Privacy Policy

This policy describes how WonderFood collects, uses, and protects your personal data. It covers three products: the WonderFood mobile application, the WonderFood Pro professional dashboard, and the site wonderfood.fr, including its public booking pages.

The data controller is WonderFood, Casablanca, Maroc — reachable at privacy@wonderfood.fr.

• Identification : first name, last name, email address — or identifier provided by Apple or Google if you connect this way.
• Profile : gender, height, weight, goal, dietary restrictions.
• Food Tracking : meal plans, recorded meals, favorite recipes, personal recipes, shopping list.
• Photos : meal photos submitted for AI analysis and results of these analyses.
• Messaging : messages and attachments exchanged with the professional you are linked to.
• Subscription : status of your Premium subscription — payment is processed by Apple or Google, we never receive your banking data.
• Advertising Measurement : advertising identifiers of the device, only if you have consented (ATT on iOS).

For the professional account itself: name, email address, specialty, professional code, and billing data for the subscription (processed by Lemon Squeezy — we do not store your banking data).

For patient records: civil status, anamnesis, measurements, prescriptions, and consultation notes, entered by the professional. This data is processed for the exclusive account of the professional, who is responsible for processing; WonderFood hosts it as a subcontractor, in accordance with Article 28 of the GDPR and Moroccan law n° 09-08, and does not consult or exploit it for its own account.

When you request an appointment from a professional's public page (wonderfood.fr/p/…), we collect your identity, contact details, and the reason for the request. This data is used for managing the appointment and is transmitted to the concerned professional, as well as to the confirmation emails sent to you.

Each processing is based on a specific legal basis:

• Account creation and management, provision of meal plans and nutritional tracking — contract execution.
• Analysis of meal photos by artificial intelligence — contract execution — feature triggered by you.
• Subscription management and billing — contract execution and legal accounting obligations.
• Sharing your tracking data with the professional you have linked — contract execution — based on your voluntary action (entering the code).
• Measuring the effectiveness of our advertising campaigns (Meta, TikTok) — consent — collected via App Tracking Transparency on iOS.
• Sending appointment confirmation emails — execution of pre-contractual measures at your request.
• Service security and abuse prevention — legitimate interest.
• Support and response to your requests — legitimate interest.

We use the following providers, each for a specific mission and within the limits of what is necessary for them:

• Supabase — database, authentication, and file storage.
• OpenAI — analysis of meal photos by artificial intelligence.
• Apple and Google — connection to the application and in-app purchases.
• RevenueCat — management of the Premium subscriptions of the application.
• Lemon Squeezy — payment and billing for subscriptions in the Pro dashboard.
• Meta and TikTok — advertising measurement SDKs integrated into the application, subject to your consent (ATT) on iOS.
• Resend — sending appointment emails.
• Hostinger — website hosting.

Your data is hosted on the secure infrastructure of our subcontractors. We do not sell your personal data.

Your tracking data (profile, meal plans, measurements, meal analyses) are shared with a healthcare professional only if you voluntarily link your account to theirs by entering the personal code they provided. Without this action on your part, no professional has access to your data.

You can break this link at any time from your profile: the professional then loses access to your account. The record they have created on their side in their professional dashboard is their own responsibility — to exercise your rights over this record, contact them directly.

• Application Account : retained for the entire duration of use; after a deletion request, the account is immediately deactivated and the data is permanently purged within 30 days, including backups.
• Professional Dashboard Records : retained as long as the professional maintains them — the duration is the professional's responsibility as data controller.
• Appointment Requests : retained for the time necessary to manage the appointment.
• Billing Data : retained for the applicable legal durations in accounting and tax matters.

Your data is hosted on the secure infrastructure of our subcontractors. We implement appropriate security measures: encryption of exchanges, secure authentication, strict access segregation to the database — each user and each professional only accesses their own data.

In accordance with the GDPR and Moroccan law n° 09-08 regarding the protection of individuals with regard to the processing of personal data, you have the following rights:

• access to your data and a copy of it;
• rectification of inaccurate data;
• erasure, under the conditions provided by the regulations;
• limitation of processing and objection, for processing based on legitimate interest;
• data portability for the data you provided to us;
• withdrawal of your consent at any time, particularly for advertising measurement.

To exercise these rights, write to privacy@wonderfood.fr — we respond within one month. You can also contact the competent supervisory authority: the CNDP in Morocco, or the data protection authority in your country of residence.

Email: privacy@wonderfood.fr
Mail : WonderFood — Data Protection, Casablanca, Morocco

The deletion of your account and the fate of your data are detailed on the Account Deletion page.