Privacy Policy — Nourish & Thrive Nutrition

Last updated: March 2025

Nourish & Thrive Nutrition ("we", "us", or "our") is committed to protecting and respecting your privacy. This policy explains how we collect, use, and safeguard your personal data when you use our website and services, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What Data We Collect

We may collect and process the following personal data:

Contact information — your name, email address, phone number, and postal address, provided when you contact us via our enquiry form, book a consultation, or correspond with us by email or telephone.
Health information — details about your health, diet, lifestyle, and medical history, provided during consultations to enable us to deliver personalised nutritional therapy.
Payment information — transaction details when you pay for our services. We do not store full payment card details on our systems.
Website usage data — technical information such as your IP address, browser type, pages visited, and time spent on the site, collected via cookies and analytics tools.

How We Use Your Data

We use your personal data for the following purposes:

To respond to your enquiries and provide the services you have requested.
To prepare and deliver personalised nutrition plans and recommendations.
To manage appointments, billing, and client records.
To send you information relevant to your care, including appointment reminders.
To improve our website and the quality of our services.
To comply with legal and regulatory obligations.

Legal Basis for Processing

Under the UK GDPR, we rely on the following lawful bases to process your personal data:

Consent — where you have given clear consent for us to process your personal data for a specific purpose, such as submitting an enquiry form or opting in to communications.
Contractual necessity — where processing is necessary to fulfil a contract with you, for example to deliver nutritional therapy services you have booked.
Legitimate interests — where processing is necessary for our legitimate business interests, such as improving our services, provided these interests do not override your rights.
Legal obligation — where we are required by law to process your data, for example for tax or regulatory purposes.

Where we process special category data (such as health information), we do so on the basis of your explicit consent, which you may withdraw at any time.

Cookies

Our website uses cookies to enhance your browsing experience. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

Data Sharing

We do not sell, trade, or rent your personal data to third parties. We may share your data with:

Trusted service providers who assist us in operating our website and delivering our services (for example, email hosting and analytics providers), subject to appropriate data processing agreements.
Professional or regulatory bodies, where required by law or professional obligation.
Law enforcement or government authorities, where we are legally obliged to do so.

Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected:

Client records — retained for a minimum of 7 years after your last consultation, in line with professional and legal requirements.
Enquiry data — retained for up to 12 months after your last correspondence, unless you become a client.
Website analytics data — retained in anonymised form for up to 26 months.

After the relevant retention period, your data will be securely deleted or anonymised.

Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

Right of access — you may request a copy of the personal data we hold about you.
Right to rectification — you may ask us to correct any inaccurate or incomplete data.
Right to erasure — you may request that we delete your personal data, subject to any legal obligations we have to retain it.
Right to restrict processing — you may ask us to limit how we use your data in certain circumstances.
Right to data portability — you may request that we transfer your data to another organisation in a structured, commonly used format.
Right to object — you may object to our processing of your data where we rely on legitimate interests as our legal basis.
Right to withdraw consent — where we process your data based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details below.

Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policy of every website you visit.

Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "last updated" date. We encourage you to review this policy periodically.

Contact Us

If you have any questions about this privacy policy or wish to exercise your data rights, please contact us:

Email: email@yourdomain.com
Phone: 07700 900 461
Address: Bristol, BS1

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.