Privacy Policy

1. Who We Are

CM Nutrition is operated by Catherine McPhillips, a Registered Associate Nutritionist (ANutr) registered on the UK Voluntary Register of Nutritionists (UKVRN) with the Association for Nutrition (AfN).Data controller: Catherine McPhillips, CM Nutrition
Email: catherine@cm-nutrition.co.uk
Website: www.cm-nutrition.co.uk 

2. What Data We Collect

We may collect and process the following categories of personal data depending on your interaction with CM Nutrition: 

Personal Data:

• Contact and identity data: name, email address, phone number, and any details you provide when making an enquiry or booking.

• Communications data: emails, messages or other correspondence you send to us.

• Website usage data: IP address, browser type, device data, pages viewed, analytics and cookie information (see our Cookie Policy).

• Newsletter data: email address and subscription preferences. 

Special Category Data:

• Health and lifestyle data: health history, dietary habits,  goals and relevant lifestyle information required to deliver nutrition services.

• Consultation records: Notes and records created during or following nutrition consultations, in line with professional practice standards set by the AfN.  

If you do not provide your data
Where data is necessary to enter into a contract (nutrition services), we may be unable to provide those services if you choose not to provide the required information.

3. Lawful Basis for Processing

We only process personal data when we have a lawful basis under UK GDPR:

• Contract: to provide the nutrition services you have requested or booked.

• Legitimate interests: for responding to enquiries, managing operations, improving services , and maintaining business records (balanced against your rights).

• Legal obligation: to comply with applicable laws and professional obligations, including those set by the AfN.

• Explicit consent: for health-related special category data and marketing. You may withdraw consent at any time. 

4. How We Use Your Data

We use your personal data for the following purposes:

• Responding to enquiries and providing the services you have requested.

• Managing appointments, sending reminders and follow-up communications.

• Creating and maintaining consultation records in accordance with AfN professional standards.

• Sending newsletters where you opt in.

• Improving our website (using anonymised analytics).

• Meeting legal, regulatory and professional obligations. 

We do not use your data for automated decision-making or profiling with legal effects. 

5. Special Category Data

Health information is treated with strict confidentiality and extra protection. We only collect and use this information with your explicit consent and only to provide nutrition advice. You may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal.

We do not disclose health information unless:

• Required by law

• Necessary to prevent serious harm, or

• You have given your explicit consent.

6. How We Store and Protect Your Data

We implement appropriate technical and organisational measures, including:

• password-protected and access-restricted systems

• secure storage of consultation records

GDPR compliant third-party platforms that act only on our instructions. We regularly review our security measures.

7. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, and to meet statutory obligations:

• Consultation and health records: retained for a minimum of 8 years from the date of last contact, in line with standard health professional practice guidelines.

• Enquiry and contact data (where no services are provided): retained for up to 12 months.

• Newsletter subscriber data: retained for as long as you remain subscribed. You may unsubscribe at any time.

• Website analytics data: retained in anonymised form per provider provider policies.

After the relevant retention period, data is securely and permanently deleted.

8. Data Processors (Third‑Party Services)

We may use GDPR‑compliant service providers such as:

• booking software,

• email marketing platforms,

• cloud storage or document systems, and

• payment processors.

Each provider acts as a data processor and may only use your data according to our instructions. They may not use your information for their own purposes.

A list of current processors can be provided upon request.

8. Sharing Your Data

CM Nutrition does not sell, rent or trade your personal data. Data is shared only in the following limited situations:

• Service providers: booking, email, payment, IT tools

• Legal or regulatory requirements

• Safeguarding concerns: Serious risk of harm

• With your explicit consent.

9. Children’s Data

Our services are not intended for individuals under 16 unless parental or guardian consent is provided. We do not knowingly collect data from children without such consen

9. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: to obtain a copy of your personal data.

• Right to rectification: to request correction of inaccurate or incomplete data.

• Right to erasure: to request deletion of your data in certain circumstances.

• Right to restriction: to request that we limit how we use your data.

• Right to data portability: to receive your data in a structured, machine-readable format.

• Right to object: to object to processing based on legitimate interests or for direct marketing.

• Right to withdraw consent: where processing is based on consent, to withdraw it at any time.

To exercise any of these rights, please contact us at catherine@cm-nutrition.co.uk.

Complaints: You may also lodge a complaint with the UK Information Commissioner’s Office (ICO): www.ico.org.uk

10. Transfers Outside the UK

We aim to keep your data within the UK. Where any third-party tools we use involve transfer of data outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR requirements.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be posted on this page with an updated date. We encourage you to review this policy periodically.