Legal notice & privacy

Legal notice, terms of use and privacy policy of the practice.

Last updated: 20/08/2026

Policy version 2 — site facts and runtime behaviour verified on 20/08/2026.

This English translation is provided for information only. The French version at conseildietetique.lu/mentions-legales prevails in case of discrepancy.

4. Privacy policy (GDPR)

a. Data controller

The data controller is Gabriela Ferent, independent dietitian-nutritionist, licensed to practise in Luxembourg and affiliated with the CNS. Contact: dieteticienne@conseildietetique.lu (the CNS provider code appears in these legal information pages and on the dedicated administrative pages). No data protection officer (DPO) has been appointed: the practice is not required to designate one.

b. What this website actually collects

The site itself has no patient form and receives no medical record:

  • Your cookie choice (stored in your browser, never transmitted).
  • If you accept audience measurement: aggregated browsing data processed by Google Analytics (pages viewed, device, country, traffic source, truncated IP address).
  • If you write to us: the information you choose to include in your email or WhatsApp message.
  • Technical connection data required to serve the site (IP address, user agent), processed by the host and its delivery network.

Consultation data (history, measurements, nutrition plan) is collected at the practice, outside this website, as part of dietary care.

c. Purposes and legal bases

  • Serving and securing the site — legitimate interest (Article 6(1)(f) GDPR).
  • Storing your cookie choice — legal obligation to collect and document consent (Article 5(3) ePrivacy as transposed, Article 6(1)(c) GDPR).
  • Audience measurement — your consent (Article 6(1)(a) GDPR), withdrawable at any time.
  • Replying to an email, WhatsApp message or call — pre-contractual steps / legitimate interest in answering you (Article 6(1)(b) and (f) GDPR).
  • Consultation file created at the practice — performance of the care contract and legal obligations applicable to health professionals (Articles 6(1)(b), 6(1)(c) and 9(2)(h) GDPR).

d. Recipients and processors

Your data is never sold or traded. The third parties that may be involved are:

  • Lovable (site hosting) and its Cloudflare delivery network: technical delivery of the pages.
  • Google Ireland Ltd — Google Analytics, only after your consent, and Google Maps, only when you press “Show map”. The site typography is self-hosted, so no font request reaches Google.
  • Doctena Luxembourg S.A. — only if you click “Book an appointment” and leave this site.
  • Meta Platforms Ireland Ltd — only if you open the WhatsApp conversation.

We do not publish the detail of our processing contracts and cannot vouch on your behalf for these providers' internal practices; their own privacy policies govern what they process.

e. Transfers outside the European Union

Three separate processing activities must be distinguished. (1) Hosting and delivery of the site are necessary for it to work: they rely on the Lovable platform and the Cloudflare delivery network, whose infrastructure may be located outside the European Union, in particular in the United States. This processing takes place even if you decline every optional service. (2) Audience measurement is activated only with your consent: declining it prevents that optional processing and the transfers specific to it. (3) Google Maps loads only if you press “Show map”: not displaying the map prevents that embedded service from loading. These providers state that their transfers rely on the Chapter V GDPR mechanisms (standard contractual clauses and/or the EU–US Data Privacy Framework). We do not hold the detail of their infrastructure or any additional contractual guarantee: declining the optional services therefore does not allow us to state that browsing this site involves no transfer outside the European Union.

f. Retention periods

  • Cookie choice: 6 months maximum, then you are asked again.
  • Google Analytics audience measurement: 14 months maximum on Google's side, aggregated data.
  • Emails and messages received: as long as needed to handle your request, then 3 years maximum if no consultation takes place.
  • Consultation file created at the practice: 10 years, in line with the obligations applicable to health professionals.
  • Technical hosting and delivery logs: retention periods are set by those providers and are not disclosed to us.

g. Is providing data required?

No data is required to browse this site: refusing audience measurement restricts no feature. To book or to get an answer, the information you provide is necessary — without it the request cannot be handled. For CNS coverage, some information is required by regulation.

h. Automated decision-making and profiling

No automated decision producing legal effects or similarly significantly affecting you is taken, and no profiling is carried out. The interactive tools on this site (calculators) run entirely in your browser: their results are never transmitted, recorded or retained.

i. Your rights

Under Articles 15 to 22 GDPR you have the following rights:

  • Access, rectification, erasure.
  • Restriction of and objection to processing.
  • Portability of the data you provided.
  • Withdrawal of consent at any time, as easily as it was given, via “Manage cookies” at the bottom of every page.

To exercise your rights: dieteticienne@conseildietetique.lu

You may lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15 boulevard du Jazz, L-4370 Belvaux — www.cnpd.lu

j. Medical documents and health data

This website has no patient form, receives no clinical data and provides no secure channel for transmitting medical documents. Ordinary email and WhatsApp are not suitable for lab results, reports or prescriptions.

Patients: bring your documents to your appointment, hand them over at the practice, or use a method explicitly agreed with the practice. Health professionals: contact the practice by telephone or email to agree an appropriate transfer method before sending any clinical document.

k. Scope of this policy

The information above concerns the public website. Four separate sets must not be confused:

  • Public website data: your cookie choice, technical delivery data and, after consent, audience measurement.
  • Messages you voluntarily send through external communication services (email, WhatsApp, telephone): these are processed by those services under their own terms, outside this website.
  • The consultation file created at the practice: it is kept outside this website, as part of dietary care and professional secrecy.
  • Processing carried out by the laboratory for the optional nutrigenetic test: it is governed by the laboratory and its own privacy policy, provided before any participation.

What is described for the public website therefore does not automatically extend to those other processing activities.

Cookies and trackers

No audience-measurement tool, no Google map and no external tracker loads before your consent. Refusing prevents neither browsing the site, nor reading the addresses, nor booking. This site uses no advertising tracker, so there is no “marketing” category.

Full inventory of cookies and data stored in your browser — verified on 2026-08-20.
NameProviderCategoryDurationPurpose
cookie-consentConseil Diététique Luxembourg (first party)Strictly necessary6 monthsStores your cookie choice and its version so you are not asked again on every visit.
cd-reload-onceConseil Diététique Luxembourg (first party)Strictly necessarytab sessionPrevents a reload loop when an application file fails to download.
_ga, _ga_*Google Ireland Ltd / Google LLC (Google Analytics 4)Audience measurement (consent)up to 13 monthsAggregated audience measurement (pages viewed, device, source). Set only after your consent.
__cf_bmCloudflare, Inc. (hébergement / CDN)Strictly necessary30 minutesBot protection set by the delivery network hosting the site. Required for site availability.
Third-party services that may be contacted, and the exact trigger for each call.
ServiceDomains contactedWhen it loads
Hébergement et réseau de diffusion (Lovable / Cloudflare, Inc.)conseildietetique.lu, www.conseildietetique.luHosting infrastructure that serves the pages, images and fonts (the fonts are self-hosted on this site, no longer on Google Fonts). It processes your IP address to deliver the site and protect it from bots.
Google Analytics 4 (Google Ireland Ltd)www.googletagmanager.com, www.google-analytics.com, region1.google-analytics.comLoaded only after you consent to audience-measurement cookies.
Google Maps (Google Ireland Ltd)www.google.com, maps.googleapis.com, maps.gstatic.comNo map loads automatically. A map is shown only if you click “Show map” for one specific practice; Google then receives your IP address. Addresses and directions stay usable without the map.
Doctena (Doctena Luxembourg S.A.)www.doctena.luNo Doctena script is embedded on the site. Booking is a plain link: you leave this site and Doctena's privacy policy then applies.
WhatsApp (Meta Platforms Ireland Ltd)wa.meNo WhatsApp script is embedded. The button is a link: the conversation happens inside WhatsApp, under Meta's privacy policy.

You can change or withdraw your consent at any time via “Manage cookies” at the bottom of every page — withdrawing is as easy as accepting. Withdrawal deletes the analytics cookies already set and reloads the page so no further data is sent.

To learn more about your rights and the cookie rules applicable in Luxembourg: Commission nationale pour la protection des données (CNPD), cnpd.public.lu.