1. About this policy
mealRoaster is operated by 180GIG Limited ("180GIG", "we", "us" or "our").
mealRoaster is a digital nutrition monitoring platform that enables individuals and authorised professionals to capture, structure and review nutrition information over time.
This Privacy Policy explains how personal information is collected, used, stored, shared and protected when mealRoaster is used through our application, WhatsApp where enabled, enterprise services, connected health services and related features.
We process personal information in accordance with applicable data protection law, including the UK General Data Protection Regulation ("UK GDPR") and Data Protection Act 2018.
2. Our role
Our role under data protection law depends on how mealRoaster is being used.
Where an individual subscribes to or uses mealRoaster directly, 180GIG Limited may act as the data controller for personal information processed to provide that service.
Where mealRoaster is provided by a healthcare provider, dietetic service, nutrition service, care organisation or other enterprise customer, that organisation will normally determine the purposes for which its service users' information is processed. In these circumstances, the organisation may act as the data controller and 180GIG Limited may act as its data processor.
Where we act as a processor, we process personal information in accordance with the controller's documented instructions and the applicable Data Processing Agreement.
3. Information we process
Depending on the features and service being used, mealRoaster may process:
Account information: name, telephone number, email address, account identifiers and organisation membership.
Meal information: meal photographs, descriptions, ingredients and corrections submitted by users.
Nutrition information: AI-generated estimates including calories, protein, carbohydrates, fats and other nutritional information.
Weight and progress information: weight records and other measurements voluntarily entered or supplied through supported integrations.
Dietary information: dietary preferences, allergies and other information provided to personalise or contextualise nutrition records.
Connected health information: information authorised by users through supported services such as Apple Health, Fitbit or other connected services.
Communications: messages and information submitted through the mealRoaster application, email or WhatsApp where WhatsApp has been enabled.
Technical and security information: IP addresses, browser and device information, authentication events, access logs, system activity and other information required to operate and protect the service.
Some information processed by mealRoaster may constitute health data and therefore special category personal data under UK GDPR.
4. How we use information
Personal information may be processed to:
- provide and operate mealRoaster
- process meal photographs and generate nutrition estimates
- create nutrition histories and longitudinal nutrition records
- display nutrition, weight and engagement trends
- provide authorised professional dashboards
- generate reports requested by users or organisations
- operate supported wearable and health integrations
- provide WhatsApp functionality where enabled
- authenticate users and manage accounts
- provide customer support
- maintain the security and reliability of mealRoaster
- investigate technical problems and security incidents; and
- meet applicable legal, contractual and regulatory obligations
We do not sell personal health information.
5. AI-assisted analysis
mealRoaster uses artificial intelligence to analyse meal photographs and convert them into structured estimated nutritional information.
AI-generated nutritional information is an estimate. Accuracy can be affected by portion size, image quality, ingredients, preparation methods, mixed dishes and other factors.
AI is used to structure and present nutrition information. mealRoaster does not independently diagnose medical conditions or make autonomous clinical decisions.
Where mealRoaster is used by a healthcare, dietetic, nutrition or care professional, that professional remains responsible for interpreting the information and making any professional or clinical decisions.
Customer and patient data is not used to train the underlying foundation AI models.
6. Lawful bases
Where 180GIG Limited acts as controller, we process personal information only where an appropriate lawful basis under Article 6 UK GDPR applies.
Where we process special category information such as health information, an appropriate Article 9 condition must also apply.
The applicable basis depends on how mealRoaster is provided and the purpose for which the information is being processed.
Where another organisation is the controller, that organisation is responsible for identifying and communicating the lawful basis applicable to its processing.
7. Organisation access
Where mealRoaster is provided through an organisation, authorised users from that organisation may access information associated with people enrolled in their service.
Depending on configuration, this may include meal records, nutrition estimates, weight records, engagement information and longitudinal trends.
Access is controlled through account permissions and organisational access controls.
8. Service providers
We use third-party technology providers to operate mealRoaster. These may provide cloud infrastructure, database hosting, artificial intelligence, communications, messaging, email, monitoring, analytics and related technical services.
These organisations may process personal information on our behalf where necessary to provide their services.
We assess relevant providers and put appropriate contractual and data protection arrangements in place.
Where 180GIG acts as a processor, subprocessors are managed in accordance with our contractual obligations to the relevant controller.
We maintain a Subprocessor Register containing information about relevant subprocessors, the services they provide and applicable processing locations.
9. How information flows
Information may enter mealRoaster through the patient/user application, WhatsApp where enabled, enterprise interfaces or authorised third-party integrations.
Submitted information is securely transmitted to mealRoaster's infrastructure. Meal photographs may be stored in private cloud object storage. Structured nutrition information and account information are stored in the mealRoaster data platform. AI services may process information required to generate nutrition estimates.
Authorised information is then made available to the relevant user or authorised organisation through mealRoaster.
We maintain more detailed data-flow documentation and diagrams describing relevant systems, integrations, processors and information flows for governance and assurance purposes.
10. International processing
mealRoaster uses cloud infrastructure and third-party technology providers, including Microsoft Azure and MongoDB Atlas.
Data may be processed in different locations depending on the infrastructure, provider and service configuration.
Where processing involves a restricted transfer of personal information outside the UK, appropriate safeguards are used where required by applicable data protection law.
11. Retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal, contractual and organisational requirements.
Standard mealRoaster retention currently includes:
Free accounts: meal analyses are normally retained for 90 days.
Pro accounts: meal analyses are normally retained for the duration of the subscription, subject to applicable deletion and retention requirements.
Enterprise accounts: retention may be determined by the organisation using mealRoaster and its agreement with 180GIG Limited.
Wearable connections: connection credentials/tokens are removed when the connection is disconnected, subject to technical and legal requirements.
Care organisations: retention may be configured according to the organisation's requirements.
We maintain a separate Data Retention Schedule specifying retention and disposal requirements for different categories of information, including operational records, account information, security logs and backups.
When a Pro account or an Enterprise WhatsApp client is downgraded to Free after access ends, the standard Free 90-day period applies to their meal analyses and associated photos from each record's original creation date. Older records may therefore be deleted at the next retention run. Documented organisation-controller instructions, legal holds and applicable law may require a different period. Care-home resident records remain subject to the organisation's instructions.
We also maintain a platform-wide count of meal analyses to measure overall service usage. The count contains no names, contact details, meal contents, meal dates, client identifiers or organisation identifiers. It is not used to make decisions about individuals and can remain after the underlying meal records are deleted. Historical records deleted before this counter was introduced cannot be reconstructed from it.
A downgrade changes meal-history retention; it does not automatically close or delete the Free account. Account identifiers, profile details, security records, backups and organisation-controlled resident records follow their applicable schedules or controller instructions rather than the 90-day meal rule. Deletion from active storage may not immediately remove copies held in backups under their separate expiry cycle.
12. Security
We use technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss and destruction.
Measures include, where applicable, encryption in transit, private cloud storage, access controls, authentication controls, secure session management, audit and security logging, vulnerability management, backups, monitoring and incident-response procedures.
Meal images are stored privately in Azure Blob Storage with controlled access mechanisms. Database connections use encrypted transport. WhatsApp webhook requests are authenticated using Meta's supported verification mechanisms.
180GIG maintains internal information-security policies and procedures covering areas such as access control, incident management, vulnerability management, backups and recovery, supplier management and secure operation of mealRoaster.
No internet-based service can guarantee absolute security.
13. WhatsApp
Where enabled by the relevant service, users may interact with mealRoaster through WhatsApp.
Information transmitted through WhatsApp is also processed through services provided by WhatsApp/Meta and is subject to applicable Meta/WhatsApp privacy arrangements.
Enterprise organisations may choose whether WhatsApp is available within their deployment.
14. Wearables and integrations
Users may choose to connect supported wearable or health services.
mealRoaster accesses only information authorised through the relevant connection and uses it to provide the requested connected features.
Users may disconnect supported integrations. Where disconnected, associated access credentials are revoked or removed in accordance with the relevant integration.
15. Enterprise processing
Where 180GIG Limited processes personal information on behalf of an Enterprise customer, the processing is governed by a Data Processing Agreement (DPA) or equivalent contractual data protection provisions.
The agreement defines matters including the subject and duration of processing, categories of information, processing instructions, confidentiality, security, subprocessors, assistance with individual rights, incidents, deletion or return of information and audit obligations.
16. Your rights
Depending on the circumstances, you may have rights to access your personal information, correct inaccurate information, request deletion, restrict certain processing, object to certain processing and receive eligible information in a portable format.
Where another organisation is the controller, requests may need to be made directly to that organisation.
17. Your choices
Depending on your service, you can manage certain communications and integrations.
stop can be used to unsubscribe from eligible broadcast WhatsApp communications.
stop email can be used to stop eligible email reports.
disconnect removes supported wearable connections and revokes associated data access.
These controls do not necessarily delete information that must be retained under applicable legal, contractual or organisational requirements.
18. Contact and complaints
If you have a privacy concern, please contact us so that we can investigate it.
You may also have the right to complain to the UK Information Commissioner's Office.
180GIG Limited / mealRoaster
Email: mealroaster@180gig.com
19. Policy updates
We may update this Privacy Policy when mealRoaster, our processing activities or applicable requirements change.
The latest version will be published on our website with its effective date.