Privacy Policy

Privacy Notice

Maxwell Nutrition Clinic

Email: hello@maxwellnutritionclinic.co.uk

1. Purpose of this Notice

This Privacy Notice explains how I collect, use, and store your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all clients, prospective clients, and visitors to my website or clinic.

2. Who I Am

Maxwell Nutrition Clinic, is a provider of nutritional therapy services, registered with the Association of Naturopathic Practitioners (ANP) and the General Naturopathic Council (GNC). I am the data controller for the personal information I collect and process in the course of providing professional services. I am registered with the Information Commissioner's Office (ICO) as a data controller. A copy of the registration is available through the ICO website.

3. Information I Collect

To provide safe and effective care, I may collect the following types of information:

•          Personal details (name, address, contact details, date of birth, GP contact)

•          Health and medical history, symptoms, and relevant test results

•          Information about diet, lifestyle, medication, supplements, and goals

•          Consultation notes and correspondence

•          Payment details (if applicable)

4. Lawful Basis for Processing

I process your personal data under the following lawful bases:

•          Contract: to provide you with agreed nutritional therapy services.

•          Legitimate interests: to maintain records and manage my business safely and professionally.

•          Consent: for processing sensitive (special category) health information. You may withdraw your consent at any time.

•          Legal obligation: to comply with legal or insurance record-keeping requirements.

Health information is 'special category data' under UK GDPR, which requires additional protection. I hold this data solely for the provision of direct healthcare.

I process your data under the following articles of the UK General Data Protection Regulation:

•          Article 6(1)(b) – Contract: to provide professional services requested by you

•          Article 9(2)(h) – Provision of healthcare: processing necessary for health and treatment purposes

5. How I Use Your Information

Your information is used to:

•          Provide safe and effective care

•          Assess suitability of personalised health advice

•          Communicate with you about your care

•          Keep accurate clinical records

•          Process payments and manage bookings

•          Meet professional, insurance, and legal obligations

•          Send marketing and newsletters, only subject to your consent

I undertake, at all times to protect your personal data, including any health and contact details, in a manner consistent with my duty of professional confidence and the requirements of UK GDPR. I will also take reasonable security measures to protect your personal data storage.

I may use your personal data where there is an overriding public interest in using the information, e.g. in order to safeguard an individual or to prevent a serious crime.

Your data will never be sold or used for marketing without your explicit consent. Your data may be shared with other parties for the following reasons if you have consented in the GDPR consent form:

•          To obtain functional tests (such as blood or urine)

•          For booking and administrative purposes

•          To courier and logistics providers who ship products to you

•          To companies supplying supplements or other products directly to you on my recommendation

6. How Your Information Is Stored

All personal information is stored securely in:

•          Practice Better, a GDPR-compliant clinical practice management platform (client records, consultation notes, intake forms, test results and bookings)

•          Google Workspace (business email and calendar), secured with two-factor authentication

•          Password-protected devices with automatic locking enabled

No paper records are routinely kept. Any paper documents are digitised to the secure systems above and the originals securely destroyed.

7. Online Consultations and Electronic Communication

Consultations are conducted online via secure video within Practice Better, my practice management platform, a reputable platform with appropriate security measures in place. Although all reasonable steps are taken to protect your information, no internet-based communication system can be guaranteed to be completely secure. If you choose to communicate via email, please be aware that standard email is not fully encrypted. Please do not send confidential health information (such as test results) by email; use the secure client portal provided.

8. How Long Records Are Kept

In line with professional standards and insurance requirements, clinical records are retained for 7 years from the date of last consultation.

After this period, records are securely deleted or destroyed. In certain cases, such as where records may be relevant to an insurance claim or legal proceeding, they may be retained for longer.

9. Clients Under 18

Maxwell Nutrition Clinic provides services to adults aged 18 and over only. I do not accept clients under the age of 18 and accordingly do not process children's data as clients.

10. Sharing Your Information

I will not share your information with third parties unless:

•          You have given explicit consent (for example, to share with your GP or another healthcare provider);

•          Disclosure is required by law (for example, in cases of serious risk of harm);

•          It is necessary for accounting or administrative purposes (e.g. my professional indemnity insurer or accountant, or other contractors and advisors who provide a service to me, on the understanding that they keep the information confidential);

•          It is required by my professional association (ANP) or registrant body (GNC) for the processing of a complaint made by you.

Anonymised case information may be shared with professional peers for the purposes of clinical supervision and professional development (for example at supervision meetings or professional conferences). Any information that could identify you is removed, and your explicit consent will be sought before your case is used in this way.

11. Your Rights

Under UK GDPR, you have the right to:

•          Access the personal data I hold about you

•          Request to move, copy or transfer your data to a third party

•          Request correction of inaccurate information

•          Request deletion of your data (where legally permissible)

•          Restrict or object to certain forms of processing

•          Withdraw consent at any time

•          Lodge a complaint with the Information Commissioner's Office (ICO): www.ico.org.uk

Please note that clinical records cannot be deleted where retention is required by law, insurance, or professional standards.

12. Subject Access Requests (SARs)

Clients have the right to request access to the personal data held about them. If a client makes a valid Subject Access Request:

•          A copy of the requested information will be provided free of charge, within one month of receiving the request (extendable by up to two further months for complex requests, in which case you will be informed within the first month)

•          Identity verification will be required before records are released; information will be provided electronically unless another format is requested

•          If a request is manifestly unfounded or excessive, a reasonable administrative fee may be charged, or the request may be refused where legally permitted

Once a Subject Access Request has been received, the relevant records will not be altered, amended, or deleted.

13. International Transfers of Personal Data

Some personal data is stored and processed outside the UK (my practice management platform hosts data in the United States); this occurs only under appropriate safeguards, including standard contractual clauses and a GDPR data processing agreement.

14. Communication and Updates

I may occasionally update this Privacy Notice to reflect legal or procedural changes. The latest version will always be available at maxwellnutritionclinic.co.uk.

15. Reporting Breaches

Any breach of this policy or of data protection laws will be reported as soon as practically possible, meaning as soon as I become aware of a breach. I have a legal obligation to report any qualifying data breaches to the UK supervisory authority, the Information Commissioner's Office, within 72 hours.

16. Data Protection Complaints

If you are unhappy with how I have handled your personal data or exercised your data protection rights, please contact me:

Venus Maxwell — Data Controller

Email: hello@maxwellnutritionclinic.co.uk

I will acknowledge your complaint within 30 days and investigate it in accordance with my data protection complaints procedure. If you are not satisfied with my response, you may complain to the ICO.

Cookies

This website uses cookies. For details of the cookies used and how to manage your preferences, please see the Cookie Policy on this website.