​I’m Lisa Fossey, the data controller for Lisa Fossey Nutrition and Reflexology. This notice explains how I collect, use, share and protect personal information when you use my nutritional therapy or reflexology services, contact me or visit my website. For questions about this notice or to exercise your data protection rights, email hello@lisafossey.com.

​

What information I collect

​

• Contact and administrative details, including your name, address, contact preferences, appointment and referral details, next of kin and GP details where relevant, and payment information.

• Nutritional therapy records, including medical history, diet and lifestyle information, medication and supplement use, test results, consultation notes and personalised plans.

• Reflexology records, including relevant medical history, other health information, treatment details and related notes.

 

Most information comes directly from you through intake questionnaires, engagement forms, consultations, treatment sessions, bookings, payments or correspondence. For nutritional therapy, I may also receive results from biochemical testing companies and, with your express consent, information from other healthcare providers.

​

How I use your information

 

I use your information to arrange appointments, administer payments and provide nutritional therapy or reflexology. This includes assessing your needs, keeping records and providing treatment, support and advice. If you choose to withhold information I need to provide a service safely, I may be unable to provide that service.

Under the UK General Data Protection Regulation (UK GDPR), I rely on contract where processing is necessary to arrange or deliver the services you request. I also rely on legitimate interests where necessary to support your care, keep appropriate records, handle complaints or promote my services as described in this notice. Where applicable, I rely on your consent, a legal obligation, or the need to protect someone’s vital interests.

Health information is special category data. Where applicable, I process it to provide health care under Article 9(2)(h) of the UK GDPR, subject to professional confidentiality. I rely on explicit consent where that is the applicable condition.

​

Who I share your information with

 

I treat your information as confidential. Where needed, I may share relevant information with the following people or organisations.

​

• The Complementary and Natural Healthcare Council (CNHC), the British Association for Nutrition and Lifestyle Medicine (BANT) for nutritional therapy, or the Association of Reflexologists (AoR) for reflexology, when handling a complaint.

• Contractors, advisers and service providers who support my practice, including payment providers where relevant. I require those acting on my behalf to protect your information and keep it confidential.

• Supplement companies and biochemical testing companies where needed to provide nutritional therapy. I share only the details needed for the service and do not include sensitive information in those disclosures.

• Anyone to whom I transfer rights and duties under an agreement with you, where relevant.

• Regulators, courts or other authorities where required by law or where lawful and necessary, for example to safeguard someone or prevent serious crime.

 

I seek your express consent before sharing information with your GP or another healthcare provider. In an emergency, I may share necessary information with an appropriate authority where lawful to protect someone’s vital interests.

 

I seek your explicit consent before using your case history for professional development. I anonymise any case history shared with peers, including in supervision, presentations or professional publications.

​

Marketing communications

​

From time to time, I may contact existing and previous clients by post with seasonal greetings, information about my services, special offers or discount vouchers. For these postal communications, I rely on my legitimate interests in maintaining relationships with my clients and promoting my services. I will only use the contact details you have provided to me and will consider whether you would reasonably expect to receive these communications.

​

You can opt out of receiving marketing communications at any time by contacting me using the details provided in this privacy notice. I will also respect any marketing preferences you have indicated on your client intake questionnaire. I will not send you marketing communications if you have opted out or asked me not to contact you for marketing purposes. Email marketing is managed separately and is only sent where I have the appropriate permission or other lawful basis to do so.

​

How I protect and retain your information

 

I use secure storage, restrict access to authorised people and protect information held on devices such as laptops with encryption. External processors acting on my behalf are contractually required to protect your information.

​

I retain records in line with my insurance requirements and BANT and CNHC guidance for Nutritional Therapy and AoR and CHNC guidance for reflexology. My CNHC retention period for records is eight years after the last treatment. For clients treated under 18, I retain records until at least age 25, or age 26 if the client was 17 when treated, and for longer if another applicable retention requirement calls for it. When the applicable retention period ends, I securely delete electronic records and shred paper records.

​

Your data protection rights

 

You can ask to access your personal information, correct or complete it, or, in certain circumstances, have it erased, restrict its use, object to its use, or receive the information you provided in a portable format or have it sent to another organisation. Where I rely on consent, you can withdraw it at any time. You have the right to object to direct marketing at any time.

​

To exercise your rights, contact me using the details at the start of this notice. I normally respond within one month. Exercising your rights is usually free of charge. If I need to retain records under an applicable requirement, this may limit what I can erase. I do not use your personal information to make solely automated decisions about you.

​

Website forms and cookies

 

My website, www.lisafossey.com, uses forms to collect information you choose to submit. The site uses cookies to support features such as site operation and preferences. I use Google Analytics to understand how visitors find and use the site, including which pages they visit. I use aggregate reports to help improve the website. You can manage cookies in your browser or find more information at www.allaboutcookies.org. Google’s Analytics opt-out tool is available at tools.google.com/dlpage/gaoptout.

​

Complaints

 

If you have a concern about how I use your information, please email hello@lisafossey.com. You also have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.