Professional Data Processing Terms

Last updated: October 6, 2026 · Español

These terms apply to any nutrition professional, team or center (dietitians, sports nutrition, habit coaching, multidisciplinary centers, corporate or school programs, and others) that uses the Unflame professional dashboard (the "Professional"). By creating or using a center on Unflame, the Professional accepts them for itself and its center. They form part of the Terms of Service.

1. Parties and Roles

• For client data the Professional records or views in the dashboard (intake forms, plans, targets, consultations, notes, reviews and shared reports), the Professional is the controller and Unflame is the processor.
• For each client's own Unflame app account, Unflame is the controller under its Privacy Policy. The client decides whether to share reports with the Professional and can revoke it at any time.

2. Subject Matter, Duration, Nature and Purpose

Hosting and processing the data the Professional needs to follow up clients' nutrition: storage, retrieval, organisation, report generation (including automated AI analysis), client invitations and client payments. It lasts while the center has an Unflame account.

3. Data and Data Subjects

The Professional's clients and team members. Identity and contact data; health and lifestyle data (meals, nutrients, body measurements, symptoms, goals, plans, consultation notes); and, only if the client orders a DNA analysis, genetic data.

4. Unflame's Obligations as Processor

• Process the data only on the Professional's documented instructions, which are these terms and the Professional's use of the dashboard, unless the law requires otherwise.
• Ensure that people authorised to process the data are bound by confidentiality.
• Apply security measures under GDPR art. 32 suited to health data: encryption in transit, per-center and per-role access control, restricted internal access and security event logging.
• Use only the sub-processors listed below and give the Professional advance notice of changes so it can object.
• Assist the Professional with client rights requests and with its security, breach-notification and impact-assessment obligations.
• Notify the Professional without undue delay of any personal data breach affecting its data, with the information available, so it can notify the authority within 72 hours where required.
• At the end of the service, delete or return the data at the Professional's choice, unless the law requires retention.
• Make available the information needed to demonstrate compliance and allow reasonable audits with prior notice.

5. Authorised Sub-processors

• Hostinger: hosting, database and email.
• Google (Gemini API) and OpenAI: automated analysis and reports.
• Stripe: client payments and professional subscriptions.

Where a sub-processor processes data outside the EEA, the EU-US Data Privacy Framework or Standard Contractual Clauses apply.

6. The Professional's Obligations

• Have a legal basis to process its clients' data, inform them accordingly, and respect any professional secrecy that applies to it.
• Invite only clients who have agreed to follow-up and use shared data only for that purpose.
• Manage its team's permissions and remove access for anyone who leaves the center.
• Not upload third-party data it does not need for the service.

7. Contact

Questions about these terms: contact@unflame.app.