ProNutrition PH Privacy Policy

1. Introduction

ProNutrition PH (“we,” “our,” or “us”) is operated by an individual/sole proprietor. We respect your privacy and are committed to protecting personal information entrusted to us. This Policy explains how we collect, use, store, disclose, and protect personal information when you visit our website, submit an inquiry or form, book a nutrition consultation, enroll in a meal program, purchase a service, or otherwise interact with us.

We aim to process personal information in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (NPC). Because our services may involve health-related information, we take particular care in handling sensitive personal information.

This Policy explains our practices. Where consent is the appropriate legal basis, we will obtain it in a clear and appropriate manner. Providing information or using our services does not, by itself, mean that you have consented to every possible use of your information.

2. Personal Information We Collect

The information collected depends on the services you request and how you interact with us.

Identification and contact information: Name, contact number, email address, age or date of birth where necessary, delivery address, and information needed to identify or communicate with you.

Health and nutrition information: When relevant to the service you request, we may collect health conditions, relevant medical history, physician-prescribed dietary restrictions, height, weight, nutritional status, assessment findings, medications or supplements, laboratory results, medical documents, allergies, intolerances, dietary preferences, appetite or digestive concerns, nutrition goals, meal preferences, and progress records. Please provide only information reasonably relevant to your requested service and avoid sending unrelated medical records.

Orders, payment, and transaction information: Selected programs or meals, order details, invoices, payment status, transaction references, and billing information. Payment credentials may be processed directly by the relevant payment provider. We do not intentionally retain complete payment card credentials unless necessary and appropriately safeguarded.

Communications and technical information: Messages, emails, inquiries, feedback, and customer support conversations. Depending on the systems used, we may also process website usage data, device information, IP addresses, cookies, and similar technical information.

3. How We Collect Information

We may collect information directly from you through consultations, assessment and registration forms, Google Forms, our website, email, messaging, and our official social media pages; through Meta/Facebook lead forms or advertisements when you submit an inquiry; through orders, payments, meal deliveries, and program monitoring; automatically through website technologies where applicable; or from an authorized representative or healthcare professional where lawfully provided and relevant to your requested service.

If someone provides information about another person, we may take reasonable steps to confirm that the collection and use are lawful and that any required authority or consent has been obtained.

4. Purposes and Lawful Basis for Processing

We may process personal information to respond to inquiries; manage registrations and appointments; conduct nutrition assessments; prepare nutrition recommendations and personalized meal plans; plan, prepare, and deliver meals; monitor progress and adjust programs; communicate about services and orders; process payments and maintain financial records; improve service quality; secure our systems and prevent fraud or misuse; comply with legal and regulatory obligations; and send permitted promotional communications.

The lawful basis depends on the specific processing activity and information involved. It may include consent, steps taken at your request before entering into a contract, performance of a contract, compliance with a legal obligation, or another basis recognized by applicable law. Sensitive personal information, including health information, will be processed only when a condition permitted by the Data Privacy Act and its implementing rules is satisfied. Where consent is required, we will obtain it before processing.

We will not use identifiable health information for unrelated marketing or public-facing content without an appropriate lawful basis and any consent required by law.

5. Disclosure to Third Parties and Service Providers

We do not sell personal information as a commercial product. Where necessary and lawful, relevant information may be accessed or disclosed to authorized nutrition professionals and personnel; website hosting and form providers; Google Forms/Sheets and related productivity or storage services; Meta/Facebook and other social media or advertising platforms; email and messaging providers; payment processors and financial institutions; delivery personnel or logistics partners; professional advisers; regulators or government authorities; and other parties where disclosure is required or permitted by law.

We aim to limit each disclosure to information reasonably necessary for its purpose. Where a provider processes personal information on our behalf, we will take reasonable steps to assess the provider and use appropriate contractual, confidentiality, and data-protection safeguards.

Some providers may process information outside the Philippines. Where applicable, we will take reasonable steps to ensure that appropriate safeguards are in place and that the processing complies with applicable legal requirements. Third-party providers may also process certain information under their own terms and privacy policies.

6. Use of AI Tools

We may use AI-enabled tools to assist with administrative tasks, drafting, organization, or service-related workflows. We will not submit identifiable client health information to an AI tool unless the use is necessary for a disclosed purpose, has an appropriate lawful basis, and suitable privacy and security safeguards are in place. Where possible, we will use de-identified or minimized information.

Before using an AI provider with client information, we will review its data-use terms, retention and deletion options, access controls, security measures, and whether submitted information may be used to train or improve its models. We will not rely on AI alone to make consequential decisions about a client’s health or nutrition care without appropriate human review.

7. Marketing and Communications

We may contact you about your inquiry, consultation, program, order, service updates, or other matters directly related to your engagement with us. Promotional communications may be sent where permitted by law and, when required, with your consent. You may ask us to stop promotional communications using the available opt-out method or by contacting us.

Opting out of marketing does not necessarily stop essential service-related communications, such as appointment details, payment confirmations, or information needed to fulfill an existing order. We will not make a service conditional on consent to unrelated promotional communications where that consent is not necessary for the service.

8. Confidentiality of Health Information

Health and nutrition information is particularly sensitive. Access to client health records should be limited to authorized individuals who need the information to provide, manage, or support the requested service or to fulfill another lawful purpose.

We will not publish or disclose identifiable client assessments, laboratory results, medical documents, or other health information for testimonials, case studies, marketing, or public educational content without an appropriate lawful basis and any consent required by law. Avoid sending sensitive medical information in public comment sections or other channels not intended for confidential communication. We may direct you to a more suitable submission method.

9. Data Security

We use reasonable organizational, physical, and technical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, and destruction. Depending on the systems and circumstances, safeguards may include access restrictions, strong account security, limited file-sharing permissions, confidentiality commitments, secure handling, and appropriate disposal of records.

We will take reasonable steps to assess and respond to suspected security incidents. No electronic transmission or storage system can be guaranteed to be completely secure.

10. Data Retention and Disposal

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, regulatory, tax, professional, and recordkeeping requirements. The schedule below is a proposed internal standard, not a substitute for any longer or different period required by law, a valid legal hold, or a documented professional obligation.

• General inquiries that do not become clients: normally up to 12 months after the last meaningful contact, unless needed to resolve a concern or comply with law.
• Active client assessment, health, nutrition, and program records: during the service and normally up to 3 years after the last service or meaningful client interaction, unless a longer period is legally required or reasonably necessary for a documented dispute or professional obligation.
• Orders, invoices, accounting, tax, and payment records: for the period required by applicable tax, accounting, and other laws. Confirm the current statutory retention period with your accountant or legal adviser before setting the final schedule.
• Consent records, complaints, and privacy requests: normally up to 3 years after closure, or longer if required to demonstrate compliance or resolve a claim.
• Marketing contact records: until you withdraw consent or opt out, plus a minimal suppression record where needed to honor your preference and demonstrate compliance.
• Website logs, cookies, and security records: according to the relevant system settings and the documented operational/security need, with periodic review.

When information is no longer required, we will take reasonable steps to securely delete, destroy, or anonymize it, subject to applicable retention obligations. We will review retention periods periodically and address copies held by service providers where practicable.

11. Your Rights as a Data Subject

Subject to applicable law and its limitations, you may have the right to be informed about processing; request access to personal information; request correction of inaccurate or incomplete information; object to or seek blocking or erasure of certain processing where applicable; withdraw consent where processing is based on consent; request data portability where applicable; and seek compensation or lodge a complaint as provided by law.

To exercise a right, contact us using the details in Section 16. We may ask for reasonable information to verify your identity or authority. We will assess and respond to requests under applicable law. Some information may need to be retained where required by law or where another lawful basis applies.

12. Children and Authorized Representatives

Where a parent or lawful representative requests nutrition services involving a minor, we will seek the involvement and appropriate authorization of a parent, guardian, or other lawful representative as required by law. We will take particular care to ensure that information relating to minors is collected and used only for appropriate and lawful purposes.

13. Third-Party Websites and Platforms

Our website or communications may link to third-party websites, social media platforms, forms, or payment services. Those providers may process information under their own privacy policies and terms. We do not control their independent privacy practices, so we encourage you to review their policies before submitting information. Our use of third-party platforms does not remove our responsibility to take appropriate measures for personal information under our control.

14. Data Breach and Security Incident Response

If a personal data breach or security incident occurs, we will take reasonable steps to assess the incident, contain its effects, investigate the cause, document it, and implement corrective measures. Where notification is required under applicable law and NPC rules, we will notify the NPC and affected individuals within the applicable period and in the required manner.

15. Changes to This Policy

We may update this Policy to reflect changes in our services, technology, business structure, or applicable legal requirements. The revised version will be published on our website or another appropriate channel with the updated date. Where required, we will provide additional notice or obtain consent for material changes to processing practices.

16. Contact Us

For questions about this Policy, requests concerning your personal information, or privacy-related concerns, please contact:

• Business / Brand: ProNutrition PH
• Business operator / Personal Information Controller: David E. Pura
• Privacy contact / Data Protection Officer: David E. Pura
• Email: ProNutritionPH@gmail.com
• Official contact number: 0935 440 1570
• Registered business address: Pasig City

If you are dissatisfied with our response, you may contact the National Privacy Commission through its official channels, subject to the procedures applicable to your concern.