Privacy policy

1. Purpose of this Policy

This Privacy Notice explains how we collect, use, and store your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all clients, prospective clients, and visitors to our website.

2. Who we are

Rachael Glover, is a nutritional therapy services provider, registered with the Association of Naturopathic Practitioners (ANP) and the General Naturopathic Council (GNC). We provide nutritional therapy services to clients to improve their health through diet and lifestyle interventions. We focus on preventative healthcare, the optimisation of physical and mental health and chronic health conditions. Through nutritional therapy consultations, dietary and lifestyle analysis and biochemical testing, we aim to understand the underlying causes of your health issues which we will seek to address through personalised dietary therapy, nutraceutical prescription (supplements) and lifestyle advice. We also provide group workshops, seminars and corporate wellness events.

We act as the data controller for the personal information we collect and process in the course of providing the professional services.

3. Information we collect

To provide safe and effective care, we may collect the following types of information:

  • Personal details (name, address, contact details, date of birth, GP contact)

  • Health and medical history, symptoms, and relevant test results

  • Information about diet, lifestyle, medication, supplements, and goals

  • Consultation notes and correspondence

  • Payment details 

4. Lawful Basis for Processing

We process your personal data under the following lawful bases:

  • Contract: to provide you with agreed nutritional therapy services.

  • Legitimate interests: to maintain records and manage our business safely and professionally.

  • Consent: for processing sensitive (special category) health information. You may withdraw your consent at any time.

  • Legal obligation: to comply with legal record-keeping requirements.

Special categories of data include race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health and sexual orientation.

We may hold special category data for the following purposes:

  • Provision of direct healthcare

We process your data under the following articles of General Data Protection Regulation:

  • Article 6(1)(b) – Contract: to provide professional services requested by you

  • Article 9(2)(h) – Provision of healthcare: processing necessary for health and treatment purposes

5. How We Use Your Information

Your information is used to:

  • Provide safe and effective care

  • Assess suitability of personalised health advice

  • Communicate with you about your care

  • Keep accurate clinical records

  • Process payments and manage bookings

  • Meet professional and legal obligations

  • Share marketing and newsletters, subject to your consent


We use MailerLite to manage our newsletter subscriber list and send emails to our subscribers. MailerLite is a third‑party provider that processes subscriber data to help us run and improve our newsletter. MailerLite’s privacy policy is available at https://www.mailerlite.com/legal/privacy-policy. You can unsubscribe from our newsletter at any time using the unsubscribe link in each email or by emailing hello@rachaelglover.com.

We undertake at all times to protect your personal data, including any health and contact details, in a manner which is consistent with our duty of professional confidence and the requirements of the General Data Protection Regulation (GDPR) concerning data protection. We will also take reasonable security measures to protect your personal data storage.

We may use your personal data where there is an overriding public interest in using the information e.g. in order to safeguard an individual, or to prevent a serious crime.

Your data will never be sold or used for marketing without your explicit consent. Your data may be shared with other parties for the following reasons, with your consent

  • To obtain functional tests (such as blood or urine).

  • For booking and administrative purposes.

  • To courier and logistics providers who ship products to you.

  • To companies supplying supplements or other products directly to you on my recommendation.

6. How Your Information Is Stored

All personal information is stored securely in:

  • Password-protected devices

  • Encrypted clinical software - Practice Better

  • MailerLite, protected with two factor authentication (when you sign up for our newsletter)

7. Online Consultations and Electronic Communication

Online consultations are conducted using a reputable platform, Practice Better, with appropriate security measures in place. Although all reasonable steps are taken to protect your information, no internet-based communication system can be guaranteed to be completely secure. 

If you choose to communicate via email, please be aware that standard email is not fully encrypted.

8. How Long Records Are Kept

In line with professional standards and insurance requirements, clinical records are retained for:

  • 7 years from the date of last consultation

  • For children: until age 25 (or 26 if aged 17 at end of treatment)

After this period, records are securely deleted or destroyed. In certain cases, such as where records may be relevant to an insurance claim or legal proceeding, they may be retained for longer.

9. Data Regulations for Minors

Where the client is under the age of 18, consent from a parent or legal guardian is required before treatment can begin. The child remains the data subject under data protection law. Both parents may have the right to access the child’s records unless there is a legal restriction or court order in place that limits this access.

10. Sharing Your Information

We will not share your information with third parties unless:

  • You have given explicit consent (for example, to share with your GP or another healthcare provider);

  • Disclosure is required by law (for example, in cases of serious risk of harm);

  • It is necessary for accounting or administrative purposes (e.g. my professional indemnity insurer, who are GDPR-compliant).

11. Website technical details for www.rachaelglover.com

Our website is built on the Squarespace platform.

Contact Forms- When you contact us through our website

We collect your name, email address, phone number (optional) and the message you send via the webform on the contact page. We provide this information to Squarespace, our website hosting provider, so that they can provide website services to us and help us manage our relationship with you.We use this to reply to your enquiry, on the basis of our legitimate interest in responding to people who contact us. Your enquiry is sent to our business email account.

If you book a discovery call or become a client, your details are transferred to Practice Better, our secure client management system.

If you tick the box to join my newsletter or fill out the newsletter sign up form, your name and email are added to MailerLite on the basis of your consent. You can unsubscribe at any time using the link in every email.

If neither applies, we keep your enquiry for 6 months and then delete it.

Cookies

This website uses cookies and similar technologies, which are small files or pieces of text that download to a device when a visitor accesses a website or app. For information about viewing the cookies dropped on your device, visit The cookies Squarespace uses.

mailerlite:webform:shown

mailerlite:session_id

mailerlite:forms:submitted:[ID]

  • These analytics and performance cookies are used on this website, as described below, only when you acknowledge our cookie banner. You can change your cookie preferences at any time using the ‘Cookie Preferences’ option in the bottom left hand corner of the site. This website uses analytics and performance cookies to view site traffic, activity, and other data.

Analytics

Like most websites, we make use of analytics software in order to help us understand the trends in popularity of our website and different sections of the website. The personal information collected to power our site analytics, includes:

  • Information about your browser, network, and device

  • Web pages you visited prior to coming to this website

  • Your IP address

Information collected may also include details about your use of this website, including:

  • Clicks

  • Internal links

  • Pages visited

  • Scrolling

  • Searches

  • Timestamps

We provide this information to Squarespace, our website analytics provider, to learn about site traffic and activity.

Analytics and performance cookies are only used when you consent using our cookie banner. You can change your cookie preferences at any time using the ‘Cookie Preferences’ option in the bottom left hand corner of the site.

12. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you.

  • Request to move, copy or transfer your data to a third party.

  • Request correction of inaccurate information

  • Request deletion of your data (where legally permissible)

  • Restrict or object to certain forms of processing

  • Withdraw consent at any time

  • Lodge a complaint with the Information Commissioner’s Office (ICO): www.ico.org.uk

Please note that clinical records cannot be deleted where retention is required by law, insurance, or professional standards.

13. Communication and Updates

We may occasionally update this Privacy Notice to reflect legal or procedural changes. The latest version will always be available on our website.

14. Reporting breaches

Any breach of this policy or of data protection laws will be reported as soon as practically possible. This means as soon as we become aware of a breach we have a legal obligation to report any data breaches to the UK Supervisory authority which is the Information Commissioners Officer within 72 hours.

15. Data protection complaints

If you are unhappy with how we have handled your personal data or exercised your data protection rights, please contact Rachael Glover at hello@rachaelglover.com

We will acknowledge your complaint within 30 days and investigate it in accordance with our data protection complaints procedure. If you are not satisfied with our response, you may complain to the ICO.