# Metabolic Nutrition Pro — IT / Corporate classification reference # https://metabolicnutritionpro.com/it # For corporate IT teams, URL categorization (Zscaler, etc.) and firewall allowlists. Category: Business / Healthcare Information Technology / Medical Software (B2B2C SaaS) Not: - Dietary supplements - Standalone consumer diet apps - E-commerce - Social media - File sharing - VPN/proxy Model: B2B professionals (subscribers) + B2C patient portal under professional clinical supervision Canonical-domain: metabolicnutritionpro.com Authorized-domains: - metabolicnutritionpro.com - www.metabolicnutritionpro.com - metabolicnutritionpro.cl - profesionales.metabolicnutritionpro.com - nutriplan.metabolicnutritionpro.com ## Service classification Metabolic Nutrition Pro is a B2B2C healthcare SaaS platform for clinical nutrition planning. Licensed healthcare professionals (B2B) create plans; patients access the portal via professional-issued links (mediated B2C). NOT related to the dietary supplement brand "Metabolic Nutrition". NOT related to "MetabolicPro" software by GMDI. ## Legal entity Commercial name: Tecnologías Helse SpA Legal name: SERVICIOS INFORMATICOS HELSE SPA RUT: 78.307.355-2 Country: Chile Security / IT contact: security@metabolicnutritionpro.com Support contact: soporte@metabolicnutritionpro.com Privacy contact: privacidad@metabolicnutritionpro.com ## Authorized domains (same owner) metabolicnutritionpro.com — Canonical web, documentation, /it page (browser allowlist: yes) www.metabolicnutritionpro.com — Primary domain alias (browser allowlist: yes) metabolicnutritionpro.cl — Alternate .cl domain, same owner; operational service on .com (yes) profesionales.metabolicnutritionpro.com — Professional app, login and workspace (B2B) (yes) nutriplan.metabolicnutritionpro.com — Patient portal, magic links, PWA (mediated B2C) (yes) Internal administration hosts and server-to-server callback hosts are NOT part of the customer product and must NOT appear in corporate browser allowlists. Contact security@metabolicnutritionpro.com or soporte@metabolicnutritionpro.com if your security questionnaire requires a full domain inventory. ## Corporate email Legitimate product email originates from @metabolicnutritionpro.com Domain email authentication: SPF, DKIM (Google Workspace and Amazon SES), DMARC quarantine (p=quarantine; pct=100). DMARC reports: security@metabolicnutritionpro.com ## Security headers (HTTP) HTML responses on the public domain and product subdomains send Content-Security-Policy in enforce mode (active browser blocking; not Content-Security-Policy-Report-Only only). Effective profile is exposed via X-CSP-Profile. ### CSP scope by host | Host | Mode | X-CSP-Profile values | |------|------|----------------------| | metabolicnutritionpro.com (apex, legal) | enforce | landing | | profesionales.metabolicnutritionpro.com | enforce | clinical, auth, commerce, public | | nutriplan.metabolicnutritionpro.com | enforce | intake, patient, doc_verify, demo | Profiles clinical, intake, patient and doc_verify exclude third-party marketing/analytics scripts. frame-ancestors restricts iframe embedding (e.g. 'none' on patient clinical views). ### Baseline headers (typical values) | Header | Value | |--------|-------| | Strict-Transport-Security | max-age=31536000; includeSubDomains; preload (public domain) | | X-Content-Type-Options | nosniff | | X-Frame-Options | SAMEORIGIN (public web) or DENY (applications) | | Referrer-Policy | strict-origin-when-cross-origin | | Permissions-Policy | camera=(), microphone=(), geolocation=() — camera=(self) only on nutriplan.*/p/* (patient QR scanner) | | Cross-Origin-Opener-Policy | same-origin-allow-popups (public web) | Common CSP directives: default-src 'self', object-src 'none', base-uri 'self', form-action limited to own origins. script-src and connect-src allowlists vary by profile — correlate with FQDN section below. ## Network requirements - Outbound HTTPS on port 443 - Session cookies on application subdomains - Cloudflare Turnstile (challenges.cloudflare.com) on login/registration — anti-abuse, not advertising - No browser plugins, VPN, or non-standard ports required ## Required for normal clinical use (browser) ### Product domains (all flows) metabolicnutritionpro.com www.metabolicnutritionpro.com metabolicnutritionpro.cl profesionales.metabolicnutritionpro.com nutriplan.metabolicnutritionpro.com ### Auth / login (profesionales + nutriplan intake) challenges.cloudflare.com accounts.google.com apis.google.com www.gstatic.com identitytoolkit.googleapis.com securetoken.googleapis.com ### Clinical workspace (profesionales — add to auth list) fonts.googleapis.com fonts.gstatic.com storage.googleapis.com ### Patient portal (nutriplan — add to auth list) fonts.googleapis.com fonts.gstatic.com storage.googleapis.com ### Marketing / analytics (optional — landing and commerce profiles only) *.googletagmanager.com *.google-analytics.com static.cloudflareinsights.com cloudflareinsights.com Note: Turnstile anti-abuse uses challenges.cloudflare.com only (not *.cloudflare.com). Firebase Auth uses specific googleapis.com subdomains (not *.googleapis.com). ## Payments only (if professional completes checkout in session) flow.cl www.flow.cl *.stripe.com ## Server-to-server (on request — not browser allowlist) Payment gateway callbacks and other integration hosts. Full inventory available on request from security@metabolicnutritionpro.com or soporte@metabolicnutritionpro.com. Note: Exact third-party dependencies may vary by browser, authentication flow, and payment method. For institutional pilots, the MNP team can provide a use-case-specific list — contact security@metabolicnutritionpro.com. ## Data and compliance (summary) Data controller: healthcare professional / clinic Data processor: Metabolic Nutrition Pro Data types: professional accounts, patient health data under professional instruction Data residency: clinical data stored in Google Cloud Platform, Chile region (southamerica-west1). Auxiliary operations and transactional email may be processed transiently in Brazil (southamerica-east1, AWS sa-east-1) without storing clinical records there. Details: https://metabolicnutritionpro.com/plataforma/privacidad#52-alojamiento-y-regiones-de-procesamiento-transparencia-de-transferencias Encryption: TLS 1.3 in transit; AES-256 at rest (cloud infrastructure) Privacy policy: https://metabolicnutritionpro.com/plataforma/privacidad DPA: https://metabolicnutritionpro.com/plataforma/terminos#511-acuerdo-de-procesamiento-de-datos-dpa---data-processing-agreement Legal hub: https://metabolicnutritionpro.com/legal HTML version: https://metabolicnutritionpro.com/it security.txt: https://metabolicnutritionpro.com/.well-known/security.txt Vulnerability disclosure policy: https://metabolicnutritionpro.com/security-policy Last-updated: 2026-07-12