This page describes the security practices we build Nutritica around. As a pre-launch product, we will keep it current as our infrastructure and certifications mature.
How we protect your data
- Encryption in transit (TLS) and at rest for all personal and health data.
- Least-privilege access: team members can only reach the data their role requires, with access logged.
- Health and lab data is isolated from marketing and analytics systems.
- Secrets and credentials are stored in managed secret stores, never in code.
- Regular dependency and infrastructure updates to address known vulnerabilities.
Data ownership and control
Your data is yours. You can export or permanently delete it at any time, and deletion is honored across our systems and backups on a defined schedule. Connections to labs and wearables are opt-in and revocable.
Responsible disclosure
If you believe you have found a security vulnerability, we want to hear from you. Please report it to security@nutritica.com with enough detail to reproduce the issue. We will acknowledge your report, keep you updated, and will not pursue legal action against good-faith research that respects user privacy and avoids service disruption. Please give us a reasonable window to remediate before public disclosure.
Machine-readable policy
Our disclosure contact is also published at /.well-known/security.txt.
Questions
For anything security- or privacy-related, reach us at security@nutritica.com or through the contact form.