Data processing agreement

In force from 14 October 2026

This agreement is between you, a coach using Mealstone (“you”), and MJK APPS SRL, Str. Islazului 24, 435100 Baia Sprie, Maramureș, Romania, trade register J2019000866242, CUI RO40832934 (“we”, “us”). It covers the personal data of your clients that we process for you in Mealstone, and it meets Article 28 of the GDPR. It's part of our terms of service, and you accept it when you register as a coach.

1. Roles and scope

• For your clients' data, you're the controller and we're the processor. “Client data” means the personal data, described in Annex 1, of:
  • your clients;
  • people you invite;
  • people who ask you to coach them.
  It's the data we process while they're connected to you, or while their request to you is open.
• For our own purposes, we're the controller and our privacy notice applies: accounts and sign-in, consent records, subscriptions, the directory, feedback about the app, and security.
• When coaching ends, you lose access to the client's data at once. The client keeps their data in their own account, and from then on we hold it for the client, under our privacy notice. What you added only for yourself about the client, such as your notes, drafts, AI summaries and safety flags, stays stored where nobody can read it. You see it again only if the client comes back to you, and it's deleted as described in section 10. What you keep is a former-client entry: the client's name, the dates and how coaching ended.

2. Your instructions

Your instructions to us are:

• these terms and this agreement;
• what you do in Mealstone, for example inviting a client, asking for an AI draft, publishing a plan or ending coaching.

We process client data only on these instructions, to provide Mealstone to you and your clients, unless EU or Member State law requires otherwise. If it does, we tell you first, unless that law forbids it. If we think an instruction breaks data protection law, we tell you.

3. Your responsibilities

You confirm that you have a lawful basis to coach your clients and to process their data in Mealstone, and you're responsible for keeping it. In particular:

• Health data needs your client's explicit consent. Mealstone asks for it for you, before a client enters any health information, and records each decision. Coaching in the app ends when a client withdraws it.
• Tell your clients how you use their data. Our privacy notice explains how Mealstone works, and you can point clients to it. You're responsible for telling them about your own use of their data.
• Add only the data you need, in the places meant for it.
• Answer your clients' requests about their data. Clients can do much of this themselves in the app, and we help you with the rest.
• Carry out a data protection impact assessment if your processing needs one. We help you with information about Mealstone.

4. Confidentiality

Everyone who works for us and can reach client data is bound to keep it confidential, and reaches it only when their work needs it.

To help with a problem you or a client report, a member of our support staff may view the app as you or that client see it: read-only, for at most 30 minutes at a time, and only with a reason. Each such session is recorded with who viewed, whom, when and why, and the record is kept for one year.

5. Security

We protect client data with the measures in Annex 2, taking into account the risks of processing health data. We keep them up to date. We may change them, but never in a way that lowers the protection.

6. Sub-processors

• You authorise us to use the sub-processors listed in Annex 3.
• Each of them is bound by a contract with data protection obligations equivalent to ours in this agreement. We remain responsible to you for them.
• We tell you by email at least 30 days before we add or replace a sub-processor. You can object on reasonable data protection grounds. If we can't resolve your objection, you can end your subscription and delete your account before the change takes effect.

7. Where data is processed

Client data is stored in the EU, in Google Cloud's Netherlands region (europe-west4), and processed by AI in the EU, on Vertex AI's EU multi-region, which keeps the processing inside EU member states. Some services work outside the EU:

• Sign-in: Google runs it from the United States. It holds the accounts' sign-in details, and no coaching data.
• Push notifications: Google's and Apple's push services work worldwide. Our notification texts never include a client's weight, measurements, photos or health terms. With message previews on, which is the default, the first 80 characters of a chat message also pass through these services, and so can a client's profile photo or your logo. Anyone can turn previews off in their notification settings.

These transfers are protected by the EU–U.S. Data Privacy Framework and by the European Commission's Standard Contractual Clauses.

8. Helping you

Taking into account what we process and the information we have, we help you:

• answer your clients' requests to exercise their rights. Clients can already change their consents, ask for a copy of their data and delete their account in the app.
• meet your obligations on security, personal data breaches, impact assessments and consultations with the authority.

If a client sends us a request about data we process for you, we pass it on to you without delay.

9. Personal data breaches

If a personal data breach affects client data, we tell you without undue delay, and no later than 72 hours after we become aware of it. We give you:

• what happened;
• the data and the people affected;
• the likely consequences;
• what we're doing about it.

If we don't know everything at first, we send the rest as soon as we know it. We contain the breach and help you notify the authority and your clients where the law requires it.

10. When processing ends

Each time coaching ends, we keep a former-client entry for you, with the client's name, the dates and how coaching ended. We delete it 3 years after coaching ended, or sooner if you remove it. It stays if the client deletes their account. What you added only for yourself about the client stays stored, unreadable, as section 1 describes.

When you delete your account, or we close it:

• your clients are disconnected from you, and they keep their own data in their accounts;
• we delete at once what you added only for yourself, such as your notes, drafts, AI summaries, saved replies and scheduled messages, and your answer memory;
• safety flags, check-in feedback and consultation drafts and meal photo descriptions that belong to a client's records stay with that client's account, where nobody can read them, until the client deletes it.

Deleted data leaves our backups within 7 days. We keep data longer only where the law requires it.

Before that, you can ask us for a copy of the client data we process for you. We send it to you in a common, machine-readable format within 30 days of your request, and then delete it as described above.

11. Information and audits

We give you the information you need to show that we meet this agreement. It includes this agreement, the security measures and sub-processors in its annexes, and the certifications of our main provider, Google Cloud.

If that isn't enough, you or an auditor bound to confidentiality can audit our compliance:

• with at least 30 days' notice;
• at your own cost;
• at most once a year, unless a breach or an authority requires more.

12. Liability and precedence

Each of us is liable under the GDPR for the part of the processing we're responsible for. Otherwise, liability follows our terms of service. For the processing of client data, this agreement takes precedence over the terms. It lasts for as long as we process client data for you.

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption: data is encrypted in transit and at rest.
• Access rules: server-side rules let a client and their currently connected coach reach the client's data, and no one else. Consents, published content, subscriptions and notifications are written only by our server functions.
• App checks: requests from anything other than the genuine apps are rejected.
• Private media:
  • progress photos, meal photos and photos in chat open only for signed-in people allowed to see them, never through a link;
  • videos in chat open through a link that only the people in the chat receive;
  • location and device details are removed from photos before upload;
  • progress photos are shown from memory and never saved on the device. Meal photos and photos in chat are kept in the app's own storage on the device, outside the photo gallery, until 60 days after they were last opened;
  • on Android, screenshots are blocked on screens that show progress photos.
• AI: every AI request about a client checks that the coach and the client are connected. AI usage records hold no content. The AI provider may not use the data for training.
• Notifications: our notification texts never include weight, measurements, photos or health terms. Message previews are as section 7 describes.
• People: only named team members can reach production systems, each through their own Google or Apple account, and only when their work needs it. Every account with access to them uses 2-step verification.
• Resilience: the database is backed up every day, and each backup is kept for 7 days.
• Usage limits: limits on sensitive actions stop abuse.
• Breach procedure: we follow a written procedure for personal data breaches.

Annex 3: Sub-processors