NutriMax · Effective date: April 19, 2026 · Published by GME Digital UG (haftungsbeschränkt)
NutriMax ("we", "us", "our", or "the app") is a personal nutrition and health-tracking
mobile application developed by GME Digital UG (haftungsbeschränkt). This Privacy Policy
explains what personal information we collect when you use NutriMax, why we collect it,
how we use and protect it, with whom we share it, and the rights you have over your data.
This policy applies to the NutriMax mobile app available on Apple App Store and Google
Play Store, and to the website https://gme-digital-ug.github.io.
By using NutriMax you agree to the practices described here.
1. Data Controller
The data controller responsible for processing your personal data is:
These details match our Impressum (legal notice) as required by
the German Telemedia Act (TMG) and the Digital Services Act (DDG).
GME Digital UG is not required to appoint a Data Protection Officer (DPO) under Article 37
GDPR. For all privacy-related enquiries, please contact us at the email address above.
2. Information We Collect
Account Information
Email address – required to create and secure your account.
Username / display name – used to personalise your in-app experience.
Password – hashed and stored securely by our authentication provider (Supabase Auth); we never store passwords in plain text.
Health & Body Data
NutriMax is a nutrition and health-tracking app. To provide its core features we collect
the following health-related information that you enter voluntarily:
Height and current weight
Birth year (used to calculate age-appropriate nutritional recommendations)
Biological sex / gender
Goal weight and target macronutrient splits (calories, protein, carbohydrates, fat)
Diet type (e.g. vegan, vegetarian, omnivore) and dietary preferences or restrictions
Fitness / activity level
This data falls within the category of health data under GDPR Article 9. We process it
exclusively on the basis of your explicit consent (Art. 9(2)(a) GDPR) to deliver the
nutrition-tracking features you have requested.
Nutrition & Meal Tracking Data
Meals you log: name, meal time, food items, portion sizes, and nutritional values
Water intake records
Daily / weekly / monthly weight entries
Photos (Camera & Photo Library)
Meal images you choose to capture with the camera or select from your photo library.
Photos are stored locally on your device. If you use the optional
AI-based nutrition estimation feature, the selected meal photo is transmitted to our
third-party AI service provider for processing as described in Section 7.
AI Meal Estimation Inputs (optional)
If you choose to use the optional AI-based nutrition estimation feature, NutriMax may
send the meal photo you selected and any meal description or other text you enter for
that feature to our third-party AI service provider to generate nutrition estimates.
Location Data (opt-in)
If you choose to enable it, NutriMax may record your approximate device location when
you log a meal (e.g., to tag "lunch at home" vs. "dinner at a restaurant"). Location
access is entirely optional, requires your explicit permission, and is never shared with
third parties or used for advertising.
You can grant or revoke location permission at any time in your device settings.
Preferences & Goals
Your main wellness goals, eating-habit targets, and personal motivators entered during
onboarding or updated in app settings.
Automatically Collected Technical Data
We do not collect persistent device identifiers (IDFA, Android Advertising ID),
IP addresses, or behavioural analytics/tracking data.
Supabase may temporarily process your IP address as part of secure session management
(see Section 7).
3. Legal Basis for Processing
Under GDPR, we rely on the following legal bases for each processing activity. The table
below maps every data category to its specific legal basis:
Consent — Art. 6(1)(a) & Art. 9(2)(a) GDPR
Used for health-related special-category data and optional features that require your
explicit permission. You may withdraw consent at any time (see
Section 5).
Height, weight, birth year, biological sex – health data (Art. 9)
Goal weight, macronutrient targets, diet type – health data (Art. 9)
Fitness / activity level – health data (Art. 9)
Dietary preferences / restrictions – health data (Art. 9)
Location data – opt-in only; used for meal location tagging
Meal photos – opt-in only; stored locally on device unless you submit
them for optional AI-based nutrition estimation
AI meal estimation inputs – optional meal photos and text you submit
for AI-based nutrition estimation
Performance of a contract — Art. 6(1)(b) GDPR
Used for data that is necessary to provide the NutriMax service you have requested.
Email address – required for account creation, login, and communication
Username / display name – required for in-app personalisation
Daily / weekly weight entries – core service feature
Wellness goals & personal motivators – core service feature
Legitimate interest — Art. 6(1)(f) GDPR
Used for processing that is necessary to protect the security and integrity of NutriMax.
You have the right to object (see Section 11).
IP address – temporarily processed by Supabase during authentication
sessions for fraud prevention and rate limiting; not stored long-term by us
Session tokens – used to maintain your authenticated session securely
Where we rely on consent, you have the right to withdraw it at any time. Where we rely on
legitimate interest, you have the right to object (see Section 11).
4. How We Use Your Information
We use your data only for the following purposes:
Authentication & account management – to create, secure, and
maintain your NutriMax account and to sync your data across your devices.
Nutrition tracking & personalisation – to log meals, calculate
calorie and macronutrient summaries, and display progress towards your goals.
Health recommendations – to compute personalised daily calorie targets
and macronutrient ranges based on your body measurements, activity level, and goals.
Meal photo storage – to let you attach images to meal entries. Photos
are stored on-device unless you choose to submit them for optional AI-based nutrition
estimation.
AI-based nutrition estimation – to analyze a meal photo and/or meal
description that you choose to submit and return estimated nutrition data.
Location tagging (opt-in) – to associate meal entries with a location
if you have granted location permission.
Goal & reminder features – to present your nutrition goals and, if
enabled, to send local (on-device) reminders.
We do not use your data for advertising, behavioural profiling, or selling
to third parties.
5. Consent & How to Withdraw It
When consent is collected:
During onboarding, when you enter your health and body data (height, weight, goals,
diet type, etc.) for the first time.
When you enable optional features such as location tagging or meal photo capture and
grant the corresponding device permission.
When you intentionally submit a meal photo and/or meal description for the optional
AI-based nutrition estimation feature.
How to withdraw consent:
Device permissions – revoke camera, photo library, or location access
at any time via your device's Settings app. The app will continue to work; only the
specific feature tied to that permission will be disabled.
AI-based nutrition estimation – stop using the optional AI estimation
feature. If you do not submit a meal photo or meal description for estimation, that
data will not be sent to the third-party AI service.
Health / body data – delete individual data points in the app's
profile or settings screens, or delete your entire account to remove all data (see
Section 10).
Full withdrawal – delete your NutriMax account (in-app or via email).
This permanently removes all personal data from our servers and effectively withdraws
all consent.
Withdrawing consent does not affect the lawfulness of processing carried out before
withdrawal (Art. 7(3) GDPR).
6. Device Permissions
NutriMax may request the following permissions on your device:
Camera
Used only when you choose to photograph a meal. Images are saved locally on your
device. If you use the optional AI-based nutrition estimation feature, the selected image
may also be transmitted to our third-party AI service provider for processing. You can deny
camera permission without affecting any other feature of the app.
Photo Library / Storage
Used only when you choose to attach an existing photo to a meal entry. Access is
limited to photos you explicitly select. Images remain on your device unless you submit a
selected image for optional AI-based nutrition estimation.
Location (optional)
Used only when you opt in to meal location tagging (see Section 2). The app
requests "while using" location access; it does not request background location.
Notifications (optional)
Used only to deliver local, on-device reminders (e.g., meal or water-intake
reminders) that you configure within the app. We do not use push notification services that
transmit your data to external servers.
Microphone
NutriMax does not request or use microphone access.
Device Identifiers
NutriMax does not collect advertising identifiers (IDFA, GAID) or other
persistent device identifiers for tracking purposes.
7. Third-Party Services
NutriMax uses a small number of carefully selected third-party services. Each service
operates under its own privacy policy and security controls:
Supabase (Authentication & Database)
Supabase
powers our cloud authentication and database backend. Account credentials, health/body
data, and nutrition logs are stored in Supabase-managed PostgreSQL databases protected by
row-level security (RLS). Supabase processes data on infrastructure hosted in the EU (AWS
eu-central-1) or another region we configure.
Supabase Privacy Policy →
OpenAI (AI-based Nutrition Estimation)
NutriMax uses OpenAI
to provide an optional AI-based nutrition estimation feature. When you choose to use this
feature, the meal photo you submit and any related text you enter are transmitted to OpenAI
for processing to generate estimated nutrition information. We do not use OpenAI for
advertising, profiling, or unrelated analytics.
OpenAI Privacy Policy →
Apple (App Store / iOS platform)
When you download NutriMax from the Apple App Store, Apple collects data as part of the
download and payment process in accordance with Apple's own privacy policy. We do not
receive your Apple ID or payment details.
Apple Privacy Policy →
Google (Google Play / Android platform)
When you download NutriMax from Google Play, Google collects data as part of the download
process in accordance with Google's privacy policy.
Google Privacy Policy →
No advertising or analytics SDKs
NutriMax does not integrate any advertising networks, cross-app tracking
SDKs, social-media SDKs, or third-party analytics services. We do not sell or share your
data with data brokers or marketing companies.
8. International Data Transfers
NutriMax is operated by GME Digital UG, based in Germany. Your data is primarily stored
within the European Union (EU) on Supabase infrastructure hosted on AWS eu-central-1
(Frankfurt).
In limited circumstances, data may be processed outside the EU/EEA by the following
third-party services:
Supabase – account credentials, health/body data, and nutrition logs
are stored on EU infrastructure (AWS eu-central-1). Supabase's US-based support and
engineering teams may access data for maintenance. Supabase participates in the
EU–US Data Privacy Framework and has Standard Contractual
Clauses (SCCs) in place.
Supabase Privacy Policy →
Apple – collects download and payment data when you install NutriMax
from the App Store. We do not receive your Apple ID or payment details. Apple complies
with the EU–US Data Privacy Framework.
Apple Privacy Policy →
Google – collects download data when you install NutriMax from Google
Play. Google is certified under the EU–US Data Privacy Framework and
has SCCs in place.
Google Privacy Policy →
OpenAI – if you use the optional AI-based nutrition estimation feature,
the meal photo you submit and any related text you enter are sent to OpenAI for
processing. This may involve processing outside the EU/EEA. We rely on the safeguards
provided under OpenAI's applicable contractual and privacy commitments.
OpenAI Privacy Policy →
Where personal data is transferred outside the EU/EEA, we ensure that adequate safeguards
are in place, including:
Standard Contractual Clauses (SCCs) – approved by the European
Commission, incorporated into our agreements with sub-processors.
Adequacy decisions – where the European Commission has determined that
the recipient country provides an adequate level of data protection (e.g., the EU–US
Data Privacy Framework for certified US entities).
NutriMax does not use Firebase, Sentry, advertising networks,
cross-app tracking SDKs, or third-party analytics services. NutriMax does use OpenAI for
optional AI-based nutrition estimation as described above. No data is sold to or shared
with data brokers or marketing companies.
You may request further information about international transfer safeguards by contacting
us at main@gmedigital.de.
9. Data Storage & Security
Encryption in transit – all communication between the NutriMax app and
our backend is encrypted using HTTPS/TLS 1.2 or higher.
Encryption at rest – Supabase encrypts data at rest using AES-256
on managed cloud infrastructure.
Row-Level Security (RLS) – database access policies ensure that each
user can only read and write their own data; no cross-user data access is possible.
Access controls – only authorised GME Digital personnel have access to
production infrastructure, and access is protected by multi-factor authentication.
Meal photos – stored on your device. If you use the optional AI-based
nutrition estimation feature, the selected photo is also transmitted securely to OpenAI
for processing.
No plain-text passwords – passwords are hashed by Supabase Auth before
storage.
While we take industry-standard precautions to protect your data, no system is completely
immune to security risks. We encourage you to use a strong, unique password and to keep
your device software up to date.
10. Data Retention & Deletion
We retain your personal data for as long as your NutriMax account is active. Once you
delete your account, all associated personal data (account info, health data, nutrition
logs) will be permanently and irreversibly deleted from our servers within 30
days.
How to delete your account
In-app: Go to Settings → Account → Delete Account and follow
the confirmation steps.
By email: Send a deletion request to
main.gme.digital@gmail.com from the
email address linked to your account. We will confirm deletion within 5 business days
and complete it within 30 days.
Note: Deleting the app from your device does not automatically delete your
account or cloud data. Please use one of the methods above to request full data removal.
11. Your Rights (GDPR / CCPA)
Depending on your country of residence, you may have the following rights regarding your
personal data:
Access – request a copy of the personal data we hold about you.
Rectification / Correction – update or correct inaccurate information
via the app's profile and settings screens, or by contacting us.
Erasure / Deletion – request deletion of your account and all
associated data (see Section 10).
Data Portability – request your personal data in a structured,
machine-readable format (JSON or CSV).
Restriction of Processing – request that we limit how we use your
data while a dispute is resolved.
Objection – object to certain types of data processing.
Withdraw Consent – where processing is based on consent, you may
withdraw it at any time without affecting lawfulness of prior processing.
CCPA (California Residents): You have the right to know what personal
information we collect and share, the right to delete your personal information, and the
right not to be discriminated against for exercising your privacy rights. We do not sell
personal information.
To exercise any of these rights, contact us at
main@gmedigital.de. We will
respond within 30 days (GDPR) or 45 days (CCPA). We may ask you to verify your identity
before processing your request.
If you are located in the EU/EEA and believe your data rights are being infringed, you
have the right to lodge a complaint with your local data protection authority.
12. Children's Privacy
NutriMax is intended for users aged 13 and older. We do not knowingly
collect personal information from children under 13 (or under 16 where required by
applicable law, such as the GDPR). If we become aware that we have inadvertently collected
data from a child below the applicable age threshold, we will delete that information as
quickly as possible.
For parents and guardians: If you believe your child under 13 (or 16 in
the EU) has created a NutriMax account or provided us with personal data without your
consent, please contact us immediately at
main@gmedigital.de. We will
promptly verify and delete the account and all associated data within 5 business days of
confirmation.
If you are between 13 and 17, please review this Privacy Policy with a parent or guardian
before using NutriMax. Users in this age group should obtain parental consent before
sharing health data in the app.
13. In-App & Store Accessibility
This Privacy Policy is accessible at the following locations:
In the NutriMax app: Navigate to About → Privacy Policy.
Apple App Store listing: Linked in the app's App Store product page.
Google Play listing: Linked in the app's Google Play product page.
The URL above is a permanent, publicly accessible link that is indexed by search engines
and does not require a login to view.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our app,
applicable laws, or industry standards. When we make material changes, we will update the
"Effective date" at the top of this page and, where appropriate, notify you within the app.
We encourage you to review this policy periodically.
15. Contact Us
If you have questions or concerns about this Privacy Policy or how we handle your data,
please contact us: