This version is a draft and is not effective until adopted.
How patient information is handled in the SmartEating clinical service and how the clinic’s role differs from Smart Lifestyle’s role. Provided by Smart Lifestyle AS, organisation number 829 972 972. Audience: patients and, where applicable, guardians.
1.Who is responsible?
The clinic and Smart Lifestyle have different roles. The clinic or healthcare provider connected to the patient's account is normally the controller for patient and clinical data. It decides why that data is used and how the patient record is handled. Smart Lifestyle processes the data for the clinic to provide and secure SmartEating. Smart Lifestyle is separately controller for limited account, security, service-administration and direct support data that it needs for its own responsibilities.
The clinic is the primary contact for questions about treatment, the patient record, the legal basis for health-data processing, correction, disclosure, deletion and retention. The clinic's own privacy information should identify it and explain its legal basis.
Smart Lifestyle AS, organisation number 829 972 972, c/o Christoffer Riseng Bølla, Strandvegen 107, 2315 Hamar, Norway, provides the SmartEating software. Privacy questions about Smart Lifestyle's own processing may be sent to support@smarteating.ai or +47 45 84 94 84. Data protection officer: David Øvrelid, dpo@smarteating.ai.
The current pilot uses synthetic patient data only and is not authorised for use with identifiable patients.
2.Scope
This notice applies when a patient uses or is represented in the patient-facing functions of the SmartEating clinical service, including a companion or self-service surface enabled by a clinic. It also applies when the clinic records or uses patient information in SmartEating even if the patient does not personally sign in.
A clinician may lawfully record information about a child patient where the clinic is authorised to provide healthcare and has established the required legal basis and safeguards. Any direct account use by a child must be assessed and explained by the clinic in an age-appropriate way.
3.Patient data processed
| Category | Examples |
|---|---|
| Identity and profile | Name or patient label, contact or account information (such as phone number or email address used to sign in), age or date of birth, sex, language and settings. |
| Health and nutrition | Conditions, medication, allergies, intolerances, bloodwork, measurements, activity, sleep, dietary information, goals, food logs and progress. |
| Clinical record | Consultations, notes, plans, protocols, recipes, shopping lists, approvals, access grants and record history. |
| Patient contributions | Check-ins, messages, prompts, meal entries, captured or uploaded images, voice transcripts and feedback. |
| Connected health data | Selected activity, sleep, heart-rate, weight, body or other data imported from a connection the patient authorises. |
| Generated and derived data | Drafts, summaries, food-recognition results, calculations, cited material and generated content. |
| Technical and security | IP address, device and browser information, session identifiers, authentication events, request metadata, errors and incident information. |
Much of this information is health data and is therefore a special category of personal data under the GDPR. The exact data depends on what the clinic and patient choose to record and which optional functions are enabled.
4.Sources
- From the patient, including information entered through a patient-facing surface.
- From the clinic and authorised healthcare personnel.
- From an account, device or browser used to access the Service.
- From an optional health or wearable connection authorised by the patient.
- From requested functions that return a transcript, recognition result, calculation or generated draft.
- From public or licensed food, nutrition, recipe and clinical-reference material used by the Service.
5.Why patient data is processed
Smart Lifestyle processes patient data for the clinic to host and secure the workspace, make authorised records available, organise information, perform calculations and reference retrieval, create requested drafts, support consultations and transcription, connect optional sources, provide support, create authorised exports, and carry out deletion or other documented instructions.
The clinic is responsible for selecting the legal basis under GDPR Article 6 and the applicable condition for health data under Article 9 and healthcare law. Smart Lifestyle does not choose the clinic's treatment purpose or rely on the patient's consent as its own legal basis for processing performed solely as the clinic's processor. A device or provider connection may still require the patient to grant a specific permission.
For the limited processing where Smart Lifestyle is itself controller, it relies on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Account administration and sign-in | GDPR Art. 6(1)(b) where the user has accepted our terms; otherwise Art. 6(1)(f), our legitimate interest in giving authorised users secure access to the Service |
| Security, access logging and incident handling | Art. 6(1)(c), our security and breach-handling duties (GDPR Art. 32–34), and Art. 6(1)(f), our legitimate interest in protecting the Service and its users |
| Contact form and direct support | Art. 6(1)(f), our legitimate interest in answering the requests people send us |
| Waitlist sign-up on smarteating.ai/kom-i-gang (email, and optionally name and interest) | Art. 6(1)(a), the consent you give by ticking the box on the form. You can withdraw it at any time by emailing support@smarteating.ai |
| Strictly necessary website cookies | Art. 6(1)(f); exempt from consent under the Norwegian Electronic Communications Act (ekomloven) § 3-15 |
| Recording your cookie choice | Art. 6(1)(c), read with Art. 7(1), to show what you chose |
You are not required by law or contract to provide personal data to Smart Lifestyle, but sign-in and security data are needed to use the Service.
Smart Lifestyle does not sell patient data, use it for behavioural advertising or use patient content to train a general-purpose model for its own purposes.
6.Generated content, photos and voice
When an authorised User requests a machine-learning function, the Service sends the information reasonably needed for that function to an approved service provider. Depending on the request, this may include selected patient context, recent conversation, a meal photo, source material or a voice recording. The result and relevant accountability information may be stored in the patient record.
A meal photo used for food recognition is analysed to propose foods and nutrition information. If the result is confirmed and saved, the patient's submitted image may be stored with the food-log entry. A voice recording used for transcription is processed for that request; SmartEating is designed not to retain the raw consultation audio after transcription, although the transcript and related clinical draft may become part of the patient record.
Generated content supports a human clinician and may be incorrect. SmartEating does not use it to make a solely automated decision that produces legal or similarly significant effects for the patient.
7.Optional health and wearable connections
If the patient connects Apple Health, Oura or another supported health or wearable service, the permission screen identifies the categories requested. Some connections send selected data directly from the patient's device or chosen service to SmartEating. Other connections may use a separate integration provider, which is identified during the connection flow.
Oura and other wearable providers you connect are separate, independent controllers for the data held in their own services, under their own privacy terms. Oura connects directly to SmartEating. Other supported wearables may connect through Terra, our sub-processor.
A connection is optional. The patient can revoke the device or provider permission through the relevant settings. This stops future collection through that connection, but information already imported into the patient record remains subject to the clinic's legal and retention duties unless it is lawfully deleted.
8.Recipients
Patient data is disclosed only where needed to relevant categories of recipients: the clinic and its authorised healthcare personnel; a covering clinician or patient recipient authorised by the clinic; cloud hosting, storage and security providers; identity and authentication providers; model, image or speech providers for a requested function; optional health and wearable integration providers selected by the patient; professional advisers and incident responders; and public authorities where disclosure is legally required.
Each provider should receive only the data reasonably needed for its function. Generic searches of public recipe sources must not include patient identifiers or the patient's clinical record.
Smart Lifestyle's current sub-processors for the SmartEating service are:
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Microsoft Azure | Hosting and database (Norway East); AI inference (EU Data Zone); speech recognition (Sweden Central and Norway East) | EU/EEA | Not needed (EEA) |
| Clerk | Sign-in: patients by phone number and SMS code, clinicians by email | USA | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Sentry | Error monitoring | EU; some account metadata in the USA | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Terra | Wearable data connections | EU | Standard Contractual Clauses |
| Expo | App updates for the patient app (device and app version information, IP address) | USA | EU–US Data Privacy Framework and Standard Contractual Clauses |
The name of an optional health or wearable connection is shown when the patient chooses it.
This website, smarteating.ai, is delivered by Cloudflare (global; Standard Contractual Clauses) and hosted by Lovable (USA and other countries; Standard Contractual Clauses). They receive visitors' IP addresses and browser information, not patient records. Waitlist sign-ups and messages sent through the contact form are stored in a database provided by Lovable Cloud, built on Supabase ([REGION: TO CONFIRM in Lovable Cloud settings]; Standard Contractual Clauses where data leaves the EEA). Fonts on this website are served from our own servers.
9.International transfers
Smart Lifestyle aims to use EEA-based processing for the clinical service. Some support, account or optional-integration providers may process data outside the EEA. Where no adequacy decision applies, the relevant controller or processor uses an approved transfer mechanism such as the European Commission's Standard Contractual Clauses, with supplementary measures where required. The transfer safeguard for each provider is listed in section 8. You can request a copy at support@smarteating.ai.
10.Retention
| Data | Retention criterion |
|---|---|
| Patient and clinical records | For the Customer relationship and then as instructed by the clinic, subject to healthcare and patient-record law. |
| Patient account | While access is active, then as needed to close access and meet security, legal or claims requirements. |
| Messages, drafts and saved images | As part of the applicable patient record until the clinic deletes them or instructs deletion, subject to record-keeping duties. |
| Raw consultation audio | Not intentionally retained by SmartEating after the transcription request. The transcript may be retained in the patient record. |
| Security and access records | For the time reasonably needed to investigate incidents, document access and meet security or healthcare logging duties. |
| Backups | Until overwritten in the controlled backup cycle, unless preservation is required for recovery, security or law. |
| Waitlist sign-ups | Until you are given access or withdraw your consent, and no later than 12 months after sign-up. |
| Contact form messages | Until the enquiry is closed, and no later than 12 months after the last message. |
Deleting an account or disconnecting a health service does not automatically erase the patient record. The clinic decides lawful correction, restriction, retention and deletion. Where law requires preservation, access is limited to the permitted purpose.
11.Security
Safeguards include verified authentication, clinic and role controls, patient-access checks, encrypted network connections, protection of selected sensitive fields and provider credentials, audit logging, input and rate limits, secret management and separation between platform-administration and clinical access. No service is completely secure. Patients should protect devices and authentication factors and report suspected loss or unauthorised access promptly.
12.Patient rights
Depending on the circumstances, a patient may have rights to information, access, correction, deletion, restriction, objection, portability, withdrawal of consent and a complaint to a supervisory authority. These rights are subject to conditions and exceptions, including healthcare record duties.
Requests about treatment or the patient record should be sent to the clinic first. The clinic decides the request as controller, and Smart Lifestyle assists it as required. Requests about data for which Smart Lifestyle is separately controller may be sent to support@smarteating.ai. You can also contact our data protection officer, David Øvrelid, at dpo@smarteating.ai. Identity and authority may be verified before a request is completed.
The in-app data export is temporarily unavailable. Until it is restored, send access and portability requests to support@smarteating.ai. We respond within one month.
A complaint may be submitted to the Norwegian Data Protection Authority at www.datatilsynet.no. A patient in another EEA country may also contact the local supervisory authority.
13.Browser storage, changes and contact
The patient-facing Service and identity provider use cookies, local storage or similar technology needed for sign-in, session security, language and core settings. We do not use analytics, advertising or other non-essential cookies. If that changes, we will ask for your consent before setting them and update this notice.
13.1 Cookies and similar technologies on this website
We only use cookies and browser storage that are strictly necessary to deliver and protect this website, and to remember your cookie choice. These do not require consent (ekomloven § 3-15).
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
| __cf_bm | Cloudflare | Bot management: tells people and automated traffic apart | 30 minutes | Strictly necessary |
| __dpl | Lovable (website hosting) | Sends your request to the correct website deployment | About 7 days | Strictly necessary |
| smarteating_cookie_consent_v1 (local storage) | Smart Lifestyle | Stores your cookie choice and when you made it | Until you change your choice or clear site data | Strictly necessary |
You can change your choice at any time with the Cookie settings link in the website footer, or by deleting cookies and site data in your browser. This table covers the website smarteating.ai. The SmartEating app and sign-in use only the storage needed for sign-in, session security, language and core settings, as described above.
This notice will be updated when patient processing materially changes, and each update gets a new version number and date. Questions about a particular patient record should be directed to the clinic. Questions about Smart Lifestyle's own processing may be sent to support@smarteating.ai or Smart Lifestyle AS, c/o Christoffer Riseng Bølla, Strandvegen 107, 2315 Hamar, Norway. Data protection officer: David Øvrelid, dpo@smarteating.ai.
