Privacy Policy

Last Updated: October 2026

This privacy notice explains how Lucy Pritchard, Specialist Dietitian ("I", "my") collects, uses, stores, and protects your personal and medical data. As a Registered Dietitian regulated by the Health and Care Professions Council (HCPC) and a member of the British Dietetic Association (BDA), I am committed to maintaining the highest standards of data privacy and confidentiality in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For the purposes of data protection law, I am registered with the Information Commissioner’s Office (ICO) as the Data Controller of your personal information.

1. The Types of Personal Data I Collect

To provide safe, accurate, and evidence-based dietetic care, I process the following categories of information:

• Basic Identifiers: Full name, date of birth, and contact information (email address, telephone number, home address, and postcode).

• Medical & Special Category Data: Medical history, diagnosed clinical conditions, current medications, dietary histories, lifestyle tracking, and allergy profiles.

• Biochemical & Physical Markers: Physical measurements (weight, height, BMI, body composition measurements) and relevant clinical blood test results/biochemistry profiles.

• Professional Correspondence: Referral letters from doctors, diagnostic correspondence, or clinical follow-up letters sent to or received from your GP or consultant medical team.

• Digital & Technical Data: IP addresses, browser types, session activity, and interaction timestamps collected automatically when you visit my website.

• Lawful Basis for Processing: Under the UK GDPR, I process your basic contact details under the basis of Contractual Necessity (to fulfil your bookings and service agreements). I process your health, medical, and allergy data under Article 9(2)(h) of the UK GDPR, which permits the processing of Special Category Data for the explicit purpose of providing health or social care treatment as a regulated healthcare professional.

2. How Your Data is Stored and Processed (My Systems)

I do not use physical paper records; your data is processed entirely within secure, industry-standard digital systems located within the UK or European Economic Area (EEA):

• Website Storefront (Wix): My website is built and hosted using the Wix.com platform. Wix provides the secure public interface for my practice. My website utilizes Hypertext Transfer Protocol Secure (HTTPS/SSL) encryption, ensuring that any browsing data or preliminary contact form messages you submit through the site are encrypted and transmitted securely. Wix automatically uses basic operational cookies to monitor website performance and security.

• Embedded Booking & Records (WriteUpp): When you schedule an appointment, submit payments, or complete health questionnaires, you are interacting directly with WriteUpp's secure, GDPR-compliant portal. Wix does not process, store, or have access to your clinical booking logs, medical intake forms, or health records. All finalised consultation notes, weight tracking logs, and billing profiles are kept entirely within WriteUpp, which is ISO 27001 certified for information security management.

• AI Consultation Assistant (Heidi Health): For clinical consultations, I utilise Heidi Health to accurately capture factual content in real time and assist in compiling structured clinical notes.

- No Long-Term Retention: All original audio clips, structural transcripts, and temporary drafts generated inside Heidi are permanently and securely deleted every month and are not retained beyond this period.

- No Product Training: Patient data processed through this clinical tool is strictly locked and is never used by the software provider to train, test, or develop external AI software models.

3. Who I Share Your Data With

Your data is kept strictly confidential and is never sold, leased, or shared for third-party marketing purposes. It is only shared under the following conditions:

• Your Clinical Care Team: With your prior informed consent, relevant assessment summaries or clinical follow-up letters may be securely shared with your General Practitioner (GP) or consultant medical doctor.

• Legal/Safety Requirements: In exceptional circumstances where there is a legal obligation or a severe risk to your safety or the safety of others, data may be disclosed to statutory authorities or emergency services in compliance with UK law.

4. Data Retention & Security

• Data Retention: Your medical records, weight data, and private health history entries are retained securely for a period of 8 years from the date of your last consultation or the conclusion of your treatment package. This timeline is directly dictated by British Dietetic Association (BDA) record-keeping mandates for adult clients. Once this 8-year retention timeline expires, your digital medical records and corresponding system profiles are permanently and securely erased.

• Data Security & Breach Protocol: While I employ robust, encrypted, and password-protected digital systems to eliminate security vulnerabilities, I maintain a strict data breach response framework. In the highly unlikely event of a critical security breach involving your personal or health records, I am legally bound to report the incident to the Information Commissioner's Office (ICO) and notify you directly within 72 hours.

5. Your Data Protection Rights

Under UK data protection law, you hold specific rights regarding your personal records:

• Right of Access: You can request copies of the clinical files and notes I hold about you at any time free of charge.

• Right to Rectification: You can request that I update or correct any factual inaccuracies within your files.

• Right to Restrict/Object: You have the right to object to or limit certain types of processing, including the option to withdraw your consent for using the Heidi AI assistant during live sessions (requiring manual note-taking instead).

• Data Deletion Limitations: You have the right to request deletion of your basic contact metadata, provided all outstanding balances are paid. However, this right does not overwrite my mandatory statutory duty under BDA guidelines to safely retain your core clinical health records for the 8-year medical retention window.

To exercise any of these rights, please contact me directly using the details provided below. If you remain unsatisfied with how your data is handled, you have the right to raise a formal complaint with the Information Commissioner’s Office (ICO) via their website (ico.org.uk) quoting my registration number. ICO Registration Number: ZC161544

Website: www.lucypritchard.com

Email: info@lucypritchard.com