Trust & Security

    How we protect your data

    This page is maintained by Club Nutrichoix to answer common security and privacy questions about the GutHealth platform. It is not an independent certification.

    Last updated: 18 juin 2026

    Shared responsibility

    GutHealth is operated by Club Nutrichoix and hosted on Lovable Cloud (powered by Supabase) with Stripe for payments. Platform-level technical controls are provided by these vendors; data handling practices, retention, and communications are managed by Club Nutrichoix.

    Authentication & access

    • Email/password and Google OAuth sign-in via Supabase Auth.
    • Sessions use signed JWT tokens; passwords are never stored in plain text.
    • Data access is enforced by PostgreSQL Row-Level Security (RLS) policies — each user only sees their own records.
    • Admin roles are stored in a separate table and verified server-side.

    Hosting & encryption in transit

    • All traffic is served over HTTPS (TLS) with HSTS enabled.
    • Database and storage hosted on Supabase; payments processed by Stripe (PCI DSS Level 1 — see their respective compliance pages).
    • Client source is served via CDN from the guthealth.clubnutrichoix.com subdomain.

    Data we collect

    • Account: email address, first name (optional), language preference.
    • Health assessment: questionnaire answers about digestive symptoms, dietary preferences, goals.
    • Subscription: Stripe status (never card numbers — they never touch our servers).
    • Usage logs to measure engagement and improve the product.

    Subprocessors & integrations

    • Supabase — database, authentication, file storage, serverless functions.
    • Stripe — payment processing and subscription management.
    • Lovable AI Gateway — powers personalized nutrition recommendations (assessment answers are passed through for processing).
    • Google Analytics 4 — anonymized audience measurement.

    Cookies & analytics

    We use strictly-necessary cookies (session, language preference) and Google Analytics 4 to understand aggregate site usage. No third-party advertising cookies are used.

    Retention & deletion

    Your assessment data is retained while your account is active. You can request deletion of your account and associated data by writing to the address below; we process requests within a reasonable timeframe.

    Privacy requests & contact

    For any question about your data, to exercise your rights of access, rectification or deletion, or to report a security incident:

    Vulnerability reporting

    If you discover a security vulnerability, please email info@clubnutrichoix.com with reproduction details. We acknowledge reports and work in good faith to fix issues.

    GutHealth is not a medical device and does not replace professional medical advice. Consult a healthcare professional for any medical condition.