Privacy Policy
Effective Date: 14 April 2026
1. Introduction and Data Controller Identity
This Privacy Policy explains how we ("we", "us", "our"), registered in Greece, collect, use, store and protect your personal data when you use Bite of Balance (the "Application").
Data Controller:
Apostolos Agrafas
Email: tolisatolis7@gmail.com
Phone: +30 6987315904
This policy is issued in compliance with Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.
2. Categories of Personal Data We Collect
We collect and process the following personal data:
2.1 Identity & Contact Data
- Full name
- Email address
- Phone number
2.2 Health & Body Measurement Data
The following constitute special category data (health data) under Article 9 GDPR and are processed only with your explicit consent:
- Body weight (kg)
- Height (cm)
- Body Mass Index (BMI)
- Historical weight records and progress data
2.3 Technical Data
- Device identifiers and IP address
- App usage logs and session data
3. Legal Basis for Processing
We process your personal data on the following legal bases under Article 6 and Article 9 GDPR:
- Explicit Consent (Art. 6(1)(a) & Art. 9(2)(a) GDPR): For health/body measurement data. You may withdraw consent at any time.
- Performance of a Contract (Art. 6(1)(b) GDPR): For name, email and phone number necessary to provide the service.
- Legal Obligation (Art. 6(1)(c) GDPR): Where required by Greek or EU law.
- Legitimate Interests (Art. 6(1)(f) GDPR): For app security, fraud prevention, and service improvement.
4. Purposes of Processing
- Creating and managing your user account
- Providing personalised dietary and nutritional consultation
- Tracking body measurements and progress over time
- Communicating with you regarding your plan or appointments
- Complying with legal and regulatory obligations
- Improving application features and user experience
5. Data Retention
We retain your personal data for as long as your account is active or as necessary to provide services, and for up to 5 years after account deletion to comply with legal obligations.
Health data is deleted within 30 days of account deletion upon your request, unless retention is required by law.
6. Data Sharing and Transfers
We do not sell your personal data. We may share data with:
- Your assigned dietician/nutritionist who uses the platform
- Technical service providers (hosting, analytics) operating under data processing agreements
- Competent authorities when required by law
If data is transferred outside the EEA, we ensure appropriate safeguards (Standard Contractual Clauses or adequacy decisions) are in place.
7. Your Rights Under GDPR
As a data subject, you have the following rights, which you may exercise by contacting us at tolisatolis7@gmail.com:
- Right of Access (Art. 15): Obtain a copy of your personal data
- Right to Rectification (Art. 16): Correct inaccurate data
- Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
- Right to Restriction (Art. 18): Limit how we process your data
- Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
- Right to Object (Art. 21): Object to processing based on legitimate interests
- Right to Withdraw Consent: At any time, without affecting prior processing
You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA): www.dpa.gr | 1-3 Kifissias Ave., Athens 115 23 | +30 210 6475600.
8. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption of health data at rest and in transit (TLS/SSL)
- Access controls and role-based permissions
- Regular security assessments
- Pseudonymisation where applicable
9. Cookies and Tracking
The Application may use essential cookies and analytics tools. You will be informed and given a choice through our cookie consent mechanism where required.
10. Children's Privacy
The Application is not directed to children under 15 years of age (the age of digital consent in Greece under Art. 8 GDPR and Law 4624/2019). We do not knowingly collect data from minors without verifiable parental consent.
11. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification at least 30 days before the change takes effect.
12. Contact Us
For any privacy-related queries or to exercise your rights:
- Email: tolisatolis7@gmail.com