Privacy Policy
Wellbeing and Nutrition provides nutritional therapy, wellbeing coaching and holistic grief coaching services.
Wellbeing and Nutrition respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains what information I collect, how I use it, who I may share it with, how I keep it secure and your rights in relation to your personal information.
1. WHO I AM
The data controller responsible for your personal information is:
Wellbeing and Nutrition
Vanessa May
vanessa@wellbeingandnutrition.co.uk
As a sole practitioner, I am responsible for deciding how and why your personal information is processed.
If you have any questions about this Privacy Policy or how your information is handled, please contact me using the details above.
2. HOW I OBTAIN YOUR PERSONAL INFORMATION
You may provide personal information to me in a number of ways, including:
contacting me by email or telephone;
making an enquiry about my services;
booking or attending a consultation;
completing a terms of engagement form;
completing a client questionnaire;
providing information during a consultation;
providing information by email;
subscribing to my newsletter; or
purchasing or making payment for a service.
I may also receive information from you in the form of relevant test or laboratory results where you choose to provide these as part of your consultation.
3. WHAT PERSONAL INFORMATION I COLLECT
Depending on the service you request, I may collect and hold information including:
your name;
contact details, such as email address and telephone number;
appointment and consultation information;
information relating to payments;
dietary, lifestyle and wellbeing information;
health information that you choose to provide;
information about symptoms, medical history and relevant health conditions;
information about medication and supplements;
information about allergies or dietary requirements;
relevant test or laboratory results;
consultation notes and recommendations;
correspondence between you and me; and
information relating to your use of my website, including technical information and, where applicable, cookie and analytics information.
I aim to collect only information that is relevant and necessary for the purposes described in this Privacy Policy.
Wellbeing and Nutrition is registered with the Information Commissioner’s Office (ICO)
4. HEALTH INFORMATION
Some of the information you provide to me may concern your physical or mental health.
Under UK data-protection law, information concerning a person’s health is classed as special category data and receives additional protection. This includes information such as medical history, symptoms, medication, treatment and test results.
I may need to collect and process relevant health information in order to provide nutritional therapy and related services, understand your individual circumstances, make appropriate recommendations and maintain accurate client records.
I will only collect and use health information where it is relevant to the service you have requested or where there is another appropriate lawful basis for doing so.
I will treat health information as confidential and take appropriate steps to protect it from unauthorised access, loss or disclosure.
5. WHY I USE YOUR PERSONAL INFORMATION
I may use your personal information to:
respond to enquiries;
arrange and manage consultations and appointments;
provide nutritional therapy and related wellbeing and grief support services;
understand your individual circumstances and nutritional needs;
provide personalised advice and recommendations;
maintain accurate and appropriate client records;
communicate with you about your consultations and services;
process payments and maintain financial records;
send newsletters and other marketing communications where you have subscribed or where I otherwise have a lawful basis to do so;
maintain the security and proper functioning of my website and systems;
meet professional, legal, regulatory, insurance and accounting requirements;
deal with complaints or enquiries; and
establish, exercise or defend legal claims where necessary.
6. LAWFUL BASIS FOR PROCESSING YOUR INFORMATION
I will only process your personal information where I have a lawful basis to do so under UK data-protection law.
Depending on the circumstances, this may include:
Contract
I may process your personal information where this is necessary to provide a service you have requested or to take steps at your request before providing that service.
Legitimate interests
I may process information where this is necessary for my legitimate interests, provided that these interests are not overridden by your rights and interests.
This may include maintaining appropriate business and client records, managing my practice, maintaining the security of my systems and dealing with legal or professional matters.
Legal obligation
I may process information where this is necessary to comply with a legal or regulatory obligation.
Consent
Where I rely on consent as the lawful basis for processing, I will ask you for consent where appropriate.
You can withdraw consent at any time where processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Health information
For client health information processed as part of providing nutritional therapy and related services, this includes processing that is necessary for the provision of health or social care, where the relevant legal requirements and safeguards apply.
I will only process health information where it is necessary and appropriate for the purposes described in this Privacy Policy.
7. CONFIDENTIALITY
Information you provide during consultations is treated as confidential.
I will not normally disclose information about you to another person or organisation without an appropriate lawful basis.
There are circumstances in which I may need to disclose information without your consent, for example where I have a legal obligation to do so, where disclosure is necessary to protect someone’s vital interests, or where disclosure is necessary to establish, exercise or defend legal claims.
Where information needs to be shared, I will aim to share only the information that is reasonably necessary for the relevant purpose.
8. CLIENT RECORDS
I maintain appropriate records of consultations and the services provided to you
Client records may include:
your personal and contact information;
your case history;
relevant health information;
your consent to assessment and care where applicable;
assessments and information provided during consultations;
recommendations and advice given;
relevant test results provided by you; and
correspondence relating to your care or services.
Some notes may initially be recorded on paper during or following a consultation. Relevant information may then be transferred to an encrypted electronic document.
I take reasonable steps to ensure that client records are accurate, confidential and secure.
9. how long i keep client recordS
In accordance with the professional record-keeping requirements and guidance applicable to my practice, I retain client records for eight years from the date of the client’s last consultation.
Where different retention requirements apply, for example in relation to a child, I will follow the applicable professional and legal requirements.
At the end of the applicable retention period, information will be securely destroyed or deleted unless there is a legitimate reason for retaining it for longer.
The CNHC Code and related guidance require registrants to retain client records for eight years from the client’s last visit, subject to specific provisions relating to children.
10. WHO MAY RECEIVE YOUR INFORMATION
I do not sell or rent your personal information.
I may use trusted third-party organisations that provide services necessary to operate my practice or website.
These may include:
Kite Web Design
My website is built using WordPress and is hosted and supported by Kite Web Design.
Kite Web Design may have access to information where this is necessary to maintain, secure or operate the website.
MailerLite
I use MailerLite to manage newsletter subscriptions and send newsletters and other marketing communications.
If you subscribe to my newsletter, your name and email address may be processed by MailerLite for this purpose.
MailerLite acts as a data processor for customer data when providing its email-marketing services.
I use Microsoft Outlook or Yahoo Mail for email communication.
Information that you provide to me by email may therefore be processed and stored within my email system.
Other service providers
Where applicable, I may also share information with:
payment providers;
accounting or bookkeeping providers;
professional advisers;
insurers;
IT or technical support providers; or
regulators, authorities or law-enforcement organisations where I am legally required or permitted to do so.
I will take reasonable steps to ensure that third parties handling personal information on my behalf provide appropriate confidentiality and security protections.
11. International transferS
Some third-party service providers may process personal information outside the UK.
Where this happens, I will take appropriate steps to ensure that any transfer of personal information is lawful and that appropriate safeguards are in place under UK data-protection law.
MailerLite’s current data-processing arrangements include provisions dealing with international transfers and appropriate safeguards.
12. EMAIL COMMUNICATIONS
I use Microsoft Outlook or Yahoo for email communication with clients and prospective clients.
Email may be used to communicate about appointments, consultations, recommendations and other matters relating to my services.
If you choose to send health or other sensitive information to me by email, that information may form part of your client record where relevant.
Although I take reasonable steps to protect information held within my systems, no method of electronic communication can be guaranteed to be completely secure.
Please avoid sending highly sensitive information by email unless it is necessary or I have specifically requested it.
13 NEWSLETTER AND MARKETING
If you choose to subscribe to my newsletter, I will use the information you provide to send you newsletters and other relevant communications.
I use MailerLite for this purpose.
You can unsubscribe at any time by clicking the unsubscribe link included in my marketing emails or by contacting me directly.
I will not sell or rent your contact information to third parties.
14. WEBSITES AND COOKIES
My website is built using WordPress and hosted by Kite Web Design.
The website may use cookies and similar technologies that are necessary for the website to function.
It may also use analytics or other third-party services to help me understand how visitors use the website and to improve the website.
Where consent is required for non-essential cookies or similar technologies, I will ask for your consent before using them.
You can also manage cookies through your web browser settings.
The specific cookies used by the website may change from time to time as the website and its functionality develop.
15. KEEPING YOUR INFORMATION SECURE
I take reasonable and appropriate technical and organisational measures to protect your personal information.
These measures include restricting access to information, using appropriate security measures for electronic records and taking care with the storage of paper records.
Electronic client records are stored in an encrypted document.
Paper records are kept securely and are not made available to unauthorised people.
I take reasonable steps to ensure that third-party service providers processing information on my behalf also have appropriate security measures in place.
No method of storing or transmitting information electronically can be guaranteed to be completely secure
16. YOUR RIGHTS
Under UK data-protection law, you have a number of rights in relation to your personal information.
Depending on the circumstances, these include:
The right to be informed about how your information is used.
The right of access to the personal information I hold about you.
The right to rectification if information I hold about you is inaccurate or incomplete.
The right to erasure in certain circumstances.
The right to restrict processing in certain circumstances.
The right to object to certain types of processing.
The right to data portability in certain circumstances.
The right to withdraw consent where processing is based on consent.
These rights are subject to certain legal conditions and exemptions. For example, I may need to retain client records where I have a professional or legal requirement to do so.
17. ACCESS TO YOUR RECORDS
You can ask to see the personal information I hold about you.
This is known as a Subject Access Request.
You can make a request by contacting me using the contact details at the beginning of this Privacy Policy.
I will normally respond within one calendar month of receiving your request, although this period may be extended in certain circumstances in accordance with UK data-protection law.
I may need to verify your identity before providing personal information, particularly where the information requested is sensitive.
18. COMPLAINTS
If you have any concerns about how I have handled your personal information, please contact me in the first instance so that I can try to resolve your concerns.
You also have the right to complain to the Information Commissioner’s Office (ICO), which is the UK’s independent data-protection regulator.
Further information about making a complaint can be found on the ICO website.
19. THIRD PARTY RIGHTS
My website may contain links to other websites.
I am not responsible for the privacy practices, content or security of third-party websites.
If you follow a link to another website, you should read that website’s own privacy policy before providing any personal information.
20. CHILDREN
My services are for adults.
21. CHANGES TO THIS PRIVACY POLICY
Changes to this Privacy Policy
I may update this Privacy Policy from time to time to reflect changes to my services, technology, legal requirements or the way in which I process personal information.
The most recent version will always be published on this website.
Last updated: September 2026