Privacy Notice

← Back to home

Contact details

Mary Brant
Email: [email protected]
ICO registration reference: ZC178121

If you have any questions about this privacy notice or how your personal information is used, please contact me using the details above.

What information I collect, use and why

1) Information collected to provide dietetic, yoga and mindfulness services

I collect or use the following personal information to provide services to clients, communicate about appointments, and manage service delivery:

• Name and contact details
• Address details where relevant
• Date of birth where relevant to the service provided
• Payment and invoicing information
• Appointment details and service history
• Information you provide through enquiry forms, consultation forms, health questionnaires or email correspondence
• Information about your goals, lifestyle, wellbeing, diet, medical background and other information relevant to the service being provided
• Emergency contact information where appropriate
• Details of your GP or other healthcare professionals where relevant and with your consent, or where otherwise permitted by law

2) Special category data

Because I provide health-related services, I may collect and use special category personal data, particularly:

• Health information, including information relevant to your dietetic care, medical background, symptoms, diagnoses, medications, allergies, intolerances, blood results where shared, lifestyle factors relevant to nutrition care, and other information relevant to yoga or mindfulness support where you choose to provide it and it is relevant to the service

I only collect special category data where it is necessary for the provision of services, where you provide it to me, and where there is a lawful basis and an additional condition under UK data protection law for processing it.

3) Information collected to comply with legal, professional and regulatory requirements

I may collect, use and retain personal information where necessary to comply with legal obligations or professional requirements, including:

• Name and contact details
• Financial transaction and invoicing records
• Client records where retention is required for legal, insurance, professional, safeguarding or complaint-handling purposes
• Information relevant to health and safety, safeguarding, complaints, claims or legal issues where applicable

4) Information collected to deal with enquiries, complaints or claims

I may collect or use the following information to respond to enquiries, manage complaints, or establish, exercise or defend legal claims:

• Names and contact details
• Address details where relevant
• Payment details and transaction information
• Client records, correspondence and service history
• Information relevant to a complaint, concern, incident or claim

5) Mailing list and marketing

If you choose to join my mailing list, I may collect and use:

• Your name
• Your email address
• Information about whether you open or engage with marketing emails, where available through the mailing platform

This information is used to send newsletters, updates, offers or relevant information about services, events or resources. You can unsubscribe at any time using the unsubscribe link in the email or by contacting me.

6) Website enquiries

If you contact me through my website, I may collect information you submit via contact or enquiry forms, such as your name, email address and message.

Where I get personal information from

I collect most personal information directly from you, for example when you:

• enquire about working with me
• book or attend a consultation, yoga session or mindfulness service
• complete forms or questionnaires
• email me or contact me through my website
• join my mailing list
• provide payment or invoicing information

I may also receive information from:

• a parent, guardian or other person acting on your behalf where appropriate
• a healthcare professional, where you have asked them to share information with me or where you have consented for information to be shared
• other documents or reports you choose to send to me

Lawful bases and data protection rights

Under UK data protection law, I must have a lawful basis for collecting and using your personal information. Different lawful bases may apply depending on why your information is being used.

My lawful bases for providing services

When I collect or use personal information to provide dietetic, yoga or mindfulness services, my lawful bases are:

Contract
Processing is necessary so that I can enter into or carry out a contract with you, for example to book appointments, provide services, communicate with you, maintain service records, and take payment.

Legal obligation
Processing is necessary to comply with legal obligations, such as accounting, tax, regulatory, safeguarding or insurance-related obligations.

Legitimate interests Processing is necessary for my legitimate interests in running and protecting the business, provided these interests are not overridden by your rights and freedoms. My legitimate interests include:

• responding to enquiries from prospective or existing clients
• keeping appropriate business records
• administering services and appointments
• maintaining secure systems and records
• managing complaints and service issues
• establishing, exercising or defending legal claims

My lawful basis for marketing

Where I send marketing emails or newsletters, I rely on:

Consent
You will only receive marketing emails if you have chosen to opt in, where consent is required. You can withdraw your consent and unsubscribe at any time.

Special category data

Where I process health information and other special category data, I do so only where I have both:
1. a lawful basis under Article 6 UK GDPR (such as contract, legal obligation or legitimate interests), and
2. an additional condition for processing special category data under Article 9 UK GDPR

For health-related services, the relevant additional condition will usually be that processing is necessary for the provision of health or wellbeing-related services and associated record keeping, or that you have provided explicit consent where appropriate.

Your data protection rights

Depending on the lawful basis relied on, you may have rights including:

• the right of access to the personal information I hold about you
• the right to ask me to correct inaccurate or incomplete information
• the right to ask me to erase your personal information in some circumstances
• the right to ask me to restrict how I use your information in some circumstances
• the right to object to certain processing
• the right to data portability in some circumstances
• the right to withdraw consent at any time where consent is the lawful basis

If you would like to exercise any of these rights, please contact me at [email protected].

Please note that some rights are not absolute, and there may be circumstances where I am legally or professionally required to retain certain records.

How long I keep information

I only keep personal information for as long as it is needed for the purpose for which it was collected, or as required by law, insurance, professional standards, safeguarding obligations or to manage complaints or claims.

Client records and service-related records

Client records, consultation notes, assessment forms, letters and related service records are generally retained for 8 years after the end of services.

Where records relate to a child, they may be retained for at least 7 years after the child reaches the age of 18 where appropriate. Where records relate to a person who lacks capacity, records may be retained for a longer period where required for legal, safeguarding, insurance or professional reasons.

Records may also be retained for longer where necessary to deal with complaints, claims, safeguarding issues, insurance matters, or other legal or regulatory obligations.

Financial and invoicing records

Financial records, invoices and transaction records are retained for as long as required by tax, accounting and legal obligations.

Mailing list and marketing data

If you join my mailing list, your marketing contact details will be kept until you unsubscribe, or for up to 12 months after your last meaningful engagement with marketing emails, whichever is sooner, unless there is a lawful reason to keep them longer.

Enquiry data

If you contact me but do not go on to use my services, I may retain your enquiry information for a reasonable period in case of follow-up, administration, or to deal with any issues arising from the enquiry.

Who I share personal information with

I do not sell your personal information.

I may share personal information with trusted third parties where necessary to run the business, deliver services, comply with the law, or manage complaints or claims.

Data processors

These are service providers who process personal information on my behalf.

Microsoft 365

I use Microsoft 365 to:

• provide email services and manage correspondence
• store client records, consultation notes, letters, forms, invoices and other business documents securely in the cloud
• manage calendars and appointment administration
• facilitate video calls where Microsoft Teams is used

Mettle

I use Mettle for business banking and invoicing. This may involve processing personal information such as:

• client names
• invoice details
• payment references
• transaction records

Other recipients I may share information with where necessary

Depending on the circumstances, I may also share personal information with:

• healthcare professionals such as your GP or another clinician, where relevant to your care and with your consent or where otherwise permitted or required by law
• insurance companies where necessary in connection with a complaint, claim or incident
• professional or legal advisers, such as an accountant, solicitor or insurer’s adviser
• relevant regulatory or public authorities, such as HMRC, the ICO, or other bodies where required by law
• organisations I am legally obliged to share information with, including where disclosure is required by law, court order, safeguarding duty or regulatory requirement

Sharing information outside the UK

I do not routinely transfer personal information outside the UK myself as part of delivering services. However, some of the third-party providers I use may store or process personal information outside the UK on my behalf.

Microsoft 365

Microsoft 365 may store or process personal information in the United Kingdom, the European Economic Area (EEA), or other countries where Microsoft or its sub-processors operate, depending on service configuration and operational requirements.

Where personal information is transferred outside the UK by Microsoft 365 or another processor, I seek to ensure that appropriate safeguards are in place in accordance with UK data protection law. These safeguards may include:

• the UK Addendum to the EU Standard Contractual Clauses
• the International Data Transfer Agreement (IDTA)
• transfers to countries recognised as providing adequate protection under UK law
• other lawful safeguards or transfer mechanisms made available under the processor’s data protection terms

Security

I take the security of personal information seriously and have appropriate technical and organisational measures in place to protect it from loss, misuse, unauthorised access, disclosure, alteration or destruction.

These measures may include:

• password-protected devices and accounts
• secure cloud storage
• restricted access to records
• appropriate document handling and record-keeping procedures
• use of reputable service providers with security measures in place

Please note that no method of electronic transmission or storage is completely secure, but I take reasonable and proportionate steps to protect your information.

Mailing list and marketing

If you have signed up to receive newsletters, updates or other marketing emails, I will use your details for that purpose. I will not use your details for marketing unless I have a lawful basis to do so, which will usually be your consent.

You can unsubscribe at any time by:

• clicking the unsubscribe link in any marketing email, or
• emailing [email protected]

Unsubscribing from marketing will not affect essential service-related communications, such as appointment confirmations, invoices, or information directly related to the service you have requested.

Website cookies

This website does not use analytics or tracking cookies.

Only essential cookies may be used where necessary for the basic functioning, security or performance of the website. These cookies do not require consent under UK data protection law where they are strictly necessary.

If this changes in future and non-essential cookies or analytics tools are added, this privacy notice and the website cookie information will be updated accordingly.

Complaints

If you have any concerns about how I use your personal information, please contact me first at:

Mary Brant
Email: [email protected]

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how your data has been handled.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk

Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes to my services, legal requirements or the way I process personal information. The most up-to-date version will be available on request and, where applicable, on my website.

Last updated 15/07/2026; Version 3.0