Privacy Notice

1st November 2026

Who I am

I'm Victoria Dickinson, a Nutritional Therapist. I provide nutritional therapy through my company, VDNutrition Ltd, which trades as Victoria Dickinson Nutrition. In this notice, "I", "me" and "my" mean Victoria acting on behalf of VDNutrition Ltd.

VDNutrition Ltd is the data controller for your personal information and is registered with the Information Commissioner's Office (ICO), registration number [Z number]. It is registered in England and Wales, company number 13387681, with its registered office at Wesley Offices, 74 Silver Street, Nailsea, BS48 2DS.

I'm registered with the General Naturopathic Council and a member of the Association of Naturopathic Practitioners (ANP) and I follow their professional standards on confidentiality and record keeping.

This notice explains how I collect, use, store and protect your information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to anyone who visits my website, contacts me, has a discovery call or becomes a client. If you have any questions, please email hello@victoriadickinson.co.uk.

Information I collect

What I collect depends on how you deal with me.

When you contact me. Your name, email address, phone number (if given) and whatever you write in your message. Please don't include detailed medical information in the contact form; we'll cover that properly on your call.

During a discovery call. Calls are not recorded. I take brief handwritten notes, such as your first name, age and the main health concerns you mention. These notes don't include your contact details.

When you become a client. To provide safe and effective care, I collect:

  • Personal and contact details: name, address, email, phone number, date of birth, GP and emergency contact details.

  • Health information: medical history, current symptoms, diagnoses, medications, and results of tests, including NHS blood tests and private functional or genetic tests.

  • Lifestyle and diet information: eating patterns, food diaries, routines, supplements and your health goals.

  • Clinical records: my consultation notes, the plans I write for you and our messages and correspondence.

  • Payment details: invoices, payment records and appointment history.

When you visit my website. Information collected through cookies, such as the pages you visit. See my [Cookie Policy] for details.

Health and genetic information are "special category" data under data protection law. I take particular care with them, as explained below.

How I use your information and why

The law requires a lawful basis for each use of your information (UK GDPR Article 6), and an additional condition for health and genetic data (Article 9).

  • Replying to your enquiry and arranging a discovery call: communication and administration actions you asked me to perform (steps you ask me to take before entering a contract).

  • Noting health concerns you share on a discovery call: administration and record keeping (steps you ask me to take before entering a contract), with your explicit consent for the health information.

  • Assessing your needs and providing nutritional therapy, including checking your medications against my recommendations and supplements for safety, and communicating with you about your care and appointments: delivering services to you (performance of my contract with you), with your explicit consent for the health information.

  • Sharing information with your GP, testing labs or supplement dispensaries: delivering services to you (performance of my contract with you), with your explicit consent for each disclosure.

  • Invoicing, accounts and tax records: legal obligation.

  • Keeping accurate clinical records in line with professional and insurance standards, and defending legal claims: legitimate interests, and for health information, the condition allowing processing to establish, exercise or defend legal claims.

  • Analytics cookies on my website: your consent.

I ask for your explicit consent to process your health information before your discovery call and again when you become a client. You can withdraw it at any time (see "Your rights"). If you do, I can't continue providing nutritional therapy, but I may keep the records I already hold where I need them to meet professional or insurance standards or defend a legal claim.

I don't use your information for automated decision-making or profiling, I don't send marketing emails, and I will never sell your information.

Children and young people

I work with clients under 18 only with the involvement of a parent or guardian, whose explicit consent I need before consultations begin.

The child is the data subject: the information belongs to them. A parent with parental responsibility can exercise the child's data protection rights on their behalf while the child is too young to understand them, unless a court order restricts this. As a young person becomes mature enough to understand their care, I'll involve them directly and take their views into account, including on what is shared with their parent or guardian, unless there is a safeguarding concern.

I keep children's records for longer than adults' records (see "How long I keep your information").

Who I share your information with

I keep your information confidential and share it only in these situations.

With your consent:

  • Your GP or other healthcare professionals, for example a referral letter or update.

  • Testing laboratories, if you choose to have private functional or genetic testing, so tests can be ordered and I can interpret the results. You'll usually order and pay for the test with the lab directly. Each lab is responsible for its own handling of your data and has its own privacy notice.

  • Supplement dispensaries, if you choose to buy recommended supplements at my practitioner discount, so they can fulfil your order. [Name dispensaries, e.g. Natural Dispensary.]

With companies that provide services to me, which process information on my behalf and under my instructions:

  • Squarespace: hosts my website and contact form.

  • Google Workspace: email, calendar and secure document storage.

  • WhatsApp (Meta): messaging with clients who choose to use it.

  • [Video platform]: online consultations.

  • [Payment provider or bank]: payments.

With professional advisers and bodies where necessary, all bound by confidentiality: my accountant (invoicing and payment records only), my insurer or legal advisers if there is a claim, and my professional bodies (the ANP and the General Naturopathic Council) if a complaint is referred to them.

Without your consent only where the law requires or allows it, for example to protect you or someone else from serious harm, to prevent a serious crime, or if a court orders it.

Messaging by email and WhatsApp

Between sessions you can contact me by email or WhatsApp, as agreed between us.

  • Email is protected in transit, but standard email is not end-to-end encrypted. Please bear this in mind when sending sensitive health details.

  • WhatsApp messages are end-to-end encrypted, but WhatsApp (owned by Meta) collects information about how the service is used, and backups to iCloud or Google Drive aren't encrypted unless you turn that on in WhatsApp's settings.

Using WhatsApp is your choice; if you'd rather not, I'll use email only. Please send documents such as test results by email rather than WhatsApp. I copy any clinically relevant information from messages into your client record.

Messaging isn't monitored outside working hours and isn't suitable for urgent health concerns. Contact your GP, call NHS 111, or call 999 in an emergency.

International transfers

Some of my service providers, including Squarespace, Google and Meta, are based in or store data in the United States. Your information is only transferred outside the UK with safeguards approved under UK law: either a UK adequacy decision (such as the UK-US Data Bridge) or the International Data Transfer Agreement or equivalent contractual clauses, so that it receives an equivalent level of protection.

How long I keep your information

  • Enquiries that don't lead to a discovery call: 6 months from your last contact.

  • Discovery call notes, if you don't become a client: 6 months, then shredded.

  • Adult client records: 7 years from your last consultation.

  • Client records for under-18s: until the client's 25th birthday, or 26th if they were 17 when their sessions ended.

  • Invoices and payment records: 6 years after the end of the financial year they relate to.

  • Email and WhatsApp messages: relevant content is copied into your client record, and message threads are deleted periodically.

These periods follow ANP professional standards, my insurer's requirements, and tax rules. If records relate to an active legal claim or insurance matter, I may keep them until it is resolved. At the end of each period I securely delete electronic records and shred paper ones.

Keeping your information secure

I keep client records partly electronically and partly on paper.

  • Electronic records are stored in Google Workspace, protected by two-factor authentication, on password-protected, encrypted devices.

  • Paper records, including discovery call notes, are kept in a locked cabinet at my clinic.

  • Online consultations take place on [video platform], a reputable service with appropriate security.

  • Access is limited to me. My company's director has administrative access to its IT systems for technical support only.

While I take all reasonable steps to protect your information, no internet transmission can be guaranteed completely secure.

If a data breach occurs, I'll report it to the ICO within 72 hours where the law requires, and tell you without undue delay if it's likely to pose a high risk to you.

Your rights

You have the right to:

  • Access: ask for a copy of the information I hold about you (a subject access request)

  • Rectification: ask me to correct information that is wrong or incomplete

  • Erasure: ask me to delete your information. This doesn't apply to clinical records I need to keep to meet professional, insurance or legal requirements, but I'll delete anything I don't need.

  • Restriction: ask me to limit how I use your information in certain circumstances

  • Objection: object to my using your information on the basis of legitimate interests

  • Portability: ask for information you gave me in a portable format

  • Withdraw consent at any time, including to cookies. This doesn't affect anything I did before you withdrew it.

To use any of these rights, email hello@victoriadickinson.co.uk. I'll need to verify your identity before releasing records. I'll respond within one calendar month, free of charge. For complex or multiple requests I may extend this by up to two further months, and I'll tell you within the first month if so. If a request is manifestly unfounded or excessive, I may charge a reasonable fee or refuse it where the law allows.

Complaints

If you're unhappy with how I've handled your information, please email me first so I can try to put it right. I'll acknowledge your complaint within 5 working days and respond fully within one calendar month.

You also have the right to complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; ico.org.uk; helpline 0303 123 1113.

Cookies, testimonials and changes to this notice

Cookies. My website uses necessary cookies and, only if you accept them, analytics cookies. My [Cookie Policy] explains these and how to change your preferences.

Testimonials. I only publish a testimonial with your written permission, and identify you only in the way you agree to, such as by first name or initials. You can ask me to remove it at any time.

Changes. I may update this notice from time to time. The latest version will always be on my website, with the date it was last updated at the top.