Privacy policy
Last updated: 08/09/2026
You're trusting me with information about your health, and often with things you haven't told anyone else. This page explains exactly what I collect, why, where it's stored, and what rights you have over it. It's written to be readable rather than to sound legal.
1. Who's responsible for your data
I am. Under UK data protection law I'm the "data controller" for the information described here.
holistic her, Address: 27 Chelsham Road, SW4 6NR
Email: hind@holisticherco.com
ICO registration number:
2. What I collect
When you visit the website
Basic technical information such as your IP address, browser type, and how you move around the site. This comes through Squarespace and any analytics tools in use. See the cookies section below.
When you get in touch or book a discovery call
Your name, email address, phone number, and whatever you choose to tell me about why you're getting in touch.
When you become a client
This is the substantial part. Through intake forms, questionnaires, journals, check-ins and our conversations, I collect:
identity and contact details, including date of birth and address
your health history: symptoms, diagnoses, medications, supplements, contraception, surgeries, family history
menstrual and hormonal history, pregnancy and postnatal history
digestive, sleep, energy and stress patterns
food intake, eating patterns and lifestyle information
information about your mental health, stress, life circumstances and, where you choose to share it, difficult or traumatic experiences
results from any functional tests or blood work you share with me
my own clinical notes, working hypotheses, protocols and correspondence
emergency contact and GP details
Payment information
Payments are processed by Practice Better. I can see that a payment was made and for what, but I don't see or store your full card details.
Marketing
If you sign up to my newsletter or download something from the website, I'll have your name and email address and a record of what you've opened or clicked.
3. Health data gets extra protection, and here's the basis for it
Most of what I hold about you is "special category data" under UK GDPR. That category covers health, sex life, and in some cases racial or ethnic origin and religious belief, where those come up as relevant context in your case.
Special category data needs two things: a lawful basis, and an additional condition. Mine are:
Delivering consultations, writing your protocol, and keeping clinical records
Lawful basis: performance of our contract.
Health data condition: Article 9(2)(h), provision of health care, together with the health and social care condition in Schedule 1 Part 1 of the Data Protection Act 2018.
Keeping records for insurance and professional body requirements
Lawful basis: legal obligation and legitimate interests.
Health data condition: Article 9(2)(f), establishment or defence of legal claims.
Taking payment and keeping financial records
Lawful basis: performance of our contract, and legal obligation.
Sending you marketing emails
Lawful basis: your consent, or the soft opt-in where you are an existing client.
Website analytics
Lawful basis: your consent.
A note on why this matters. Many wellness practitioners use "your consent" as the basis for holding health data. Consent under UK GDPR must be freely given and freely withdrawable, which sits awkwardly with clinical records I'm professionally obliged to keep. Article 9(2)(h) is the more accurate basis for practitioner records, and it's what the ICO and most professional bodies point to. Consent still applies to marketing, which you can withdraw at any time without it affecting your care.
I keep an appropriate policy document covering the health and social care condition, as the Data Protection Act requires.
4. Who else sees it
I don't sell your data, and I don't share it for advertising. I use the following services to run the practice, and each of them processes data on my instructions under a contract:
Practice Better holds your client record, intake forms, clinical notes, scheduling and secure messaging. Data is held in Canada.
Squarespace hosts this website and its contact forms. Data is held in the US.
MailerLite sends my newsletter and marketing emails. Data is held in the EU.
Google Workspace handles my email and document storage. Data is held in the EU and US.
Stripe processes payments. Data is held in the US.
Zoom hosts online consultations. Data is held in the US.
the Natural Dispensary fulfils supplement orders, if you choose to order. Data is held in the UK.
Several laboratories process functional tests, if you choose to test. Data is held in the UK and US.
Beyond those, I'd only share your information:
with your GP or another practitioner, if you ask me to
with my professional indemnity insurer or professional body, if there's a complaint or claim
where the law requires it, or where there's a serious risk of harm to you or someone else, as set out in my terms and conditions
I discuss cases in clinical supervision and peer review. Nothing identifying is shared in those discussions.
5. Data going outside the UK
Some of the services above store data outside the UK. Where that happens, transfers are covered by UK adequacy regulations or by the International Data Transfer Agreement or Addendum, which are the legal mechanisms designed to keep your protections travelling with your data.
6. How long I keep it
Clinical records: 7 years from our last contact. This reflects GNC’s and Balens’ guidance and the limitation period for claims.
Enquiries that don't become clients: 36 months.
Financial records: 6 years plus the current tax year, as HMRC requires.
Marketing data: until you unsubscribe, and then a minimal suppression record so I don't email you again by accident.
Once a retention period ends, records are securely deleted or destroyed.
7. How it's kept safe
Client records are held in Practice Better, which is purpose-built for health practitioners and encrypted in transit and at rest. My devices are encrypted and password protected, accounts use two-factor authentication where it's available, and any paper notes are stored securely and transferred to your digital record.
I'm the only person with access to your records.
Please don't send detailed health information by ordinary email or social media message. Use the Practice Better portal, which is secure. If you do email me something sensitive, I'll move it into your record and delete the email.
8. Your rights
Under UK GDPR you can:
ask for a copy of the information I hold about you
have inaccurate information corrected
ask me to delete information, though this is limited where I'm professionally or legally required to keep clinical records
ask me to restrict how I use it while a concern is being resolved
object to processing based on legitimate interests
ask for your data in a portable format
withdraw consent for marketing at any time
To exercise any of these, email me at hind@holisticherco.com. I'll respond within one month. There's no charge, unless a request is clearly unfounded or excessive.
One point worth being straight about: a request to delete your clinical record won't always be one I can grant in full, because record-keeping obligations sit on me as a practitioner rather than being something I've chosen. I'll always explain what I can and can't do, and why.
9. Cookies
The website uses cookies that are necessary for it to function, and analytics cookies.
You can control cookies through your browser settings.
10. Marketing emails
I'll only send you marketing emails if you've agreed to them, or if you're an existing client and I'm sending you something related to what you've already worked on with me. Every email has an unsubscribe link, and unsubscribing has no effect on your care.
11. Children
I work with women aged 18 and over, and I don't knowingly collect data about anyone under 18.
12. If you're unhappy
Please come to me first, at hind@holisticherco.com, and I'll do what I can to sort it out.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.
13. Changes
I'll update this page when what I do changes. The date at the top tells you when it was last revised.
This page was last reviewed on 08/09/2026.