Privacy Policy

VELMARX is a software platform for nutritionists, dietitians, personal trainers, fitness coaches and the clients they work with. It is operated by Marko Novaković, an individual based in Serbia, who is responsible for your personal information as described in this policy (“VELMARX”, “we”, “us”).

For anything about privacy, including requests to exercise your rights, write to info@velmarx.com.

VELMARX is used by two kinds of account holders. Professionals (nutritionists, dietitians, trainers and coaches) subscribe to VELMARX, invite clients and create plans for them. Clients are invited by a professional and use VELMARX free of charge to follow their plans and record their progress.

A professional who uses VELMARX to work with their own clients may have their own responsibilities for the information they collect and manage about those clients, for example under the rules of their profession or data protection law. Clients may want to read the professional's own privacy information as well.

Responsibilities are divided like this:

• VELMARX decides how and why (acts as controller) for account and sign-in data, subscriptions and billing, security, your cookie choices, privacy requests and emails you send us, and for health-related information you enter yourself with your explicit consent.
• The professional decides how and why (acts as controller) for the information they record and manage about their own clients, such as plans, check-in reviews, private notes and appointments. For that information VELMARX processes data on the professional's behalf, under the data processing terms in our Terms and Conditions.

Information you or your professional enter

• Account details: your name, email address and password. Passwords are handled by our authentication provider and stored only as a secure hash; VELMARX staff can't see them.
• Profile and settings: account type (professional or client), an optional profile photo, language, time zone, measurement units, theme and notification preferences.
• Professional profile: title, business name, short bio, country, website, years of experience and specialties (nutrition and/or fitness). These are self-reported and not verified by VELMARX.
• Connections: invitations (including the invited email address), the connection between a professional and a client, its status, and the client's sharing settings for progress, goals and habits.
• Plans and libraries: nutrition plans, meals, foods and recipes (including photos you upload or link), workout plans, sessions and exercises, templates, and published plan versions.
• Progress information: body measurements, performance records and notes, goals and their updates, habits and completions, weekly check-in answers, the professional's feedback, and the professional's private notes on check-ins.
• Communication and scheduling: messages between connected professionals and clients, appointments (times, type, location or meeting link, status, cancellation reasons), availability settings, and in-app notifications.
• Subscriptions (professionals): your plan, subscription status and dates, the amounts and status of invoices, and reference numbers from our payment provider. See Payments and Paddle.
• Early-access list: if you joined our early-access list, the email address and role you entered.
• Emails to us: what you send to info@velmarx.com.

Information collected automatically

• Sign-in and security records kept by our authentication provider, such as when you signed in and the email links sent to you.
• Technical request data: like any website, our hosting and database providers receive your IP address, browser and device details and the address of each page or request, and keep operational logs. VELMARX's own database doesn't store your IP address.
• Cookies and browser storage needed to keep you signed in and remember your choices. See the Cookie Policy.

We don't use analytics, advertising or tracking tools, and we don't buy information about you from others.

VELMARX can hold information about a person's diet, exercise, body measurements, goals and progress. Some of it may reveal something about a person's health. Where it does, data protection laws, including the GDPR and Serbia's Law on Personal Data Protection, may treat it as a special, more protected category of data. Not every nutrition or fitness record falls into that category; it depends on what the record reveals.

Please enter only what is needed for your coaching, and don't add unrelated medical details. Professionals should collect only what they need for the services they provide.

Your explicit consent. Before clients record measurements, check-in answers or goals, VELMARX asks for their explicit consent to process health-related information. Consent is separate from accepting the Terms, isn't pre-ticked, and can be withdrawn at any time in Settings → Privacy & data. After withdrawal you can't add new measurements, check-in answers or goals, and your connected professionals stop seeing the progress and goals you shared; what you entered before stays until you ask us to delete it. Withdrawing doesn't affect processing that took place before.

Information that professionals record about their clients is processed on the professional's instructions and under their own legal basis and professional duties.

• A professional can see the clients connected to them and the information those clients share with them, and only while the connection is active or paused.
• Clients choose whether their progress entries, goals and habits are shared with each connected professional.
• Clients see the plans a professional has published to them, not drafts or templates.
• Messages are visible only to the people in that conversation.
• Other clients and unrelated professionals can't see your private records. These rules are enforced in the database itself, not only in the app's screens.
• The operator of VELMARX can technically access the database to run, secure and support the service, and accesses personal information only when needed for those purposes or when required by law.

We use personal information to:

• create and run your account and sign you in securely;
• provide the features you use: plans, libraries, progress tracking, check-ins, messages, appointments and notifications;
• let professionals and their clients work together as they choose;
• administer professionals' subscriptions, free trials and the free plan;
• keep the service secure, prevent abuse and fix problems;
• answer your questions and privacy requests;
• meet legal obligations, such as keeping billing records where the law requires it.

Where laws such as the GDPR or Serbia's Law on Personal Data Protection apply, we rely on these legal bases:

• Performing our contract with you: running your account and the features you use, connecting professionals and clients, administering subscriptions, trials and the free plan, and answering your requests.
• Our legitimate interests: keeping VELMARX secure, preventing abuse and fraud, and fixing problems. We weigh these against your interests, and you can object.
• Legal obligations: keeping records the law requires and responding to lawful requests.
• Explicit consent: health-related information that clients enter themselves (see above).
• Consent: optional cookies, if we ever use any.

Accepting our Terms is not treated as consent to anything else.

We don't sell or rent personal information. We share it only with:

• the people you work with in VELMARX, as described in “Who can see what”;
• service providers who run parts of VELMARX for us, listed below;
• authorities or others where the law requires it, or where needed to protect people's safety or our legal rights.

Recipe photos can also be added as a link to another website. When such a photo is shown, your browser loads it from that website, which then receives your IP address. We send no referrer information with these requests.

We have data processing terms in place with Supabase, Vercel and Hostinger. Paddle acts as an independent seller (merchant of record) and processes your billing information under its own privacy policy.

VELMARX subscriptions are sold by Paddle, which acts as merchant of record: Paddle is the seller of the subscription, runs the checkout, takes payments, handles sales tax and issues invoices, and provides a billing portal for managing payment methods.

• Card and other payment details are entered directly into Paddle's checkout. VELMARX never receives or stores full card numbers or security codes.
• We send Paddle your email address (pre-filled in the checkout, which you can change), the plan and price you chose, and internal reference numbers that link the payment to your VELMARX account.
• Paddle tells VELMARX about your subscription through signed notifications: its status, plan, billing period and invoice amounts. We store those together with Paddle's reference numbers for your customer record, subscription and transactions.
• Paddle also processes your information for its own purposes, such as fraud prevention, tax and its legal obligations, as described in Paddle's Privacy Policy.

VELMARX's database is hosted in the European Union (Frankfurt, Germany). The website's server functions run in the United States, so information you send or view passes through servers there. Our other providers may process information in other countries.

Where information leaves the EEA or Serbia, the transfer is covered by the European Commission's standard contractual clauses included in our providers' data processing terms.

• Account and service information is kept while your account is open, so you and the people you work with can use it.
• When a connection between a professional and a client ends, the professional can no longer see the progress, goals and habits the client shared, and the client no longer sees that professional's plans. The records themselves stay in the accounts that hold them until deletion is requested.
• When you ask us to delete your account, we delete or anonymise its personal information within 30 days, except what we must keep by law. Copies in backups are removed when those backups expire on our database provider's schedule.
• Subscription and invoice references are kept for as long as accounting and tax law requires. Paddle keeps its own billing records as the seller.
• Records of privacy requests and consent are kept for 3 years, so we can show how requests were handled.
• Early-access list entries are deleted 12 months after VELMARX's public launch.
• Operational logs kept by our hosting and database providers are kept only for their limited standard periods.
• Cookie choices are kept for 12 months in your browser.
• Emails to us are kept as long as needed to deal with your request.

Depending on the law that applies to you, you may have the right to:

• access the personal information we hold about you and get a copy;
• correct inaccurate information (most of it you can edit directly in the app);
• receive your information in a portable format;
• have your information deleted;
• restrict or object to certain processing;
• withdraw consent at any time where we rely on consent, without affecting earlier processing.

Signed-in users can download a copy of their information and send privacy requests from Settings → Privacy & data. You can also write to info@velmarx.com from the email address on your account. We may need to confirm your identity, and we'll answer within the time the law requires.

If you're a client and your request concerns information your professional manages, we may involve that professional where appropriate.

You can also complain to a data protection authority, for example the one where you live or work. In Serbia this is the Commissioner for Information of Public Importance and Personal Data Protection. We'd appreciate the chance to address your concern first.

We use only the cookies and browser storage needed to run VELMARX, such as keeping you signed in. We don't use analytics, advertising or tracking cookies. Details are in the Cookie Policy, where you can also change your cookie settings.

We protect information with encrypted connections (HTTPS), access rules enforced in the database for every record, hashed passwords, private storage for profile photos and limited access to systems. Payment details are handled by Paddle. No system is completely secure, so we can't guarantee absolute security. Please use a strong, unique password and tell us at info@velmarx.com if you notice anything suspicious.

VELMARX is designed for adults: professionals and their adult clients. It isn't directed at children.

You must be at least 18 years old to create an account. We don't knowingly collect information from anyone younger.

If you believe a child has given us personal information, contact info@velmarx.com and we'll look into it.

VELMARX doesn't make decisions about you based solely on automated processing, and doesn't profile you for advertising. Nutrition totals and progress charts are calculations shown to you and your professional, not decisions.

We'll update this policy when the service or the law changes. The date at the top shows the latest version. For significant changes we'll give notice in the app or by email before they take effect.

Questions or requests about privacy: info@velmarx.com.