Privacy Policy
MAY is a supervised nutrition service. Most of what it holds about you is information you chose to record so that the clinic could prepare and review your programme, and some of it relates to your health. This policy explains what is collected, why, who can see it, which providers process it and how long it is kept.
Draft updated · 16 September 2026
What this policy covers
This policy covers the MAY website, the client portal behind it, the e-mails the service sends, and e-mails you send to the clinic’s published addresses.
It does not cover websites you reach through a link, or anything that happens outside the service.
Who is responsible for your information
MAY is operated by the clinic that provides the nutrition service, and that clinic is responsible for your information. Inside the portal your programme information can be seen by you and by the clinic’s authorized administrators, the accounts the clinic uses to run the service.
Administrator access belongs to a role, not to a named person: it requires an active administrator account and ends when that account is disabled. It is enforced by the database on every request, not only by the screens you see.
For privacy questions and requests, write to privacy@maynutriclinic.com.
Awaiting confirmation
- The registered legal name, address and registration details of the operating clinic.
- The name or role of the person responsible for privacy questions.
- How many people hold administrator access to client records, the roles they hold, and whether anyone outside the clinic has access.
What information we collect
Each item below is collected because a specific part of the service needs it. Nothing is collected for advertising, profiling, resale or automated decision-making.
Your account
- Your e-mail address and password. The password is held only by our authentication provider in protected form; it is never stored in our own database and the clinic cannot see it.
- Your full name, your phone number if you give it, and your preferred language.
- A profile photograph, only if you add one.
- The pricing market assigned to your account, which decides the currency and prices you see, and when you were last active.
What you record during your programme
- Weekly measurements: weight and the waist, abdomen, hip, thigh and arm circumferences you enter.
- Weekly lifestyle entries: energy, how closely you followed the plan, water intake, stress, mood, any symptoms, and your notes.
- Weekly physical activity: exercise days, session length, exercise types, intensity and your notes.
- Progress photographs, only if you choose to upload them.
What the clinic records about your programme
- The weekly nutrition plans prepared for you, stored as private documents.
- Its review of each check-in you submit, and the dates and status of each programme week.
- Internal notes about your programme, which are visible to the clinic only.
- Programme events such as scheduling, activation, pauses, completion and cancellation.
Messages, notifications and e-mails
- The messages you exchange with the clinic in the portal, and any files you attach.
- The notifications the portal shows you, and whether you have read them.
- E-mails you send to the clinic’s addresses, and the clinic’s replies.
Payment
- The programme you bought and, as they were at the moment of purchase, the price, currency, market, programme length and language.
- The status of each payment and refund and the reference supplied by the payment processor. For a payment made another way, such as a bank transfer, the clinic may keep a copy of the proof of payment.
- MAY never receives your card number, security code or PIN. Card details are entered with the payment processor, not with MAY.
Technical information
- When you use the service, your device’s network (IP) address, browser details and the pages or functions requested are processed by our hosting and authentication providers to deliver and secure the service.
- A two-letter country signal supplied by our hosting provider, used only when choosing which market’s prices to show.
- A request identifier that links a request to our server logs when something goes wrong.
Health-related information
Measurements, symptoms, notes about your health and progress photographs are health-related information, and some of it may be sensitive. You decide what to record, and photographs are always optional.
This information is used only to prepare, review and supervise your programme. It is never used for advertising, never sold, never shared with advertisers or data brokers, and never used to train an automated model.
Proposed rule — awaiting approval
- Before a client records health information for the first time, the portal asks for separate, explicit agreement to its use for the programme, which can be withdrawn by writing to privacy@maynutriclinic.com. The service does not ask for this today.
Awaiting confirmation
- The legal basis on which health-related information is processed under the applicable data-protection law.
How your information is used
- To create and secure your account, verify your e-mail address and let you recover access.
- To prepare nutrition plans based on what you actually recorded, and to review your progress.
- To run your programme: opening each week on schedule, notifying you when a plan is published or a reply arrives, and handling pauses, completion and cancellation.
- To take payment, record what was bought and process refunds.
- To answer your messages and e-mails.
- To keep the service working and secure, investigate faults and misuse, and keep a record of sensitive administrative actions.
Awaiting confirmation
- The legal bases for each of these purposes under the applicable data-protection law.
Who can see your information
You can see everything you recorded. The clinic’s authorized administrators can see your programme information, because reviewing it is the service. No other client can see any part of it; the database enforces this on every request.
Progress photographs, nutrition plans and message attachments are kept in private storage. They never have a permanent public link: when you or the clinic open one, the service creates a short-lived link that expires shortly afterwards.
Information is shared outside the clinic only with the providers listed in the next section, or where the law requires it.
Providers that process information for us
MAY does not run its own servers. These providers process information on the clinic’s behalf, only to operate the service:
- Supabase — the database, authentication and private file storage. It stores your account, programme records, messages and files.
- Vercel — hosting of the website and portal. It processes every request you make, including your IP address.
- Resend — delivery of account e-mails (address verification, password reset and address-change confirmation). It receives your e-mail address and the content of those e-mails.
- Namecheap — forwarding of e-mails sent to the clinic’s addresses to the mailbox the clinic uses to read them.
Payments in this review environment are simulated, so no payment processor receives your information here. When real payments are introduced, the payment processor will receive the information needed to take and refund payment.
The service uses no advertising, no analytics, no social-media widgets and no third-party tracking. Its fonts are served from our own hosting, so reading a page does not reveal your visit to a font service.
Awaiting confirmation
- The payment processor for real payments, and the provider of the mailbox where the clinic reads e-mail.
Where information is processed
In the environment currently used for review, the database and file storage are hosted in the Seoul region (South Korea), and the website’s server functions also run in that region. Our providers may process some information, such as e-mail delivery, in other countries under their own safeguards.
Awaiting confirmation
- The hosting regions of the live service, the countries to which information is transferred, and the safeguards that apply to those transfers.
Account e-mails are sent from an automatic address that does not receive replies. The service sends no newsletters or marketing e-mails.
E-mails you send to support@maynutriclinic.com, nutrition@maynutriclinic.com or privacy@maynutriclinic.com are forwarded to the clinic’s mailbox and read by the clinic. Please do not send card details or detailed medical records by e-mail; if the clinic needs more information, it will ask through your dashboard where possible.
Proposed rule — awaiting approval
- E-mail correspondence is kept for 24 months after the last message in the conversation, unless it is needed for an unresolved request or dispute.
Security and operational records
Our server logs are designed to leave out passwords, access tokens, payment credentials, file links, private file locations, health notes, message contents and photographs.
Sensitive administrative actions, such as changing an account, pausing a programme or recording a refund, are written to an internal record that cannot be edited or deleted through the service. It notes the administrator who acted and the time and, for changes to a client’s account, the administrator’s network address.
Our hosting and database providers keep their own request logs for a limited period set by their plans; at present the database provider keeps them for about a week.
How your information is protected
No system is perfectly secure, and we cannot promise that information will never be accessed without authorization. If a security incident affects your information, the clinic will tell you where the law requires it or where you need to take action to protect yourself.
- Database access rules on every table that holds client information, so a request can only return what that account is allowed to see.
- Passwords held by our authentication provider, never in our own tables.
- Verification of your e-mail address before the account can be used, and a confirmation step to change it.
- Private file storage reachable only through short-lived links.
- Encrypted connections (HTTPS) for every page and request.
- An internal record of sensitive administrative actions that cannot be altered or deleted through the service.
How long information is kept
While your account is active, your programme records are kept so that you and the clinic can look back at them.
Some records are deliberately permanent while your account exists and cannot be edited by anyone: what you paid, in which currency, for which programme and for how many weeks, and the internal record of administrative actions.
Some records are removed automatically: an upload you started but never confirmed is cleaned up, an unfinished message attachment is released, and a photograph you delete is removed from storage by a scheduled job, normally within about a week.
Proposed rule — awaiting approval
- After a verified request to close an account, the clinic deletes or irreversibly anonymizes the programme records, messages, photographs and plans within 30 days, keeping only what the law requires or what an unresolved dispute needs.
- Payment and refund records are kept for the period that accounting and tax law requires, and then deleted.
- An account with no sign-in and no active programme for 24 months is closed after the clinic has tried to contact the client and received no reply within 30 days.
Awaiting confirmation
- The retention period that applicable law requires for payment, refund and accounting records.
Your choices and requests
Inside the portal you can, at any time:
- update your name, phone number, preferred language and profile photograph;
- change your e-mail address through a verified confirmation step;
- change your password, or reset it if you have lost access;
- edit a weekly check-in while it is still a draft;
- delete a progress photograph, or choose never to upload one.
To ask for a copy of your information, to correct something you cannot change yourself, to object to a use of your information, or to have your information deleted, write to privacy@maynutriclinic.com from the e-mail address on your account. Requests are handled by a person.
Proposed rule — awaiting approval
- The clinic confirms receipt of a privacy request within 5 working days and answers it within 30 days. It may ask for proportionate confirmation of identity before acting, but will not ask for identity documents unless they are genuinely needed.
Awaiting confirmation
- The data-protection rights that apply under the governing law, the authority a client may complain to, and any statutory response period.
Closing your account
The portal does not have a self-service button to delete an account. To close your account, write to support@maynutriclinic.com or privacy@maynutriclinic.com. The clinic can disable the account immediately so it can no longer be signed in to.
Closing an account while a programme is running also ends that programme; any refund is decided under the Refund & Cancellation Policy.
Age
The platform does not ask for or verify your age, and no minimum age has been set. The age rule that will apply, and how a programme for a younger person would be arranged, are proposed and listed below.
Proposed rule — awaiting approval
- The service is offered only to people aged 18 or over, and information about a younger person is deleted when the clinic learns that it was provided without a parent’s or guardian’s involvement.
Awaiting confirmation
- The minimum age for holding an account, and the process for a programme supervised by a parent or guardian.
Changes to this policy
If this policy changes, the date at the top of this page changes with it.
Proposed rule — awaiting approval
- Material changes are announced inside the portal and by e-mail before they take effect, and a change that would use existing information for a new purpose is not applied without asking the client first.
Contact
Privacy questions and requests: privacy@maynutriclinic.com. General support: support@maynutriclinic.com.
Questions about this document?
Write to us at the address below. If you already have an account, you can also message your specialist from inside your dashboard.