Privacy Notice

1. Who we are

Nutricore Health is operated by Marie Frost, sole trader trading as Nutricore Health®. Marie Frost is the data controller for the personal information described in this notice.

2. Information we may collect

The information we collect depends on how you interact with Nutricore Health and which services you use. It may include:

• your name and contact details;
• date of birth and sex where relevant to the service;
• occupation, working pattern and relevant lifestyle information;
• information you provide when making an enquiry or booking a service;
• payment and transaction information;
• appointment and service information;
• questionnaire, food diary and check-in responses;
• notes and records created as part of delivering your service;
• communications between you and Nutricore Health;
• information you choose to provide through our website or forms; and
• information relating to your use of our website where applicable.

Health information

If you use one of our private health services, we may also collect information about your physical or mental health. This may include information about symptoms, health conditions, medication, supplements, allergies or intolerances, family health history, lifestyle, sleep, stress, nutrition, movement, hormonal or reproductive health and relevant tests or investigations.

Health information is special category personal data under UK data protection law and receives additional protection. We aim to collect only information that is relevant and reasonably necessary to provide the service you have chosen.

3. Why we use your information

We may use your personal information to:

• respond to enquiries;
• arrange discovery calls and appointments;
• provide Nutricore Health services;
• understand your health, circumstances and goals before and during your work with us;
• prepare for appointments;
• provide appropriate health coaching, education and practical support;
• communicate with you about your service;
• manage bookings and payments;
• maintain appropriate service and client records;
• provide continuity of support;
• enable appropriate Practitioner support, quality assurance and oversight;
• manage our relationship with you;
• meet legal, regulatory, insurance, accounting and record-keeping obligations;
• manage and improve the operation of Nutricore Health; and
• send marketing communications where we have an appropriate basis to do so.

We do not use your health information for marketing.

4. Our lawful bases

UK data protection law requires us to have a lawful basis for using personal information. Depending on the circumstances, we may rely on:

Contract — where using your information is necessary to take steps at your request before entering into a contract or to provide a service you have purchased.

Legal obligation — where we need to use or retain information to comply with a legal requirement.

Legitimate interests — where we have a legitimate business reason to use information and your interests, rights and freedoms do not override that reason.

Consent — where we have asked you to make a genuine choice about a particular use of your information, for example certain marketing communications.

5. Health and other special category information

Health information requires an additional condition under Article 9 of the UK GDPR as well as an Article 6 lawful basis.

Where Nutricore Health needs health information in order to provide a service you have chosen, we ask for your explicit consent to process that health information for that specified purpose.

You can withdraw your explicit consent by contacting marie@nutricorehealth.com. Withdrawal does not affect processing that was lawful before consent was withdrawn. Depending on the service and information involved, withdrawing consent may mean that we can no longer provide some or all of the service because we may no longer have the information necessary to do so.

6. Nutricore Health Practitioners

If you work with a Nutricore Health Practitioner, relevant information may be made available to your assigned Practitioner so they can provide your service.

Where appropriate, relevant information may also be accessed by other Nutricore Health Practitioners involved in supporting the delivery, quality and oversight of your service.

Access is limited to what is appropriate for the person's role and the service being provided. Nutricore Health Practitioners are expected to handle client information confidentially and in accordance with Nutricore Health's data-protection and professional requirements.

7. Organisations we use to provide our services

Nutricore Health uses third-party service providers to operate the business and deliver services. These may include providers used for:

• business email, document storage and collaboration;
• website hosting and online forms;
• workflow automation;
• booking and appointment management;
• payment processing;
• email communications; and
• other essential business administration.

Current providers may include Google Workspace, Netlify, Make, Stripe and MailerLite where relevant to the service or interaction.

These organisations process information for their respective purposes and/or on our behalf under their own contractual and data-protection arrangements.

We do not sell your personal information. We do not allow third-party service providers to use client health information for their own marketing purposes.

8. Payments

Payments may be processed through third-party payment providers such as Stripe. Nutricore Health does not need to store your full payment-card details when those details are collected and processed directly by the payment provider. Payment providers process information in accordance with their own privacy and security arrangements.

9. Marketing

If you choose to receive marketing communications from Nutricore Health, we may use your name and email address to send relevant news, information and updates.

Where consent is the basis for those communications, you can unsubscribe at any time using the unsubscribe option provided or by contacting us.

Choosing not to receive marketing communications does not affect your ability to use Nutricore Health services. We do not add you to marketing communications simply because you complete a health questionnaire or purchase a private health service.

10. Corporate services

If you interact with Nutricore Health through an employer or other organisation, we may receive or process information necessary to organise and deliver the agreed service.

Where individual health or wellbeing information is provided directly to a Nutricore Health Practitioner, we do not routinely provide identifiable individual health information to an employer unless there is an appropriate lawful basis and the individual has been clearly informed.

Where reporting is provided to an organisation, we aim to use aggregated or non-identifiable information wherever appropriate.

11. How we protect your information

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. Measures may include:

• limiting access according to role and need;
• using appropriate authentication and access controls;
• using reputable business systems and service providers;
• maintaining appropriate client and business records;
• reviewing access when Practitioner involvement changes; and
• avoiding unnecessary collection or duplication of sensitive information.

No method of storing or transmitting information can be guaranteed to be completely secure, but we take proportionate steps based on the sensitivity of the information we hold.

12. International transfers

Some technology providers used by Nutricore Health may process or store information outside the UK. Where UK data-protection law requires safeguards for an international transfer, appropriate transfer mechanisms or safeguards are used by the relevant provider.

Nutricore Health reviews the data-processing arrangements of providers handling personal information as part of its privacy and security responsibilities.

13. How long we keep information

Client health and service records are normally retained for eight years following the end of your last Nutricore Health service. We may retain particular information for longer where reasonably necessary for legal, insurance, safeguarding or dispute purposes.

Other business and administrative records may be retained for different periods where required by law or for legitimate business purposes.

When information is no longer required, it is securely deleted or anonymised where appropriate.

14. Your data-protection rights

Depending on the circumstances and the lawful basis being used, you may have rights including:

• the right to be informed about how your information is used;
• the right to ask for access to your personal information;
• the right to ask us to correct inaccurate or incomplete information;
• the right to ask us to erase your information in certain circumstances;
• the right to ask us to restrict how your information is used in certain circumstances;
• the right to object to certain processing;
• the right to data portability in certain circumstances; and
• rights relating to consent, including withdrawing consent where consent is the basis for processing.

Not every right applies in every situation.

To exercise your rights or ask a question about your information, contact marie@nutricorehealth.com.

15. Complaints

If you have concerns about how Nutricore Health uses your personal information, please contact us first so that we can try to resolve the issue.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator. Information about making a complaint is available on the ICO website.

16. Changes to this notice

We may update this privacy notice when our services, systems, legal obligations or data-processing arrangements change. The current version will be published on the Nutricore Health website with its latest revision date.