The Whole You Dietitian is the trading name of Steven Paul, a sole trader registered in England and Wales, HCPC registration number DT036168, and a member of the British Dietetic Association. I am the data controller for the personal data described in this policy.

Last updated: 12 August 2026

1. Who we are

The Whole You Dietitian is the trading name of Steven Paul, a sole trader registered in England and Wales, HCPC registration number DT036168, and a member of the British Dietetic Association. I am the data controller for the personal data described in this policy.

Contact: info@thewholeyoudietitian.co.uk / 07467 689 466

ICO registration number: CSN6994737

2. What data I collect

Free 15-minute discovery call: if you book a free discovery call, I ask for your name, date of birth, gender and preferred pronouns (optional), a brief general description of what you’d like to discuss, and your contact details. This is collected via a short form, only after you’ve given consent to it. Date of birth is used to confirm you’re an adult enquiring about the service; gender and pronouns are entirely optional and are used only so I can address you appropriately when we speak, not for any clinical purpose.

Paid consultations and ongoing care: once you book a paid consultation, I collect the following:

• Contact details: name, email address, phone number, address
• Health data: medical history, current medications, dietary intake, anthropometric measurements (height, weight), symptoms, and other information you share during consultations — this is “special category data” under UK GDPR
• Ethnicity: used to apply clinically appropriate thresholds and reference ranges (for example, BMI and waist circumference cut-offs, which vary by ethnic background) — this is also “special category data” under UK GDPR, and is optional to disclose
• Sex assigned at birth: used to apply clinically appropriate reference ranges (for example, BMI, waist circumference, and some blood test results, which differ by male/female physiology) — this is also “special category data” under UK GDPR; you may select “prefer not to say” or “other” if male/female categorisation does not apply to you
• Consultation records: clinical notes, meal plans, nutrition analysis, and AI-generated consultation summaries
• Consultation audio: as standard practice, your consultation audio is processed using an AI scribe tool to generate clinical notes and is not retained afterwards
• Booking and payment data: appointment history via Microsoft Bookings, and payment records via Square
• Communications: emails and messages sent via Microsoft 365 (Outlook, Forms, Bookings), and any social media DMs relating to your care

Your date of birth and address may also be used together to verify your identity when we speak by phone or video call.

3. Why I process your data and my lawful basis

• Free discovery call enquiries — lawful basis: consent (Article 6(1)(a)), given before any information is collected. If consent isn’t given, no data is collected or retained
• Providing dietetic consultations and care — lawful basis: performance of a contract (Article 6(1)(b)) and, for health data, Article 9(2)(h) — provision of health care by, or under the responsibility of, a health professional subject to a duty of confidentiality
• Managing bookings, payments, and cancellations — performance of a contract
• Complying with professional and legal obligations (HCPC record-keeping standards, tax records) — legal obligation
• Sending appointment reminders and service-related communications — legitimate interest
• Marketing emails or newsletters, if you opt in — consent (you may withdraw this at any time)

Article 9(2)(h) is used as the primary basis for processing health data because I am an HCPC-registered health professional providing care under a duty of professional confidentiality; explicit consent (Article 9(2)(a)) is also obtained through the Client Consent Form as an additional safeguard. Ethnicity is processed under this same basis, as it directly informs clinical thresholds used in your assessment.

4. Where your data is stored

Clinical records, bookings, and day-to-day communications are managed through Microsoft 365 Business: client files and clinical notes in OneDrive/SharePoint, email via Outlook, intake forms via Microsoft Forms, appointment scheduling via Microsoft Bookings, and video consultations via Microsoft Teams. Your Microsoft 365 tenant is hosted in the UK.

AI-assisted consultation notes are generated via Heidi Health, an AI medical scribe, as standard practice. Heidi Health hosts UK client data within the UK, is certified to ISO 27001 and SOC 2 Type 2, and consultation audio is processed to generate notes and then deleted rather than retained.

Online payments are processed via Square (operated by Block, Inc.). Square is PCI-DSS compliant and, as merchant of record, carries responsibility for PCI compliance rather than the practice. Square applies its EEA/UK Data Processing Terms to UK-registered accounts.

I have satisfied myself that each of these processors provides appropriate safeguards for UK GDPR compliance. I do not sell or share your data with any third party for marketing purposes. Where relevant to your care — for example, following a referral, or where necessary for your safety — I may correspond with your GP or another healthcare professional. I will only share what is necessary for that purpose, sent using a secure method via Microsoft 365. Separately, if you give consent when completing your intake form, I will also share a summary of your consultation with a GP or other healthcare professional you nominate, even where this isn’t required for a referral or your immediate safety. You can withdraw this consent at any time by letting me know.

5. How long I keep your data

• Free discovery call enquiries that don’t proceed to a paid consultation: deleted after 12 months
• Client intake form contact details, where a client does not consent to proceed after booking: retained only to process your refund, and deleted once the refund is confirmed
• Clinical consultation records: retained for a minimum of 10 years from your last consultation, in line with professional record-keeping guidance
• Booking and payment records: retained for 6 years for tax and accounting purposes
• Marketing consent records: retained until you withdraw consent

6. Your rights

Under UK GDPR, you have the right to:

• Access a copy of the data I hold about you
• Ask me to correct inaccurate data
• Ask me to delete your data (“right to be forgotten”), subject to my professional record-keeping obligations
• Ask me to restrict or object to certain processing
• Receive your data in a portable format

To exercise any of these rights, contact me at info@thewholeyoudietitian.co.uk. I will respond within one month.

7. Complaints

If you have concerns about how your data is handled, please contact me first at info@thewholeyoudietitian.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or 0303 123 1113.

8. Changes to this policy

I may update this policy from time to time. The “last updated” date at the top will reflect the most recent revision.