How We Look After Your Information
We want you to feel safe, respected, and informed when you share your personal information with us. This privacy notice explains what we collect, why we collect it, and how we keep it secure.
Who We Are
The Dietetic Clinic is an independent dietetic practice providing personalised, evidence-based nutrition and dietetic care.
We are the data controller for the personal information we hold about you. This means we are responsible for deciding how and why your information is used, and for keeping it safe.
What Information We Collect
We collect only the information necessary to provide safe, personalised dietetic care. This may include:
Personal information
- Full name, date of birth, and gender
- Contact details including address, phone number, and email address
- Emergency contact details where relevant
Health and clinical information
- Medical history, diagnoses, and current medications
- Dietary history, food intake, and eating patterns
- Anthropometric data (height, weight, body composition)
- Relevant test results, GP letters, or referral information
- Clinical notes from appointments
Administrative information
- Appointment records and correspondence
- Payment and invoicing details
- Any documents, forms, or messages you share with us
Health information is classed as “special category data” under UK GDPR and is given the highest level of protection.
How We Collect Your Information
We collect information in the following ways:
- Directly from you — through intake forms, consultations, emails, or telephone calls
- From referrers — GPs, consultants, or other healthcare professionals who refer you to us (with your knowledge)
- From other healthcare providers — where you have given consent for information to be shared
- Through our website — if you submit a contact or enquiry form
Why We Use Your Information
We use your information to:
- Provide safe, personalised dietetic assessment and treatment
- Maintain accurate and up-to-date clinical records
- Communicate with you about your care, appointments, and progress
- Prepare reports, letters, or care plans where requested
- Meet our legal, regulatory, and professional obligations as an HCPC-registered dietitian
- Respond to your enquiries and provide information about our services
- Process payments and manage our administrative records
We will never use your information for marketing purposes without your explicit consent.
Our Legal Basis for Processing Your Information
Under UK GDPR, we must have a lawful basis for processing your personal information. We rely on the following:
Contract
Processing is necessary to fulfil our agreement to provide dietetic services to you.
Legitimate interests
For administrative purposes such as managing appointments, responding to enquiries, and maintaining business records.
Legal obligation
Where we are required to process or retain information to comply with our legal or regulatory duties.
Vital interests
In rare circumstances where processing is necessary to protect your life or the life of another person.
For special category health data, we rely on:
- Provision of health or social care — the primary basis for processing clinical information
- Explicit consent — where we ask for your specific agreement, for example to share information with your GP
- Substantial public interest — in limited circumstances required by law
Where we rely on consent, you have the right to withdraw it at any time. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.
Who We Share Your Information With
We treat your information with the utmost confidentiality. We will only share it in the following circumstances:
Your GP or other healthcare professionals
With your consent, to support your ongoing care or where clinically necessary.
Other treating clinicians
Where you have been referred to us by, or are being treated alongside, another professional.
Booking and practice management systems
Third-party software used to manage appointments and records, operating under data processing agreements.
Payment processors
To process payments securely. We do not store full card details.
Regulatory or legal bodies
Where required by law, court order, or to comply with our regulatory obligations (e.g. HCPC, ICO).
Safeguarding authorities
Where we have a legal duty to report concerns about the safety of a child or vulnerable adult.
We never sell, rent, or share your personal information with third parties for marketing purposes.
How We Keep Your Information Safe
We take the security of your personal information seriously. Our measures include:
- Encrypted, password-protected devices and systems
- Two-factor authentication on accounts holding personal data
- Secure, UK/EU-based data storage and cloud services
- Restricted access to clinical records on a need-to-know basis
- Regular review of our data security practices
- Secure disposal of paper records when no longer needed
In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform you directly where required.
How Long We Keep Your Information
We retain your information only for as long as necessary. Our retention periods are guided by professional and legal requirements:
Adult clinical records
8 years from the date of last contact or treatment.
Children's clinical records
Until the patient's 25th birthday, or 26th birthday if the young person was 17 at the conclusion of treatment.
Records relating to serious incidents
May be retained for longer in accordance with legal or regulatory requirements.
Financial and administrative records
6 years in line with HMRC requirements.
Enquiry and contact form data
12 months from the date of enquiry, unless a clinical relationship is established.
After the relevant retention period, records are securely deleted or destroyed.
Your Rights Under UK GDPR
You have the following rights in relation to your personal information:
Right of access
You can request a copy of the personal information we hold about you (a Subject Access Request).
Right to rectification
You can ask us to correct any inaccurate or incomplete information.
Right to erasure
You can ask us to delete your information in certain circumstances, such as where it is no longer necessary for the purpose it was collected.
Right to restrict processing
You can ask us to limit how we use your information in certain circumstances.
Right to data portability
You can request your information in a structured, commonly used format to transfer to another provider.
Right to object
You can object to processing based on legitimate interests.
Right to withdraw consent
Where processing is based on consent, you can withdraw it at any time without affecting prior processing.
To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month. We may need to verify your identity before processing your request.
Transfers Outside the UK
We aim to store and process your data within the UK or European Economic Area (EEA). Where any third-party service provider processes data outside the UK or EEA, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the ICO, to protect your information to the same standard as required under UK GDPR.
Cookies and Website Data
Our website may use cookies and similar technologies to support its functionality. This may include:
- Essential cookies required for the website to function
- Analytics cookies to help us understand how visitors use the site (where consent is given)
- Third-party cookies from embedded booking widgets or forms
We do not use cookies to track you across other websites or to sell your data to third parties. For more detail, please see our Cookie Policy.
How to Raise a Concern or Complaint
If you have any concerns about how we handle your personal information, please contact us in the first instance so we can try to resolve the matter:
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent data protection authority:
- Website: www.ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Updates to This Privacy Notice
We review and update this privacy notice periodically to reflect changes in our practice, legal requirements, or guidance from the ICO. The most current version will always be available on our website. This notice was last reviewed and updated in June 2026.
Questions about your data?
We’re happy to help. Contact us directly and we’ll respond within two working days.