Last updated: 28 September 2026 · Version 2.1
The short version
- We hold your name, email, mobile number, date of birth, your food likes and dislikes, your allergies and intolerances, any religious or ethical requirements, your calorie target, and whether you told us you have a health condition — never what that condition is.
- If you send us a photo of your food, we read it to name the food and then discard it. We do not keep your photos. WhatsApp and our AI provider each keep their own copy for up to 30 days under their own policies, and we cannot shorten that.
- If you send us a voice note, it is turned into text on our own server — the recording never leaves our machine, is not sent to any other company, and is not kept. Every reply starts by showing you what we heard, so you can correct any mishearing. The text of what you said is kept in your message record like any typed message; WhatsApp keeps its own copy of the recording under its own policy.
- We use your date of birth to check you're 18 or over — and to send you a happy-birthday email once a year. If you'd rather we didn't, tell us and we'll stop.
- We keep a record of every message we send you, including the safety warnings, so we can answer a question or a complaint later. We keep that for six years.
- The website itself still uses no cookies and no third-party analytics or trackers.
- When you arrive through one of our links, we record which link or post brought you as a short code (for example ig-bio), with the time, whether it was a phone or a computer, and how many of the four sign-up steps were reached — no cookies, no IP address, nothing that identifies you. If you sign up, that code and your answer to the optional “How did you hear about us?” question are kept with your account.
- Your allergies and health-related information get extra legal protection, and we only store them if you explicitly agree.
- We never sell your data. Not to anyone, at any price.
- You can get a copy, correct it, or have it deleted, whenever you like.
- We delete everything 60 days after you cancel, automatically.
Who we are
MyPlatePrep is a service of MY PLATE PREP LTD, a company registered in England and Wales, company number 17395576. Our registered office is Unit 6 Whitewall Road, Medway City Estate, Rochester, England, ME2 4LQ. You can reach us any time at info@myplateprep.com.
In data protection language we are the controller of your personal data — we decide what is collected and why, and we're responsible for looking after it.
We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator — registration reference ZC220881. You can check it yourself on the ICO's public register at ico.org.uk.
What we collect today
Right now MyPlatePrep is a launching-soon website. Visiting it collects no personal data whatsoever:
- No cookies. None at all — not even "essential" ones.
- No third-party analytics. We don't use Google Analytics, Meta Pixel, or any other tracking service. We only count which of our own links people arrive from, as described above.
- No sign-up. There's no account to create and no payment to make.
- The preview quiz saves nothing. It runs entirely in your browser; your answers never leave your device and are gone when you close the tab.
If you choose to email us, we'll obviously have your email and whatever you wrote. We keep those messages while we're dealing with your enquiry and for a reasonable period after, then delete them.
Our website is delivered by Cloudflare, which processes visitors' IP addresses briefly for security and to serve pages. That's ordinary infrastructure, it isn't tracking, and we can't identify you from it.
What we'll collect when the service launches
This section describes how MyPlatePrep will work once subscriptions open. We're publishing it now so you can read it before you decide anything.
Information you give us
- Contact details — your email address, and your mobile number if you want to use WhatsApp.
- Your goals — what you're trying to achieve, and your rough activity level.
- Your food preferences — what you like, what you won't eat, whether you're vegetarian, vegan, halal, gluten-free, and so on.
- Your allergies and intolerances — so every suggestion avoids them.
- Anything else you tell your coach — because it's a conversation, you might mention your weight, how you slept, or that you had two pints at the match.
Information created by using the service
- Your message history with the coach, so it remembers what you've discussed.
- The meal plans and shopping lists generated for you.
- Your subscription status and billing dates.
What we deliberately don't collect
- Your card details. Payments are handled by Stripe. Your card number goes to them, never to us — we can't see it and we don't store it.
- Your location. We don't ask for it or track it.
- Your contacts, photos, or anything else on your phone. There's no app, so there's nothing to grant access to.
Health information, and why it's treated differently
Your allergies, intolerances, weight and dietary needs are special category data under UK GDPR — the same protected class as medical records. That means we need your explicit consent to hold them, separately from you simply agreeing to the service.
So at sign-up we'll ask you, in plain words, for permission to store your allergy and health-related information for the purpose of planning your meals. You can say no — but be aware that without your allergy information we genuinely cannot suggest food safely, so we'd have to decline to provide the service rather than guess.
You can withdraw that consent at any time by emailing us, and we'll delete the information. Withdrawing it will end your subscription, for the same safety reason.
MyPlatePrep is not a medical service. We don't diagnose, treat or manage medical conditions. If you tell us something that needs a professional — a pregnancy, an eating disorder, diabetes, anything clinical — the coach will stop and point you to proper help rather than pretend. We keep a record that this happened so we can check our safety systems are working.
Our legal bases
UK GDPR requires us to have a specific legal reason for every use of your data. Ours are:
- Performance of a contract — for your contact details, subscription and message history. We can't run the service you're paying for without them.
- Explicit consent — for your allergies and health-related information. This is the extra permission described above, and you can withdraw it.
- Legitimate interests — for keeping the service secure, preventing abuse, and reviewing quality. We've considered your rights and think you'd expect this; you can object.
- Legal obligation — for keeping financial records HMRC requires.
Who else sees your data
We use a small number of established suppliers to run the service. They act on our instructions and can't use your data for their own purposes.
- Meta (WhatsApp) — carries your WhatsApp messages, exactly as it does for every WhatsApp conversation you have.
- Anthropic — provides the AI that writes your coaching replies. Your messages are processed to generate a response. Anthropic does not use business API data to train its models.
- Amazon Web Services — sends our emails.
- Stripe — takes payments and holds your card details, as a controller in their own right.
- Cloudflare — serves the website and routes our email.
Your conversations and meal plans are stored on our own hardware in the United Kingdom, not on a rented cloud server.
We do not sell your data, share it with advertisers, or hand it to data brokers. We would only ever disclose it if the law required it — a court order, for example — or to protect someone from serious harm.
Data leaving the UK
Some of those suppliers are based in the United States. Where your data goes there, the transfer is covered by the UK's approved safeguards — the International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework — which give you broadly the protection you'd have at home. You can ask us for details of the safeguards for any particular supplier.
How long we keep things
- While you're a subscriber — we keep your profile and conversation history so the coach remembers you.
- After you cancel — everything is deleted 60 days later. The delay is so you can change your mind and pick up where you left off.
- Financial records — kept 6 years, because HMRC requires it. This is invoice and payment information, not your food data.
- Safety records — where the coach escalated something serious, we keep a minimal record for 12 months so we can audit our safeguards.
Keeping it safe
- Everything in transit is encrypted, and our own server isn't reachable from the open internet except through one locked-down verified channel.
- Every incoming message is cryptographically checked before it's accepted, so nobody can impersonate a customer.
- Access is limited to the owner. There are no staff accounts to compromise.
No system is perfect. If a breach ever put your rights at risk, we'll tell the ICO within 72 hours and tell you without undue delay — in plain language, saying what happened and what to do.
Your rights
Under UK GDPR you can ask us to:
- Give you a copy of everything we hold about you.
- Correct anything that's wrong.
- Delete it — the "right to be forgotten".
- Restrict how we use it while a dispute is sorted out.
- Port it — receive it in a machine-readable file to take elsewhere.
- Object to processing based on legitimate interests.
- Withdraw consent for your health information at any time.
Email info@myplateprep.com and we'll respond within one month. It's free, and you don't have to give a reason.
Automated decisions
Your meal plans and coaching replies are generated automatically by AI, and we tell you that everywhere rather than pretending there's a person typing. These are suggestions about food — they don't produce legal effects or similarly significant consequences for you, so the strict rules on automated decision-making don't bite. You can always ask a human to look at something by emailing us, and the owner reviews the service's quality regularly.
Children
MyPlatePrep is for adults aged 18 and over only. We don't knowingly collect data from anyone under 18, and if we discover we have, we'll delete it immediately. The coach is built to stop and refuse if someone indicates they're under 18.
Marketing
We'll email you about your own service — your plans, your billing, changes to how things work. That's not marketing, it's the product.
We'll only send you promotional email if you've asked for it, and every one carries a one-click unsubscribe that we honour immediately.
Changes to this notice
If we change anything significant, we'll email subscribers before it takes effect rather than quietly editing this page. The version number and date at the top always tell you which version you're reading.
Complaining
Please come to us first — info@myplateprep.com — because most things are fixable in an email.
If we don't put it right, you can complain to the Information Commissioner's Office, the UK's independent data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. Complaining to them doesn't cost you anything.