Privacy Policy
Last updated: 25 June 2026
1. Who we are
This website, nutritionwithmila.com, is operated by Liudmila Dormidontova (NIE: Y7360447R), a self-employed professional (autónoma) registered in Spain. Registered address: Calle Armonía 2, 29639 Benalmádena, España. Trading name: DOR Mila Nutrition Coach. Contact: privacy@nutritionwithmila.com
2. What data we collect
We collect personal data that you provide directly: your name, email address and phone number when you book BioMap; your answers to the health and nutrition questionnaire, which may include information about your physical measurements, medical history, current diagnoses, medications, and symptoms (health data); any blood test results or medical documents you voluntarily upload; and payment information processed securely by Stripe (we never store card details). We also collect anonymised analytics data via Google Analytics 4, only with your consent.
3. Special category data (health data)
The questionnaire you complete as part of BioMap contains health-related information, which is classified as special category data under Article 9 of the GDPR. We collect and process this data solely for the purpose of providing personalised nutritional assessment and guidance. We do not use it for any other purpose. This processing is carried out on the basis of your explicit consent, given at the time of completing the questionnaire. You may withdraw your consent at any time by contacting privacy@nutritionwithmila.com, after which we will cease processing and delete your health data within 30 days.
4. Why we collect it
We use your data to deliver the product or service you requested; to communicate with you about your BioMap appointment and nutritional assessment; to provide personalised nutritional guidance based on your questionnaire responses; and, with your separate consent, to send occasional emails about new content or offers. We do not sell your data to third parties.
5. Legal basis (GDPR)
Processing of ordinary personal data is based on: contract performance (to deliver the BioMap service you purchased); and legitimate interest (to communicate with existing clients). Processing of health data (special category data under Art. 9 GDPR) is based exclusively on your explicit consent. Marketing emails are sent only with your separate, freely given consent, which you may withdraw at any time.
6. Data retention
We retain your personal data for as long as necessary to provide the services and comply with legal obligations, typically no longer than 5 years after the end of our business relationship. Health data collected through the questionnaire is retained for the duration of our professional relationship and deleted upon your request or within 12 months of the end of the service. Blood test files uploaded to our secure storage are deleted within the same timeframe.
7. International data transfers
Some of our sub-processors (including Supabase and Vercel) may process data on servers located outside the European Economic Area, including in the United States. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission. A copy of the applicable safeguards can be requested at privacy@nutritionwithmila.com.
8. Your rights
Under GDPR you have the right to access, rectify, erase, restrict or object to processing of your personal data, and to data portability. You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. To exercise any of these rights, email privacy@nutritionwithmila.com. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.
10. Third-party processors
We use the following sub-processors, each bound by GDPR-compliant Data Processing Agreements: Stripe (payment processing — USA, SCCs in place), Supabase (database and file storage — USA, SCCs in place), Vercel (hosting — USA, SCCs in place), Resend (transactional email — USA, SCCs in place), Google Analytics (analytics, consent-based — USA, SCCs in place), and Cal.com (appointment scheduling).
11. Security
We implement appropriate technical and organisational measures to protect your data, including encrypted storage, access controls, and private storage buckets for sensitive health documents. Only Liudmila Dormidontova has access to your health data.
12. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. For material changes affecting how we process health data, we will notify you by email.