Privacy Policy

The Short Version

• We never sell your data. Period.
• We never use your client data to train AI. Your data generates outputs for you — that's it.
• We never share client data for marketing or advertising.
• You control your data. Access it, export it, or delete it anytime.
• We store data in the United States on encrypted servers. We don't currently offer data residency in other countries.
• No tracking cookies. We use cookies only to keep the Service running — not to follow you around the internet.

The full policy follows.

Chartless Nutrition, LLC ("Chartless," "we," "us," or "our") operates the Chartless Nutrition platform at chartlessnutrition.com (the "Service"). This Privacy Policy explains what information we collect, how we use it, how we share it, and your rights regarding that information.

This policy applies to all users of the Service, whether you are an individual nutrition professional or signing up on behalf of a practice.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Our Role — Data Processor, Not Data Controller

You (or your Practice) decide what client data to enter, how it is used in your practice, and what communications to send. Chartless processes your client data solely on your behalf and at your direction to provide the Service. Where applicable data protection law distinguishes between data controllers and data processors (such as GDPR), you are the data controller and Chartless is the data processor.

If you are a HIPAA Covered Entity, our handling of Protected Health Information ("PHI") is governed by the Business Associate Agreement ("BAA") between us, which supplements this Privacy Policy. In the event of a conflict between this Privacy Policy and the BAA regarding PHI, the BAA controls.

2. Information We Collect

Account Information

When you create an account, we collect:

• Full name
• Email address
• Phone number (if provided)
• Practice or organization name
• Professional credentials
• Billing information (processed by our payment provider — we do not store complete payment card numbers)

Client and Patient Data (Processed on Your Behalf)

When you use the Service to manage your clients, we process the following data on your behalf as your data processor:

• Demographics: name, email, phone, date of birth, sex
• Physical data: height, weight, goal weight
• Clinical information: medical conditions, food allergies, food preferences, dietary restrictions
• Insurance and referral information: insurance details, diagnosis codes, referring physician
• Session data: session audio transcriptions, clinical notes (ADIME and SOAP formats), goal summaries
• Health metrics: weight, blood pressure, glucose levels, lab values
• Meal plans: food items, macronutrient breakdowns, calorie targets, clinical recommendations
• Supplements: product names, dosages, start and end dates
• Communications: emails composed and sent to your clients through the Service

If you are a HIPAA Covered Entity, this data may constitute Protected Health Information ("PHI"). You are responsible for determining whether HIPAA applies to your use of the Service and for executing a BAA with us before transmitting any PHI.

Usage Data

We automatically collect:

• Login timestamps and session duration
• Feature usage (which parts of the Service you use)
• Session counts and subscription usage metrics
• Error logs and performance data
• Device type, browser type, and operating system

Cookies

The Service uses cookies that are necessary for the Service to function, including session authentication, workspace identification, and session persistence. We may update the specific cookies used as the Service evolves.

We do not use cookies for advertising or for tracking you across third-party websites. If we introduce analytics or non-essential cookies in the future, we will update this policy and, where required by applicable law, obtain your consent.

3. How We Use Your Information

We use your information to:

• Operate the Service: Store and display your client records; generate AI-powered clinical notes, meal plans, goal summaries, transcriptions, and emails at your direction
• Process billing: Manage your subscription, enforce seat limits and session caps, process payments
• Send service communications: Deliver transactional emails (password resets, billing notices, service alerts) and deliver client emails when you initiate them through the Service
• Maintain security: Detect and prevent unauthorized access, fraud, and abuse
• Improve the Service: Analyze aggregated, de-identified usage patterns to improve functionality and user experience
• Comply with legal obligations: Respond to lawful requests from law enforcement or regulators

We do not use your client data or PHI for marketing, advertising, AI model training, or any purpose unrelated to providing the Service.

4. How We Share Your Information

We share information only in the following limited circumstances:

Service Providers (Sub-Processors)

We use service providers to operate the Service. Each is bound by contractual obligations requiring them to protect your data and use it only for the purposes we specify:

• AI Service Providers: We transmit session data and client information to third-party AI providers (which may include Anthropic, Google, OpenAI, and others) to generate clinical notes, meal plans, transcriptions, and other AI-powered outputs. We may use multiple AI providers and may change providers over time to improve quality and reliability. Data is transmitted only as needed for processing. Under our agreements with these providers, your data is not retained by them for model training or other purposes beyond processing your request.
• Cloud Infrastructure: Provides hosting, data storage, and computing resources for the Service
• Payment Processor: Processes subscription payments (receives only billing information, not client data)
• Email Delivery: Delivers client emails you send through the Service

Public Data Sources

• USDA Food Database: We query this public API for nutritional information. No PHI or personal data is transmitted to the USDA.

Third-Party Connectors (User-Initiated Only)

If you choose to connect third-party services through the Service, data is shared only as you authorize:

• Fullscript: Supplement dispensing, if you connect your account
• Healthie: Practice management data, if you connect your account
• Google: Calendar or authentication, if you connect your account

These connections are optional, initiated entirely by you, and governed by those third parties' own terms and privacy policies.

Legal Requirements

We may disclose information if required by law, regulation, legal process, or enforceable government request, or if disclosure is necessary to protect our rights, safety, or property, or the safety of others.

Business Transfers

In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

What We Will Never Do

• We will never sell your data or your clients' information
• We will never use PHI or client data for advertising or marketing
• We will never share client data with third parties for their own purposes
• We will never use your client data or PHI to train, fine-tune, or improve AI models. Your data is processed by AI solely to generate outputs at your direction. Under our agreements with our AI providers, your data is not retained by them for model training or improvement.

5. Data Security

We implement the following safeguards to protect your information:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
• Encryption at rest: All stored data is encrypted at rest
• Authentication: Your account is protected by secure authentication with automatic token rotation. Sessions expire after periods of inactivity.
• Secure cookies: Authentication tokens are stored in HTTP-only cookies with the Secure flag enabled, preventing access by browser scripts
• Workspace isolation: Each practice's data is logically isolated in its own workspace. Users in one workspace cannot access data from another.
• Role-based access: Team members have permissions assigned by their practice administrator. Access is restricted to what each role requires.
• Ongoing security management: We review and update our security practices as our platform evolves

No system is perfectly secure. While we use commercially reasonable safeguards, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials and for any activity that occurs under your account.

6. Data Retention and Deletion

• Active accounts: Your data is retained for as long as your subscription is active.
• Client record deletion: You may delete individual client records at any time through the Service. Deletions are permanent and cannot be reversed.
• Account termination: When your account is terminated, your data is retained for 30 days to allow you to export it. After 30 days, all data is scheduled for permanent deletion.
• Backup retention: Deleted data may persist in encrypted backups for up to an additional 30 days for disaster recovery purposes, after which backups are permanently overwritten.
• Suspended accounts: If your account is suspended for non-payment, your data will be retained for a commercially reasonable period (not less than 30 days from suspension). If the account is not reactivated, data will be deleted.
• De-identified data: We may retain aggregated, de-identified data indefinitely for the purpose of improving the Service. De-identified data cannot be traced back to any individual.
• Legal requirements: We may retain certain information as required by law or to resolve disputes.

7. Your Rights

All Users

You have the following rights regarding your data:

• Access: You can view and export your client data at any time using the Service's export features
• Correction: You can correct inaccurate information in your account or client records at any time through the Service
• Deletion: You can request deletion of your account and all associated data by contacting privacy@chartlessnutrition.com
• Portability: You can download your client records in standard formats for transfer to another system

GDPR Rights (EU/EEA Users)

If you are located in the EU/EEA, you additionally have the right to: restrict processing, object to processing, and lodge a complaint with your local data protection authority.

CCPA Rights (California Users)

If you are a California resident: (a) you have the right to know what personal information we collect and how we use it; (b) you have the right to request deletion; (c) we do not sell personal information and never will; (d) we will not discriminate against you for exercising your rights.

PIPEDA Rights (Canadian Users)

If you are located in Canada, you have the right to: (a) access your personal information held by us; (b) challenge the accuracy and completeness of your information and have it amended; (c) withdraw consent to our processing (subject to legal or contractual restrictions); and (d) file a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.

Exercising Your Rights

Contact privacy@chartlessnutrition.com to exercise any privacy rights. We will respond to verified requests within the timeframes required by applicable law (generally within 30 days, extendable by an additional 60 days for complex requests with notice to you).

Complaints

If you believe your privacy rights have been violated, you may contact us at the address below. You may also file a complaint with:

• HIPAA: U.S. Department of Health and Human Services, Office for Civil Rights (https://www.hhs.gov/ocr/complaints)
• PIPEDA: Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca)
• GDPR: Your local data protection authority
• CCPA: California Attorney General

8. HIPAA Compliance

Chartless is a Business Associate under HIPAA when processing PHI on behalf of Covered Entity users. We handle PHI in accordance with:

• The HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
• The HIPAA Security Rule (45 CFR Part 164, Subpart C)
• The HITECH Act breach notification requirements
• Our Business Associate Agreement with you

Our obligations regarding PHI are detailed in the BAA. If there is a conflict between this Privacy Policy and the BAA regarding the handling of PHI, the BAA controls.

9. Children's Privacy

The Service is designed for use by nutrition and dietetics professionals, not children. We do not knowingly collect personal information from individuals under 18 as users of the Service. If we learn that we have collected personal information from a child under 18 as a Service user, we will promptly delete that account.

Note: In the course of your professional practice, you may enter information about minor clients into the Service. You are responsible for ensuring that you have all necessary consents and authorizations to do so under applicable law.

10. Data Residency and International Transfers

The Service is operated from the United States. All data, including client health information, is stored and processed on servers located in the United States. We do not currently offer data residency in other countries.

If you access the Service from outside the United States, your information will be transferred to and stored in the United States. By using the Service, you consent to this transfer. You are responsible for determining whether transferring data to the United States complies with your local laws, including any data residency requirements that may apply in your jurisdiction.

We rely on standard contractual clauses and other lawful transfer mechanisms where required by applicable law (such as GDPR).

Canadian Users

If you are located in Canada, please note that your data will be stored and processed in the United States, not in Canada. Certain Canadian provinces (including British Columbia and Nova Scotia) may impose restrictions on the storage of health information outside of Canada. You are responsible for determining whether your use of the Service complies with PIPEDA and applicable provincial health information legislation.

11. Dispute Resolution

Any disputes arising from this Privacy Policy are subject to the dispute resolution provisions in our Terms of Service, including the binding arbitration clause and class action waiver.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect and update the "Last Updated" date. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise any of your rights, contact us at:

Chartless Nutrition, LLC
Email: privacy@chartlessnutrition.com
Address: 2300 Holcomb Bridge Road, Suite 103-423, Roswell, GA 30076

For HIPAA-related complaints, you may also contact:

U.S. Department of Health and Human Services
Office for Civil Rights
https://www.hhs.gov/ocr/complaints

Appendix A — Chartless EMR Connect (Browser Extension)

Chartless EMR Connect is a Google Chrome browser extension that complements the Chartless Nutrition web application. It allows Registered Dietitians to move clinical notes and client information between Chartless and a supported Electronic Medical Record ("EMR") platform. Where the preceding sections refer to "the Service," they apply to Chartless EMR Connect as well, except where this Appendix says otherwise.

Supported EMR Platforms

• SimplePractice
• Practice Better
• Kalix
• Healthie

How the Extension Accesses Data

• The extension runs on the EMR websites listed above (which you are already logged into through your own EMR account) and on the Chartless web application. It reads information visible on those pages and, where necessary, the EMR's own internal APIs used by your browser to render its interface.
• The extension authenticates to Chartless using the same email and password as the Chartless web application. An authentication token is stored locally in your browser's extension storage so you don't have to log in on every use.

What the Extension Stores Locally in Your Browser

The following data is stored in Chrome's per-profile extension storage area (chrome.storage.local). This storage is isolated to your browser profile on your device and is not transmitted to Chartless except as described below.

• Your Chartless authentication token and email address
• The Chartless API URL you have configured (for developers running a local backend)
• A cached copy of your client list and recent clinical notes from Chartless, used to match your EMR chart to the corresponding Chartless client. This cache may contain Protected Health Information ("PHI").
• Your per-EMR field-mapping preferences, import toggles (notes, goals, files, demographics), and auto-sync setting (no PHI)
• Internal bookkeeping such as "which EMR note IDs have already been pushed" and last-sync timestamps (no PHI)

What the Extension Transmits

• From Chartless to your EMR: clinical notes (ADIME, SOAP, goals, email) that you choose to inject into an EMR field.
• From your EMR to Chartless: notes, client demographics (name, email, phone, date of birth, height, weight, sex), goals, and files that you choose to import.
• All transmissions go directly between your browser and either the Chartless API or your EMR vendor's systems, over HTTPS.
• Chartless EMR Connect does not send data to any third-party analytics, advertising, telemetry, or tracking service. It contains no embedded analytics SDK.

Chrome Permissions Requested by the Extension

• activeTab and scripting: needed to inject notes into, and read notes from, the EMR page you have open. These permissions only apply to the tab you are actively using.
• storage: needed to cache your Chartless client list, remember your settings, and keep you logged in between browser sessions.
• Host permissions (listed in the Chrome Web Store listing): needed so that the extension can run on the supported EMR sites and on Chartless itself. A full list of host permissions is declared in the extension's manifest and shown by Chrome at install time.

Clearing Extension Data

You can clear all locally cached Chartless data at any time by one of the following methods:

• Log out of the extension using the popup — this removes your authentication token.
• Visit chrome://extensions, open "Details" on Chartless EMR Connect, and use the browser-provided controls to clear the extension's data.
• Remove the extension entirely. Uninstalling an extension deletes all of its chrome.storage.local data.