Privacy policy

Protecting your personal data matters to me. Below I explain, in line with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which data is processed when you visit this website, send me a message or book an appointment.

1. Controller

Klarita Kalemi
Online nutrition counselling
Am Achalaich 10, 82362 Weilheim i. OB, Germany
Email: klaritakalemi.diet@gmail.com

2. Hosting and server log files

This website is hosted by a service provider (Lovable, Lovable Labs Incorporated). When you open the site, technical data sent by your browser is processed automatically: IP address, date and time of access, the page requested, referrer URL, browser type and operating system. This is technically necessary to deliver the website and keep it secure and stable.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). A data processing agreement under Art. 28 GDPR is in place with the hosting provider. Any processing in third countries is based on the EU standard contractual clauses.

3. Contact form and email notifications

The contact form requires your name, your email address, your mobile number, your country of residence and your message; the subject is preselected from a list. The message field is where you describe your request. Purpose: to receive, assess and answer your enquiry.

These entries and the time of submission are stored in a database run by my technical provider (Supabase, on my behalf via Lovable Cloud). So that I can respond quickly, a notification email is sent to my business Gmail mailbox (Google Ireland Limited). In addition, an automatic branded acknowledgement email is normally sent to the email address you entered, via the same business Gmail/Google service. For technical reasons (for example duplicate submissions or a temporary failure of the sending service) this acknowledgement may occasionally not be sent.

Legal basis: Art. 6(1)(b) GDPR (steps prior to a counselling contract) and, for details you provide voluntarily beyond the required fields, Art. 6(1)(a) GDPR (consent). Ticking the acknowledgement box confirms that you have read this privacy policy; it is not a consent to marketing, and no marketing consent is bundled into the form.

Please note: do not send health data or other special category data (Art. 9 GDPR) through the contact form. We discuss anything related to your health confidentially in a personal conversation.

Retention: your enquiry is deleted once it has been dealt with conclusively and no statutory retention obligation applies, at the latest after 24 months.

3b. Pricing request (price overview)

The "Request an offer" form lets you receive my current price overview by email. Required fields are your first name, last name, email address and phone number. In addition, the language version and page of the request, the version of the consent wording, the time you confirmed the privacy notice and, only if you tick the optional box, your marketing consent with its timestamp are stored. No form has no free-text field, and no health data is collected through it.

Purpose: handling your pricing request, sending the price overview and pre-contractual communication. Legal basis: Art. 6(1)(b) GDPR. The first checkbox covers only this request handling and contains no marketing consent. The optional marketing consent is separate (Art. 6(1)(a) GDPR) and can be withdrawn at any time without giving reasons, for example by emailing me; you receive the price overview either way. No newsletter sending service is currently used; the consent is only documented so that it can later be used lawfully.

Recipients and processors are the same as in section 3 (Supabase via Lovable Cloud for the database, Google Ireland Limited for email sent from my business Gmail mailbox). Retention: as in section 3, at the latest after 24 months; a marketing consent is documented until it is withdrawn. You may object to the processing at any time (Art. 21 GDPR).

4. Online appointment booking (Google Calendar and Google Meet)

On the booking page you choose a service (free introductory call or a consultation) and a free time slot. The times shown come from my business calendar; only the information whether a period is busy or free is read.

For a booking I process your name, your email address, your mobile number, the selected service and time, your country of residence, your browser time zone (so that times are displayed and confirmed in your local time) and an optional short message. Purpose: to create the appointment, to send you a localized branded confirmation email and a calendar invitation with a Google Meet video link, and to contact you if the appointment has to be rescheduled.

The calendar and the mailbox are operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as a processor; transfers to the USA rely on the EU-US Data Privacy Framework and on the EU standard contractual clauses. Legal basis: Art. 6(1)(b) GDPR (steps prior to and performance of the counselling relationship). No cookies are set for the booking and no statistics consent is required. Appointment data is deleted after our collaboration ends unless a statutory retention period applies. Please do not enter health data in the booking form.

5. Counselling by video call and email

For online counselling I use video conferencing and email services. The data needed to deliver the service is processed (for example name, email address, appointment details) on the basis of Art. 6(1)(b) GDPR.

If, during nutrition counselling or clinical nutrition support, health-related information is genuinely needed (for example symptoms, diagnoses, laboratory values, weight history), this is special category data under Art. 9 GDPR. I only process such data on the basis of your explicit consent under Art. 9(2)(a) GDPR, which you may withdraw at any time with effect for the future. Health data is never collected through the public forms on this website.

6. Cookies, local storage and consent management

This website uses no advertising or marketing cookies and no advertising pixels. Optional processing is only activated after your explicit consent.

Strictly necessary storage

Strictly necessary information is stored in your browser's local storage: your privacy choice, the login session for the client portal and technical values needed for the secure operation of the contact form. This storage is permitted without consent under § 25(2)(2) TDDDG because it is strictly necessary to provide the service you requested. The subsequent processing is based on Art. 6(1)(f) or Art. 6(1)(b) GDPR.

Consent and withdrawal

On your first visit you are shown a consent dialog with the equally weighted options "reject all", "settings" and "accept all". There is exactly one optional category ("statistics", off by default) which controls Google Analytics 4. Closing the dialog without choosing does not count as consent. Your choice is stored locally in your browser and requested again after six months at the latest. Using the permanently available "Cookie settings" button you can change your choice or withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

7. Cloudflare Web Analytics (cookieless)

As a baseline measurement I use Cloudflare Web Analytics, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. It is loaded only on the production domain klaritakalemi.com. Aggregated metrics are collected: page paths, the host of the referring page, country, device type, browser and operating system, and performance values. According to Cloudflare the service sets no cookies, stores no identifiers on your device, uses no fingerprinting and builds no user profiles. As nothing is stored on or read from your device, this measurement is exempt from consent under § 25(2)(2) TDDDG; the legal basis for the processing is Art. 6(1)(f) GDPR.

8. Google Analytics 4 (consent only)

I additionally use Google Analytics 4 (provider for users in the EEA: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; measurement ID G-RW6L71HZB5). The Google tag is loaded dynamically only if you have actively allowed the "statistics" category and you are on the production domain. Before your consent no connection to Google is established. Google signals, the user-ID feature, personalised advertising and cross-site tracking are disabled. Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR (consent), which you may withdraw at any time via "Cookie settings". Event data is retained for 14 months. The content of your enquiry (name, email address, phone number, subject, message) is never transmitted to Google.

9. Fonts

The "Inter" typeface is served locally from this web server. Google Fonts is not embedded; no data is transmitted to Google or other third parties when fonts are loaded.

10. Recipients and processors

Your data is only passed on where this is necessary to deliver the service or where you have consented. The providers used (hosting, database, email, calendar, video conferencing) are contractually bound as processors under Art. 28 GDPR. Any disclosure to doctors or other health professionals happens exclusively with your explicit consent.

11. Your rights

Under the GDPR you have the right at any time to:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

An email to klaritakalemi.diet@gmail.com is enough to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), usually the authority of your place of residence or of my place of business.

12. Data security and updates

Data is transmitted on this website in encrypted form via HTTPS/TLS. This privacy policy is updated whenever data processing on this website changes.