Privacy Policy

1. Who We Are

NefroChef (hereafter "we" or "the App"), based in Mexico, is the data controller responsible for processing your personal data. We comply with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and, for users in the European Union and the United Kingdom, with the General Data Protection Regulation (GDPR).

Privacy contact: contact@nefrochef.com

2. Data We Collect

To provide our nutritional personalization service, we collect the following personal data:

• Identification data: Name and email address.
• Account data: Password (encrypted using security protocols) and referral code.
• Technical data: IP address, device type and browser (collected automatically).

Sensitive Personal Data (Health)

Given the nature of the app, we collect data that requires special protection:

• Primary kidney condition: Chronic Kidney Disease stage (1 to 5), transplant status, or type of replacement therapy (hemodialysis or peritoneal dialysis).
• Secondary conditions and comorbidities: Additional diagnoses such as diabetes, high blood pressure, gout (hyperuricemia) or cardiovascular disease.
• Dietary preferences: Allergies, intolerances and ingredients to avoid.

3. Purposes of Processing

Primary purposes (necessary):

• Create and manage your nutritional health profile.
• Filter the recipe catalog based on your kidney stage and secondary conditions to ensure nutritional safety.
• Manage the "Friends Plan" features and referral codes.
• Send critical notifications (email verification, security alerts).

Secondary purposes (optional):

• Send newsletters about new recipes and kidney health tips.
• Perform aggregated, anonymous statistical analysis to improve the recommendation algorithm.

4. Data Sharing

Your personal data, and health data in particular, will never be sold, rented or shared with third parties for commercial or marketing purposes.

It may only be transferred to technology providers (for example: Neon database infrastructure, Railway hosting, Resend email service) under strict confidentiality and secure processing agreements.

5. Your Rights

In Mexico, you may exercise your ARCO rights (Access, Rectification, Cancellation and Objection) by emailing contact@nefrochef.com. Because this involves sensitive data, we may ask for additional identity verification to protect your information.

If you are in the European Union or the United Kingdom, the GDPR grants you the following rights over your data:

• Access: obtain a copy of the data we hold about you.
• Rectification: correct data that is inaccurate or incomplete.
• Erasure: request permanent deletion of your data ("right to be forgotten").
• Restriction: limit how we process your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on our legitimate interests.
• Withdraw consent: at any time, without affecting processing carried out beforehand.

Legal basis. We process your health data on the basis of your explicit consent (GDPR Article 9(2)(a)), given when you create your health profile. You may withdraw that consent at any time by deleting your account.

You also have the right to lodge a complaint with your national data protection authority.

6. Security and Storage

We use bank-grade encryption (AES-256) to protect your data in our cloud infrastructure. Health data is stored separately from identification data wherever possible, to minimize risk.

Our servers are located in the United States. For users in the European Union and the United Kingdom, this means your data is transferred outside your country; that transfer is governed by the Standard Contractual Clauses approved by the European Commission, which our providers apply.

7. Permanent Deletion

In line with your right to erasure, if you request deletion of your account, NefroChef will permanently and completely delete your health data from our servers within a maximum of 72 hours.