Privacy Policy

NutriGly Tech S.E.N.C. — Version 1.2 (June 27, 2026). Privacy Officer: Richard Baby, info@nutrigly.com. Compliant with Quebec Bill 25, EU GDPR, Canadian PIPEDA, and California CCPA/CPRA.

Data we collect

• Medical: CGM glucose, insulin doses, meal photos and analyses, diabetes profile
• Account: name, email, date of birth
• Technical: IP, user-agent, access logs, sensor sync metadata

No-sale commitment

• NutriGly will NEVER sell your data (pharma, insurers, data brokers, marketers)
• No targeted ads, no ad-network sharing
• No data rental, leasing, or barter

Security

• AES-256-GCM encryption (Encrypt-then-MAC, NIST-grade)
• TLS 1.3 in transit, Canada hosting (Supabase ca-central-1, Montreal)
• Postgres RLS, full audit trails, ISO 27001 / HITRUST CSF / NIST

Your rights

• Access, rectification, erasure, portability (JSON), objection, consent withdrawal
• Automated decisions / AI (Bill 25 s. 12.1, GDPR art. 22): right to human review
• Response time: 30 days (Bill 25) / 1 month (GDPR) / 45 days (CCPA)

Cross-border transfers

Covered by Standard Contractual Clauses (SCCs). US subprocessors: OpenAI, Anthropic, Google AI, ElevenLabs, Resend, Firebase, RevenueCat, Cloudflare. EU subprocessors: OVH.

View full subprocessor list →

Contact

NutriGly Tech S.E.N.C. — Co-founders: Richard Baby & Marie-Josée Zampini. DPO: Richard Baby — info@nutrigly.com.

Supervisory authorities: CAI (Quebec), Privacy Commissioner of Canada, CNIL (France), CPPA (California).