Terms of Service & Data Processing Agreement
Effective Date: June 2026 · Governing Law: England & Wales
Section 1: Terms of Service
Introduction: Between 180GIG Ltd ("we", "us", "mealRoaster") and the organisation or individual creating an account ("Client", "you").
Clause 1: The Parties
This agreement is between 180GIG Ltd, a company registered in England and Wales ("180GIG", "we", "us"), and the individual or organisation creating an account on the mealRoaster platform ("Client", "you").
By ticking the acceptance checkbox and creating an account, you confirm you have authority to bind your organisation to these terms.
Clause 2: What mealRoaster Is
mealRoaster is an AI-powered nutrition monitoring platform that enables clients or their service users to submit meal photos via WhatsApp or the inpatient module for nutritional intake analysis. Results are made available via an organisational dashboard.
The platform is a documentation and monitoring tool only. mealRoaster does not provide medical advice, clinical diagnoses, or treatment recommendations. All clinical decisions remain the sole responsibility of the Client and any qualified professionals engaged by the Client.
Clause 3: Subscription & Payment
Fees are as published on mealroaster.180gig.com at the time of sign-up. Payment is due monthly in advance.
Unpaid invoices more than 14 days overdue may result in suspension of access. 180GIG will provide 7 days' written notice before suspending an account for non-payment.
Prices may change with 30 days' written notice to the email address on your account.
Clause 4: Client Responsibilities
By using mealRoaster you agree to:
- Ensure all service users or patients whose data is submitted have given appropriate informed consent before their data is processed through the platform.
- Use the platform only for lawful purposes and in accordance with your professional obligations, including any obligations arising from your registration with any relevant professional body.
- Keep login credentials secure and notify us immediately at contact@180gig.com of any suspected unauthorised access.
- Not submit data relating to individuals under 16 years of age without appropriate written consent from a parent or legal guardian.
- Not attempt to reverse-engineer, copy, resell, or redistribute the platform or its outputs.
Clause 5: Limitation of Liability
To the fullest extent permitted by law, 180GIG's total liability to the Client for any claim arising from this agreement shall not exceed the fees paid by the Client in the three calendar months immediately preceding the claim.
180GIG is not liable for any indirect, consequential, clinical, or patient-outcome loss of any kind, however arising.
Clause 6: Term & Termination
This agreement begins when you accept these terms and continues on a rolling monthly basis until terminated.
Either party may terminate with 30 days' written notice. You may terminate at any time by cancelling your account from the dashboard; cancellation takes effect at the end of the current billing period.
180GIG may terminate immediately and without notice if the Client:
- Breaches these terms and fails to remedy the breach within 7 days of written notice
- Uses the platform in a manner that is unlawful or harmful to third parties
- Becomes insolvent or enters administration
On termination, all Client data will be deleted within 30 days unless a longer retention period is required by applicable law.
Clause 7: Intellectual Property
The mealRoaster platform, including its software, AI models, design, and documentation, is and remains the intellectual property of 180GIG Ltd.
The Client retains ownership of all data submitted to the platform. 180GIG processes that data solely to provide the service and does not use it to train models or share it with third parties outside the sub-processors listed in the Data Processing Agreement.
Clause 8: Governing Law
This agreement is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.
If any provision of these terms is found to be unenforceable, the remaining provisions continue in full force.
Section 2: Data Processing Agreement (DPA)
Introduction: This schedule forms part of the Client Services Agreement and satisfies the requirements of Article 28 of the UK General Data Protection Regulation (UK GDPR).
Clause 9: Roles & Responsibilities
The Client is the Data Controller — you determine the purposes and means of processing personal data belonging to your service users or patients.
180GIG Ltd is the Data Processor — we process personal data only on your documented instructions, as set out in this agreement and the Terms of Service.
180GIG will not process personal data for any purpose other than providing the mealRoaster service without your prior written consent.
Clause 10: Data Processed
The following categories of personal data are processed when you use mealRoaster:
| Data Type | Purpose | Retention |
|---|---|---|
| Meal photographs | AI nutritional intake analysis | Contract duration + 30 days |
| Nutritional analysis outputs | Dashboard reporting for nutrition professional | Contract duration + 30 days |
| Service user identifiers (name or reference) | Linking intake records to individual clients | Contract duration + 30 days |
| Account contact details | Account management and billing | Contract duration + 6 years |
| Usage and access logs | Security monitoring and audit trail | 12 months rolling |
Meal photographs and nutritional data are health-adjacent special category data under UK GDPR Article 9. The Client is responsible for establishing and documenting a lawful basis under Articles 6 and 9 before submitting this data to the platform.
Clause 11: Sub-Processors
180GIG uses the following approved sub-processors. Each is bound by data processing terms at least as protective as this agreement:
| Sub-Processor | Role | Location |
|---|---|---|
| Meta Platforms (WhatsApp Business API) | Meal photo submission channel | USA / EEA (Standard Contractual Clauses) |
| Microsoft Azure / Azure OpenAI | AI nutritional analysis and hosting | UK / EEA |
| Cloud infrastructure provider | Data storage and dashboard infrastructure | UK / EEA |
180GIG will notify the Client of any intended change to the sub-processor list with at least 14 days' advance notice. The Client may object to a new sub-processor within that window; if the objection cannot be resolved, either party may terminate the agreement without penalty.
Clause 12: Security Measures
180GIG implements and maintains the following technical and organisational security measures:
- All data encrypted in transit using TLS 1.2 or higher
- All data encrypted at rest using AES-256 or equivalent
- Access to systems protected by authentication and role-based access controls
- Access to personal data limited to personnel who require it to provide the service
- Regular security reviews and vulnerability assessments
- Personal data not transferred outside the UK or EEA without appropriate safeguards (Standard Contractual Clauses or adequacy decision)
Clause 13: Data Breach Notification
In the event of a personal data breach affecting Client data, 180GIG will notify the Client within 72 hours of becoming aware of the breach, providing:
- A description of the nature of the breach
- The categories and approximate number of data subjects affected
- The likely consequences of the breach
- Measures taken or proposed to address the breach
The Client is responsible for determining whether notification to the ICO or affected data subjects is required under UK GDPR Article 33 and 34.
Clause 14: Data Subject Rights
180GIG will assist the Client in responding to data subject rights requests (access, rectification, erasure, restriction, portability, objection) within reasonable timescales and at no additional charge for standard requests.
Requests received directly by 180GIG from data subjects will be forwarded to the Client within 5 working days, as the Client is the Data Controller responsible for responding.
Clause 15: Data Return & Deletion
On termination of this agreement, 180GIG will, at the Client's election:
- Return all personal data in a structured, commonly used format (JSON or CSV); or
- Securely delete all personal data
This will be completed within 30 days of the termination date, unless a longer period is required by applicable law. 180GIG will provide written confirmation of deletion on request.
Clause 16: Audit Rights
180GIG will make available to the Client all information reasonably necessary to demonstrate compliance with Article 28 UK GDPR, and will allow for and contribute to audits conducted by the Client or a mandated auditor.
Audits must be conducted with at least 30 days' written notice, at the Client's cost, and in a manner that does not unreasonably disrupt 180GIG's operations.
Section 3: Privacy Policy
Introduction: This policy explains how 180GIG Ltd collects and uses personal data. It applies to visitors to our website and end users of the mealRoaster platform.
Clause 17: Who We Are
180GIG Ltd is the data controller for information collected through our website (mealroaster.180gig.com) and the mealRoaster platform.
For any privacy queries, contact us at contact@180gig.com.
Clause 18: What Data We Collect & Why
| Data | Why We Collect It | Legal Basis |
|---|---|---|
| Account name and email | Creating and managing your account | Contract (Art. 6(1)(b)) |
| Billing information | Processing subscription payments | Contract (Art. 6(1)(b)) |
| Meal photographs and intake data | Providing nutritional analysis via the platform | Legitimate interests / explicit consent (Art. 6(1)(f) / Art. 9(2)(a)) |
| Usage and access logs | Security monitoring, bug fixes, platform improvement | Legitimate interests (Art. 6(1)(f)) |
Clause 19: Your Rights
Under UK GDPR you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — request deletion of your data in certain circumstances
- Restriction — ask us to pause processing in certain circumstances
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
To exercise any of these rights, email contact@180gig.com. We will respond within one calendar month. If you are unsatisfied with our response, you have the right to complain to the ICO at ico.org.uk.
Clause 20: Cookies
mealRoaster uses essential cookies only — those required to keep you logged in and maintain session security. We do not use advertising, tracking, or analytics cookies.
You can disable cookies in your browser settings, but this will prevent you from logging in to the platform.
Clause 21: Changes to This Policy
We may update this policy when our practices change or when required by law. We will notify account holders by email at least 14 days before material changes take effect. The current version is always available at mealroaster.180gig.com/terms.