Legal

Privacy Policy

This policy explains what personal information Nutrition by Andriana collects, why it is collected, how it is stored and what your rights are. It applies to this website and to clients of the practice.

Last updated: 29 September 2026

1. Who is responsible for your information

Nutrition by Andriana is the data controller for the personal information described in this policy. If you have any question about how your information is handled, or wish to exercise any of the rights set out below, contact [email protected].

2. What information is collected

When you use this website: the information you type into an enquiry form (your name, email address, the type of enquiry, your preferred consultation format, your message, how you heard about the practice and whether you have opted into the newsletter). The website also records how you arrived — the page you landed on, the website that referred you, and any campaign parameters or advertising click identifiers in the address you arrived with — so that enquiries can be attributed to the marketing that produced them.

When you become a client: your contact details, date of birth, medical history and family health background, current symptoms, diagnoses, medications and supplements, allergies and intolerances, food and lifestyle diaries, any test results you choose to share, and the notes and recommendations produced during your consultations. Health information is treated as special category data under UK data protection law and is handled accordingly.

When you pay: a record that payment was made and for which service. Card details are handled by the payment provider and are not stored by Nutrition by Andriana.

3. Why it is collected, and the lawful basis

To answer your enquiry and arrange a consultation — on the basis of steps taken at your request before entering into a contract.
To provide nutritional therapy — on the basis of performing our contract. Health information specifically is processed on the basis of your explicit consent, and for the provision of health care as permitted under Article 9 of the UK GDPR.
To keep accurate client records and meet professional obligations — on the basis of legal obligation and legitimate interests.
To send the email newsletter — on the basis of your consent, which you can withdraw at any time using the unsubscribe link in any email.
To understand how the website performs and where enquiries come from — on the basis of legitimate interests in running and improving the practice, using data that does not identify you by name.

4. How long information is kept

Client notes for adults are destroyed after seven years. Notes held for children and teenagers are destroyed when the client reaches 18 years of age. Enquiries that do not become clients are kept for up to two years and then deleted. Newsletter subscriptions are kept until you unsubscribe. Financial records are kept for six years to meet HMRC requirements.

5. How information is stored and kept secure

Records are held securely, with access limited to Andriana. Digital records are stored on password-protected, encrypted devices and reputable cloud services. Paper records, where they exist, are kept in a locked location. Information is never sold, and is not shared for marketing purposes.

6. Who information may be shared with

Information may be shared with the following, only to the extent necessary:

Website hosting and email providers used to operate this site and send correspondence.
The email marketing platform used to send the newsletter, if you have subscribed.
Laboratories, where you have agreed to a specific test.
Your GP or another healthcare professional, only with your consent, or where there is a serious concern regarding safety.
Professional bodies or insurers, where required in connection with a complaint or claim.
Accountants and tax authorities, for financial records.

Where a provider processes information outside the UK, appropriate safeguards are in place.

7. Cookies and website analytics

This website sets a small number of first-party cookies. These record how you arrived at the site — the referring website, the campaign parameters in the address you arrived with, and the page you landed on — so that an enquiry can be attributed to the right marketing activity. They also count how many times you have visited. These cookies hold no name, email address or health information, and they are not used for advertising to you elsewhere.

If website analytics or advertising measurement tools are in use, they are named here and their own privacy policies apply. Analytics can be refused by declining cookies in your browser, or by using your browser’s private mode.

8. Your rights

Under UK data protection law you have the right to:

Ask for a copy of the personal information held about you.
Ask for inaccurate information to be corrected.
Ask for information to be deleted, where there is no legal or professional reason to keep it.
Ask for processing to be restricted, or object to it.
Ask to receive your information in a portable format.
Withdraw consent at any time, where processing relies on consent.

To exercise any of these rights, email [email protected]. A response will be provided within one month.

9. Complaints

If you are unhappy with how your information has been handled, please raise it directly first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, by calling 0303 123 1113, or by writing to the ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

10. Changes to this policy

This policy may be updated from time to time. The latest version is always published on this page, with the date it was last updated shown at the top.