Data Retention Schedule
This schedule defines standard retention and disposal rules for information processed through mealRoaster. Where an organisation acts as controller, its documented requirements may replace the standard enterprise period where agreed and technically supported.
Retention principles
- Retain personal data only for as long as necessary.
- Apply customer or controller instructions where 180GIG acts as processor.
- Avoid indefinite retention by default.
- Securely delete or de-identify expired data, subject to backup cycles and legal holds.
- Record material exceptions, legal holds, and customer-specific schedules.
- Review the schedule annually and after material processing changes.
Core product data
| Data category | Standard retention | Trigger | Disposal |
|---|---|---|---|
| Free-user meal analyses and nutrition records | 90 days | Record creation | Delete from the active service, with dependent data handled under the same lifecycle. |
| Free-user meal photos | 90 days, unless shorter period configured | Meal submission | Delete from active object storage with the related meal record. |
| Pro analyses, longitudinal records and photos | Duration of subscription; after downgrade to Free, the Free 90-day rule applies from each record's creation | Subscription termination or downgrade | Delete expired active records and associated photos, subject to backup and legal requirements. |
| Enterprise nutrition, meal and weight records | Customer-defined; otherwise duration of service | Customer instruction or contract termination | For downgraded WhatsApp clients, the Free 90-day rule applies to meal analyses and photos unless a documented controller instruction or legal requirement governs them. Resident records remain subject to organisation instructions. Return or export where agreed before deletion. |
| Care-home resident data | Organisation-defined | Organisation instruction | Return or delete under the controller configuration or agreement. |
| Weight records | Same as associated nutrition record | Account termination or controller instruction | Delete with the longitudinal record unless separately required. |
| Dietary preferences and allergies | While required for the feature | Feature or account termination | Delete when no longer required. |
| Ingredient corrections | Same as associated meal/account unless de-identified | Associated record deletion | Delete or irreversibly de-identify; never retain identifiable corrections for foundation-model training. |
| Wearable access and refresh tokens | Until disconnected, revoked, or invalid | Disconnect or revocation | Revoke where supported and delete from the active credential store without undue delay. |
| Wearable-derived data | Same as associated account record | Account termination or instruction | Delete with the associated record. |
| WhatsApp-linked phone number | While required for service and applicable retention | Account termination | Delete when no longer required, subject to legal or controller obligations. |
| Email address | While required for account or reports | Account deletion or email removal | Delete when no longer required, subject to legal obligations. |
Operational and governance records
| Category | Rule | Reason and disposal |
|---|---|---|
| Anonymous platform-wide analysis count | Duration of the service | Aggregate usage measurement only; no person, meal or organisation identifiers. It remains after individual meal records expire. |
| Authentication and security logs | Defined operational period based on security need and customer requirements. | Security monitoring and audit; securely expire after the configured period. |
| Application and technical logs | Minimum period necessary for troubleshooting and security. | Minimise personal data and expire automatically. |
| Support records | Resolution period plus a reasonable audit period. | Avoid unnecessary health data; delete or anonymise when no longer needed. |
| Billing and transaction records | Applicable statutory and accounting period. | Delete when the period expires unless a legal hold applies. |
| Contract and DPA acceptance | Customer relationship plus applicable evidence period. | Evidence of contract and processing instructions. |
| Rights-request records | Long enough to evidence handling and accountability. | Restrict access and delete when no longer required. |
| DPIA, risk, audit and assurance records | Current version plus necessary superseded versions. | Archive securely as governance evidence. |
| Subprocessor and transfer records | Current relationship plus necessary historical period. | Accountability and audit evidence. |
Backups, termination and legal holds
Deletion from active systems does not necessarily remove data from backups immediately. Backups must be protected from routine use and expire through the documented backup lifecycle. If an older backup is restored, applicable deletion instructions must be re-applied.
For organisation customers, Customer Data may be returned or exported before deletion. Retention may be extended only for a documented legal, regulatory, dispute, fraud, security, or legal-claim requirement. A legal hold records its scope, reason, approver, restrictions, and review date.
Subprocessor Register
These providers may process personal data to operate mealRoaster. Optional providers apply only when the corresponding feature is enabled. Exact locations can depend on the customer configuration and provider region.
| Provider | Purpose | Data involved | Location / transfer position | Status |
|---|---|---|---|---|
| Microsoft Azure | Application hosting, private blob storage and Azure OpenAI processing | Account, meal-photo and nutrition data required to provide the service | Configured Azure resource regions; provider support processing may be global. Transfer safeguards applied where required. | Core |
| MongoDB Atlas | Managed operational database | Account identifiers, organisation records, structured nutrition, weight, engagement and audit data | Configured Atlas cluster region; restricted transfers protected where required. | Core |
| Meta Platforms / WhatsApp Business Platform | Meal submission and messaging where WhatsApp is enabled | Phone number, message content and meal media sent through WhatsApp | Meta global infrastructure; applicable contractual transfer safeguards. | Optional channel |
| Stripe | Subscription checkout, payment status and billing administration | Customer and payment metadata; mealRoaster does not store full card details | Provider global infrastructure; safeguards apply to restricted transfers. | Paid plans |
| Namecheap Private Email | Transactional and report-email delivery | Recipient address, subject and email content | Provider infrastructure and configured mail region; safeguards applied where required. | Email features |
| Fitbit / Google | Authorised wearable connection | OAuth identifiers/tokens and authorised activity, body or health data | Provider global infrastructure under its privacy terms. | Optional integration |
| Apple Health | User-authorised health-data import | Authorised health measurements and connection identifier | User device and mealRoaster infrastructure; Apple terms also apply. | Optional integration |
| Customer-selected FHIR/EHR provider | Customer-directed inbound or outbound integration | Mapped patient/resident identifiers and authorised nutrition observations | Destination selected and controlled by the customer. | Optional integration; generally an independent recipient/customer processor rather than a mealRoaster subprocessor |
Retention Schedule Guide
For individual users
Your plan determines the standard active-service period. Account closure begins the applicable deletion workflow, although protected backups and records required by law may remain for their defined lifecycle.
For organisation controllers
Document your chosen period in your contract, DPA, order form, dashboard configuration, or written instruction. Consider professional-record obligations, safeguarding needs, limitation periods, and data minimisation. mealRoaster applies an agreed customer period where technically supported.
Requesting return or deletion
- Email mealroaster@180gig.com from an authorised organisation address.
- Identify the organisation, data scope, requested action and required completion date.
- mealRoaster verifies authority and confirms export, deletion, exceptions, and the applicable backup lifecycle.
- Where appropriate, written confirmation is provided after completion.
Exceptions
Legal holds and statutory records are isolated, access-restricted and reviewed. They are not retained for unrelated product use.
Governance
The schedule is reviewed at least annually and whenever the product, hosting, processing, or legal requirements materially change. Customer-specific instructions are recorded and retained as accountability evidence.