Privacy policy
Last updated: October 2026
1. Who is responsible for your data
This Privacy Policy explains how your personal data is processed when you visit mymednutritioncoach.com (the "Site") and use its forms. It is provided under Article 13 of Regulation (EU) 2016/679 ("GDPR") and applicable national law, including Italian Legislative Decree 196/2003 ("Privacy Code") as amended.
Data Controller: Gioia Caputo. Email:gioiacaputo.nutritioncoach@gmail.com.
No Data Protection Officer (DPO) has been appointed. You can send any privacy request directly to the email address above.
The Site does not sell products, does not have user accounts, and does not sell or share your data for advertising.
2. What data we collect, why, and on what legal basis
We only collect the data needed for each purpose below. Fields marked as required are needed to fulfil your request; without them we cannot respond, book your call or send the guide.
| Purpose | Data collected | Legal basis (GDPR) |
|---|---|---|
| Contact form: answering your questions | Name, email address, your message | Steps taken at your request before a possible contract (Art. 6(1)(b)) |
| Free guide or ebook request: sending you the guide | Name, email address | Providing the service you requested (Art. 6(1)(b)) |
| Site operation and security | Technical data: IP address, browser type, pages requested, date and time | Our legitimate interest in running a secure site (Art. 6(1)(f)) |
We use the email address you provide in any form only for that purpose. We do not add you to marketing lists unless you have given separate consent.
We do not make decisions about you based solely on automated processing, and we do not profile you.
3. Health data
The Site's forms are not designed to collect health data. Please do not include information about your health, medical conditions, medications, allergies or similar details in the contact form.
If you share such information anyway, we will use it only to answer your request, and we will delete it if it is not needed. Any health information needed for coaching is collected later, only with your explicit consent (Art. 9(2)(a) GDPR), through a separate process explained to you at that time.
The nutrition coaching services offered are educational and lifestyle-focused and are not a substitute for medical advice.
4. Who receives your data
We do not sell, rent or share your data for advertising. To run the Site, we use the service providers below. They act as data processors on our behalf, under a written data processing agreement (Art. 28 GDPR), and may use your data only to provide their service to us.
| Provider | Service | Data involved | Where |
|---|---|---|---|
| Netlify, Inc. | Hosting of the Site | IP address and technical data of your visit (server logs); the content of the forms while they are sent | USA (servers worldwide) |
| Resend, Inc. | Sending the Site's emails (the free guides and the notices we receive about your requests) | Name, email address, content of the email | Emails sent from the EU (Ireland); company based in the USA |
| Google (Gmail) | Our email inbox, where we receive and answer your messages | Name, email address, your message | EU and USA |
We may also disclose data to public authorities when required by law, and to professional advisers (for example, an accountant or lawyer) bound by confidentiality, where needed to meet legal obligations or defend our rights.
You can request an up-to-date list of our providers by writing to the email address in Section 1.
5. Transfers outside the EU/EEA
Some of our providers process data in the United States. When your data leaves the European Economic Area, it is protected by one or both of these safeguards:
• EU–US Data Privacy Framework, an adequacy decision of the European Commission (10 July 2023), for providers certified under it.
• Standard Contractual Clauses approved by the European Commission (Decision 2021/914), included in the provider's data processing agreement.
Resend and Netlify state that they rely on both. Google includes Standard Contractual Clauses in its data processing terms for Google Workspace.
You can request a copy of the relevant safeguards by writing to the email address in Section 1.
6. How long we keep your data
We keep your data only as long as needed for the purpose it was collected for, then delete it.
| Data | How long we keep it |
|---|---|
| Contact form messages | 12 months after our last exchange, unless you become a client |
| Free guide requests | 12 months after the guide is sent |
| Technical data and server logs | 30 days, unless needed to investigate a security incident |
| Client data, if you start coaching with us | For the period required by tax and accounting law |
Copies of emails held by our email providers are deleted according to their own retention settings and our deletion of the related messages.
7. Cookies
The Site uses only one technical cookie, called "lang". It is set only when you choose a language with the language switcher, it remembers that choice for 12 months, and it contains no personal data. As a strictly necessary technical cookie, it does not require your consent. You can delete it at any time in your browser settings and the Site will still work.
We do not use analytics, advertising or social media tracking tools, tracking pixels or any other non-essential cookies.
If this changes, we will update this policy before doing so and, where required, ask for your consent before any non-essential cookies are set.
8. Your rights
Under Articles 15–22 GDPR, you have the right to:
• access your personal data and get a copy of it
• correct inaccurate or incomplete data
• have your data deleted
• restrict how we process your data
• receive your data in a portable format and have it sent to another controller
• object at any time to processing based on our legitimate interest
• withdraw your consent at any time, without affecting processing done before the withdrawal
To exercise these rights, write to the email address in Section 1. It is free, and we will reply within one month, as required by Art. 12 GDPR. We may ask you to confirm your identity.
You also have the right to lodge a complaint with a supervisory authority. In Italy, this is the Garante per la protezione dei dati personali (www.garanteprivacy.it). If you live or work in another EU country, you can also contact the authority there.
9. Security, minors and changes to this policy
Security. We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), protected access to our accounts and providers bound by data processing agreements. No system is completely secure, but we work to keep risks low.
Minors. The Site and its services are intended for adults. We do not knowingly collect data from people under 18. If you believe a minor has sent us data, please contact us and we will delete it.
Changes. We may update this policy, for example when we add new features or providers. The current version is always on this page, with its effective date. If we make significant changes, we will make them clearly visible on the Site.
Effective date: 25/10/2026