Privacy policy
Harvest Club Last updated: August 2026
1. Who we are
Harvest Club is operated by Manu Food Consultant FZCO, based in Dubai, United Arab Emirates ("we"), the data controller for your personal data. The service is provided under the clinical supervision of Manu Martins, nutritionist registered in Brazil (CRN 21102038), Sport Nutrition Specialist (USA) and Certified Personal Trainer (USA).
Privacy contact: suporte@nutrimanumartins.com
2. What data we collect
We collect only what is necessary to provide clinical nutrition and training services.
Identification data: full name, email, phone/WhatsApp, date of birth, gender, country and city of residence, preferred language. For payments in Brazil: CPF and address.
Health data (sensitive data): anthropometric measurements (weight, height, circumferences, body composition), health conditions, allergies and intolerances, medications and supplements, lab test results you upload, intake questionnaire information (sleep, eating habits, physical activity, digestive health, menstrual cycle where applicable), body progress photos and meal photos.
App usage data: logged meals, weigh-ins, completed workouts, check-ins, app interactions and communication preferences.
Technical data: app event records, error logs and technical access information, used for security and service operation.
Payment data: plan, amounts, validity dates. We do not store card numbers — payments are processed by specialized providers (section 5).
3. How we use your data
- To prepare and monitor your individualized nutrition and training plan.
- To track your progress (weight, measurements, photos, lab results).
- To communicate with you about your care.
- To process payments and manage your account.
- To keep clinical records, as required by professional obligation.
- To prevent fraud, unauthorized access and misuse of the platform.
- To keep the app secure and working properly.
We do not sell your data. We do not use your data for third-party advertising.
4. Legal basis
We process health data based on the data subject's consent and for the provision of health care by a health professional. Other data is processed to perform our contract with you, comply with legal obligations and pursue our legitimate interest in service security.
5. Who we share data with
We share only the minimum data necessary for each provider to perform its function. We use service providers (processors) strictly to operate Harvest Club:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase (São Paulo region, Brazil) | Database and storage | All service data |
| Vercel | Cloud hosting | Data transmitted during use |
| Stripe | International payments | Email, internal identifier, amount |
| Asaas | Payments in Brazil | Name, CPF, email, phone, address, amount |
| Resend | Email delivery | Email, name, message content |
| Anthropic | Support for plan preparation and lab report reading | Clinical data without direct identification (no name, email or phone); lab report images and body assessment photos |
| OpenAI | Transcription of form audio | Audio you record, without direct identification |
| Sentry | Technical error monitoring | Technical error data |
These providers process data under our instructions and may not use it for their own purposes.
6. International transfers
Your data may be processed in other countries by service providers we engage (for example, in the United States). For these transfers, we adopt appropriate contractual safeguards to ensure a level of protection compatible with applicable law.
7. How long we keep your data
Clinical records (intake questionnaire, lab results, prescriptions, progress records, assessment photos): kept for 20 years after the last appointment, in compliance with health record retention obligations. These records cannot be deleted before this period, even upon request, due to legal and professional duty.
Non-clinical data (account data, preferences, usage records): kept while your account exists and deleted upon request, subject to legal obligations (for example, payment records).
8. Your rights
You may at any time request: confirmation of processing, access to your data, correction, portability, information about sharing, withdrawal of consent and deletion of data not subject to mandatory retention. Write to suporte@nutrimanumartins.com. We will respond within the legal timeframe. We may request additional information to confirm your identity before fulfilling certain requests.
Withdrawing consent for health data processing makes it impossible to continue your care, as this data is indispensable to the service.
Data subjects in Brazil may also petition the Brazilian Data Protection Authority (ANPD).
9. Security
We adopt technical and organizational measures to protect your data: encryption in transit (HTTPS), authenticated access control, per-patient data isolation in the database, private photo storage with temporary access links, dependency vulnerability checks, security event logging and periodic permission reviews.
10. Children
Harvest Club is intended for adults 18 and over. Care for minors occurs only with the consent and involvement of a legal guardian, outside the app's standard flow.
11. Changes
We may update this policy. Relevant changes will be communicated through the app or by email and, where required, we will request renewed consent for continued use of the service. The current version will always be available on this page.