Your data stays between you and your coach

Desi Nordic Lifestyle is run by Jayesh Khatri and Katharina Khatri, a sole trader business (enskild firma) registered in Sweden. Email: hello@desinordic.com. We are the data controller for the personal data described here, under the EU General Data Protection Regulation (GDPR) and Swedish data protection law.

Write to the email above for anything about your data. We reply within one month, usually much sooner.

• Your account — name, email, password (stored hashed by our database provider; we never see it), profile photo if you add one, and your timezone so times and emails show in your local time. Why: to run your account. Legal basis: contract.
• Bookings — the name, date of birth, email and message you give when booking, the time you pick, and the call link. Why: to hold the session and prepare for it. Legal basis: contract.
• Health information — sex, birth year, height, weight, body measurements, activity level, goal, diet, allergies, food and calorie logs, weekly check-ins and anything you write in notes. Why: to work out your targets, track your progress and coach you. Legal basis: your explicit consent (GDPR Art. 9(2)(a)). We only store it after you tick the box agreeing to it, and you can withdraw that consent at any time on your Profile page — we then delete it.
• Payments and orders — what you bought, the amount, currency and date, and Stripe’s payment reference. Card and UPI details go straight to Stripe; we never see or store them. Why: to deliver what you paid for and to keep accounts. Legal basis: contract, and our legal obligation under the Swedish Bookkeeping Act.
• Things you choose to share — recipe ratings, meal plans and coach applications. If you send us a testimonial, we publish it only with your permission and under the name you choose. Legal basis: contract or consent, as applies.
• Contact messages — the name, email and message you send through the contact form. It reaches us as an email and isn’t stored on the site. Why: to answer you. Legal basis: legitimate interest in replying to people who write to us.
• Emails we send — booking and payment confirmations, reminders and replies to your check-ins. We don’t send newsletters or marketing emails. Legal basis: contract.
• Site usage — anonymous page-view counts (no cookies, no personal profile) and technical logs kept by our host for security. Legal basis: legitimate interest in running a safe, working site.

We don’t sell your data, we don’t use it for advertising, and we don’t make automated decisions about you.

Only the two of us. The coach you book with sees your booking details, and if you’re a member or have shared your progress, your health information and check-ins. Nobody else works on the site.

We use a small number of service providers, each under a data processing agreement:

• Supabase — database, file storage and login.
• Vercel — hosting and cookieless, anonymous page-view analytics.
• Stripe — payments by card and UPI. Stripe is also an independent controller for fraud prevention; see Stripe’s privacy policy.
• Resend — sending our emails.
• Google — Google Meet links for video calls, created from our own Google accounts. On the call itself, Google’s terms apply.

Some of these companies are based in, or may access data from, the United States or other countries outside the EU/EEA. Where they do, the transfer is covered by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

• Account and health information: for as long as you have an account. Health data is deleted when you withdraw consent.
• Bookings and messages: as long as you have an account, then deleted.
• Orders and receipts: 7 years after the end of the financial year, as the Swedish Bookkeeping Act requires — even if you delete your account.
• Server logs: kept by our host for a short period (days to weeks), then deleted automatically.

You can ask us to:

• give you a copy of the data we hold about you, in a portable format;
• correct anything that’s wrong (most of it you can edit yourself on your Profile and Progress pages);
• delete your data or your whole account;
• restrict or object to how we use it;
• withdraw consent — this doesn’t affect what we did before you withdrew it.

Email hello@desinordic.com. We may ask you to confirm it’s really you. If you’re unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY) or the data protection authority where you live.

If you live in India: you have the rights given by the Digital Personal Data Protection Act, 2023, including access, correction, erasure and naming a nominee. Our grievance contact is hello@desinordic.com; if we don’t resolve your complaint you may go to the Data Protection Board of India.

We only use what’s needed for the site to work, so we don’t show a cookie banner:

• Login cookies from Supabase that keep you signed in.
• Your theme choice (light or dark), stored in your browser’s local storage.
• Stripe’s checkout sets its own cookies for fraud prevention when you pay.

Our analytics don’t use cookies. We have no advertising or social media trackers.

Desi Nordic Lifestyle is for adults. You must be 18 or older to create an account or book a session.

Data is encrypted in transit (HTTPS) and at rest with our providers, access is limited by database rules so each person only sees their own data, and only the two of us have admin access. If a breach ever puts your data at risk, we will tell you and IMY as the law requires.

If we change how we use your data, we’ll update this page and the date at the top, and tell you by email or on the site before a significant change takes effect. See also our Terms and Conditions.