Privacy Policy

The personal information controller for the data described here is John Zachary Mereul Tecson, Patricia Nicole Tabunda, and Mary Ava Delle Napacia, trading as WellPlate, of Block 5 Lot 25, Phase 3, Diamond St., Heritage Homes, Marilao, Bulacan.

Our Data Protection Officer is John Zachary Mereul Tecson, zactec114@gmail.com. Contact them with any question about this policy or about your data.

When you complete the questionnaire we collect the answers you give us. Some of these are sensitive personal information under the Data Privacy Act of 2012 (Republic Act No. 10173):

• Health information — medical conditions, medications you take, allergies and intolerances
• Religion — optional, and only because some religions carry dietary restrictions
• About you — name, age, gender, height, weight, and the region you live in
• Your goals, lifestyle, cooking habits, typical diet, and weekly food budget
• Your email address and password, to create your account

We do not currently store uploaded lab-result files. If you attach one it is not retained, and it is not sent to us. We will update this policy before that changes.

To prepare a personalized meal plan for you, and to let a nutritionist review your answers before doing so. We ask about conditions, medications, and allergies specifically so that a plan does not recommend food that would be unsafe for you.

We process sensitive personal information on the basis of your consent, which you give explicitly before submitting the questionnaire. You can withdraw that consent at any time — see Your rights below.

We do not sell your information, and we do not use it for advertising or profiling.

• You.
• The nutritionists and administrators of WellPlate, in order to review your submission and write your plan.
• Our hosting and infrastructure providers, who store the data on our behalf and do not use it for their own purposes.
• Whop, our payment processor, which receives only what is needed to take a payment — your email address, billing details, and an internal reference number. It never receives your health information: not your name as given in the questionnaire, your conditions, your medications, your allergies, or your region.

Access is enforced by the database itself, not only by the interface: one customer cannot retrieve another customer's submission. Access by a nutritionist is limited to accounts we have explicitly granted that role, and changes to a submission's review status are recorded with the person who made them.

Notification emails we send internally contain a link only — never your name, conditions, medications, or allergies.

Your data is stored in a managed PostgreSQL database operated by Supabase, hosted in Singapore (ap-southeast-1), and the application is served by Vercel. Email is delivered by our email provider. Where any of these process data outside the Philippines, that transfer is covered by the contractual protections those providers offer.

Payment for a meal plan is taken by Whop, which acts as the merchant of record. Your card details are entered on Whop's own checkout and are never sent to, seen by, or stored by WellPlate.

We keep a record of each payment — the amount, the currency, the date, and Whop's reference for it — so that we can answer questions about your order. That record is linked to your account and to the questionnaire it paid for, and contains no health information. Whop keeps its own records under its own privacy policy.

We keep your questionnaire and meal plans for two years after your last activity, so that a nutritionist can see your history when preparing a new plan. After that we delete or anonymize it.

If you ask us to delete your data sooner, we will, except where we are required to keep records by law.

Under the Data Privacy Act you have the right to:

• Be informed about how your data is used — this document
• Access the data we hold about you, and get a copy of it
• Correct anything that is inaccurate or out of date
• Object to processing, or withdraw your consent
• Have your data erased or blocked, where the law allows it
• Receive your data in a portable format, and be compensated for damage caused by misuse

To exercise any of these, email zactec114@gmail.com or contact our Data Protection Officer. We will respond within the period the law requires.

If you are not satisfied with our response, you may complain to the National Privacy Commission (privacy.gov.ph).

We restrict access to health information to accounts that need it, enforce that restriction in the database, and keep health information out of notification emails and application logs.

No system is perfectly secure. If a breach occurs that is likely to put you at serious risk, we will notify you and the National Privacy Commission as the law requires.

WellPlate is not intended for children. The questionnaire does not accept an age under 13, and we do not knowingly collect information from children. If you believe a child has given us data, contact us and we will delete it.

If we change how we handle your data, we will update this page and ask for your consent again where the change requires it. Each submission records which version of this policy you agreed to.