Foodzilla is GDPR compliant
Dietitians, nutritionists and coaches in the EU and UK can use Foodzilla with their clients' data. We meet the GDPR and the UK GDPR, and we have an appointed GDPR representative in both.
Click the badge to check our GDPR representative on Euverify.
How Foodzilla meets the GDPR
A DPA with every account
Our Data Processing Agreement is part of the Terms of Service, so every practitioner has one from the day they sign up. You're the controller of your clients' data and we're the processor, as Article 28 of the GDPR requires. There's nothing extra to request or sign.
EU and UK representatives
Zilla Technologies Ltd, the company behind Foodzilla, is based in New Zealand. Euverify is our representative under Article 27, in Ireland for the EU and in London for the UK. Your clients can contact them directly.
Where client data is stored
Client data sits in a MongoDB Atlas database in Singapore. Transfers out of the EU and UK use the European Commission's Standard Contractual Clauses and the UK Addendum. New Zealand, where we're based, has adequacy decisions from both the EU and the UK.
Encryption and access
Data is encrypted in transit with TLS and encrypted at rest, backups included. Only the people who need access have it, and admin access needs multi-factor authentication. Backups are deleted after three months.
Client data requests
Clients can ask for a copy of their data, a correction or deletion through our privacy request form or Euverify's GDPR portal. We help you answer any request about data you keep in Foodzilla.
Breach notice within 48 hours
If a breach affects your clients' data, we tell you within 48 hours of finding out. You get what you need to report it to your supervisory authority.
Sub-processors you can see
The DPA lists every sub-processor, what it does and where it is. We give 30 days' notice before we add or replace one, and you can object.
Retention and deletion
You can delete client data at any time. If an account goes quiet, we keep the data for up to 7 years to cover health record rules, then delete it. You get 30 days' notice first.
Video calls aren't recorded
Foodzilla Meet calls run in real time on Cloudflare. We don't record or store the video or audio. AI call summaries use open-source models on Cloudflare Workers AI, and nobody trains AI models on your calls. When you use AI summaries, the call transcript and summary are stored with your other data in MongoDB Atlas in Singapore.