, and we do not use it for advertising or profiling.
Access is enforced by the database itself, not only by the interface: one customer cannot retrieve another customer's submission. Access by a nutritionist is limited to accounts we have explicitly granted that role, and changes to a submission's review status are recorded with the person who made them.
Notification emails we send internally contain a link only — never your name, conditions, medications, or allergies.
Your data is stored in a managed PostgreSQL database operated by Supabase, hosted in Singapore (ap-southeast-1), and the application is served by Vercel. Email is delivered by our email provider. Where any of these process data outside the Philippines, that transfer is covered by the contractual protections those providers offer.
We keep your questionnaire and meal plans for [RETENTION PERIOD] after your last activity, so that a nutritionist can see your history when preparing a new plan. After that we delete or anonymize it.
If you ask us to delete your data sooner, we will, except where we are required to keep records by law.
Under the Data Privacy Act you have the right to:
To exercise any of these, email [SUPPORT EMAIL] or contact our Data Protection Officer. We will respond within the period the law requires.
If you are not satisfied with our response, you may complain to the National Privacy Commission (privacy.gov.ph).
We restrict access to health information to accounts that need it, enforce that restriction in the database, and keep health information out of notification emails and application logs.
No system is perfectly secure. If a breach occurs that is likely to put you at serious risk, we will notify you and the National Privacy Commission as the law requires.
WellPlate is not intended for children. The questionnaire does not accept an age under 13, and we do not knowingly collect information from children. If you believe a child has given us data, contact us and we will delete it.
If we change how we handle your data, we will update this page and ask for your consent again where the change requires it. Each submission records which version of this policy you agreed to.