Privacy policy
Last updated: 24 October 2026
1. Who we are
NutriClinic is the data controller for the personal data processed through this website and the client portal. Contact: info@mytaxconsultant.gr.
2. What data we process
| Category | Examples | Why |
|---|---|---|
| Identity & contact | name, e-mail, phone | to manage your account and appointments |
| Health data (special category, GDPR Art. 9) | medical history, measurements, body composition, meal plans, notes | to provide nutrition care |
| Usage & security | sign-in times, IP address, security logs | to protect your account and our systems |
| Newsletter | e-mail, language | only if you subscribe |
We collect this data from you (forms, sessions, messages) and from devices you use with us (e.g. a body-composition analyser).
3. Legal basis
- Your explicit consent (Art. 6(1)(a) & 9(2)(a) GDPR) for health data — given when you activate your account.
- Contract (Art. 6(1)(b)) for appointments, plans and services you request.
- Legal obligation (Art. 6(1)(c)) for invoicing and tax records.
- Legitimate interest (Art. 6(1)(f)) for the security of our systems.
You can withdraw consent at any time; this does not affect processing that already took place.
4. How we protect your data
- Health data is encrypted at rest with modern authenticated encryption (XChaCha20-Poly1305); encryption keys are stored separately from the database.
- Passwords are stored only as Argon2id hashes. Two-factor authentication is available.
- Every access to health records is recorded in a tamper-evident audit log.
- Only you and the professionals of the clinic who care for you can see your records.
5. Who receives your data
We never sell your data. We only use processors bound by contract and GDPR: our hosting provider (servers in the EU) and our e-mail provider for appointment reminders. E-mails and push notifications never contain health details. We disclose data to authorities only when the law requires it.
6. How long we keep it
Health records are kept for as long as you are a client and afterwards for the period required by Greek law for health-related records, then deleted or anonymised. Security logs are kept for up to 12 months. Newsletter data is deleted as soon as you unsubscribe.
7. Your rights
You have the right to access, rectify, erase, restrict, object and to data portability. You can download a full copy of your data from Profile → Download my data at any time, or contact us. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr, Kifisias 1-3, 115 23 Athens).
8. Cookies & local storage
We use only strictly necessary cookies and browser storage — no advertising or analytics trackers:
| Name | Purpose | Duration |
|---|---|---|
nc_sid | keeps you signed in securely | session |
nc_lang | remembers your language (EL / EN) | 1 year |
nc-theme (local storage) | remembers light / dark mode | until cleared |
The map on the contact page is loaded from OpenStreetMap only when you click "Show map".
9. Changes
We will publish any changes to this policy on this page and inform active clients of material changes.
Last updated: 24 October 2026