Privacy policy

Who this policy covers

Ration Lab is a meal-planning tool for dietitians and nutritionists (practitioners). Practitioners use it to prepare meal plans for their clients. This policy explains how we handle information from people who send us an enquiry, from practitioners who use Ration Lab, and about the clients they enter.

The practitioner collects their client's information and is responsible for the plans they approve. We handle client information on the practitioner's behalf to produce the plan.

What we collect

Enquiries

When you send an enquiry we store your name, email address, practice or organisation, role and message. We also store a one-way scrambled (hashed) version of your internet address so we can limit repeat submissions. We use these details to reply to you and to decide on access.

Practitioner accounts

Your name, email address and password (stored only in hashed form), your credential, practice name, contact line, branding colours and logo, and the plans you create.

Client information entered by a practitioner

A client code chosen by the practice, an optional first name or initials for the PDF, age, sex, height, weight, activity level, pregnancy or breastfeeding, any medical conditions and medicines, allergies and intolerances, diet pattern, cultural preferences, budget and cooking skill.

Information about diet, health, conditions and medicines is health information. It is sensitive information under the Privacy Act 1988 (Cth).

We do not ask for client contact details, and practitioners should not enter them.

Consent

Before creating a plan, the practitioner confirms that their client has agreed to their health information being collected and used to prepare the plan. This includes processing by the service providers named below, some of which are overseas.

How we use information

We use client information only to work out nutrient targets, build the meal plan, produce the PDF and keep a record for the practitioner. We use practitioner details to run their account and brand their plans. We do not sell any information and we do not use it for advertising.

Service providers and overseas processing

Cloudflare

Ration Lab runs on Cloudflare, Inc. Accounts, enquiries, plan records and files are stored with Cloudflare, with plan records and files kept in the Oceania region where possible. Cloudflare runs a global network, so requests and processing may happen in data centres outside Australia, including the United States.

OpenAI

Ration Lab may use an AI model from OpenAI, L.L.C. to write recipe names and a short description for each recipe. When it does, we send OpenAI plan content only: the foods in each recipe, their amounts, the meal type (for example lunch) and diet tags (for example vegetarian or halal). We never send a client's name, contact details or client code, and we never send the practitioner's details.

OpenAI may process this information overseas, including in the United States. We turn off OpenAI's option to store responses for later use, but OpenAI's own policies may keep requests for a limited time, for example to check for misuse. Recipe wording is saved by Ration Lab and reused for other plans with the same recipe.

Food choices, amounts and nutrient checks are worked out by Ration Lab itself, not by AI.

Cookies

We use one cookie to keep practitioners signed in. We do not use advertising or tracking cookies.

Keeping information secure

Access to plans needs a practitioner account. Each practitioner can see only their own plans. Information is encrypted in transit and at rest by Cloudflare.

How long we keep it

We keep plans and accounts while the practitioner's account is open, and enquiries for as long as we need them to respond and to manage access. Retention periods are still to be confirmed in legal review.

Access, correction and deletion

Clients should contact their practitioner first. Practitioners and people who sent an enquiry can ask us to see, correct or delete their information. Until a privacy contact is published, please use the enquiry form and say that your request is about privacy. Do not include client health information in the form.

Data breaches

If a data breach is likely to cause serious harm, we will tell the affected practitioners and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

Complaints

The complaints contact is still to be confirmed. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We will update this page when our practices change and show the date of the latest change at the top.