Privacy Statement (UK)
Privacy Notice
Embracing Nutrition Limited | Last updated: July 2026
Embracing Nutrition Limited respects your privacy and is committed to protecting your personal information. This Privacy Notice explains what we collect, why we use it, who we share it with, how long we keep it, and your rights under UK data protection law. When we refer in the notice to data protection law we mean the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy & Electronic Communications Regulation, the Data Use (and Access) Act 2025 and any other applicable data protection laws.
1. Who we are
Embracing Nutrition Limited provides nutritional therapy, functional medicine, functional testing, consultations, corporate wellness, EFT tapping and related wellbeing services. For UK data protection law, Embracing Nutrition Limited is the data controller for the personal information covered by this Privacy Notice.
| Detail | Information |
|---|---|
| Controller | Embracing Nutrition Limited |
| Address | St Marys House, Netherhampton, Salisbury, Wiltshire, SP2 8PL, United Kingdom |
| enquiries@embracingnutrition.co.uk | |
| Telephone | 0345 319 6827 |
| Website | https://embracingnutrition.co.uk |
| Company registration number | 07707235 |
| Data Protection Officer | LAUDIS |
| DPO email | enquiries@embracingnutrition.co.uk |
Please contact us or our Data Protection Officer if you have any questions about this Privacy Notice or how we use your personal information.
2. When this notice applies and what we collect
This notice applies when you visit our website; contact us by phone, email, post, website form or social media; book a discovery call or consultation; create an account or use Practice Better or another client system; become a client; buy products or services; order or consent to functional testing; subscribe to marketing; or interact with our online shop, resources, blog or website.
The personal information we collect depends on how you interact with us. It may include:
| Category | Examples |
|---|---|
| Identity and contact information | Name, account name or username, address, email address, telephone number, date of birth or age, sex where relevant to services or testing, emergency contact details, and social media handle where provided. |
| Appointment, account and client information | Discovery call and appointment details, consultation notes, messages, questionnaires, journals or uploaded records, recommendations, health plans, login/dashboard information, purchases, bookings, refunds, complaints and support requests. |
| Health and lifestyle information | Symptoms, medical history, diagnoses, medication and supplement use, allergies, family medical history, nutrition, sleep, stress, exercise information, laboratory and functional test results, and information relevant to consultations, recommendations or care. |
| Payment, order and delivery information | Products or services ordered, purchase price and transaction date, billing and shipping details, payment-support information, refunds, complaints and order support information. Card payments are processed securely through Stripe. |
| Website, technical and marketing information | IP address, browser type, device information, operating system, access times, referring website or page, pages or products viewed, basket contents, approximate location, cookie preferences, marketing preferences, newsletter sign-up details and email engagement such as opens and clicks. |
We collect information directly from you when you complete forms, contact us, book or attend appointments, create an account, complete questionnaires, upload documents or journals, purchase products or services, consent to functional testing, subscribe to marketing, or communicate through Practice Better or similar systems.
We may also receive information from functional testing laboratories, healthcare professionals where you ask them to share it, payment providers, booking, website, marketing and ecommerce systems, and service providers who help us operate our website and services.
3. How we use your information and our lawful bases
We use personal information only where we have a lawful basis under Article 6 UK GDPR. Where we use special category data, such as health information, we also rely on an Article 9 UK GDPR condition.
| Purpose | Information used | Lawful basis / Article 9 condition |
|---|---|---|
| Responding to enquiries and arranging discovery calls | Identity, contact and message information | Legitimate interests; contract or steps before entering into a contract. |
| Booking appointments, managing accounts and providing services | Identity, contact, account, appointment, client record, health, lifestyle, consultation and test information | Contract; legitimate interests; Article 9 health care or treatment where applicable; explicit consent where required. |
| Creating recommendations, health plans and personalised programmes | Health, lifestyle, consultation, test and client record information | Contract; legitimate interests; Article 9 health care or treatment where applicable; explicit consent where required. |
| Arranging and processing functional tests | Identity, contact, age/date of birth, sex, relevant health information and test information | Contract;; Article 9 health care or treatment. Explicit consent where required |
| Managing communications, questionnaires, journals and records through Practice Better or similar systems | Identity, contact, account, appointment, health and client record information | Contract; legitimate interests; Article 9 health care or treatment, explicit consent where applicable. |
| Processing payments, fulfilling shop orders, deliveries, refunds and complaints, and preventing fraud | Identity, contact, billing, shipping, order, payment, transaction, account and security information | Contract; legal obligation; legitimate interests. |
| Operating, securing and improving our website and services | IP address, device and browser information, usage data, security logs, cookie identifiers and analytics data | Legitimate interests; consent for non-essential cookies where required. |
| Sending newsletters, relevant product or service updates and other permitted marketing | Name, email address, marketing preferences, purchase history and email engagement | Consent or soft opt-in where permitted; legitimate interests for suppression records and relevant communications where lawful. |
| Meeting legal, tax, accounting, insurance and professional obligations, and handling complaints, disputes, regulatory enquiries or legal claims | Relevant identity, contact, financial, transaction, correspondence, client and health information | Legal obligation; legitimate interests; legal claims where applicable. |
Health information and special category data
Health information receives additional protection. We process it only where necessary for services such as nutritional therapy, functional medicine, functional testing, consultation support, health plans, recommendations, record keeping, complaints, insurance and legal obligations. The Article 9 condition will usually be one or more of: health care or treatment by or under the responsibility of a professional subject to confidentiality obligations, where this applies; explicit consent; or legal claims and related professional, insurance or regulatory purposes.
If explicit consent is needed for a particular use of health information, we will ask clearly. You are not legally required to provide most information we request, but if you do not provide information needed for an enquiry, order, consultation, programme or functional test, we may be unable to respond, fulfil your order, or provide safe and appropriate advice.
4. Marketing, cookies and website tracking
We send marketing emails only where permitted, for example because you subscribed, asked for updates, bought or enquired about similar products or services, or we are otherwise allowed by law to contact you. Marketing may include information about our services, events, resources, health-related content, relevant products and related updates.
You can unsubscribe at any time using the link in our emails or by contacting us. We may keep a limited suppression record to make sure we respect your preferences.
Our website uses cookies and similar technologies to make the website work, remember preferences, keep track of basket contents, improve performance, understand website use, support security, and measure email or campaign effectiveness. Where required, we ask for consent before using non-essential cookies..
5. Who we share your information with
We share personal information only where necessary for the purposes described in this notice. Our team members, including practitioners, administrators, shop managers and support staff, may access information where needed to do their work. Access is limited to what is necessary.
Where your services are provided by one of our contracted practitioners, we and the practitioner act as joint controllers of the personal information used to assess your needs, determine any appropriate testing, interpret results, provide advice and maintain your service records. We manage your customer relationship and the secure portal and act as the main contact for privacy enquiries, complaints and requests to exercise your data protection rights. The practitioner is responsible for the professional assessments, records and recommendations they make. We have agreed how our respective data protection responsibilities will be managed, but you may exercise your rights against either us or the relevant practitioner.
| Recipient | Purpose |
|---|---|
| Practice Better | Clinic management, appointment booking, client communication, secure video consultations, questionnaires, journals, uploaded records, client records, recommendations and health plans. |
| Functional testing laboratories | Processing tests and producing results. We may share information such as name, address, sex, age and contact details so the test can be processed correctly, not for unrelated purposes. Privacy information for individual laboratories will be available through the relevant Functional Tests pages where relevant. |
| Stripe | Secure payment processing, payment support and fraud prevention. |
| WooCommerce | Online shop, checkout, order management, account dashboard and purchase history. |
| Mailchimp and ActiveCampaign | Newsletters, email campaigns, purchase-related communications, relevant marketing and product/service updates where permitted. |
| Google, NitroPack and Cloudflare | Website analytics, website services, caching, performance, security and related technical processing. |
| Website hosting, design, SEO and technical support providers | Operating, maintaining and supporting our website and systems. |
| Accountants, insurers, legal advisers and other professional advisers | Accounting, insurance, legal, professional and business support. |
| Regulators, courts, law enforcement and public authorities | Where required by law or necessary for legal, regulatory or public safety purposes. |
| Prospective buyers, new owners or advisers | If our business, website or assets are sold, merged, restructured or transferred. |
Practice Better is based in Canada. When you create a Practice Better account, you will also need to agree to Practice Better’s own terms and privacy policy. We have a data processing agreement with Practice Better to help ensure your information is stored and handled securely.
6. International transfers
Some service providers are based outside the UK or may store or access personal information outside the UK. For example, Practice Better is based in Canada, and providers such as Stripe, Mailchimp, ActiveCampaign, Google, Cloudflare or similar technology providers may involve processing outside the UK depending on how their services are delivered.
Where personal information is transferred outside the UK, we make sure appropriate safeguards are in place where required. These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer safeguards recognised under UK data protection law. You can contact us for more information about the safeguards used.
7. How long we keep your information
We keep personal information only for as long as necessary for the purposes for which it was collected, including legal, tax, accounting, insurance, professional and regulatory requirements.
| Type of information | Retention period |
|---|---|
| General enquiries and contact records | Up to 6 years after the last meaningful contact, unless deleted earlier where appropriate. |
| Client account, appointment, consultation, health and functional medicine records | (Adults) – Retain for 7 years after the last consultation or engagement date, then securely delete unless required for ongoing legal proceedings, complaints, insurance matters or regulatory investigations. Children – Retain until the later of: 7 years after the last consultation; or the client’s 25th birthday. |
| Functional test support records | Up to 24 months after completion, unless they form part of the client record or must be kept longer. |
| Website analytics, personalisation and website activity information | Up to 24 months, unless anonymised or required for security purposes. |
| Payment, order and delivery records | 6 years for tax and accounting purposes. |
| Legal, regulatory, insurance and compliance records | Up to 7 years, or longer if required for legal proceedings or regulatory reasons. |
| Marketing records | Until you unsubscribe, withdraw consent or the information is no longer required. |
| Marketing suppression records | Kept as needed to make sure we do not contact people who have opted out. |
| Reviews, comments or testimonials | Kept while published or relevant, unless removed earlier. |
| Cookies | Kept in accordance with our Cookie Policy. |
When information is no longer needed, it is securely deleted, anonymised or put beyond use.
8. Security, automated decisions, third-party links and children
We use appropriate technical and organisational measures to protect personal information from unauthorised access, loss, misuse, alteration or disclosure. No online system can be guaranteed to be completely secure, but we take security seriously and keep safeguards under review.
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
Our website may link to third-party websites, platforms or services. This Privacy Notice does not apply to those third parties, and we are not responsible for how they use personal information. You should read their privacy notices before using them or providing personal information.
9. Your rights
Depending on the circumstances, you may have the right to:
- access your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to delete your personal information;
- ask us to restrict how we use your personal information;
- object to certain uses of your personal information;
- receive certain information in a portable format;
- withdraw consent at any time, where we rely on consent;
- complain to the Information Commissioner’s Office.
These rights are not absolute. Sometimes we may need to keep or continue using information for legal, professional, insurance, regulatory or legitimate business reasons. To exercise your rights, please contact us using the details in section 1 and clearly state who you are and which right you want to exercise. We may need information to confirm your identity before acting on your request.
10. Complaints
If you are unhappy with how we use your personal information, please contact us first so that we can try to resolve your concern. You can submit a data protection complaint by emailing enquiries@embracingnutrition.co.uk and labelling your email: Data Complaint.
If you are unhappy with our response, then you have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
11. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, systems, legal requirements or how we use personal information. The latest version will be published on our website with the date it was last updated.