Privacy policy
Last updated September 21, 2026
Nutrai is a SollareAI product that helps nutrition professionals prepare consultations, record what happened, and finish the follow-up work they approve. This policy explains what data we handle, why, who we share it with and for how long, and how to exercise your rights under Brazil's General Data Protection Law (LGPD).
Who is responsible for which data
Your professional account data, such as your name, email and preferences: SollareAI is the controller.
Patient data the professional records, captures or receives through Nutrai: the professional is the controller, and SollareAI processes it on their behalf as a processor. If you are a patient, please contact your professional first; we help them answer your request.
What data we handle
Only what the service needs to work:
- Account: your name, email, and the preferences you set in Settings.
- Patients: identification and contact details, health and nutrition information, goals, uploaded documents, and answers to the first-visit form.
- Consultations: the audio, recorded only after the professional confirms the patient's consent; the transcript; clinical notes; and the drafts generated for review.
- Audit history: what was approved, edited, sent or deleted, and when.
- Technical data: the cookies needed to keep you signed in and remember your language, and error logs that contain no clinical content.
Legal bases
We process personal data on these LGPD bases:
- performance of our contract with the professional, to provide the service (art. 7, V);
- protection of health, in a procedure carried out by a health professional, for patients' health data (art. 11, II, f);
- the patient's consent to recording, confirmed by the professional before each recorded consultation;
- compliance with legal obligations and the regular exercise of rights, where applicable (art. 7, II and VI).
What we use it for
Only to provide the service: preparing the consultation, transcribing and organising what was said, suggesting records and actions for review, and carrying out the actions the professional approves.
Nutrai does not make clinical decisions. Every suggestion is reviewed by the professional before it becomes part of the record or leaves the app.
We do not sell data, use it for advertising, or pass it to data brokers.
Artificial intelligence
Consultations are transcribed and analysed with Google Gemini through the paid API. Under those terms, Google does not use the data sent to improve its products.
Before any text is sent to the model, Nutrai replaces the patient's name, email and phone number with placeholders. Audio cannot be treated that way, and other names spoken during the consultation may appear in the transcript.
Everything the model produces is checked by the system and reviewed by the professional before it is saved to the record.
Data from your Google Account
Signing in with Google uses only your name, email address and profile picture.
Integrations are optional and connected one at a time, each with the least access it needs:
- Google Calendar: create events on a calendar Nutrai creates itself, and check only when you are busy, never what your events say.
- Gmail: send the message you have read in full and confirmed. Nutrai does not read, list or search your inbox.
- Google Tasks: create the tasks you approved.
- Google Drive: access only the files Nutrai itself created.
Access credentials are stored encrypted. You can disconnect any service from the Integrations screen, or revoke access at myaccount.google.com/permissions.
Data received from Google APIs is not used to train artificial intelligence models, is not passed to third parties, and is not read by people, except when you ask us to, when it is needed to keep the service secure, or when the law requires it.
Nutrai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Who we share it with
Only the providers the service needs in order to work, under contract:
- Supabase: database, authentication and file storage, in São Paulo.
- Vercel: application hosting.
- Google: Gemini, for transcription and analysis, and the Google Workspace APIs when you connect an integration.
- Resend: delivery of sign-in emails, which contain your email address.
We may also share data when the law or a court order requires it.
Where the data lives
The database, recordings and documents are stored in Brazil, in São Paulo.
Processing by Gemini, hosting and email delivery may take place outside Brazil. These international transfers happen only as far as needed to provide the service, under article 33 of the LGPD.
How long we keep it
- Consultation audio: deleted as soon as processing finishes, by default. The professional can choose to keep it for 30 days, 90 days or 1 year.
- Transcript text: kept by default. The professional can choose to discard it as soon as the records are ready.
- Clinical records and other entries: for as long as the account is active, as the professional decides, who is also responsible for any legal record-keeping periods.
- Account: deletion can be requested in Settings or by email. We email you before anything is removed, then delete or anonymise whatever we are not legally required to keep.
Security
Data is encrypted in transit and at rest. Each professional can reach only their own data, through rules enforced inside the database itself, and significant actions are kept in the audit history.
No system is immune to failure. If an incident could bring significant risk or harm, we will notify the people affected and the ANPD, as the LGPD requires.
Your rights
Under the LGPD, you can ask for:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymisation, blocking or deletion of data that is unnecessary or processed unlawfully;
- portability of your data;
- information about who we share your data with;
- withdrawal of consent, where processing depends on it.
We answer within 15 days. You can also lodge a complaint with Brazil's National Data Protection Authority (ANPD).
Cookies and browser storage
We use only necessary cookies: the ones that keep you signed in and the one that remembers your language. We use no advertising or analytics cookies.
The first-visit form keeps the patient's answers on their own device until they are sent, so nothing is lost if the connection drops.
Changes to this policy
If we change this policy in a meaningful way, we will tell you in the app or by email before the change takes effect. The date at the top shows the version in force.
Contact
For questions, requests about your data, or to reach the person in charge of personal data processing, write to: