Privacy Policy

4. How We Store & Secure Your Information

We maintain strict technical and physical security measures to protect both digital and physical client records:

• Digital Security: Digital records, calendar bookings, and electronic client notes are stored using encrypted, access-restricted cloud software (e.g., Google Workspace, dedicated practice management tools).

• Physical Paper Storage: Any physical paper records—including handwritten clinical notes, printed questionnaires, or physical lab reports—are held securely in locked filing cabinets within restricted-access premises. Physical records are never left unattended in public or shared clinic spaces.

• Third-Party Processors: We share data only with trusted service providers necessary to run our business (e.g., payment processors, practice management systems, clinical testing laboratories). All providers are bound by strict data processing agreements.

• Primary Care / GP Contact: We will only contact or share details with your registered Medical Doctor (GP) or healthcare team if you have granted explicit consent on your health questionnaire, or in rare circumstances where there is an immediate emergency safety risk (Art. 9(2)(c)).

5. Cross-Border Data Transfers

Because we operate in France, serve clients internationally (including across the European Economic Area, the UK, and worldwide), and utilise secure cloud technology providers:

• French & EEA-Based Clients: Data processed within France and the European Economic Area (EEA) is protected under EU GDPR standards and does not require additional transfer mechanisms.

• UK-Based Clients: Transfers between France (EEA) and the UK are permitted under mutual adequacy decisions established between the European Commission and the UK Government.

• Clients Outside the EEA/UK & International Transfers: Where digital data is transferred to or stored on servers outside the EEA/UK (e.g., cloud infrastructure or software providers based in the United States), we ensure appropriate legal safeguards are in place, such as EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or certification under the EU-U.S. Data Privacy Framework.

6. Data Retention & Destruction (BANT & CNHC Compliant)

In accordance with professional standards set by BANT (British Association for Nutrition and Lifestyle Medicine), the CNHC (Complementary and Natural Healthcare Council), and our professional indemnity insurance providers, we adhere to the following retention periods:

• Adult Client Records: Health assessments and questionnaires, consultation notes, personalised plans and booking records are retained for a minimum of 7 years from the date of your last consultation or session.

• Minor Client Records (Under 18): Client records for minors are retained for 7 years after the client reaches the age of majority (18)—meaning records are kept until the client's 25th birthday.

• General Enquiries: Email inquiries that do not result in a consultation or client relationship are securely deleted after 12 months.

• Secure Disposal: Upon expiry of the mandatory retention period, digital files are permanently erased, and physical paper records are destroyed using high-security cross-cut shredding or certified confidential disposal services.

Note: Storage of client records following the conclusion of your sessions is maintained under our legitimate interest and legal requirement to comply with professional record-keeping standards and to establish, exercise, or defend potential legal claims (GDPR Art. 6(1)(f) and Art. 9(2)(f)).

7. Your Legal Rights

Under EU and UK data protection laws, you have the right to:

1. Access: Request a copy of the personal data and consultation notes we hold about you.

2. Rectification: Request correction of inaccurate or incomplete data.

3. Erasure ("Right to be Forgotten"): Request the deletion of your personal and non-clinical data (e.g., marketing preferences, booking accounts, or general enquiries). Note: For consultation records, retention for a minimum of 7 years post-session remains mandatory for professional indemnity insurance and regulatory compliance.

4. Restriction & Objection: Restrict or object to how we process non-clinical data.

5. Withdraw Consent: Withdraw your consent at any time where processing relies purely on consent (e.g., marketing or Doctor/GP communication).

 To exercise any of these rights, please contact us at [email protected].

If you are unsatisfied with our response, you have the right to lodge a complaint with a supervisory authority:

• In France: Commission Nationale de l'Informatique et des Libertés (CNIL) – cnil.fr

• In the UK: Information Commissioner’s Office (ICO) – ico.org.uk

8. Cookies & Online Tracking

Our website uses essential cookies to enable secure bookings and site navigation. We may also use analytical cookies to understand website usage. You can manage or disable non-essential cookies at any time via our cookie banner.

9. Contact Us

For questions regarding this Privacy Policy or your personal health records, please contact:

Claire Hansen Change Nutrition

Attn: Data Protection Officer / Practitioner

291 chemin du Castellaras, 06650 LE ROURET, FRANCE

Email: [email protected]

Phone: +33 (0)6 89 13 18 79