Privacy Policy

Introduction

Nichola Dobinson, three wishes natural health holds some information about you. This policy outlines how that information is used , who we may share that information with and how we keep it secure. We (three wishes natural health) are committed to protecting and respecting your privacy. Please read the following carefully to understand our views and practices regarding your personal data and how we treat it. This notice does not provide exhaustive detail. However, we are happy to provide any additional information or explanation needed.

The rules on processing of personal data are set out in the General Data Protection Regulation (the “GDPR”).

Definitions

Data controller – A controller determines the purposes and means of processing personal data.

Data Processor– A processor is responsible for processing personal data on behalf of a controller.

Data subject– Natural person

Personal data– The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier (as explained in Article 6 of GDPR). For example: Name, home address or private email address. Online identifiers include IP addresses and cookies.

Special categories personal data- The GDPR refers to the sensitive personal data as ‘special categories of personal data’ (as explained in Article 9 of GDPR). The special categories specifically include genetic data and biometric data where processed to uniquely identify an individual. Other examples include racial and ethnic origin, sexual orientation, health data, trade union membership, political opinions, religious of philosophical beliefs.

Processing– This means any operations or set of operations which is performed on personal data or on sets of personal data, automated or not, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Third Party– Means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Who are we?

Nichola Dobinson, three wishes natural health provides nutritional therapy services to clients improving their health through diet and lifestyle interventions. This tailored approach to health requires detailed evidence provided by ‘you’ the client including medical history, family history, diet, lifestyle, GP information and biochemical test results.

Nichola Dobinson, three wishes natural health is the data controller. This means we decide how your personal data is processed and for what purposes. Our contact details are: three wishes natural health: Uplands, Pilgrims Way, Westerham, Kent TN16 2DU.

For all data matters please email: nichola@threewishesnaturalhealth.co.uk

How do we obtain your personal data?

You, the data subject, provide us with personal information in the following ways:

  • Completing our (three wishes natural health) client questionnaire.
  • Signing our terms of engagement.
  • During the course of a nutritional therapy consultation.
  • Via email, telephone or by post.
  • Through credit card and online payment.

This personal data may include any data recorded or related to clinic records and notes such as next of kin, child’s name, date of birth, place of education, medical history, medication, diet, lifestyle, biochemical test results, GP contact.

We may obtain personal medical information in the form of test results direct from biochemical testing companies. We may also obtain sensitive personal data from other healthcare providers however, this cannot occur without your express consent to do so.

How do we use your personal data?

We act as data controller, using this information to provide you with direct healthcare. This means that the legal basis of our holding your personal data is for legitimate interest.

We also act as a controller and processor in regard to the processing of your data from third parties such as testing companies and other healthcare providers. We act as a data controller and processor in regard to the processing of credit card and online payments.

Further purposes of processing your personal data:

  • Carrying out any relevant health assessments
    It is vital that you share any relevant medical information during health assessments.
    We will ask for your agreement to undertake any appropriate assessments.
  • Identifying any reasonable adjustments and adaptations to support inclusion:
    If you or your child has a disability or special needs, we will review the information you have provided to help us identify any actions we can take to support inclusion.
  • Responding to any comments, questions or complaints you may send to us.
  • Maintaining contact details for emergency purposes.
  • Legal reasons
    To comply with applicable laws and to protect our legitimate interests and legal rights. This includes, but is not limited to the use of your information relating to legal claims and compliance and regulatory activity.
  • Marketing
    With your consent we may send you  information by email about news and activities that we think will be of interest to you. You can ask us to stop sending you this information at any point by following the instructions in the relevant communication or by contacting us directly.

Do we share your personal data?

Your personal data will be treated as strictly confidential.

We will not share your information with any other organisation except with your consent or in exceptional or emergency circumstances where we believe that the sharing of information about you is vital to protect you, your child or another person.

We will only disclose your information with other third parties with your express consent with the exception of the following categories of third parties:

  • Our registrant body, CNHC and our professional association, BANT, for the processing of a compliant made by you.
  • Any contractors and advisors that provide a service to us or act as our agents on the understanding that they keep the information confidential.
  • Anyone whom we may transfer our rights and duties under any agreement we have with you.
  • Any legal or crime prevention agencies and/or to satisfy any regulatory request (CNHC) if we have a duty to do so or if the law allows us to do so.

We may share information with a supplement or biochemical testing company in the provision of our services. This will not include any sensitive information.

We will seek your express consent to share your information with your GP or other healthcare providers.

We may share your case history in an anonymised form with our peers for the purposes of professional development. We would seek your express consent before processing your data in this way.

How long do we keep your personal data?

We keep personal data for a period of seven years in order to comply with the specifications of our professional association BANT.

How is your data kept secure?

We only use information that may identify you in accordance with GDPR. This requires us to process personal data only if there is a legitimate basis for doing so and that processing must be fair and lawful. We undertake at all times to protect your personal data, including any health and contact details, in a manner which is consistent with our duty of professional confidence and the requirements of the GDPR concerning data protection.

We ensure that the information we hold is kept in secure locations, restrict access to information to authorised personnel only and protect personal information held on equipment (such as laptops) with encryption. We ensure that external data processors that support us are legally and contractually bound to provide security that protects the identity of the data subject.

Your rights concerning your personal data

Unless subject to an exemption under GDPR, you have the following rights with respect to your personal data:

  • The right to request a copy of the personal data which we hold about you.
  • The right to request that we correct any personal data if it is found to be inaccurate or out of date.
  • The right to request your personal data is erased where it is no longer necessary to retain such data.
  • The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable i.e. where the processing is based on consent or is necessary for the performance of a contract with the data subject and where the data controller processes the data by automated means).
  • The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing.
  • The right to object to the processing of personal data, (where applicable i.e. where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics).

Further processing

If we wish to use your data for a new purpose not covered by this data privacy notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions.

Changes to our privacy policy

Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to our privacy policy.

How to make a complaint

To exercise all relevant rights, queries or complaints please in the first instance contact:
Three wishes natural health: Uplands, Pilgrims Way, Westerham, Kent, TN16 2DU.
Email: nichola@threewishesnaturalhealth.co.uk