LegalData Subject & Consumer Request Procedure
Data Subject & Consumer Request Procedure
1. Who Can Request
| Requester | Scope |
|---|---|
| Account holder | Personal Data we process about your Optimal account and Environments |
| Authorized agent | Where permitted by law (for example, CCPA/CPRA), with proof of authorization |
| Parent or guardian | Where applicable for a minor we should not have onboarded. See the age section in the Privacy Policy |
Nativity Ltd is the Controller for account, health profile, meal, journal, AI conversation, and related product data. Infrastructure vendors are processors or sub-processors. Named vendors appear in the Sub-processor List.
2. Rights We Honor
We honor rights available under applicable data-protection laws. Exact scope depends on your location and the law that applies.
| Right | Typical regimes | How we handle |
|---|---|---|
| Access / know | GDPR, UK GDPR, CCPA/CPRA, and similar laws | We provide categories and, where required, a copy of Personal Data we hold |
| Rectification / correction | Most laws | We correct inaccurate account or profile data. Many fields are editable in-product |
| Erasure / deletion | GDPR Article 17, CCPA delete, and similar | We close the account and delete identifiable data from active systems, subject to Section 6 |
| Restriction | GDPR / UK GDPR | We limit processing where legally required |
| Objection | GDPR / UK GDPR | You may object to processing based on legitimate interests or direct marketing |
| Portability | GDPR / UK GDPR | Structured export. Self-serve export may be partial. Contact us for more |
| Opt out of sale or share | CCPA/CPRA | We do not sell Personal Data for money. See the Privacy Policy for our analysis of limited outbound partner click metrics |
| Limit use of sensitive personal information | CCPA/CPRA | Health and pregnancy data are core to the product. Contact [email protected] |
| Human review of automated processing | GDPR Article 22 posture | Scores and AI outputs are informational, not medical decisions. See Automated Decisions and AI Transparency |
| Withdraw consent | GDPR Articles 7 and 9 | Change your choices in the Privacy Center (the separate consents for health-detail, weight and ancestry analytics signals, the two sponsor-matching switches, sponsor notifications, and the analytics opt-out), stop using AI, disable push, or close your account. Withdrawal stops further collection. It does not undo processing that was already lawful or remove figures already published in aggregate |
If a right is not available in your jurisdiction, we may still honor reasonable requests as a matter of practice.
3. How To Request
Email (primary)
Email [email protected] and include:
- The type of request (access, correction, erasure, portability, restriction, objection, CCPA know/delete/opt-out, or another right).
- The email address associated with your account, and any prior emails if you changed it.
- Enough detail to locate records, including the Environment name if relevant.
- For agents, we require proof of authorization and identity of the consumer.
In-Product Correction
You can correct many profile, preference, meal, and journal fields directly in the signed-in Services without a formal request.
Close An Account
To close an account, use account settings or email [email protected]. We will help if you cannot complete closure yourself.
Product Support
Product questions that are not legal rights requests should be sent to [email protected]. We may route privacy matters to [email protected].
4. Identity Verification
To protect Special Category Health Data and other Personal Data, we verify the requester before disclosing or acting.
| Check | Practice |
|---|---|
| Account match | The request email and account identifiers must match our records |
| Signed-in actions | Where appropriate, we prefer actions from a signed-in account |
| Heightened scrutiny | For erasure or bulk access, we may ask for additional confirmation |
| Agents | Valid authorization plus consumer identity verification as required by law |
| Failure to verify | We will not disclose or delete until identity is reasonably verified |
We do not request government identification where less intrusive verification works.
5. Export & Portability
A self-serve export may not include everything. For example, it may omit AI conversation bodies.
For a fuller copy of what we hold, please contact [email protected]. We will provide what we can reasonably assemble from systems we control, subject to verification and the limits outlined in other Sections.
6. Deletion
When you close your account:
- We delete your account and the records held under it. A few pseudonymised records are kept, including proof of what you agreed to and certain payment records (Privacy Policy, Section 13).
- When you delete your account, the forum profile is anonymized (Privacy Policy, Section 13). Your posts and uploads are not deleted and remain visible under an anonymous identifier.
- Backups, security logs, email logs, and our processors may keep copies for a limited time under their own rules.
- We do not currently instruct AI Model Providers to delete their copies. Those copies follow their terms.
- Anonymous participations prevent identification and cannot be taken back. Anonymized or aggregated statistics that no longer identify you are retained and cannot be withdrawn, because no individual record remains to remove.
- Legal holds and mandatory retention (including Legal hold suspends deletion where required by law) can delay erasure.
We do not issue a formal deletion certificate. If something still looks linked to you after closure, contact [email protected].
7. Timelines
| Framework | Target response time |
|---|---|
| GDPR / UK GDPR | Approximately 1 month from receipt, extendable for complex or numerous requests. We will tell you if we extend. |
| CCPA/CPRA | Approximately 45 days, extendable by 45 days with notice. |
| Other regions | Without undue delay, and within local statutory limits. |
We aim to acknowledge requests promptly.
8. Fees
Requests are free of charge, except where a law permits a reasonable fee for manifestly unfounded, excessive, or repetitive requests. We will explain any fee before charging.
9. Refusal, Partial Response, Appeals
We may refuse or limit a request where:
- Identity cannot be verified.
- A legal hold or mandatory retention applies.
- Disclosure would adversely affect others' rights and freedoms.
- The request is manifestly unfounded or excessive.
- An exemption under the relevant law applies.
We will explain the basis for a refusal or partial response. You may:
- Reply to [email protected] to appeal or provide more information.
- Lodge a complaint with a supervisory authority (see the Privacy Policy).
- Seek judicial remedy where available.
10. Children
The Services are directed at adults with a self-attested age 18+. We do not knowingly process children's data as users. If you believe we hold a child's data, please contact [email protected] for prompt deletion.
Contact
| Topic | Contact |
|---|---|
| Privacy rights | [email protected] |
| Product support | [email protected] |
See also the Privacy Policy, Automated Decisions and AI Transparency, and Sub-processor List.