Privacy & Cookie Notice

Who I am

I am Susan Matthew, usually known as Sue Matthew, and I operate as a sole trader. I provide personalised nutrition services through Dartmouth Nutrition Studio and leadership physiology consulting, development programmes and related services under the name The Physiology of Leadership Performance.

I am the data controller responsible for the personal information described in this notice.

I am registered with the Information Commissioner's Office under registration number ZC105366.

You can contact me at:

Dartmouth Nutrition Studio: sue@dartmouthnutritionstudio.co.uk

The Physiology of Leadership Performance services: hello@suematthew.co.uk

What information I collect

The information I collect depends on the service you use and may include:

• your name and contact details;

• date of birth, where relevant;

• enquiry, booking and appointment details;

• correspondence and records of meetings;

• occupation, business role and professional information;

• information about your goals, priorities and circumstances;

• records of services provided, recommendations and agreed actions;

• workshop, event or programme registration details;

• payment and invoice information;

• mailing-list preferences and records of consent;

• information needed to respond to a complaint, claim or regulatory enquiry;

• website enquiry details and limited technical information about visits to my website, such as IP addresses and pages visited.

For personalised nutrition services, I may also collect health and lifestyle information, including:

• health concerns, symptoms and medical history;

• family health history;

• dietary and lifestyle information;

• medication and supplement use;

• allergies and intolerances;

• GP or other healthcare-professional details;

• laboratory and test results;

• consultation notes and personalised plans.

Health information is special-category personal data and is handled with additional care and confidentiality.

I work with adults only and do not knowingly provide services directly to children.

How I collect information

Most information is provided directly by you when:

• you contact me by email, through a website link or through social media;

• you arrange an appointment through Calendly;

• you complete a questionnaire, terms-of-engagement document or other PDF;

• you attend a consultation, meeting, workshop or programme;

• you correspond with me after a session;

• you book or purchase a service directly;

• you ask to receive updates or nutrition information;

• you submit an enquiry through a website contact form.

I may also receive limited information:

• from an employer or organisation commissioning a workshop or programme;

• from a laboratory or testing provider;

• from a GP or other healthcare professional, where you have agreed to this;

• from another person acting with your authority.

Where an organisation collects registration or employee information for its own purposes, that organisation will normally be responsible for its own use of that information.

You are not generally required by law to provide personal information to me. However, if you do not provide information needed to assess, arrange or deliver a service, I may be unable to provide that service safely or effectively.

How I use your information

I may use personal information to:

• respond to enquiries;

• monitor website usage and performance to help maintain and improve my website and services;

• assess whether a service is suitable for you;

• arrange and manage appointments;

• provide nutrition, leadership physiology, consulting, workshop or educational services;

• prepare and maintain appropriate client records;

• communicate with you about a service;

• arrange laboratory testing or supplement orders where appropriate;

• take bookings and administer payments;

• manage invoices, accounts and business records;

• respond to complaints, claims or regulatory matters;

• meet legal, professional and insurance requirements;

• protect someone’s life or respond to a serious safeguarding concern;

• send updates or nutrition information where you have asked to receive them.

I do not use personal information to make decisions about you solely through automated processing.

Legal basis for using your information

I only collect and use personal information where there is a lawful reason to do so.

In general, I rely on contract to arrange and provide paid services, legitimate interests to respond to enquiries and administer my business and records, consent for marketing and specific disclosures, legal obligation where required by law, and vital interests in a genuine emergency.

Depending on the circumstances, I may rely on:

Contract
Where processing is needed to respond to your request before entering into an agreement, or to provide and administer a service you have booked.

Legitimate interests
Where processing is reasonably necessary to respond to enquiries, administer my business and website, maintain appropriate records, manage professional relationships or establish or defend legal claims, provided that your rights do not override those interests.

Consent

Where you have chosen to receive marketing or updates, agreed to the use of optional website cookies, or where consent is needed before particular information is obtained, used or shared.

Legal obligation
Where information must be used or retained to comply with the law.

Vital interests
In a rare emergency where using or sharing information is necessary to protect someone’s life.

Where I rely on consent, you may withdraw it at any time. This will not affect processing that has already taken place.

Health information is special-category personal data. I rely on your explicit consent to collect and use this information for the purpose of providing personalised nutrition services. You may withdraw that consent at any time. However, I may still need to retain certain records where this is required for legal, professional or insurance purposes.

Organisations and services I use

I currently use:

• 123 Reg to host my business email accounts;

• Microsoft Outlook to access email;

• Microsoft OneDrive to store electronic files;

• Microsoft Teams and Zoom for online consultations and meetings;

• Calendly for bookings;

• Squarespace to build and host my website, collect enquiries submitted through its contact form, and provide website analytics and visitor activity information.

Teams and Zoom meetings are not currently recorded.

Clients currently pay by direct bank transfer. I do not currently use a card-payment processor or collect clients’ card details.

These providers may process limited personal information in accordance with their own privacy terms and their contractual arrangements with me.

I maintain a third-party processors register containing details of the services I use, why I use them and links to their relevant privacy and data-protection information.

Some providers may store or process information outside the UK. Where this happens, I use providers that rely on an applicable adequacy arrangement or another appropriate legal safeguard for international data transfers. Further information is available on request.

Confidentiality & sharing

I keep personal and health information confidential. I do not sell or lend personal information to other organisations.

I may share limited information with:

• technology and administrative providers that support my business;

• laboratories and testing providers;

• supplement suppliers, where information is needed to fulfil an order;

• your GP or another healthcare professional, where appropriate and with your agreement;

• BANT, my professional insurer or professional advisers where necessary in connection with a complaint or claim;

• CNHC, where relevant to a complaint or regulatory matter;

• an organisation commissioning a programme, but not normally including confidential health or consultation information;

• legal, regulatory or public authorities where disclosure is required or permitted by law;

• emergency services or another appropriate authority where necessary to prevent serious harm.

When information is discussed for professional supervision or development, identifying details will be removed wherever reasonably possible.

I will obtain explicit consent before using identifiable case information for teaching, publication, testimonials or other purposes outside the direct provision of your service.

How I protect and store information

I use reasonable technical and organisational measures to protect personal information.

These include:

• password-protected accounts and devices;

• multi-factor authentication;

• secure cloud-based file storage;

• restricted access to client information;

• appropriate device and account security;

• limiting the amount of identifying information kept in accounting records.

Client records are held electronically. I do not maintain paper client records.

Questionnaires and other client information may be provided as PDF documents and stored securely in OneDrive.

Accounting records are maintained in Excel using client reference numbers rather than client names. This minimises the identifying information held in the accounting records.

How long I keep information

I retain personal information for no longer than is necessary for the purpose for which it was collected.

Nutrition-client records are normally retained for eight years after the final consultation, in accordance with BANT professional guidance, unless a longer period is necessary to meet legal, professional or insurance requirements.

Other records, including enquiries, workshop registrations, business correspondence, mailing-list details, invoices and complaints, are retained only for as long as they are reasonably needed for the relevant business, legal or professional purpose.

Information is securely deleted when it is no longer required.

Mailing list and marketing

I maintain a small mailing list for people who have asked to receive updates and nutrition information.

I only send marketing or updates where I have the necessary consent or another lawful basis permitted for electronic communications.

You can ask to stop receiving updates at any time by replying to an email or contacting me using either of the email addresses above.

I retain an appropriate record of consent and any request to unsubscribe.