Privacy policy

What personal information we collect, why we collect it, who we share it with, how long we keep it, and how you can have it removed.

Last updated: 17 September 2026

1. Who this policy covers

This policy applies to Systemfy Infotech (“Systemfy”, “we”, “us”), with its registered office at P 88/5 Helen Keller Sarani, Kolkata, West Bengal 700053, India. It covers:

  • this website and Mealie;
  • the Mealie professional and client portals;
  • the Mealie mobile applications on the Apple App Store and Google Play;
  • correspondence with us by email or post.

2. Our role under data protection law

For Mealie, Systemfy Infotech is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 — the equivalent of the “controller” under other data protection laws. We determine how personal data on the platform is handled, retained and secured; we carry the resulting legal obligations; and reporting a personal data breach to the Data Protection Board of India is our responsibility, not that of the practices using our software.

A practice that uses Mealie decides which of its own clients it records and what it records about them, and remains responsible for having a lawful basis for doing so and for meeting its own professional and record-keeping obligations. Where it holds copies of records outside our platform, those copies are its responsibility.

If you are a client of a practice that uses Mealie, you do not have to go through that practice to reach us. Write to support@mealiepro.com and we will deal with your request ourselves.

3. Information we collect

Information you or your practice provides

  • Account information — name, email address, telephone number, the practice you belong to and your role within it, and an encrypted form of your password. We never store passwords in a readable form.
  • Profile and health information — this may include date of birth, gender, height, weight, body measurements, dietary restrictions, allergies, medical conditions, medications, family medical history, uploaded medical or laboratory reports, progress photographs, food and meal logs, wellness check-ins and assessment responses.
  • Scheduling and communications — appointments, and messages exchanged between a practice and its clients inside the product.
  • Billing information — the legal name, address and tax registration of a subscribing practice, and a record of invoices and payments. Card, UPI and net banking payments are handled by our payment gateway partners, such as Razorpay; we do not receive or store payment card numbers.
  • Correspondence — what you send us when you write for support, including anything you choose to attach.

Information collected automatically

  • Usage records — we record that an authenticated user was active on a given day, and a record of actions that change data (who changed what, and when).
  • Technical and device information — IP address, device and operating system type, application version and browser, together with server logs of requests made.
  • Diagnostics — when the software errors, a technical report of the fault is generated so we can fix it.

We use cookies and browser storage only to keep you signed in and remember your preferences. We do not use advertising trackers, we do not build advertising profiles, and we do not sell personal information.

4. Health and other sensitive information

Mealie is used to record health information, which is sensitive personal data and is treated accordingly. It is used solely to deliver the service to the practice and the individual concerned, is visible only to that practice and the individual, and is never used for advertising, sold, or shared for any purpose unconnected with providing the software.

Records belonging to one practice are not reachable from another, and this separation is covered by automated tests that run on every change to the software.

5. How we use information

  • To provide, maintain and secure Mealie, and to authenticate you.
  • To make the features you use work — planning, scheduling, logging, messaging and reporting.
  • To send service messages such as appointment reminders, notifications and account or security notices.
  • To provide support, and to investigate and fix defects.
  • To bill subscribing practices and to meet our tax and accounting obligations.
  • To detect, prevent and investigate abuse, fraud and security incidents.
  • To understand aggregate usage so we can improve the software.

We do not use your content to train machine learning models, and we do not permit our vendors to do so.

6. Sharing and disclosure

We do not sell personal information or share it with data brokers. We disclose it only in these circumstances:

  • Within your practice. Records are visible to authorised people at the practice holding the account, according to the roles it has configured.
  • Service providers acting on our instructions, bound by contract to process information only as we direct:
    • hosting, databases and file storage, operated for us in the European Union;
    • email delivery, to send service and notification messages;
    • payment gateways, such as Razorpay, to process subscription payments;
    • error monitoring (Sentry), for fault diagnostics;
    • AI-assisted planning (OpenAI) — the relevant plan and nutritional details are sent to generate a suggestion. Names and contact details are not sent.
  • Legal requirement. Where we are compelled by a valid legal process. We will notify the affected practice unless prohibited from doing so.
  • Business transfer. If our business or Mealie is transferred, information may transfer with it, subject to this policy. We will give notice before it takes effect.

7. Security

We protect information with measures appropriate to its sensitivity: encryption in transit using TLS; encrypted storage of credentials; role-based access control; segregation of each practice’s data; restricted administrative access on a need-to-know basis; and monitoring, logging and regular encrypted backups.

No system is perfectly secure. If a breach affects your personal information we will notify you and the relevant authority without undue delay, and tell you what happened and what to do about it.

8. Retention, and deleting your account and data

We keep personal information for as long as the account it belongs to is active, and afterwards only where we have a specific reason to.

To request deletion, write to support@mealiepro.com from the email address registered to the account. We verify that the request comes from the account holder before we act on it, and we do not charge for this.

  • We acknowledge the request within five business days.
  • We delete the account and its associated personal data — profile, health records, logs, uploaded files, messages and progress history — within 30 days of verifying the request.
  • Residual copies in encrypted backups are overwritten on the normal backup cycle, within 90 days.

What we must keep:

  • Financial records — invoices and payment records, retained for eight years as required by Indian tax law.
  • Security records — a minimal record of security-relevant events, retained up to 12 months.
  • Records your practice is required to keep under its own professional rules. Where that limits what we can delete, we will tell you what is affected and why.

When a subscribing practice closes its account, its data is retained for 30 days so it can be exported, then deleted.

9. Your rights

Subject to the law applying to you, you may ask us to:

  • confirm what personal information we hold about you, and give you a copy;
  • correct information that is inaccurate or incomplete;
  • delete information, as described in section 8;
  • restrict or object to a particular use;
  • nominate another person to exercise these rights on your behalf;
  • withdraw a consent you previously gave.

Write to support@mealiepro.com. We respond within 30 days. If we cannot act on a request we will tell you why.

10. International transfers

We are established in India. Our production infrastructure is operated in the European Union, and our AI features involve transfer to a provider in the United States. Where we transfer personal information across borders we do so under contractual protections requiring a standard of protection equivalent to that described in this policy.

11. Children

Mealie is supplied to practices and their adult users, and is not directed at children. Where a practice records information about a minor as part of that minor’s care, the practice is responsible for obtaining parental or guardian consent. If you believe a child has provided information to us directly, write to support@mealiepro.com and we will delete it.

12. Grievance Officer

In accordance with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 and the rules made under them, complaints about Systemfy Infotech’s services or the processing of your personal data may be sent to our Grievance Officer:

Grievance Officer, Systemfy Infotech
P 88/5 Helen Keller Sarani, Kolkata, West Bengal 700053, India
Email: support@mealiepro.com (subject: “Grievance”)

We will acknowledge your complaint within 48 hours and resolve it within one month of receipt. If you are not satisfied with the outcome, you may approach the Data Protection Board of India.

13. Changes to this policy

We may update this policy as our products and obligations change. The date at the top records the current version. Where a change materially affects your rights we will give notice by email or in the product before it takes effect.

14. How to contact us

Privacy and data requests: support@mealiepro.com. Post: Systemfy Infotech, P 88/5 Helen Keller Sarani, Kolkata, West Bengal 700053, India. See also our contact page.