Last updated: July 2026
1. Who we are
The Dietitian's Clinic (“we”, “us”, “our”) is a clinical nutrition practice based at Kathmandu, Nepal. We provide personalised nutrition coaching, medical nutrition therapy, and related wellness services through our website at https://thedietitiansclinic.com (the “Service”).
For any privacy questions, contact us at info@thedietitiansclinic.com or +977 9800000000.
2. What data we collect
We collect only the data necessary to provide our services:
- Account data: name, email, phone number, password (stored as a scrypt hash — never in plain text).
- Profile data: date of birth, gender, height, weight, body composition, medical history, allergies, medications, dietary preferences, emergency contact.
- Appointment data: service booked, dietitian assigned, scheduled time, mode (video/in-clinic), notes you provide.
- Payment data: program purchased, amount, payment method (Khalti/eSewa/bank), transaction reference. We do not store card numbers — payments are processed by the gateway.
- Communication data: messages between you and your dietitian, notifications we send you.
- Health reports: lab reports and other documents you upload (e.g. blood panel, thyroid function, HbA1c).
- Usage data: IP address, browser type, pages visited — collected via server logs. We do not use third-party advertising trackers.
3. Legal basis for processing
We process your data under the following lawful bases:
- Contract: to deliver the nutrition services you booked and to manage your client relationship.
- Consent: for sending marketing emails (newsletter) — you can opt out at any time.
- Legal obligation: to maintain financial records as required by Nepal tax law.
- Legitimate interest: to secure our systems, prevent fraud, and improve our services.
4. How we use your data
- To create and manage your client account.
- To schedule and conduct consultations with your assigned dietitian.
- To design personalised meal plans and track your progress.
- To process payments and issue receipts.
- To send you service-related notifications (appointment reminders, messages from your dietitian).
- To send marketing emails — only if you have explicitly opted in. You can unsubscribe from any email.
- To comply with legal obligations.
We never sell your data to third parties.
5. Who we share data with
- Your assigned dietitian: they need access to your profile, medical history, and reports to provide care.
- Payment processors: Khalti and eSewa process your payments. They receive only the transaction amount and a reference — not your health data.
- Email provider (Resend): sends transactional emails (booking confirmations, password resets) on our behalf. Resend receives the email content but does not store it beyond delivery.
- Hosting provider: our server infrastructure provider has access to encrypted database backups but not to the contents (data is encrypted at rest in the database).
- Legal authorities: only if compelled by a valid court order or as required by law.
6. International data transfers
Our servers are hosted in Nepal. Email delivery (Resend) and error monitoring (Sentry) may process data in the EU or US. We only transfer the minimum data necessary (email address, error messages — never health records) and rely on standard contractual clauses for protection.
7. Data retention
- Active client records: retained for the duration of your program plus 7 years (medical records retention standard).
- Inactive accounts: if you don't log in for 3 years, we will email you to confirm you want to keep the account. If no response within 30 days, we will delete your data.
- Audit logs: retained for 1 year, then automatically deleted.
- Payment records: retained for 7 years as required by Nepal tax law.
- Newsletter subscribers: retained until you unsubscribe. Unsubscribe links are in every email.
8. Your rights
Under the GDPR and Nepal's Privacy Act 2075, you have the right to:
- Access: request a copy of all data we hold about you. Use the “Export my data” button in your dashboard settings.
- Rectification: correct inaccurate data. You can edit your profile in the dashboard, or contact us.
- Erasure: request deletion of your account and all associated data. Use the “Delete my account” button in your dashboard settings. Note: payment records required by tax law will be retained for the statutory period but anonymised.
- Restriction: ask us to limit processing (e.g. while a dispute is resolved).
- Portability: receive your data in a machine-readable JSON format.
- Objection: object to processing based on legitimate interests.
- Withdraw consent: for marketing emails — at any time, via the unsubscribe link.
To exercise any of these rights, visit your dashboard settings or email us at info@thedietitiansclinic.com. We respond within 30 days.
9. Security
We take security seriously. Passwords are hashed with scrypt (never stored in plain text). The database is encrypted at rest. Session cookies are httpOnly, secure, and signed with HMAC. All traffic is served over HTTPS. File uploads are validated by magic bytes (not just extension). Rate limiting protects authentication endpoints from brute force.
Despite our efforts, no system is 100% secure. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the relevant authority within 72 hours, as required by the GDPR.
10. Cookies
We use only essential cookies:
- admin_session: keeps you logged in. HttpOnly, secure, expires after 7 days.
- theme: remembers your light/dark mode preference. Set by next-themes.
We do not use advertising cookies, third-party tracking cookies, or social media pixels. A cookie consent banner appears on your first visit to acknowledge this.
11. Children's privacy
Our services are intended for adults (18+). If you are booking for a child (e.g. paediatric nutrition), the parent or guardian must create the account and provide consent. We do not knowingly collect data from unaccompanied minors. If you believe a child has provided us with personal data, please contact us so we can delete it.
12. Changes to this policy
We may update this policy from time to time. We will notify you by email of any material changes at least 30 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.
13. Contact
Questions about this policy or your data? Contact our Data Protection Officer at info@thedietitiansclinic.com or +977 9800000000, or write to us at Kathmandu, Nepal.
If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.