Effective date: 23 July 2026
Review date: 23 July 2027
Data controller: Claire Lynch, sole trader, trading as Rooted Health

1. About this policy

This Privacy Policy explains how Rooted Health collects, uses, stores, shares and protects personal information. It also explains your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable privacy legislation.

Rooted Health provides nutrition, lifestyle medicine and health coaching services to adults. These services may combine dietetic assessment and advice with coaching approaches. As a UK Registered Dietitian, I keep appropriate professional clinical records when providing nutrition, lifestyle medicine and related health services.

Contact: claire@rootedhealthuk.com

Please contact me using the email address above if you have questions about this policy or how your information is handled.

2. The information I collect

Depending on how you engage with Rooted Health, I may collect and process:

• identity and contact details, including your name, email address, telephone number and address;
• booking and appointment information;
• billing and transaction information, although full card or bank-security details are handled by the relevant payment provider;
• emails, contact-form submissions and other communications;
• information you provide through questionnaires, consultations or coaching conversations;
• clinical and lifestyle information, including medical history, diagnoses, symptoms, medication, allergies, dietary intake, physical activity, sleep, stress, body measurements, test results, family history and details of other healthcare professionals, where relevant;
• your goals, preferences, agreed actions and progress;
• newsletter subscription and marketing preferences; and
• limited technical information generated when you use the website, such as security logs, device or browser information and cookies described in section 12.

I ask you not to provide information that is not reasonably needed for your care, enquiry or participation in a Rooted Health service.

3. Special-category health information

Information about physical or mental health is classed as special-category personal data and receives additional legal protection.

Where health information is necessary to provide dietetic, nutrition or lifestyle medicine services, it is normally processed under Article 9(2)(h) UK GDPR for the provision of health care or treatment, together with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. As an HCPC-registered healthcare professional, I am also subject to professional duties of confidentiality.

Where a different special-category condition is more appropriate, such as explicit consent, vital interests or the establishment, exercise or defence of legal claims, I will identify and document that condition.

4. How I collect information

I may collect information directly from you when you:

• visit the website or submit an enquiry;
• book an introductory call or appointment;
• subscribe to a newsletter or download a resource;
• complete a questionnaire or provide information before a consultation;
• participate in a consultation, coaching session, workshop or other service;
• communicate by email, telephone, video call or social media; or
• make a payment.

With your knowledge and where lawful, I may also receive relevant information from another healthcare professional or a person you have asked to communicate with me.

5. How and why I use your information

I use personal information only where it is necessary and proportionate. This may include:

• responding to enquiries and arranging appointments;
• assessing your needs and providing dietetic, nutrition, lifestyle medicine and health coaching services;
• creating and maintaining accurate clinical records;
• communicating with you about appointments, agreed actions and service administration;
• processing payments, issuing invoices and maintaining financial records;
• meeting professional, safeguarding, insurance, legal and regulatory responsibilities;
• managing complaints, concerns or legal claims;
• maintaining the security and operation of the website and business systems;
• improving Rooted Health services using appropriately limited or anonymised information where possible; and
• sending newsletters and marketing communications where you have chosen to receive them or where otherwise permitted by law.

6. Lawful bases

Under Article 6 UK GDPR, the lawful bases I may rely on are:

• Contract: where processing is necessary to take steps at your request or to provide an agreed service.
• Legitimate interests: for proportionate activities such as responding to enquiries, administering and improving the business, maintaining security and establishing or defending legal claims.
• Legal obligation: where information must be processed to comply with the law, tax requirements or regulatory duties.
• Consent: particularly for optional email marketing or another specific activity where consent is appropriate. You may withdraw consent at any time, although this does not affect processing already carried out lawfully.
• Vital interests: in an exceptional situation where processing is necessary to protect someone’s life or physical safety.

For special-category information, an additional Article 9 condition is also required, as explained in section 3.

7. Clinical records and professional confidentiality

Clinical records are maintained in secure, access-restricted Google Workspace documents and cloud storage. Records may include information from dietetic assessment and advice as well as relevant lifestyle medicine and coaching discussions.

Individual consultations are not routinely recorded. If I ever propose recording a call or session, I will explain why, how the recording will be used and retained, and obtain appropriate agreement before recording begins.

I will not normally disclose confidential clinical information without your agreement. Information may, however, be disclosed without consent where this is required by law, ordered by a court, necessary to protect vital interests, or justified in the public interest, for example to help prevent serious harm. Any such disclosure will be limited to what is necessary.

8. Who I may share information with

I do not sell or rent personal information. Where reasonably necessary, limited information may be shared with:

• healthcare professionals or other people involved in your care, normally with your agreement;
• Google Workspace, including Gmail, Google Drive, Google Docs, Google Calendar and Google Meet;
• Calendly for introductory-call scheduling;
• Zoom where that platform is used for a consultation, workshop or group session;
• MailerLite for newsletter subscriptions and email communications;
• PayPal, banks or other payment providers used to process transactions;
• Hostinger and relevant WordPress website services used to operate and secure the website;
• professional advisers such as an accountant, insurer, solicitor or IT-support provider, subject to appropriate confidentiality;
• a purchaser or successor if the business is reorganised, transferred or sold, subject to appropriate safeguards; and
• regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law.

Service providers acting on my instructions are expected to process personal information only for the agreed purpose and to apply appropriate confidentiality and security safeguards.

9. International transfers

Some service providers may process or store personal information outside the United Kingdom. Where information is transferred internationally, I take reasonable steps to ensure that an appropriate legal transfer mechanism and safeguards are in place. These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard.

10. Security

I use proportionate technical and organisational measures designed to protect personal information against loss, misuse, alteration, unauthorised access or disclosure. These measures include, where appropriate:

• a dedicated Rooted Health Google Workspace account;
• restricted file and folder permissions;
• two-step verification and secure account-recovery controls;
• password-, biometric- and encryption-protected devices;
• automatic device locking and software updates;
• secure cloud storage and encrypted transmission provided by reputable business systems;
• access limited to information necessary for the task; and
• procedures for responding to security incidents and personal-data breaches.

No electronic system can be guaranteed completely secure, but I regularly review whether the measures used remain appropriate for the sensitivity of the information held.

11. How long I keep information

I keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet professional, insurance, tax, legal and regulatory requirements.

When information is no longer required, it will be securely deleted, anonymised or otherwise disposed of appropriately. The right to erasure is not absolute and may not apply where information must be retained for professional, legal, insurance or public-interest reasons.

12. Website cookies and analytics

The Rooted Health website may use cookies or similar technologies that are necessary for security, basic functionality and remembering privacy choices. Clear information about the cookies in use will be provided through an appropriate cookie notice or preference tool.

At the effective date of this policy, Rooted Health does not intend to use Meta Pixel or optional advertising tracking and does not intend to enable Google Analytics at initial website launch. If non-essential analytics, advertising or other tracking technologies are introduced, this policy and the website’s cookie information will be updated, and consent or a simple means of objecting will be provided where required by law.

Third-party websites reached through external links, including booking or social-media services, may use their own cookies and are responsible for their own privacy practices.

13. Newsletter and marketing

If you subscribe to Rooted Health emails, your contact details and subscription preferences will be processed through MailerLite. You can unsubscribe at any time by using the link in an email or contacting claire@rootedhealthuk.com.

Choosing not to receive marketing will not prevent Rooted Health from sending essential service, appointment, payment or clinical communications. Marketing consent is kept separate from receiving a professional service.

14. Artificial intelligence and automated decisions

Rooted Health does not knowingly authorise service providers to use identifiable client clinical content to train public artificial-intelligence models.

Identifiable health or clinical information will not be entered into public AI systems. If an AI-assisted tool is considered for an administrative or professional purpose, its privacy, security and contractual safeguards will be assessed first, and additional information or agreement will be provided where required.

Rooted Health does not use solely automated decision-making to make decisions that have legal or similarly significant effects on clients.

15. Your data-protection rights

Depending on the circumstances, you may have the right to:

• ask for access to the personal information held about you;
• ask for inaccurate or incomplete information to be corrected;
• ask for information to be erased where there is no lawful reason to retain it;
• ask for processing to be restricted;
• object to processing based on legitimate interests or to direct marketing;
• withdraw consent where processing relies on consent;
• receive certain information in a portable format; and
• complain to the Information Commissioner’s Office.

These rights are not absolute and may be limited by professional-record-keeping duties, legal obligations, confidentiality owed to another person or the need to establish, exercise or defend legal claims.

To exercise a right, email claire@rootedhealthuk.com. I may need to verify your identity before releasing information. I will respond without undue delay and normally within one month, subject to any lawful extension.

16. Complaints

Please contact me first if you have concerns about how your information has been handled:

Claire Lynch, Rooted Health: claire@rootedhealthuk.com

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection.

ICO website: ico.org.uk

ICO telephone: 0303 123 1113

17. External links

The Rooted Health website may contain links to websites or services operated by other organisations. Rooted Health is not responsible for their content or privacy practices. Please review the relevant privacy information before providing personal information to another service.

18. Changes to this policy

This policy may be updated to reflect changes in Rooted Health services, technology, legal requirements or professional guidance. The current version will be published on the Rooted Health website with its effective date.

Rooted Health | Claire Lynch | claire@rootedhealthuk.com