Privacy Policy

Victoria Malcolm Nutrition

30 Carr Road

Calverley

Leeds

LS285RH

hello@victoriamalcolmnutrition.co.uk

07970717010

Date effective: 08/07/2026

1. Purpose of this Notice

This Privacy Notice explains how I collect, use, and store your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all clients, prospective clients, and visitors to my website or clinic.

2. Who I Am

Victoria Malcolm Nutrition, is a nutritional therapist registered with ANP.

I am the data controller for the personal information I collect and process in the course of providing the professional services.

3. Information I Collect

To provide safe and effective care, I may collect the following types of information:

•             Personal details (name, address, contact details, date of birth, GP contact)

•             Health and medical history, symptoms, and relevant test results

•             Information about diet, lifestyle, medication, supplements, and goals

•             Consultation notes and correspondence

•             Payment details

4. Lawful Basis for Processing

I process your personal data under the following lawful bases:

•             Contract: to provide you with agreed naturopathic services.

•             Legitimate interests: to maintain records and manage my business safely and professionally.

•             Consent: for processing sensitive (special category) health information. You may withdraw your consent at any time.

•             Legal obligation: to comply with legal or insurance record-keeping requirements.

Special categories of data included race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health and sexual orientation.

I may hold special category data for the following purposes:

•             Provision of direct healthcare

I process your data under the following articles of General Data Protection Regulation:

•             Article 6(1)(b) – Contract: to provide professional services requested by you

•             Article 9(2)(h) – Provision of healthcare: processing necessary for health and treatment purposes

5. How [I/we] Use Your Information

Your information is used to:

•             Provide safe and effective care

•             Assess suitability of personalised health advice

•             Communicate with you about your care

•             Keep accurate clinical records

•             Process payments and manage bookings

•             Meet professional, insurance, and legal obligations

•             Marketing and newsletters subject to your consent

I undertake at all times to protect your personal data, including any health and contact details, in a manner which is consistent with our duty of professional confidence and the requirements of the General Data Protection Regulation (GDPR) concerning data protection. I will also take reasonable security measures to protect your personal data storage.

I may use your personal data where there is an overriding public interest in using the information e.g. in order to safeguard an individual, or to prevent a serious crime.

Your data will never be sold or used for marketing without your explicit consent. Your data may be shared with other parties for the following reasons if you have consented to in the GDPR consent form:

•             To obtain functional tests (such as blood or urine).

•             For booking and administrative purposes.

•             To courier and logistics providers who ship products to you.

•             To companies supplying supplements or other products directly to you on my recommendation.

6. How Your Information Is Stored

All personal information is stored securely in:

•             Encrypted clinical software

7. Online Consultations and Electronic Communication

Online consultations are conducted using reputable platforms with appropriate security measures in place. Although all reasonable steps are taken to protect your information, no internet-based communication system can be guaranteed to be completely secure. If you choose to communicate via email, please be aware that standard email is not fully encrypted.

8. How Long Records Are Kept

In line with professional standards and insurance requirements, clinical records are retained for:

•             7 years from the date of last consultation

•             For children: until age 25 (or 26 if aged 17 at end of treatment)

After this period, records are securely deleted or destroyed. In certain cases, such as where records may be relevant to an insurance claim or legal proceeding, they may be retained for longer.

9. Data Regulations for Minors

Where the client is under the age of 18, consent from a parent or legal guardian is required before treatment can begin. The child remains the data subject under data protection law. Both parents may have the right to access the child’s records unless there is a legal restriction or court order in place that limits this access.

10. Sharing Your Information

I will not share your information with third parties unless:

•             You have given explicit consent (for example, to share with your GP or another healthcare provider);

•             Disclosure is required by law (for example, in cases of serious risk of harm);

•             It is necessary for accounting or administrative purposes (e.g., my professional indemnity insurer or accountant, who are GDPR-compliant).

11. Your Rights

Under UK GDPR, you have the right to:

•             Access the personal data I hold about you.

•             Request to move, copy or transfer your data to a third party.

•             Request correction of inaccurate information

•             Request deletion of your data (where legally permissible)

•             Restrict or object to certain forms of processing

•             Withdraw consent at any time

•             Lodge a complaint with the Information Commissioner’s Office (ICO): www.ico.org.uk

Please note that clinical records cannot be deleted where retention is required by law, insurance, or professional standards.

12. Website technical details

Forms

I use electronic forms on my website making use of an available ‘forms module’ which has a number of built-in features to help ensure privacy. I also aim to use secure forms where appropriate.

Cookies

In compliance with EU legislation, the following table lists the use of cookies on this web site:

Cookie name Purpose

AcceptCookies This is used to store whether you have agreed to receive cookies. Persistent for one year.

Google Analytics _utma _utmb _utmc _utmz

These cookies are used to collect information about how visitors use my site. I use the information to compile reports and to help improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited.

Cookies are small. I do not make use of cookies to collect any private or personally identifiable information. The technical platform of this website uses cookies solely to aid the proper technical functioning of the website. The cookies used contain random strings of characters alongside minimal information about the state and session of the website – which in no way collects or discloses any personal information about you as a visitor.

Advanced areas of this site may use cookies to store your presentation preferences in a purely technical fashion with no individually identifiable information. Note also our statement on analytics software below – as analytics software also uses cookies to function.

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.allaboutcookies.org

To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout

13. Analytics

Like most websites, I make use of analytics software in order to help understand the trends in popularity of my website and of different sections. I make no use of personally identifiable information in any of the statistical reports we use from this package. I use an analytics package called Google Analytics who provide details of their privacy policy on the Google website.

14. Communication and Updates

I may occasionally update this Privacy Notice to reflect legal or procedural changes. The latest version will always be available on request www.victoriamalcolmnutrition.co.uk

15. Reporting breaches

Any breach of this policy or of data protection laws will be reported as soon as practically possible. This means as soon as we become aware of a breach.

[I/we] have a legal obligation to report any data breaches to UK Supervisory authority which is the Information Commissioners Officer within 72 hours.

16. Data protection complaints

If you are unhappy with how we have handled your personal data or exercised your data protection rights, please contact us at

Victoria Malcolm Nutrition

Email: hello@victoriamalcolmnutrition.co.uk | Phone: 07970717010