Plain-English summary (not legally binding — the sections below are): We collect what's needed to run the platform, and patient health data stays between the patient and their practitioner. We never sell your data. Health data is encrypted, access is logged, and we sign BAAs on paid plans. You can ask for your data or ask us to delete it. Questions: support@mealcircle.co.

1. Introduction

MealCircle is a product of TELOVANT (SMC-PRIVATE) LIMITED (“TELOVANT”, “MealCircle”, “we”, “us”, or “our”). TELOVANT operates the MealCircle clinical nutrition tracking and analytics platform accessible at mealcircle.co and through our mobile applications. This Privacy Policy explains how we collect, use, disclose, and protect information about users of our platform — including nutrition practitioners (“Practitioners”) and their patients (“Patients”).

By using MealCircle, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use our services.

2. Information we collect

Account information

When you register, we collect your name, email address, practice name, credentials, and billing information. Practitioners may also provide profile photos and professional bio information for their public profile pages.

Health and nutritional data (PHI)

Patients may log meal data, biometric measurements (weight, body fat %, blood glucose, blood pressure), progress photos, and other health-related information. Where a Practitioner is a HIPAA Covered Entity, this information constitutes Protected Health Information (PHI). It is collected only through Practitioner-initiated interactions and is accessible only to the Practitioner and their authorized team members.

Usage data

We collect log data including IP addresses, browser type, pages visited, features used, and timestamps. This helps us improve the platform and diagnose technical issues.

Cookies and tracking

We use cookies and similar tracking technologies to maintain session state, remember preferences, and analyze usage patterns. You can control cookies through your browser settings. Disabling cookies may affect some platform functionality.

3. How we use your information

To provide, operate, and maintain the MealCircle platform
To process transactions and send billing-related communications
To send service updates, security alerts, and support messages
To analyze usage patterns and improve platform features
To comply with legal obligations, including HIPAA requirements where applicable
To enforce our Terms of Service and protect against fraud or abuse

We do not use PHI for any purpose other than providing services to the Practitioner who holds that patient relationship. We do not use PHI to train machine-learning models, and we do not sell any personal data.

4. How we share your information

We do not sell, rent, or trade your personal information or PHI to any third party for marketing purposes. We may share information in limited circumstances:

Service providers (subprocessors): Third-party vendors who process data on our behalf under data processing agreements. Our core subprocessors are currently: Google Cloud Platform (application hosting, database, and file storage — United States), Google Firebase (authentication and website services), and Brevo (transactional and marketing email — account email addresses only, never PHI). We will update this list as our infrastructure evolves; the current list is also available on request.
Business associates: Vendors who handle PHI are required to sign Business Associate Agreements (BAAs) compliant with HIPAA.
Legal requirements: We may disclose information if required by law, court order, or governmental authority.
Business transfers: In the event of a merger or acquisition, your information may be transferred to the acquiring entity, subject to this policy's protections.

5. HIPAA and Protected Health Information

MealCircle operates as a Business Associate under HIPAA for Practitioners who are Covered Entities and have executed a BAA with us. We maintain a HIPAA-oriented security program including:

PHI encrypted at rest (AES-256) and in transit (TLS 1.3)
Immutable PHI access audit trail
Role-based access control limiting PHI to authorized users
BAAs available on paid plans
Breach notification procedures consistent with the HIPAA Breach Notification Rule (and within 72 hours to affected Practitioners wherever feasible)

Practitioners are responsible for maintaining their own HIPAA compliance obligations as Covered Entities. MealCircle supports this but does not replace the Practitioner’s compliance obligations.

6. Data retention and deletion

We retain account information for as long as your account is active and for a reasonable period thereafter for legal and business purposes.

When you request deletion of your account or data, we delete personal data and PHI from active systems within 30 days, and encrypted backups are purged within 60 days — except where a longer retention period is required by applicable law or by an executed BAA. Practitioners are responsible for exporting and retaining their own clinical records before requesting deletion, in line with the medical-record retention rules that apply to their license and jurisdiction (commonly 6–7 years in the US); MealCircle deleting platform data does not satisfy a practitioner's independent record-keeping obligations.

7. International users and data transfers

MealCircle is operated from Pakistan and our platform infrastructure is hosted on Google Cloud in the United States. If you use MealCircle from outside the United States, your information will be transferred to and processed in the United States (and accessed from Pakistan for support and operations).

For users in the European Economic Area, the United Kingdom, or Switzerland: we process personal data on the legal bases of contract performance and legitimate interests; where required, we rely on appropriate safeguards for international transfers, including standard contractual clauses. You have the rights described in Section 8 below, plus the right to lodge a complaint with your local supervisory authority.

8. Your rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate personal data.
Deletion: Request deletion of your personal data (subject to legal retention requirements).
Data portability: Request your data in a portable format.
Opt-out: Opt out of non-essential marketing communications.

To exercise any of these rights, contact us at support@mealcircle.co. Patients: requests concerning records held under a Practitioner's care are typically routed through your Practitioner, who controls the treatment relationship; we support them in fulfilling your request.

9. Children’s privacy

MealCircle is not directed at children. We do not knowingly collect personal information directly from children under 13, and if we become aware that we have, we will delete it promptly. Patients under 18 may use MealCircle only under the care of a Practitioner and with the consent of a parent or legal guardian, consistent with the Practitioner's own consent procedures.

10. Changes to this policy

We may update this Privacy Policy periodically. We will notify you of significant changes by email or by posting a prominent notice on our website. Continued use of MealCircle after changes are posted constitutes your acceptance of the updated policy.

11. Contact us

For privacy-related inquiries, contact our Privacy Officer at:

TELOVANT (SMC-PRIVATE) LIMITED — operator of MealCircle.
Email: support@mealcircle.co

See also our Terms of Service and Security overview.