LegalRecords of Processing Activities

Records of Processing Activities

Version 5.0.0 · Effective 2026-10-18 · Operator Nativity Ltd

1. Controller Identity

Field	Value
Controller	Nativity Ltd
Trading as	Optimal, Optimal Being
Company number	17457413
Registered address	167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF
Incorporation	England and Wales, United Kingdom
Privacy contact	[email protected]
DPO / privacy lead	[email protected]
EU representative	[email protected]
UK representative	Not required (Nativity Ltd is established in the UK)
Website	https://beingoptimal.org

Role model: Optimal is Controller for B2C account, health, nutrition, AI, community (as platform operator), and product-analytics processing described below. Infrastructure vendors are processors or sub-processors. There is no general B2B clinic-processor offering in the current product model (no customer DPA for clinics unless separately contracted).

2. Processing Activities

2.1 Account & Authentication

Ref	Activity	Purposes	Lawful basis	Data subjects	Categories of personal data	Recipients	Transfers	Retention
C-1	Account registration and authentication	Provide the Services; secure access	Contract; legitimate interests (security)	Users	Email, name or profile metadata, authentication identifiers, session tokens	Authentication Provider; Webhook Transport; Hosting Provider; CDN / Edge Network Provider; Database Provider	Primarily United States; global edge delivery; SCCs/IDTA as needed	Account life; sessions shorter

2.2 Planner, Health Profile, Labs, Symptoms

Ref	Activity	Purposes	Lawful basis	Data subjects	Categories of personal data	Recipients	Transfers	Retention
C-2	Environment and nutrition planner	Meal planning; nutrient tracking; Day Score / grades	Contract; acceptance of the Terms and voluntary provision of health data; explicit consent for analytics contribution	Users	Meal logs, combos and templates, ingredient quantities, scores	Database Provider; Cloud Infrastructure Provider (compute)	As above	Active account lifetime; deletion on account close subject to Privacy Policy caveats
C-3	Health profile and gestational context	Personalize targets; pregnancy-phase nutrition context	Contract; acceptance of the Terms and voluntary provision of health data; explicit consent for analytics contribution	Users	Pregnancy timing (LMP/EDD), date of birth, weight, ethnicity, trimester-related fields	Database Provider	As above	Active account lifetime; deletion on account close subject to Privacy Policy caveats
C-4	Blood markers and symptoms journal	Informational comparison to product ranges; user record-keeping	Contract; acceptance of the Terms and voluntary provision of health data; explicit consent for analytics contribution	Users	Lab values entered by the user; symptom notes	Database Provider	As above	Active account lifetime; deletion on account close subject to Privacy Policy caveats
C-5	Custom ingredients and user content	User-authored food entries	Contract	Users	Custom nutrient entries and labels	Database Provider	As above	Active account lifetime; deletion on account close subject to Privacy Policy caveats
C-6	Preferences, entitlements, and product state	Product configuration; tier features	Contract; legitimate interests	Users	Preference flags; tier or entitlement metadata	Database Provider; Hosting Provider	As above	Active account lifetime; deletion on account close subject to Privacy Policy caveats
C-6a	Tasks	Scheduled reminders and their completion	Contract	Users	Task text, schedule, completion status	Database Provider	As above	Active account lifetime; deletion on account close subject to Privacy Policy caveats

2.3 AI Conversations & Run Metadata

Ref	Activity	Purposes	Lawful basis	Data subjects	Categories	Recipients	Transfers	Retention
C-7	AI assistant conversations	Answer questions; planning help; propose-only edits	Contract; Article 9 explicit consent for health context in prompts	Users	Message bodies; optional health-context snippets; safety filter signals	Database Provider; AI Model Providers; Cloud Infrastructure Provider	Primarily United States; global edge delivery and provider regions; SCCs/IDTA as needed	While account active unless deleted; external Model Provider copies per provider DPA. Processors may retain copies under their own terms for a limited time.
C-8	AI run metadata	Reliability, rate limiting, debugging	Legitimate interests; contract	Users	Run metadata	Database Provider; Cloud Infrastructure Provider	As above	Operational period

2.4 Email, Web Push, Native Push

Ref	Activity	Purposes	Lawful basis	Data subjects	Categories	Recipients	Transfers	Retention
C-9	Transactional email	Account, security, and service notices	Contract; legitimate interests	Users	Email address, message content	Email Delivery Provider; Email Design Provider	Configurable	Provider log retention plus operational need
C-10	Web push	Optional browser notifications	Consent (push permission)	Users	Push endpoint, keys, payloads	Database Provider; Push Delivery (Web)	Device and endpoint	Until unsubscribe or account close
C-11	Native app push	Optional mobile-app notifications	Consent (OS notification permission)	Users	Device token, platform, app version, payloads	Database Provider; Push Delivery (Native app)	Device and provider regions	Until token prune, uninstall, or account close
C-12	Notification preferences	Deliver notices and respect preferences	Contract; legitimate interests	Users	Preference flags; notification events	Database Provider	As above	Operational period

2.5 Community

Ref	Activity	Purposes	Lawful basis	Data subjects	Categories	Recipients	Transfers	Retention
C-13	Community forum sign-in and user content	Peer discussion; support	Contract; legitimate interests; consent where required for cookies	Users who join the community	Identity for forum sign-in; posts; uploads	Community Platform Provider; Cloud Infrastructure Provider (uploads where used)	Forum host region	Posts may remain anonymized after account close rather than being hard-deleted by default

2.6a Wishlist & Registry

Ref	Activity	Purposes	Lawful basis	Data subjects	Categories	Recipients	Transfers	Retention
C-22	Wishlist item listing and sharing link	Let a user list and share desired items	Contract	Users	Item titles, links, notes, and the sharing link	Database Provider	As above	Active account lifetime; deletion on account close subject to Privacy Policy caveats
C-23	Wishlist purchase marking	Let a link recipient mark or note an item purchased	Legitimate interests (operating a feature the account holder chose to enable and share); consent of the purchaser to the extent they supply optional identifying details	Wishlist link recipients, who may not hold an Optimal account	Optional name or short message a purchaser supplies; which item and when	Database Provider	As above	Until removed by the account holder or with the Wishlist item

2.6 Location, Help, Analytics, Commercial

Ref	Activity	Purposes	Lawful basis	Data subjects	Categories	Recipients	Transfers	Retention
C-14	Reverse geocoding	Country or region for localization or profile	Legitimate interests; consent where required	Users who invoke the feature	Raw coordinates (transient); derived country or region	Reverse-Geocoding Provider; Database Provider (labels only)	Global API	Coordinates are not stored. Labels follow account preferences.
C-15	Help and Learning Center delivery	Education; documentation	Legitimate interests; contract	Visitors and users	IP and request logs	Hosting Provider; CDN / Edge Network Provider	Edge global	Log retention per host
C-15a	Website visit counting	Understand how the public website is used	Legitimate interests	Visitors to the public website	Page address, referring site and page-load timing. No cookie or other identifier is stored in the browser.	CDN / Edge Network Provider	Global edge	Per the provider's retention period
C-16	First-party catalog analytics	Improve catalog and product experience	Legitimate interests; opt-out available. Ancestry and pregnancy stage only with explicit consent (Art. 9(2)(a), see C-16a)	Users	Pseudonymous catalog choice events (item, action, country or region, age band). No third-party analytics SaaS.	Database Provider; Cloud Infrastructure Provider	Primarily United States; global edge delivery	As needed for product improvement (first-party, pseudonymous)
C-16a	Exploration-interest analytics	Improve in-app recommendations; aggregate population analytics	Ordinary buckets (day-part, country or region, age band): legitimate interests, opt-out available. Health-related and ancestry buckets (gestational phase, a "currently short on a nutrient"-style bucket, ethnicity category): explicit consent (Art. 9(2)(a)), asked separately, in the Privacy Center, withdrawable at any time. Collected under a pseudonym; published figures are aggregate and carry no user id.	Users	Topic-sequence events and coarse buckets (for example day-part, country or region, and, only with explicit consent, gestational phase, a nutrient-shortfall bucket derived from health-adjacent entries, or ethnicity category), never the raw symptom, lab, or journal text itself, which stays governed by C-3/C-4's explicit-consent basis. No user id on published figures.	Cloud Infrastructure Provider	Primarily United States; global edge delivery	Individual-level record short-lived. Anonymous aggregate retained indefinitely and cannot be withdrawn once published.
C-16b	Personal API / MCP read access	User-initiated read access for a third-party tool the user connects	Consent (user mints a key or completes an OAuth grant)	Users	Whatever the user's own account holds and the grant's scope covers (for example journal, labs, plans, profile, Tasks, Wishlist); read at the user's direction, not by us	The user's chosen third-party tool, which is not our Sub-processor for what it does after the read	Wherever the user's chosen tool operates; outside our control	Not retained by this activity beyond the audit log of the read itself
C-16b	Anonymous contributions ("Helping parents like you")	Improve guidance for members; aggregate population analytics	One master switch, on unless turned off. Food choices, eating patterns and a mood band: legitimate interests, opt-out available. Health details (symptom facts, blood-result facts, stage), a weight band, and ancestry category: explicit consent (Art. 9(2)(a)), asked separately in the Privacy Center, off until the member taps, withdrawable at any time (withdrawal stops further collection and does not remove published aggregates).	Users	Pseudonymous facts (day, item or band, and, only with explicit consent, symptom, blood-marker, stage, weight-band and ancestry fields), never the raw symptom, lab or journal text. No user id on published figures.	Cloud Infrastructure Provider	Primarily United States; global edge delivery	Individual-level record short-lived. Anonymous aggregate retained indefinitely and cannot be withdrawn once published.
C-17	Outbound partner or affiliate clicks	Measure partner links	Legitimate interests; disclosure in the advertising policy	Visitors	Pseudonymous click records (no stored user identifier; IP transient for rate limiting)	Database Provider; Hosting Provider	As above	Operational analytics period
C-18	Subscription billing	Collect fees; manage plans	Contract	Paying users	Billing email, subscription status, payment references.	Billing Provider; Database Provider (status)	Primarily United States; global edge delivery	at least seven (7) years from the end of the relevant accounting period, plus any longer period required by our Billing Provider or applicable law
C-19	Security, fraud prevention, and abuse	Protect the Services and users	Legitimate interests; legal obligation	Users and abusers	IP, logs, rate-limit signals, abuse reports	CDN / Edge Network Provider; Hosting Provider; Cloud Infrastructure Provider; Database Provider	As above	Security retention period
C-20	Legal compliance and data-subject requests	Respond to rights; comply with law	Legal obligation; legitimate interests	Users; requesters	Request correspondence; verification data	Internal staff; counsel; regulators as required	As needed	Per legal hold and statutory periods. Legal hold suspends deletion where required by law
C-21	Informational scoring	Day Score, nutrient flags, optimizer suggestions, Knowledge Score, blood-marker displays	Contract; Article 9 for health inputs	Users	Derived scores and flags from C-2 through C-4	Database Provider; Cloud Infrastructure Provider. See Automated Decisions and AI Transparency.	Primarily United States; global edge delivery	With source data

3. Special Category (Article 9) Data

Categories	Processing refs	Article 9 condition	Notes
Pregnancy timing and reproductive health context	C-2, C-3, C-7, C-21	Contract and voluntary provision of the data (C-2, C-3, C-21); explicit consent for health context in AI prompts (C-7)	Core product purpose; disclosed in the Privacy Policy
Health metrics, labs, and symptoms	C-3, C-4, C-7, C-21	Contract and voluntary provision of the data (C-3, C-4, C-21); explicit consent for health context in AI prompts (C-7)	User-entered; not clinical ingestion from laboratories
Health context in AI prompts	C-7	Explicit consent, plus contract for service delivery	International transfer to AI Model Providers

To withdraw consent, you may stop using the AI assistant, or close the account. See the Data Subject Request Procedure. Prior processing remains lawful where applicable.

4. Categories Of Recipients

Recipient role	Typical processing
Authentication Provider	Identity, sessions, lifecycle messages
Webhook Transport	Delivery of authentication lifecycle messages
Database Provider	Primary datastore
Hosting Provider	Application hosting, which may include limited page-view or performance telemetry
CDN / Edge Network Provider	DNS, edge, and gateway
Cloud Infrastructure Provider	Privileged APIs, heavy compute, object storage
Email Delivery Provider	Transactional email
Email Design Provider	Operator-side template tooling
AI Model Providers	Generative inference on prompts
Community Platform Provider	Forum
Reverse-Geocoding Provider	Coordinates to place labels (coordinates transient)
Billing Provider	Payments
Push Delivery (Web)	Browser web push (no third-party push SaaS)
Push Delivery (Native app)	Native-app push when that channel is used
Regulators / law enforcement	Only under legal process
Professional advisors	Counsel and auditors under confidentiality

Named vendors for each role appear in the Sub-processor List.

5. International Transfers

Mechanism	Use
Provider data-processing terms	Sub-processors
Standard Contractual Clauses / UK IDTA (as applicable)	Transfers outside the EEA/UK
Other lawful transfer tools	Where required

Primary hosting posture: Primarily United States; global edge delivery.

6. Technical & Organizational Measures

Technical and organizational measures are summarized in the Security & Compliance Overview.

7. Processor Record (Article 30(2))

Not generally applicable to the current B2C model. Optimal does not offer a multi-tenant clinic-processor product in which customers are Controllers and Optimal is Processor for patient panels. If a B2B or clinic offering is launched, a separate Article 30(2) schedule and DPA will be added.

8. Maintenance

Item	Practice
Owner	[email protected] (or privacy lead)
Review cadence	At least annually, and on material processing change (new AI Model Provider, new health data type, billing changes, and similar)
Legal hold	Legal hold suspends deletion where required by law

9. Contact

Topic	Contact
Privacy	[email protected]
DPO / privacy lead	[email protected]