Privacy Policy

1. Who we are & data controller

The data controller for personal data processed through this website and through my coaching services is:

Carla Högström - Registered Nutritionist Therapist, trading as MyNutritionCode.
Location: Stockholm, Sweden.
Email: info@mynutritioncode.com

2. Information we collect

I only collect information that is necessary to deliver my services to you:

a. Information you give me

Your name, email address, and any message you submit through the contact form.
Booking details submitted through Calendly (name, email, preferred time, and any notes you add).
Billing information required to process payments (collected and processed by Stripe - see Section 6). I do not store your full card details on my servers.
Health, lifestyle, and wellness information you choose to share with me during the intake process or during coaching sessions (e.g. symptoms, medical history, goals, diet, sleep, stress, supplementation).
Copies of third-party lab reports, functional test results, or DNA test reports that you voluntarily share with me so that I can interpret them during our coaching sessions.

b. Information collected automatically

Basic technical information from your browser when you visit the website, such as IP address, device type, browser type, pages visited, and referral source. This is used strictly to keep the site running securely and to understand aggregate usage.

3. How we use your information

I use your information only for the following purposes:

To respond to enquiries submitted through the contact form.
To schedule and deliver consultations, coaching sessions, and follow-ups.
To interpret any DNA, functional, or lab reports you share with me and to build your personalised nutrition and lifestyle plan.
To process payments and send you a receipt/confirmation.
To send transactional emails directly related to your booking or programme (e.g. confirmation of payment, appointment reminders, programme materials).
To keep minimal client records as required by Swedish and EU law (accounting, tax).
To improve the quality of my services and the security of this website.

I do not sell your data. I do not rent your data. I do not use your data for profiling or targeted advertising.

4. Legal basis for processing

Under GDPR, I rely on the following legal bases to process your personal data:

Contract - to deliver the coaching programme you have booked and paid for.
Consent - for sensitive data such as health information and genetic information, which you share voluntarily so I can advise you. You may withdraw consent at any time.
Legitimate interest - to answer enquiries, secure the website, and keep records of my work.
Legal obligation - to comply with Swedish tax and accounting law.

5. Genetic & health information

Important: I do not sell DNA tests, I do not collect saliva samples, and I do not sequence or process DNA in a laboratory. Clients who work with me either:

bring a DNA or genetic test report they have previously purchased from a third-party laboratory (for example Nordic Labs, 3x4 Genetics, MyHeritage, 23andMe, or similar), or
purchase a test directly from an independent laboratory that I may recommend. The laboratory is the data controller for the raw genetic data; I only receive and interpret the report you choose to share with me.

When you share genetic or health data with me, I treat it as special-category personal data under GDPR Article 9. This means:

I process it only on the basis of your explicit consent and only for the purpose of delivering your coaching programme.
I will never share your genetic data or health data with any third party for research, marketing, analytics, insurance, or commercial purposes.
Your genetic and health data will never be used to create a product, database, or scientific publication without your explicit, separate, written consent.
You can ask me to delete your genetic and health data at any time.

I rely on a small number of carefully selected service providers (“data processors”) to run this business. Data is only shared with them to the extent strictly necessary, and each of them is GDPR-compliant.

I may be required to disclose information if compelled by a valid court order or Swedish/EU law. In any such case, I will only share the minimum necessary.

7. How long we keep your data

Contact-form enquiries: up to 12 months after last contact, then deleted.
Client records (coaching notes, shared lab/DNA reports): kept for the duration of our working relationship and for up to 3 years afterwards, so that I can answer any follow-up questions. You may request earlier deletion at any time (subject to legal retention obligations).
Payment / invoice records: kept for 7 years as required by Swedish accounting law (Bokföringslagen).
Website analytics / server logs: kept for a maximum of 14 months in aggregated form.

8. Security

I take appropriate technical and organisational measures to protect your personal data, including encryption in transit (HTTPS), encrypted databases, access controls, and strong authentication. Payment data is handled entirely by Stripe on PCI-DSS-compliant infrastructure. Despite all reasonable care, no system is 100% secure; if a data breach occurs that is likely to affect your rights, I will notify you and the Swedish supervisory authority (IMY) in accordance with GDPR.

9. Cookies & website analytics

This website uses only the minimum cookies and similar technologies needed to keep the site functional (for example, a session cookie and preferences). I do not use advertising cookies, I do not sell behavioural data, and I do not track you across the web. If analytics are used, they are configured to be privacy-friendly (IP anonymisation, no cross-site tracking).

10. Your rights under GDPR

As a data subject, you have the following rights, free of charge:

Right of access - to request a copy of the personal data I hold about you.
Right to rectification - to correct inaccurate or incomplete data.
Right to erasure (“right to be forgotten”) - to ask me to delete your data, subject to legal retention obligations.
Right to restrict processing - to ask me to pause processing in certain circumstances.
Right to data portability - to receive your data in a structured, machine-readable format.
Right to object - to object to processing based on legitimate interest.
Right to withdraw consent - at any time, for processing that is based on consent.
Right to lodge a complaint - with the Swedish supervisory authority Integritetsskyddsmyndigheten (IMY), imy.se.

To exercise any of these rights, email me at info@mynutritioncode.com. I will respond within 30 days.

11. Children

My services are directed at adults. I do not knowingly collect personal data from anyone under the age of 16 without the verifiable consent of a parent or legal guardian.

12. Changes to this policy

I may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will always reflect the current version. Material changes will be highlighted on this page.

13. Contact

For any question about this Privacy Policy, or to exercise your rights, please contact:
Carla Högström - MyNutritionCode
Email: info@mynutritioncode.com
Location: Stockholm, Sweden

Contents