Privacy Policy

Last updated: October 2026 · Version 3.1

1. About this policy

Yummbak is a nutrition and symptom tracking tool used by registered dietitians and by the clients they invite to track between appointments. This policy explains how we collect, use, share and protect information.

We act in two roles, and it matters which one applies to you

For your dietitian. When you track through Yummbak at your dietitian's request, your dietitian decides what you are asked to record and for how long. They are responsible for your clinical records, and we hold and process that information on their behalf, on their instructions. If you want to see, correct or question what is in your clinical record, ask your dietitian first. We will help them answer you.

In our own right. You also hold your own Yummbak account, so we deal with you directly for things like signing in, your profile, reminders you have opted into, and support. We are directly responsible for that, and this policy is the main description of how we handle it.

Yummbak is operated from Auckland, New Zealand. It is currently in a private beta with selected New Zealand dietitians, and your dietitian will tell you that when they invite you.

2. Getting in touch

You can contact us at any time to ask a question, update your information, exercise any of your rights, or raise a concern.

Our Privacy Officer can be reached at privacy@yummbak.com. That is the best way to contact us about anything in this policy.

3. What we collect

Account information

Your name, email address, phone number, date of birth, and sex where you give it, which is used for nutrient reference values.

Profile information (optional)

Height, weight, activity level, dietary preferences and restrictions, and any health conditions you choose to record.

Health information

Your meal logs including photos, symptom logs, bowel movement logs, and fluid logs. This is health information under the Health Information Privacy Code 2020.

Your tracking plan

Which dietitian invited you, what they have asked you to record, for how long, and why.

Messages

If you choose to log through WhatsApp, the messages you exchange with Yummbak.

Technical information

Basic information needed to keep the service running and secure, such as device and browser type.

4. How we use it

We use your information to run the service: to record what you log, estimate nutrition from it, show it to you and to your dietitian, send reminders you have opted into, and keep the service secure and working.

We also use de-identified information, which has had everything identifying removed, to improve how Yummbak works. We do not attempt to re-identify it. Separately, while Yummbak is in beta, your dietitian may tell us how useful it was in your care, and that feedback can identify you to us. We use it only to improve Yummbak, we do not share it, and we delete it when the beta ends.

Our own access is limited. Running Yummbak does not mean reading what you log. We access your information only where we need to in order to provide the service to your dietitian, to investigate or fix a technical problem, to create the de-identified information described above, or where the law requires it.

We do not sell your information, use it for advertising, share it for marketing, or allow it to be used to train AI models.

5. Who can see your information

Your dietitian can see what you log, your profile, your daily and weekly totals, and which days you logged. That is the point of the tool.

Where your dietitian works in a clinic, the clinic owner and the clinic's administrative account can also reach the records of clients in that clinic, in the same way they can reach any other record the practice holds. No practitioner outside your clinic can see anything.

Other than that, we do not share, sell or rent your information to anyone without your permission, unless we are required to by law.

6. Service providers

We use a small number of third-party services to run Yummbak, such as our database, hosting, meal photo analysis and email delivery. They are based in Australia, Singapore, the United States and the European Union, and they may use your information only to provide that service to us, and for nothing else.

Each one is bound by a data processing agreement requiring protections comparable to those New Zealand law requires. A current list of the services we use, what each one receives, and where it operates, is published at yummbak.com/privacy/service-providers.

7. Where your information is held

Your records and your meal photos are stored in Sydney, Australia, encrypted, in a database where access is enforced per account so no one can reach another person's records. Photos are kept in private storage reachable only through links that expire after an hour.

Some of the services listed above process information outside Australia and New Zealand in order to do their job. That is covered by the agreements described in section 6.

8. Security

Your information is encrypted in transit and at rest. Access is enforced per account at the database level, so no account can reach another person's records. Meal photos are held in private storage, reachable only through links that expire after an hour.

We monitor the service for technical errors so that problems are found rather than missed, and that monitoring is configured to collect no personal or health information. Access to live information is limited to authorised people, and every service provider we use is bound by a data processing agreement.

9. Keeping and deleting your information

Your dietitian is required to keep your clinical records for at least 10 years from when they last provide you with services, under the Health (Retention of Health Information) Regulations 1996. We hold those records on their behalf for that period.

You can delete your account at any time from your profile in the app, or by emailing us. Your name, email address and phone number are permanently removed. What you logged stays with your dietitian as part of your clinical record, no longer linked to your identity. Deleting your account cannot be undone.

10. Your rights

Under the Privacy Act 2020 and the Health Information Privacy Code 2020 you can ask to see the information held about you, have it corrected, ask for it to be deleted, withdraw your consent, and complain.

For your clinical records, ask your dietitian, who holds them. We will support them in answering you.

For your Yummbak account, you can change your profile and delete your account in the app, or email privacy@yummbak.com. We will respond as soon as we reasonably can and within 20 working days at the latest.

11. If something goes wrong

If a privacy breach happens that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected, as the Privacy Act 2020 requires. Where the information concerned is part of a dietitian's clinical records, we will notify the dietitian so they can respond to their clients, and support them in doing so.

12. Age

You must be 16 or older to hold a Yummbak account. We do not knowingly collect information from anyone under 16.

13. Yummbak is not medical advice

Yummbak is a tracking tool. It does not diagnose, does not determine cause, and does not replace your dietitian's or your doctor's judgement.

Talk to your dietitian or doctor before changing your diet, medication or treatment.
Nutrition estimates are approximate.
Symptom and bowel logs are records of what you observed, not clinical assessments.

14. Changes to this policy

We may update this policy as Yummbak develops. If a change is material we will tell you in the app or by email at least 14 days before it takes effect.

15. Questions and complaints

Email privacy@yummbak.com. This is the best way to reach us.

If we have not resolved your concern, you can contact the Office of the Privacy Commissioner at privacy.org.nz.