Privacy policy
This page explains what data this website collects, why, where it is sent, how long it is kept and how to withdraw your consent. The policy follows Russian Federal Law No. 152-FZ of 27 July 2006 “On personal data”.
Data controller: Nadezhda Morozova (the “Controller”).
Website: the site on which this policy is published (the “Site”).
Contact for data questions: Telegram — @nutritionmorozova.
1. General
This policy sets out how personal data of Site users is processed. The terms used (“personal data”, “processing”, “controller”, “data subject”) have the meanings given to them in 152-FZ.
Processing follows the principles of lawfulness, limitation to specific purposes, data minimisation, and the prohibition on merging databases processed for incompatible purposes (art. 5 of 152-FZ).
2. What data is processed
The Site requires no registration. Personal data reaches the Controller only if you voluntarily fill in and submit the request form after taking the free wellbeing test.
| Data | When collected | Category under 152-FZ |
|---|---|---|
| Name | Given in the test voluntarily; the step can be skipped | Other |
| Phone number and preferred messenger (WhatsApp / Telegram / VK) | When the request form for a free review is submitted | Other |
| Sex | During the test — it determines which questions are asked | Other |
| Answers about how you feel (sleep, energy, digestion, stress and others), including — for women — questions about the menstrual cycle | During the test; sent to the Controller only together with the request form | Special category (health information) |
| Technical data: IP address, browser and OS type, pages and events on the Site | Automatically by the hosting infrastructure; by analytics — only after cookie consent | Other |
The Site does not ask for your surname, patronymic, passport details, address, payment details or other highly sensitive information.
3. Health data and consent
Answers about how you feel are a special category of personal data (art. 10 of 152-FZ). They may be processed only with the data subject’s consent given in line with art. 9 and art. 10(2)(1) of 152-FZ.
- Consent is given by an active step: before submitting the request form you tick a checkbox consenting to the processing of your personal data, including health information, on the terms of this policy. Without that tick the form is not submitted and no data reaches the Controller.
- Consent is given freely, by your own will and in your own interest.
- Consent is specific and informed: the data involved, the purposes and the recipients are described in this policy.
- The fact and time of ticking the box are recorded together with the request and serve as proof of consent.
- Consent stays valid until the purposes of processing are met or until it is withdrawn (section 9).
4. How the free test works
- You answer questions in a pop-up window. The answers are processed locally in your browser: the result is calculated and shown without sending anything to a server.
- Seeing the result requires no transfer of data to the Controller. If you close the window after the result, nothing is sent.
- If you want a free review, you fill in the form — phone number and messenger — tick the consent box and press submit.
- After submission the request (name, phone, messenger, sex, test answers and its result) goes to the Controller’s automated request system, and the Controller then contacts you in the messenger you chose.
The test is for general information only. It is not a medical service, a diagnosis or a treatment prescription, and it does not replace a consultation with a doctor.
5. Purposes and legal grounds
| Purpose | Data | Ground |
|---|---|---|
| Preparing a free review and getting in touch | Name, phone, messenger, sex, test answers and result | Consent (art. 6(1)(1); art. 10(2)(1) of 152-FZ) |
| Arranging consultations and coaching | Name, phone, correspondence | Consent; steps to conclude and perform a contract (art. 6(1)(5)) |
| Running the Site, security, statistics | Technical data, analytics events | Cookie consent; legitimate interest in keeping the Site working |
6. Who the data is shared with
The Controller does not sell personal data and does not pass it to third parties for marketing. Data may be processed by:
- Hosting infrastructure — to serve the Site’s pages and handle technical requests (including the IP address);
- The Controller’s automated request system — to receive and keep track of review requests;
- A web analytics service (PostHog) — only after cookie consent (section 7);
- Messengers (WhatsApp, Telegram, VK) — for the conversation you have with the Controller in the messenger you chose; that correspondence is also governed by the rules of the service in question;
- Public authorities — in cases expressly provided for by Russian law.
Cross-border transfer
Hosting, analytics and messenger infrastructure may be located outside the Russian Federation, which means a cross-border transfer of data (art. 12 of 152-FZ). The Controller takes the measures required by law in connection with such transfers and notifies the competent authority in the established manner.
7. Cookies and analytics
On your first visit the Site shows a consent banner. Until you choose, analytics collects nothing about your visit: PostHog starts in opt-out mode.
- “Accept all” — analytics records section views, button clicks and test steps (without the content of your answers, your name or your phone number — contact details are never sent to analytics), device data and an approximate region based on IP.
- “Necessary only” — only technically necessary mechanisms work; your choice is stored in the browser (localStorage).
You can change your mind by clearing the Site’s data in your browser — the banner will appear again.
8. Retention periods
- Test answers in the browser — only in the memory of the current tab; they are not saved when the window is closed.
- Requests (name, phone, answers, result) — until the purpose of processing is met, but no longer than 3 years from the last interaction, unless consent is withdrawn earlier.
- Analytics data — for the periods set in the analytics service settings.
- Messenger correspondence — until you or the Controller delete it, subject to the rules of the service.
Once the purposes are met, or if consent is withdrawn, the data is destroyed or anonymised within no more than 30 days (art. 21 of 152-FZ).
9. Your rights
A data subject has the right to (art. 14, 20, 21 of 152-FZ):
- obtain information about the processing of their data — the Controller replies within 10 working days, extendable by no more than 5 working days;
- require that data be corrected, blocked or destroyed if it is incomplete, outdated, inaccurate or processed unlawfully;
- withdraw consent — just write to Telegram @nutritionmorozova from any channel that suits you; processing stops and the data is destroyed within no more than 30 days;
- appeal the Controller’s acts or omissions to Roskomnadzor (rkn.gov.ru) or to a court.
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
10. Security
The Controller applies legal, organisational and technical measures to protect the data (art. 18.1, 19 of 152-FZ):
- data travels between the Site and the request systems only over a secure connection (HTTPS/TLS);
- access to requests is limited to the Controller; passwords and access credentials are not shared with third parties;
- the set of data collected is kept to a minimum: contact details are not sent to analytics, and test answers are not stored on your device;
- the built-in protection mechanisms of the services used are enabled.
11. Changes to this policy
The Controller may update this policy. A new version is published on this page with its version number and effective date. Material changes to the data collected or to the purposes of processing will require your consent again.
Questions about personal data: Telegram — @nutritionmorozova.
This page is an English translation of the Russian original. In case of any discrepancy, the Russian version prevails.