Privacy Policy
Effective: 27 July 2026 (version 1.0)
Summary
This summary is provided for convenience only. It does not form part of the Privacy Policy, and the numbered clauses below govern.
The Provider is Klara Kisznyer, a nutritionist and sole trader in Co. Carlow, trading as “Nutrition by Klara”. For everything the Provider does with personal information, the Provider is the controller and is accountable for it.
The Provider collects only what a given interaction needs: contact and booking details when the Client books; the answers to the intake questionnaire when the Client fills it in; a payment record when the Client buys; and limited, mostly anonymous website data.
Everything the Client enters on the intake questionnaire is treated as health information, in full — not only the obvious medical fields. The Provider processes it on the Client’s explicit consent alone, and the Client can withdraw that consent at any time. Clauses 6 and 8 set out the detail.
The Provider does not sell personal information, does not advertise to anyone who has not asked to hear from the Provider, uses no tracking pixels, and makes no automated decisions about anyone.
The Client’s intake answers are encrypted in the Client’s own browser before they are sent, so that the network in front of the website receives them already scrambled. Clause 12 explains what this does and does not cover — including the flows that are not encrypted this way, which the Provider sets out rather than glosses over.
The Client can obtain a copy of everything the Provider holds, or have it erased, from the self-service page at nutritionbyklara.com/data-subject, without any email exchange. Clause 19 lists the Client’s rights in full.
Questions or complaints go to info@nutritionbyklara.com. The Client may also complain to the Data Protection Commission at any time. Clause 21 gives the details.
1. Who the Provider is, and defined terms
1.1. This Privacy Policy explains how the Provider handles personal information when a person visits the website, makes an enquiry, books or attends a consultation, completes an intake questionnaire, buys a Digital Guide or other product, or signs up for the newsletter or a free resource.
1.2. In this Privacy Policy:
- (a) “the Provider”, “Klara” — Klara Kisznyer, trading as Nutrition by Klara, the controller of the personal information described here;
- (b) “the Client”, “you” — the individual whose personal information the Provider processes, whether a prospective, current or former client, an enquirer, a subscriber, or a reviewer;
- (c) “the GDPR” — Regulation (EU) 2016/679;
- (d) “the 2018 Act” — the Data Protection Act 2018;
- (e) “the ePrivacy Regulations” — the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011);
- (f) “the Commission” or “the DPC” — the Data Protection Commission, the Provider’s supervisory authority;
- (g) “special category data” — personal data within Article 9(1) GDPR, which for this service means the whole of the intake questionnaire (clause 6);
- (h) “a Digital Guide” — a downloadable product licensed to the Client under the Provider’s Terms of Service.
1.3. The Provider’s details are:
| Controller | Klara Kisznyer, trading as Nutrition by Klara |
|---|---|
| Legal form | Sole trader (registered business name: “Nutrition by Klara”) |
| Registered business address | 1 Milford Park, Ballinabrannagh, Co. Carlow, R93 K263, Ireland |
| info@nutritionbyklara.com | |
| Phone | 085 203 4929 / +353 85 203 4929 |
| Website | https://nutritionbyklara.com |
1.4. The Provider sees clients in person at Edenbrook, Carlow and at The Surgery, Castledermot, and by video call. Consultations are not delivered by telephone.
1.5. The Provider is not required to appoint a data protection officer under Article 37 GDPR and has not appointed one. Klara deals with all data protection matters personally.
1.6. Klara is an MNU Certified Nutritionist (MN.Nutr) holding a Level 5 Diploma in Advanced Nutrition Science from Mac-Nutrition Uni, and is a member of Foyht. Nutrition consultancy is not one of the professions designated under section 4 of the Health and Social Care Professionals Act 2005, and the Provider is not a medical practice. This affects the condition on which the Provider is permitted to process health information, which clause 6 explains.
2. What this Privacy Policy covers
2.1. This Privacy Policy applies to the website and every form on it; to consultations in person and by video call; to Digital Guides and other products bought through the site; to the newsletter and free resources; and to correspondence between the Client and the Provider about any of these.
2.2. The website links to third parties — Google, where the Provider’s reviews are published, and Stripe, where payments are completed. Once the Client leaves the website, the third party’s own privacy notice applies, not this one.
2.3. This Privacy Policy sits alongside the Provider’s Terms of Service, Disclaimer and Cookie Policy. Where they overlap, this Privacy Policy governs how personal information is handled. Clause 13 below lists every cookie and similar item of storage the website uses; the Cookie Policy explains the categories and how to change a choice, and describes the same storage.
3. The law the Provider works to
3.1. The Provider is bound by the GDPR; by the 2018 Act, which supplements the GDPR in Ireland; and by the ePrivacy Regulations, which govern cookies, similar storage on the Client’s device, and marketing by email and text.
3.2. The Provider’s supervisory authority is the Commission. Clause 21 explains how to complain to it.
4. The information the Provider collects
4.1. The contact form. The Provider collects the Client’s name, email address, subject line, message, and the topic selected. The Provider also stores a one-way encrypted fingerprint of the Client’s IP address and a broad browser category, solely to prevent the form being abused.
The Client should not put medical details in this form. It is a general enquiry box, not a clinical one. If the Client needs to describe a condition, that belongs in the intake questionnaire, which is built for it. Any health information sent through the contact form is treated as confidential and deleted once the enquiry is closed.
4.2. Booking a consultation. The Provider collects the Client’s first name, email address, phone number, chosen slot, format, topic, the consents the Client gives, and the version of this Privacy Policy in force at the time.
If the Client begins a booking and does not finish, the Provider holds the Client’s name, email, phone and slot for 30 minutes so that the slot is not double-booked. That record then deletes automatically.
4.3. The intake questionnaire. Everything the Client enters on this form is health information. The Provider states this plainly because it is the honest position and because it determines how the information is protected (clause 6).
The questionnaire collects:
- (a) identity and contact details — first name, last name, email address, phone number, date of birth, town and county;
- (b) consultation details — preferred format, how the Client heard about the Provider, the Client’s primary goal, the detail given about that goal, and how urgent it feels; and
- (c) health and lifestyle information, namely: previous attempts to change diet or health; existing medical conditions; medications; supplements; allergies and intolerances; whether the Client takes, has taken, or is considering a GLP-1 medication (such as Ozempic, Mounjaro or Wegovy); pregnancy and breastfeeding status; menstrual and menopausal status; family medical history; height and weight; recent laboratory results the Client chooses to mention; anything else the Client wants the Provider to know; a typical day’s meals; whether the Client smokes; current diet pattern; cultural, religious or personal food preferences; activity level; how often and what kind of exercise the Client does; occupation; sleep quality and hours slept; stress level; water intake; alcohol and caffeine intake; how many meals and snacks the Client eats; how the Client usually obtains meals and how willing they are to cook or meal-prep; what gets in the way of eating well; and the kind of support the Client wants.
Every field in paragraph (c) is special category data under Article 9 GDPR, and the Provider treats them identically. So is anything the Client writes in a free-text box, because the Provider cannot know in advance what the Client will disclose.
4.4. Purchases. The Provider collects the Client’s name, email and order details. The Client’s card details never reach the Provider’s systems; payment is completed on Stripe’s infrastructure, and Stripe returns only a confirmation and a reference. The Provider keeps a record of what was bought, when, for how much, and whether it was paid or refunded.
4.5. Newsletter and free resources. The Provider collects the Client’s email address, first name, the resource requested, the marketing consent given, and the policy version. The Provider uses double opt-in: nothing is sent, and no list is joined, until the Client clicks a confirmation link. If the Client never clicks it, the record is discarded.
4.6. Data-rights requests. The Provider collects the action requested and the Client’s email address.
4.7. Website data.
- (a) Cookie choices. The Provider records which cookie categories the Client accepted or refused, and the policy version, against a pseudonymous identifier derived from an encrypted fingerprint of the Client’s IP address. No name or email address is stored against it.
- (b) Analytics. Collected only if the Client accepts analytics cookies (clause 14).
- (c) Funnel measurement. The Provider counts how many people reach each step of the booking process, using a randomly generated identifier and a fixed list of permitted step names. It records no name, email or health information; but because the identifier persists for a year, the Provider treats it as personal data and gates it behind the Client’s analytics consent.
4.8. What the Provider does not collect. For the avoidance of doubt:
- (a) there are no client accounts — no sign-up and no password; everything is handled by single-use links to the Client’s email;
- (b) there is no postal-address field anywhere in the Provider’s systems;
- (c) the Provider holds no card or bank details (clause 4.4);
- (d) the Provider uses no tracking pixels of any kind — no Meta pixel, no advertising tags, no email open-tracking;
- (e) the Provider carries out no profiling and no automated decision-making (clause 16); and
- (f) there is no user-generated content — reviews are drawn from Google and are read-only, and there is no review form on the site.
4.9. Whether the Client must provide information. The Client is never obliged to. But some information is necessary: without a name, email and chosen slot the Provider cannot make a booking, and without the information in clause 4.3 the Provider cannot advise responsibly. If the Client would rather not answer a particular question, the Provider will say honestly whether it can still help.
5. Where else the Provider obtains information
5.1. Almost all of the information the Provider holds comes directly from the Client. The two exceptions are:
- (a) Stripe, which confirms payment outcomes and passes on the billing details the Client gave it; and
- (b) Google, which supplies the reviews shown on the site, including reviewers’ names, photographs and text. A reviewer’s position is set out in clause 17.
6. The Client’s health information
6.1. Everything described in clause 4.3 is special category data under Article 9 GDPR — not only the obvious items.
The Provider explains why, because it is not intuitive. Under the guidance European data protection regulators apply, information collected through an online questionnaire for the purpose of giving health advice is health data regardless of what the Client actually enters. Whether the Client is healthy or unwell makes no difference. Nor does the apparent innocence of a single answer: stress level speaks to mental health; alcohol, caffeine and smoking answers speak to future health risk; diet pattern, activity level and sleep quality allow conclusions to be drawn about health, and may also reveal a philosophical or religious belief. Each is read alongside the Client’s medications and conditions, which is what makes the whole set sensitive.
The Provider therefore does not divide the questionnaire into “sensitive” and “ordinary” parts. All of it is sensitive, and all of it receives the same protection.
6.2. The Provider’s condition for processing this information is the Client’s explicit consent, under Article 9(2)(a) GDPR. The Client agrees to the following statement:
“I explicitly consent to Klara processing my health and related information for the purpose of providing nutrition consultation. I understand I can withdraw this consent at any time.”
6.3. This consent is a real gate, not a formality. The questionnaire remains locked until the Client ticks that box, and the Provider’s server rejects any submission that arrives without it. There is no pre-ticked box, and no way to give this consent by accident.
6.4. There is a route in the law that lets some practitioners process health information without asking — where it is necessary for preventative medicine or the provision of medical care (Article 9(2)(h) GDPR, given effect in Ireland by section 52 of the 2018 Act). The Provider has not taken it. For a service of this kind the Provider takes the view that the Client should be the person who decides, and that a permission the Client can take back is worth more than one the Client was never asked for. The Provider therefore relies on the Client’s consent, and only on that consent. If the Client withdraws it, the Provider does not fall back on some other justification and continue (clause 6.6).
6.5. The Client may withdraw consent at any time, at nutritionbyklara.com/data-subject or by email. It is free, requires no reason, and is as easy as giving consent was.
6.6. On withdrawal:
- (a) the Provider stops processing the Client’s health information immediately;
- (b) withdrawal is not retrospective — it does not make anything done beforehand unlawful;
- (c) the Provider will be unable to continue consultations with the Client, because it cannot advise safely without knowing the Client’s medical background; this is a practical consequence, not a penalty; and
- (d) the Provider deletes the Client’s health information, unless it needs it to establish, exercise or defend a legal claim — for example where a complaint or claim is live or reasonably foreseeable. In that narrow case the Provider relies on Article 9(2)(f) GDPR, restricts the record from ordinary use, and deletes it once the matter is finally resolved. The Provider will tell the Client if this applies.
6.7. The Client’s health information is never used for marketing, never shared with an advertiser, never profiled, never sold, and never included in any bulk export. It is encrypted (clause 12), and every time it is read the Provider’s systems record that it was read, by whom, and when.
7. Why the Provider uses the Client’s information, and the lawful basis for each use
7.1. Under the GDPR, every use of personal information needs a lawful basis; where health information is involved, the Provider needs a lawful basis under Article 6 and a condition under Article 9. The Provider’s purposes are:
| # | Purpose | Lawful basis (Article 6) | Article 9 condition |
|---|---|---|---|
| 1 | Intake assessment — reading the questionnaire, preparing the consultation | 6(1)(b) — performance of the contract, or steps taken at the Client’s request before it | 9(2)(a) — explicit consent |
| 2 | Booking and managing appointments — confirmations, reminders, rescheduling | 6(1)(b) | — |
| 3 | Taking payment and keeping the record | 6(1)(b); and 6(1)(c) — the Provider’s legal record-keeping obligation | — |
| 4 | Delivering Digital Guides and other products | 6(1)(b) | — |
| 5 | Sending a free resource the Client asked for | 6(1)(a) — consent, confirmed by double opt-in | — |
| 6 | Sending the newsletter | 6(1)(a) — consent, confirmed by double opt-in | — |
| 7 | Answering an enquiry | 6(1)(b) — steps taken at the Client’s request; and 6(1)(f) — the Provider’s legitimate interest in replying | 9(2)(a), if the Client volunteers health information |
| 8 | Inviting the Client to leave a review, once, after a completed paid session | 6(1)(f) — the Provider’s legitimate interest in gathering honest feedback (clause 15.4) | — |
| 9 | Website analytics | 6(1)(f) — the Provider’s legitimate interest in understanding which pages help, and only after the Client accepts analytics cookies | — |
| 10 | Handling data-rights requests | 6(1)(c) — Articles 15 to 22 GDPR | 9(2)(b) |
| 11 | Keeping the site secure — rate limiting, abuse prevention, audit logs | 6(1)(f) — the Provider’s legitimate interest in protecting the Client’s information | 9(2)(f) for logs recording access to a health record |
| 12 | Tax and accounting records | 6(1)(c) — section 886, Taxes Consolidation Act 1997 | — |
7.2. Where the Provider relies on legitimate interests (rows 7, 8, 9 and 11), it has weighed that interest against the Client’s rights and concluded that the processing is limited, expected, and does not override them. The Provider will share its reasoning on request. The Client may object (clause 19.1(f)).
8. How the Provider handles consent
8.1. Where the Provider relies on consent, it records the consent type, the date and time, and the policy version. It does not bundle consents. The consents the Provider records are:
| Consent | What it covers |
|---|---|
| Health / special category | The whole of clause 4.3 |
| Marketing | The newsletter and free resources |
| Functional cookies | Cookies that remember preferences the Client has set |
| Analytics cookies | Google Analytics 4 and the Provider’s funnel measurement |
| Marketing cookies | Reserved; not currently in use |
| Start-now acknowledgement (checkout) | Where the Client buys a session, programme or Digital Guide and asks the Provider to begin straight away, the Client acknowledges the effect this has on the 14-day right to cancel. This is a consumer-rights acknowledgement under the Provider’s Terms of Service rather than a GDPR permission, but it is recorded the same way, against the order it relates to |
8.2. Every optional consent is a separate, unticked box. Ticking one is never a condition of booking, buying, or receiving an answer.
8.3. Contacting the Client to arrange a consultation is not a consent — it is how the service works, and the Provider relies on the contract with the Client (Article 6(1)(b)). The Provider states this so that the Client is not misled into thinking this contact could be declined while the service continued.
8.4. Review invitations do not appear in the table above because the Provider does not rely on consent for them; the basis is legitimate interest, described in clause 15.4.
8.5. The Client may withdraw any consent at any time, as easily as it was given (Article 7(3)). Withdrawing one consent does not affect the others.
9. Who the Provider shares information with
9.1. The Provider does not sell, rent or trade personal information. It shares information only with the recipients below, only for the purpose stated, and only under a contract that binds them.
| Recipient | What it receives | Role | Where |
|---|---|---|---|
| Innostack Limited (trading as Innostack), company number 793621, registered office 56 Bramble Avenue, Castleoaks, Carlow, Co. Carlow, R93 F9NF, Ireland | Hosting, maintenance and encrypted backups; has access to everything, including health information | Processor, under a written contract meeting Article 28 GDPR | Ireland |
| Cloudflare, Inc. (United States) | Runs the Provider’s DNS and screens traffic before it reaches the server. Receives the Client’s IP address and, in transit, name, email, phone and date of birth. Receives the Client’s intake health answers only in encrypted form, because the Client’s browser encrypts them first (clause 12). Receives, in readable form, anything typed into the contact form, and the health information Klara opens on her dashboard (clause 10.5) | Processor | Global edge network — see clause 10.5 |
| Stripe Payments Europe, Limited (Ireland) | The Client’s name, email, billing address and payment metadata. No health information | Controller for its own compliance purposes; processor for payment execution | Ireland, with sub-processors in the US |
| Google Ireland Limited — Calendar API | The Client’s name, email address, phone number and appointment time. For a free call, the entry also carries what the Client wrote when asked what they would like to talk about, and how they heard about the Provider; for a paid session, the amount paid and a partial Stripe reference. The event title names the session and the Client — “Free 15-min call — [first name]”, “Nutrition consultation — [full name]”, or, for a session included in a programme, the name of that session. The Provider does not copy anything from the intake questionnaire into a calendar entry, but the Client should be aware that what they write in the booking box is stored in the Provider’s Google Calendar and may itself describe a health concern | Processor | Ireland / US |
| Google Ireland Limited — Workspace and Gmail | Recipient address, subject and body of the Provider’s emails; the Provider does not put health data in email bodies | Processor | Ireland / US |
| Google Ireland Limited — Business Profile API | Nothing about the Client as a client; this feed brings reviews onto the site (clause 17) | Processor | Ireland / US |
| Google Ireland Limited — Google Analytics 4 | Page views, e-commerce events, _ga identifiers, anonymised IP; only with the Client’s consent | Processor | US |
| Capital ABC, 46 Enterprise Centre, Lavery Avenue, Park West Business Park, Dublin 12, D12 N2X6 — the Provider’s accountants | Invoices, orders, payment records; no health information | Independent controller | Ireland |
| The Provider’s professional advisers and insurers | Only what is strictly necessary, and only if a dispute or claim arises | Independent controllers | Ireland |
| An Garda Síochána, the Revenue Commissioners, the courts, or the Commission | Only what the Provider is legally obliged to give, once satisfied the request is lawful | — | Ireland |
9.2. Every processor above is bound by a written contract requiring it to act only on the Provider’s instructions, to keep the Client’s information confidential and secure, to help the Provider answer the Client’s rights requests, and to delete or return the information when the contract ends.
9.3. If the Provider changes hosting, backup or payment provider, it will update this Privacy Policy and its version before the change takes effect.
9.4. If the business is sold or transferred, the Client’s information may transfer with it. The Provider would tell the Client first, and the buyer would be bound by this Privacy Policy until the Client received a fresh notice.
10. Sending information outside the EEA
10.1. The Provider’s systems, and the Client’s health information, are hosted in Ireland or elsewhere in the EU.
10.2. Some providers are US companies or use US sub-processors. Where information reaches the United States, the Provider relies on:
- (a) the European Commission’s adequacy decision for the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023), where the recipient is certified — Google LLC and its wholly-owned US subsidiaries are certified, which covers Google Workspace and Google Analytics, and Cloudflare, Inc. is certified; any organisation’s status can be checked at dataprivacyframework.gov; and/or
- (b) the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), together with a documented transfer assessment and supplementary safeguards where needed.
10.3. The Client is entitled to a copy of the safeguards the Provider relies on, on request.
10.4. For completeness: the adequacy decision in clause 10.2(a) was challenged and upheld by the General Court of the European Union in Latombe v Commission (Case T-553/23, 3 September 2025), and an appeal is pending before the Court of Justice (Case C-703/25 P). If the decision is struck down, the Provider will move the affected transfers onto Standard Contractual Clauses and update this Privacy Policy.
10.5. Cloudflare. The website sits behind Cloudflare, Inc.’s network, which screens traffic before it reaches the Provider’s server and protects it from attack. That network spans many countries, and the Client’s connection is opened at whichever of Cloudflare’s locations serves the Client — normally the nearest, which for clients in Ireland is usually Dublin, though this is not guaranteed. Cloudflare, Inc. is certified under the EU–US Data Privacy Framework, which is the safeguard the Provider relies on for it.
Coming in, the Client’s intake answers reach Cloudflare already encrypted, because the Client’s browser encrypts them before they are sent (clause 12). Two other flows are not encrypted in this way, and the Provider states them rather than imply a protection it does not provide:
- (a) the Client’s name, email, phone number and date of birth, and anything typed into the contact form, pass through Cloudflare in readable form; and
- (b) when Klara opens the Client’s file on her dashboard, the server decrypts it and sends it to her browser through Cloudflare, so the Client’s health information passes through Cloudflare in readable form at that moment.
The Provider keeps Cloudflare in front of the whole site deliberately: taking the dashboard out from behind it would expose the server’s address directly to the internet and make it a target for attack, which the Provider judges the greater risk to the Client’s information over time. Cloudflare handles this data only in transit; it is a processor acting on the Provider’s instructions, bound by the contract in clause 9, and it does not store or use the Client’s information for its own purposes.
11. How long the Provider keeps information
11.1. The Provider keeps information only as long as it needs it (Article 5(1)(e) GDPR):
| Information | Retention period | Basis |
|---|---|---|
| Intake questionnaire, including health information | 36 months from submission; a shorter period requested by the Client is stored against the record and honoured | Long enough for returning clients, short enough to be proportionate for sensitive information |
| Bookings — attended, completed or no-show | 7 years from the appointment date | These carry payment consequences and fall under the tax record-keeping obligation (section 886, Taxes Consolidation Act 1997) |
| Bookings — cancelled | Name and contact details erased at 36 months; payment fields kept for 7 years on the tax basis above | The appointment did not proceed, so the Provider minimises what is kept |
| Incomplete booking holds | 30 minutes | Technical, to prevent double-booking |
| Contact-form enquiries | 24 months from the Client’s message | Context if the Client returns |
| Free-resource sign-ups — not confirmed | 30 days, then deleted | The confirmation link was never clicked, so consent was never given |
| Newsletter and free-resource subscriptions — confirmed | Until the Client unsubscribes | The Client’s consent |
| Unsubscribe records | A minimal suppression record (email only), kept for as long as the Provider sends marketing at all | So the Provider can honour the opt-out; deletion would risk emailing the Client again |
| Consent records | For as long as the Provider may be required to demonstrate that the Client validly consented; there is no fixed end date, because the obligation to prove consent has none | Article 7(1) GDPR requires the Provider to be able to show consent; a deleted record would leave it unable to |
| Data-rights requests (access, erasure, withdrawal) | 6 months after execution | To show the request was handled properly, then discarded |
| Cookie choice on the Client’s device | 180 days, then the Provider asks again; also re-asked if the cookie list changes | The Client’s control |
| Website audit logs — general operational | 24 months | Detecting and investigating misuse |
| Website audit logs — record of health-file access, the data-rights process, the booking lifecycle, and key security events | 7 years | These prove who opened a health file and when, and that rights requests were honoured; they are the Provider’s accountability evidence under Article 5(2). They hold no health information |
| Funnel-measurement events | 90 days | An opaque session identifier only, no name or email |
| Off-site backups | 90 days, with a monthly verified restore | To recover information after an incident, without keeping old copies indefinitely |
| Google Analytics data | User data: 14 months. Event data: 2 months | Google’s retention settings for the Provider’s property; these govern the detailed exploration reports only, and Google’s aggregated reports persist regardless |
| Single-use links | 15 minutes for a data-rights confirmation link; a booking cancellation, reschedule or session-scheduling link lasts until the appointment it relates to | Security, balanced against the link still working when the Client needs it |
11.2. Audit entries record only who did what, to which record, and when, plus an encrypted IP fingerprint and a broad browser category. They never contain the Client’s health information.
11.3. If a claim or complaint is live, or reasonably expected, the Provider may keep the relevant records until it is finally resolved and all appeal periods have expired. In Ireland the ordinary limitation period for breach of contract is six years (section 11(1), Statute of Limitations 1957); for personal injury it is two years from the injury, or from the Client’s knowledge of it, whichever is later (section 3(1), Statute of Limitations (Amendment) Act 1991, as amended by section 7 of the Civil Liability and Courts Act 2004). Where health information is involved, the Provider relies on Article 9(2)(f) GDPR, restricts the records from ordinary use, and deletes them once the matter ends.
11.4. When a retention period expires, the record is deleted, not hidden.
12. Security
12.1. The Client’s intake answers are encrypted in the Client’s own browser, before they are sent anywhere. They cross the internet — and pass through the network in front of the website — already encrypted, and only the Provider’s server holds the key that opens them. They remain encrypted at rest, on an encrypted disk. They are decrypted only at the moment Klara opens the Client’s file, and every such read writes an audit entry recording who did it and when. Keys are versioned and rotated annually. Bulk exports never include them.
12.2. The Client’s IP address is never stored in the clear. It is put through SHA-256 with a server-side secret and cannot be reversed. Browser details are reduced to one of seven broad categories.
12.3. Only Klara has an administrator account. It is protected by a password, an authenticator app (two-factor authentication) and single-use recovery codes, with automatic lockout after repeated failures. Sessions expire after 60 minutes.
12.4. Website traffic is encrypted in transit (TLS). The Provider uses HTTP Strict Transport Security with a two-year policy and enforces a Content Security Policy. Every public form is rate-limited.
12.5. Backups are held in Ireland and are encrypted. Because the Client’s health information is encrypted at the application level rather than only on the disk it sits on, it remains encrypted inside the backup — a stolen copy of the database is not a readable copy of the Client’s health information.
12.6. No system is perfectly secure, and the Provider does not claim otherwise. What the Provider can say is that the above is what it actually operates, that it reviews these measures, and that it will tell the Client plainly if something goes wrong (clause 20).
13. Cookies and similar storage
13.1. Under Regulation 5(3) of the ePrivacy Regulations, the Provider needs the Client’s consent before storing anything on the Client’s device or reading anything from it. Regulation 5(5) exempts two things: what is needed purely to transmit a communication, and what is strictly necessary to deliver a service the Client has explicitly requested.
13.2. This rule concerns the Client’s device, not the word “cookie”. It covers local storage and similar techniques in the same way, and the Provider treats them the same.
13.3. Nothing outside the strictly necessary category is set until the Client accepts it. There are no pre-ticked boxes. Refusing is as easy as accepting and does not degrade the site. The Client may change these choices at any time using the cookie settings link in the footer.
13.4. First-party — set by the Provider.
| Name | Purpose | Category | Duration |
|---|---|---|---|
nbk_admin_session | Authenticates Klara’s admin session; never set for visitors | Strictly necessary | 60 minutes |
nbk_funnel_sid | Opaque random identifier linking booking-funnel steps; no name, email or health information | Analytics — consent required | 365 days |
nbk_leadmagnet_popup_dismissed_v1 | Remembers that the Client closed the free-guide popup, so it is not shown again. Records no identifier and is never read for any other purpose | Strictly necessary | 14 days after a dismissal; 180 days after a sign-up |
nbk_google_oauth_state | Security token for the Google Business Profile connection; admin only | Strictly necessary | 10 minutes |
nbk_calendar_oauth_state | Security token for the Google Calendar connection; admin only | Strictly necessary | 10 minutes |
All of the above except the popup cookie are httpOnly, SameSite=Lax and Secure. The popup cookie is readable by the page because the popup itself has to check it.
13.5. First-party — stored on the Client’s device, not a cookie.
| Name | Purpose | Category | Duration |
|---|---|---|---|
nbk_cookie_consent | The Client’s cookie choices and the version they were given against, so the Provider does not ask again | Strictly necessary | 180 days, then re-prompted; also re-prompted if the cookie list changes |
| Checkout and measurement markers | A small number of short-lived markers held in session storage — one carries a chosen appointment slot into checkout, the others stop a single analytics event being counted twice on a page refresh | Strictly necessary | Cleared when the browser tab closes |
The consent record is held in the Client’s browser local storage. It never leaves the device except as the pseudonymous record described in clause 4.7(a).
13.6. Third party.
| Name | Set by | Purpose | Category | Duration |
|---|---|---|---|---|
_ga | Google Analytics 4 | Distinguishes users | Analytics — consent required | 2 years |
_ga_<container-id> | Google Analytics 4 | Maintains session state | Analytics — consent required | 2 years |
__cf_bm | Cloudflare | Bot management | Strictly necessary | ~30 minutes |
cf_clearance | Cloudflare | Records a passed security challenge | Strictly necessary | ~30 minutes |
__stripe_mid | Stripe | Payment fraud prevention | Strictly necessary (on checkout) | 1 year |
__stripe_sid | Stripe | Payment fraud prevention | Strictly necessary (on checkout) | ~30 minutes |
The Stripe cookies are set only on the checkout pages, at the point the Client is paying — not while the Client browses the rest of the site.
13.7. The Cookie Policy describes the same storage and explains the categories and how to change a choice. Where the two differ on a detail, this clause governs.
14. Analytics
14.1. The Provider uses Google Analytics 4, and only after the Client accepts analytics cookies. Nothing fires before the Client does.
14.2. The Provider has configured it deliberately, so that: the Client’s IP address is truncated (anonymize_ip: true); the Client’s activity is never joined to a Google account or used to build a cross-device advertising profile (allow_google_signals: false); and nothing the Provider measures feeds advertising personalisation (allow_ad_personalization_signals: false).
14.3. In plain terms, the Provider counts visits; it does not follow the Client around the internet.
14.4. Google’s privacy notice for this service is at policies.google.com/privacy.
15. Marketing
15.1. The Provider emails marketing only to a Client who has asked for it. Under Regulation 13(1) of the ePrivacy Regulations, unsolicited marketing by email to an individual requires consent, and that is the standard the Provider applies.
15.2. The Provider uses double opt-in. After the Client signs up, the Provider emails a confirmation link; until the Client clicks it, the Provider sends nothing.
15.3. Every marketing email carries a one-click unsubscribe. It is instant, free and permanent unless the Client signs up again. The Client may also simply reply and ask.
15.4. Review invitations. After a completed, paid consultation, the Provider may send the Client one email inviting a Google review. The Provider relies on its legitimate interest in gathering honest feedback (Article 6(1)(f)), not on consent, and holds itself to a strict limit: one invitation per client, ever; only after a session that actually took place, never after a cancellation or no-show; and no follow-up. Every such email carries a clear opt-out, and the Client may tell the Provider at any time never to send one.
15.5. The Client may object to any use of personal information for direct marketing at any time, and the Provider must then stop — there is no balancing exercise and no discretion on the Provider’s side (Article 21(2) and (3) GDPR).
15.6. The Provider runs no advertising campaigns, builds no custom or lookalike audiences, and shares the Client’s details with no advertising platform. If that changes, the Provider will update this Privacy Policy and tell the Client first.
16. No profiling, no automated decisions
16.1. The Provider makes no decision about the Client by automated means alone that produces a legal effect or similarly significantly affects the Client. Article 22 GDPR does not arise.
16.2. The Provider does not profile, score or segment the Client.
16.3. Every piece of nutrition advice the Client receives is written by Klara, having read the Client’s questionnaire.
17. Reviewers, client stories and photographs
17.1. The website displays reviews drawn from the Provider’s Google Business Profile, including the name, photograph and text the reviewer published on Google.
17.2. The Provider did not collect that from the reviewer; it receives it from Google. The Provider relies on its legitimate interest in showing prospective clients what its clients say (Article 6(1)(f)). Reviews are displayed as published, and the Provider cannot edit them.
17.3. If a reviewer deletes or amends a review on Google, the site reflects that at the next sync. To have a review removed from the site sooner, the reviewer may email the Provider.
17.4. This clause is the Provider’s notice to a reviewer under Article 14 GDPR. The rest of this Privacy Policy — the Client’s rights, the Provider’s retention, and how to complain — applies to a reviewer too.
17.5. Where the Provider publishes a named testimonial or a before-and-after image that identifies the Client, it does so only with the Client’s written consent, recorded against the Client’s record, and removes it promptly if the Client withdraws that consent. The Provider does not publish an identifiable client story or image without that consent in place.
18. Children
18.1. The Provider’s service is intended for adults. The intake form is built for adults, and the Provider does not knowingly provide consultations to anyone under 18.
18.2. In Ireland the age of digital consent is 16 (section 31(1) of the 2018 Act). A person under 16 cannot validly consent to an online service processing their data; a parent or guardian must consent.
18.3. If the Client believes a child has given the Provider personal information, the Client may email the Provider, and the Provider will delete it promptly.
19. The Client’s rights
19.1. The Client has all of the following rights, free of charge:
- (a) access — a copy of the personal information the Provider holds and an explanation of what it does with it (Article 15);
- (b) correction — to have anything inaccurate fixed and anything incomplete completed (Article 16);
- (c) erasure — deletion where the Article 17 grounds apply; where the Provider holds the Client’s health information on consent, withdrawing that consent will generally trigger this right;
- (d) restriction — to have the Provider pause its use of the information while a matter is resolved, for example while it checks an accuracy point (Article 18);
- (e) portability — to receive the information the Client gave the Provider in a machine-readable format, or to have it sent to another controller (Article 20);
- (f) objection — to object to processing the Provider bases on legitimate interests, on grounds relating to the Client’s particular situation; for direct marketing the Client’s objection is absolute (Article 21);
- (g) withdrawal of consent — at any time, without affecting anything done beforehand (Article 7(3)); and
- (h) complaint — to the Commission (clause 21).
19.2. The Client exercises these rights at nutritionbyklara.com/data-subject, choosing access, export, erasure or consent withdrawal, or by emailing info@nutritionbyklara.com.
19.3. The Provider verifies the Client’s identity by sending a single-use link to the email address on the Client’s record, valid for 15 minutes, because access to the Client’s information runs through the Client’s email address rather than a password. The Provider deliberately returns the same response whether or not an email matches a record, so that the page cannot be used to discover whether a person is a client.
19.4. If the Client uses a different email address, or the Provider has genuine doubt about the Client’s identity, the Provider may ask for further information (Article 12(6)). It asks for the minimum needed and deletes it once the Client is verified.
19.5. The Provider responds within one month. If the request is complex, the Provider may extend by up to two further months and will tell the Client within the first month (Article 12(3)).
19.6. The Client’s export is a JSON file containing everything the Provider holds, with the Client’s health information decrypted so that the Client can read it — everything, not a summary.
19.7. These rights are free. If a request is manifestly unfounded or excessive — in practice, repeated identical requests — the Provider may charge a reasonable fee or decline, and will explain why (Article 12(5)).
20. If something goes wrong
20.1. If there is a personal data breach, the Provider notifies the Commission within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to the Client (Article 33).
20.2. Where a breach is likely to result in a high risk to the Client’s rights and freedoms — and the Provider treats any breach involving health information as being in that category — the Provider tells the Client directly and without undue delay, in plain language: what happened, what information was involved, what the Provider is doing, and what the Client should do (Article 34).
21. Complaints
21.1. The Client is asked to raise a concern with the Provider first, at info@nutritionbyklara.com; the Provider will look into it properly.
21.2. The Client does not have to come to the Provider first, and may complain to the supervisory authority at any time:
Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland (Portarlington office: Canal House, Station Road, Portarlington, R32 AP23, Co. Laois). Telephone: (01) 765 01 00 or 1800 437 737. Online: forms.dataprotection.ie/contact. Website: www.dataprotection.ie
The Commission does not accept complaints by telephone; they must be made in writing.
21.3. The Client also has the right to an effective judicial remedy in the Irish courts (Articles 78 and 79 GDPR) and to compensation for material or non-material damage caused by a breach of the GDPR (Article 82).
22. Changes to this Privacy Policy
22.1. The Provider versions this Privacy Policy and records which version the Client saw when the Client gave each consent, so that the Provider always knows what the Client was told.
22.2. If the Provider makes a change that affects the Client — a new recipient, a new purpose, a longer retention period — it publishes a new version with a new number and effective date, and emails the Client first where it holds the Client’s address for that purpose. Where a change means the Client’s existing consent no longer covers what the Provider intends to do, the Provider asks again rather than assume.
22.3. Minor corrections are made without notice, and the effective date is updated.
22.4. Every previous version is kept and is available on request.
23. Contact
| info@nutritionbyklara.com | |
| Phone | 085 203 4929 / +353 85 203 4929 |
| Post | Klara Kisznyer, Nutrition by Klara, 1 Milford Park, Ballinabrannagh, Co. Carlow, R93 K263, Ireland |
| The Client’s rights | nutritionbyklara.com/data-subject |
The Provider answers every message personally. There is no ticketing system and no call centre.
Nutrition by Klara — Privacy Policy, version 1.0