Privacy Policy – Alison Diss Nutrition

1. Who we are

This policy explains how Alison Diss Nutrition collects, uses and protects your personal information when you visit our website, book a call, work with us as a client or follow us on social media.

Alison Diss Nutrition is run by Alison Diss, who is the data controller responsible for your information. In this policy, "we", "us" and "our" mean Alison Diss Nutrition.

  • Address: 89 Green Lane, Shepperton, TW17 8DU

  • Email: alison@alisondissnutrition.com

  • Phone: 07985 347244 (8.00 am to 5.00 pm, Monday to Friday)

  • ICO registration number: ZB689425

We are not required to appoint a Data Protection Officer. Please contact Alison directly with any question about your information.

2. What information we collect

We only collect what we need for the purpose it's collected for. Most of it comes directly from you.

  • Contact details: your name, email address, phone number and, for clients, your postal address.

  • Booking information: the date and time of calls you book and anything you tell us in the booking form.

  • Health information (clients only): your health history, symptoms, medications and supplements, diet and lifestyle, weight, blood pressure and other measurements, and test results you share with us or that we arrange with your agreement. This is "special category" data under UK data protection law and gets extra protection.

  • Payment information: what you bought and when. Card details are handled by our payment provider and never seen or stored by us.

  • Messages: emails, direct messages on Instagram or LinkedIn, and anything you send through our website forms.

  • Website data: your IP address, browser and device type, and how you use our website, collected through cookies (see section 7).

We only receive information about you from someone else if you ask us to, for example a referral from another practitioner or results sent directly by a testing laboratory.

You don't have to give us your information. However, we can't safely provide nutrition advice without your health information, so if you choose not to share it we may not be able to work with you.

3. Why we use your information and our lawful basis

UK data protection law says we must have a lawful reason for each way we use your information.

  • Reply to enquiries, emails and direct messages: Legitimate interests: answering people who contact us

  • Book and hold free clarity calls: Taking steps you've asked for before entering a contract

  • Provide your nutrition programme, including assessments, plans and follow-ups: Contract. For your health information: your explicit consent

  • Take payments and keep business accounts: Contract, and legal obligation (tax and accounting law)

  • Send newsletters and marketing emails: Consent, which you can withdraw at any time

  • Measure how our website is used: Consent, given through our cookie banner

  • Share an anonymised case study based on your client records: Your explicit, written consent (see section 4)

  • Reshare a public review you've left for us, such as on Google: Legitimate interests: showing prospective clients genuine feedback (see section 4)

  • Keep records in case of a complaint, insurance or legal claim: Legitimate interests. For health information: establishing or defending legal claims

Health information. Because your health information is special category data, we ask for your explicit consent before collecting it, usually in your client agreement or health questionnaire. We use it only to provide your nutrition support. We never sell it or use it for marketing without your separate written consent.

Legitimate interests. Where we rely on legitimate interests, we have considered your rights and only use your information in ways you would reasonably expect.

We do not make any decisions about you using solely automated processing or profiling.

4. Client stories, testimonials and reviews

We never share anything from your client records, such as your story, results or what you've told us in sessions, without your explicit written consent.

Case studies. Sometimes we share anonymised client stories on our website, Instagram, LinkedIn or in emails, to show others what's possible. If we'd like to share yours, we will:

  • show you exactly what we plan to post before it goes live, and get your written agreement to that version;

  • remove your name, photo and anything else that could reasonably identify you, and change minor details where needed;

  • only include health results, such as blood pressure readings, if you specifically agree to them being shared.

Public reviews. If you leave a public review of our services, for example on Google, we may reshare it on our website, social media or in emails. We'll use it word for word, credited as it appears on the original review, and we won't add any details from your client records. We do this because we have a legitimate interest in showing prospective clients genuine feedback. If you'd rather we didn't reshare your review, just tell us and we'll stop (see section 5).

You can say no to either, and it won't affect your programme in any way. You can also change your mind later. Tell us and we'll remove the post from our own channels as soon as possible. We can't recall copies other people have already shared or saved.

5. Your right to object

You have the right to object to us using your information where we rely on legitimate interests. You can also object to direct marketing at any time, and we will stop straight away.

To unsubscribe from emails, use the link at the bottom of any email or contact us using the details in section 1.

6. Who we share your information with

We never sell your information. We only share it with trusted providers who help us run the business, under contracts that require them to keep it secure and use it only on our instructions.

Provider and what they do for us

  • Squarespace: Hosts our website, forms, cookies and website analytics

  • Acuity Scheduling (owned by Squarespace): Handles bookings for calls and appointments

  • Payment provider Stripe: Takes card payments

  • MailerLite: Sends our newsletter

  • Zoom: Hosts online consultations

  • Google Drive: Stores client records and health notes

  • Instagram and LinkedIn: Carry direct messages you send us on those platforms

We may also share information:

  • with your GP or another health professional, but only with your permission, unless there's a serious risk to your health or someone else's safety;

    with a testing laboratory, if you choose to take a test we arrange; with our insurer or legal advisers, if needed to deal with a complaint or claim; when the law requires it.

Transfers outside the UK. Some of these providers, including Squarespace, store data in the United States. Where that happens, the transfer is protected by UK-approved safeguards. These are either the UK Extension to the EU-US Data Privacy Framework, where the provider is certified, or the UK International Data Transfer Addendum to standard contractual clauses. Contact us for a copy of the relevant safeguards.

7. Cookies on this website

Our website is built on Squarespace, which uses cookies. Cookies are small text files stored on your device. We only use cookies that aren't strictly necessary if you agree to them through our cookie banner.

You can change your choice at any time using the cookie settings link at the bottom of every page. You can also block or delete cookies in your browser settings, though some parts of the site may not work properly.

Squarespace explains its own use of cookies in its Cookie Policy.

8. How long we keep your information and how we protect it

We keep your information only as long as we need it, then delete it securely.

Information and how long we keep it

  • Enquiries and messages from people who don't become clients: 12 months from last contact

  • Client records, including health information: [8] years after your last appointment, as recommended for practitioner records and needed for insurance

  • Payment and accounting records: 6 years after the end of the tax year they relate to, as tax law requires

  • Newsletter sign-ups: Until you unsubscribe

  • Consent for a client story: For as long as the story is published, plus 6 years

  • Website analytics: Kept by Squarespace in summary form. We don't use it to identify individuals

Keeping it secure. Client records are stored in password-protected systems with two-step login where available. Only Alison has access. Paper notes, if any, are kept locked away and shredded when no longer needed. If a data breach ever put your information at risk, we would tell you and, where required, the ICO.

9. Your rights

You have rights over your personal information. To use any of them, contact us by email, phone or post using the details in section 1. There's no charge, and we'll respond within one month.

  • Access: ask for a copy of the information we hold about you.

  • Correction: ask us to correct anything inaccurate or incomplete.

  • Erasure: ask us to delete your information. We may need to keep some records, such as client notes or accounts, for the periods in section 8.

  • Restriction: ask us to limit how we use your information while a concern is looked into.

  • Objection: object to how we use it (see section 5).

  • Portability: ask for information you gave us in a format you can pass to someone else.

  • Withdraw consent: where we rely on your consent, withdraw it at any time by emailing us or unsubscribing. It's as easy to withdraw as it was to give. Withdrawing doesn't affect anything we did before. If you withdraw consent for us to hold your health information, we may no longer be able to continue your programme.

10. Complaints

If you're unhappy with how we've handled your information, please tell us first so we can put it right.

  1. Contact us in any way you like: email, phone, post or a direct message. You don't need to use any particular wording.

  2. We'll acknowledge your complaint within 30 days.

  3. We'll look into it properly, keep you updated and tell you the outcome without undue delay.

If you're still not satisfied, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

  • Website: ico.org.uk/make-a-complaint

  • Phone: 0303 123 1113

  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

11. Changes to this policy

We review this policy at least once a year and whenever we change how we use your information. If we plan to use your information in a new way, we'll tell you before we start.

Last updated: 25/09/2026