Last updated: September 2026

Personalised Nutritional Therapy is committed to protecting your privacy and handling your personal information responsibly, securely and transparently.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and store it, who it may be shared with, how long we keep it, and your rights under UK data-protection law.

This policy applies when you use our website, purchase a product or service, subscribe to our emails or resources, contact us, complete a questionnaire or form, or use one of our nutrition services.

Who we are

The data controller is:

Sonia Hollis trading as Personalised Nutritional Therapy
Seven Grange Lane
Pitsford
Northampton
NN6 9AP

Email: sonia@personalised-nutritional-therapy.co.uk

ICO registration reference: ZB476627

CNHC registration number: CNHC02157

For the purposes of this Privacy Policy, “we”, “us” and “our” refer to Sonia Hollis trading as Personalised Nutritional Therapy.

If you have any questions about this Privacy Policy or the way your personal information is handled, please contact us using the email address above.

What information we may collect

The information we collect depends on how you use our website and services.

This may include:

• your name
• email address
• telephone number
• postal, delivery or billing address
• date of birth
• details of products or services you purchase
• payment and transaction information
• information submitted through questionnaires or forms
• information you provide when contacting us
• feedback or survey responses
• newsletter and marketing preferences
• website usage and technical information
• health, nutrition and lifestyle information where this is necessary to provide a practitioner service

Where you use a nutrition or practitioner service, we may also collect special-category health information such as:

• relevant health history
• dietary and lifestyle information
• symptoms or concerns you choose to disclose
• prescribed medication
• supplements
• biochemical or laboratory test results
• practitioner notes
• reports and recommendations prepared for you

We aim to collect only information that is reasonably necessary for the purpose for which it is being used.

Blood Chemistry & Nutrition Review

The Blood Chemistry & Nutrition Review is a practitioner-reviewed, nutrition-led interpretation service for people who already have blood-test results.

If you purchase this service, we may collect:

• your name and contact details
• date of birth
• the date your blood test was taken
• whether the test was fasting
• the approximate time of testing where relevant
• information about illness or strenuous exercise around the time of testing
• prescribed medication
• supplements
• relevant hormonal status where applicable
• relevant health information you choose to provide
• your blood-test results and laboratory reference ranges
• information about particular results or concerns you would like explained
• your consent to processing health information
• your acknowledgement of the scope of the service
• the final Blood Chemistry & Nutrition Review prepared for you

Blood-test results, medication information and other relevant health information are classed as special-category personal data under UK data-protection law.

We therefore take additional care when collecting, accessing, storing and processing this information.

The Blood Chemistry & Nutrition Review is a nutrition-led educational service. It does not diagnose medical conditions, replace medical care or advise you to stop or change prescribed medication.

How we obtain your information

We may obtain personal information in several ways.

Information you provide directly

You may provide information when you:

• purchase a product or service
• complete a questionnaire, intake form or consent form
• upload blood-test results
• contact us by email or another communication method
• subscribe to a newsletter or free resource
• attend a workshop, webinar or event
• provide feedback
• respond to a survey
• create or use an account on our website where applicable

Information collected through our website

When you use our website, certain technical information may be collected automatically, including information such as:

• IP address
• browser type
• device type
• operating system
• pages visited
• website usage information

This may be collected through cookies, server logs and analytics technologies.

Information from payment providers

When you purchase from us, payment and transaction information may be provided by payment processors such as Stripe or PayPal.

We do not normally receive or store your full payment-card details.

Why we use your personal information

We may use your information to:

• provide products or services you have requested or purchased
• process and administer orders
• prepare practitioner-led nutrition services
• prepare a Blood Chemistry & Nutrition Review
• respond to enquiries
• communicate with you about a service you have purchased
• maintain appropriate professional and client records
• process payments
• comply with professional, regulatory, insurance, accounting and legal obligations
• maintain the security and integrity of our website and services
• operate and improve our website
• send newsletters and marketing communications where permitted
• manage subscriptions and communication preferences
• investigate or respond to complaints or legal claims

We do not sell your personal information.

Our lawful basis for processing personal information

Under UK GDPR, we must have a lawful basis for processing personal information.

The basis we rely upon depends on why the information is being processed.

Contract

We may process your personal information where this is necessary to provide a product or service you have purchased or requested.

For example, we need certain personal information in order to fulfil an order or prepare a Blood Chemistry & Nutrition Review.

Consent

We may rely on your consent where you have actively agreed to a particular use of your information.

Examples include:

• agreeing to receive certain marketing communications
• explicitly consenting to the processing of health information where required

You can withdraw consent for future processing that relies upon consent.

Legal obligation

We may process or retain information where this is necessary to meet a legal, regulatory, accounting or professional requirement.

Legitimate interests

In some circumstances we may process information where we have a legitimate business or professional reason to do so and your rights and interests do not override that interest.

Examples may include maintaining appropriate business administration, protecting our website or responding to enquiries.

Health information and special-category data

Information about your health is given additional protection under UK GDPR.

Where health information is required to provide a practitioner service, we identify both an appropriate lawful basis for processing personal information and an appropriate condition for processing special-category information.

For the Blood Chemistry & Nutrition Review, the personal information necessary to provide the purchased service is processed primarily because it is required to fulfil the service you have purchased.

Before we process the health information you submit for the Blood Chemistry & Nutrition Review, including your blood-test results, medication, supplements and relevant health information, we ask you to provide explicit consent.

Your consent is recorded as part of the intake process.

You may withdraw consent for future processing that relies upon consent by contacting us.

Withdrawing consent does not make processing that has already lawfully taken place invalid.

There may also be circumstances where we are required or permitted to retain particular professional records even after consent for further processing has been withdrawn.

How the Blood Chemistry & Nutrition Review is handled

We aim to keep the systems containing health information to a minimum.

Intake and consent – Tally

We use Tally to collect the intake information and consent required to provide the Blood Chemistry & Nutrition Review.

This may include personal and health information.

Access to these submissions is restricted to Sonia Hollis.

Tally stores form data within Europe.

Blood-test uploads and client records – pCloud

We use pCloud to:

• receive blood-test files through a file-request link
• store retained client records
• store completed Blood Chemistry & Nutrition Review reports
• provide clients with access to completed reports

Our pCloud account uses the European Union data region, with data stored in Luxembourg.

People using our file-request link to upload blood results do not need to create a pCloud account.

Practitioner processing

Blood-test results and other information may be temporarily accessed or processed on the practitioner’s computer when preparing and quality-checking a review.

The computer used for this work is protected using full-disk BitLocker encryption.

Access to client health information, Tally, pCloud and the practitioner systems is restricted to Sonia Hollis.

We aim to remove unnecessary temporary or duplicate working copies once they are no longer required.

Website, orders and hosting

Our website is hosted by SiteGround.

Our website may use WooCommerce to process orders and manage purchases.

WooCommerce order information may include details such as:

• your name
• email address
• billing information
• the product or service purchased
• payment status

Detailed Blood Chemistry & Nutrition Review health information is not intended to be stored within the standard WooCommerce order record.

Payments

Payments may be processed by third-party payment providers including:

• Stripe
• PayPal

These providers process payment information in accordance with their own privacy and security arrangements.

We do not normally receive or store your complete payment-card details.

Email and marketing communications

We may use email services and mailing-list providers, including MailerLite, to send newsletters, educational information and other communications.

Marketing communications are separate from communications that are necessary to fulfil a product or service you have purchased.

You can unsubscribe from marketing emails at any time using the unsubscribe link provided in the email or by contacting:

sonia@personalised-nutritional-therapy.co.uk

Unsubscribing from marketing does not prevent us from sending essential communications relating to an order or service you have purchased.

Where your information is stored

Personal and health information submitted through Tally is stored in Europe.

Blood-test files and retained client records stored in pCloud are held within pCloud’s European Union data region in Luxembourg.

Website, payment, email and other business-service providers may process information using infrastructure in the UK, European Economic Area or other countries.

Some providers may also use subprocessors located outside the UK.

Where an international transfer of personal data takes place, we expect the relevant provider to use appropriate safeguards required under applicable data-protection law.

Keeping your information secure

We take reasonable technical and organisational measures to protect personal information against:

• unauthorised access
• accidental loss
• misuse
• alteration
• unauthorised disclosure
• destruction

Measures used within the business include:

• access restricted to the practitioner
• secure passwords
• two-factor authentication where available
• encrypted local-device storage
• secure cloud storage
• limiting the number of systems containing health information
• avoiding unnecessary health-data attachments in ordinary email
• keeping detailed health information separate from standard order information where practical
• removing unnecessary duplicate or temporary files

No online or electronic system can be guaranteed to be completely risk-free.

However, we aim to use proportionate security measures and minimise the amount of personal information stored or transferred unnecessarily.

How long we keep your information

We do not keep personal information for longer than is reasonably necessary for the purpose for which it was collected.

For adult practitioner client records, including records required to support the Blood Chemistry & Nutrition Review, the core client record is normally retained for:

Eight years from the date of the client’s last contact.

This reflects our professional record-keeping requirements.

Our professional indemnity insurance also requires appropriate records of professional services to be maintained.

A core client record may include:

• intake information
• consent records
• blood-test results relied upon
• relevant practitioner notes
• material correspondence
• the final report or recommendations provided

Temporary working files or duplicate upload/download copies may be deleted sooner once they are no longer required.

Other types of information, such as financial, order, website or marketing records, may have different retention periods depending on why the information is held and any applicable legal or business requirements.

We periodically review retained information and aim to delete or anonymise information that is no longer required.

Who we may share information with

We do not sell your personal information.

Where necessary to operate our business or provide a service, information may be processed by third-party service providers such as those providing:

• website hosting
• website and e-commerce functionality
• online forms
• secure cloud storage
• payment processing
• email and newsletter services
• analytics
• accounting
• IT support
• professional or legal services

Current service providers may include:

• SiteGround
• WooCommerce
• Tally
• pCloud
• Stripe
• PayPal
• MailerLite

These providers only receive the information necessary for the relevant service.

We may also disclose information where:

• we are legally required to do so
• a court or regulatory authority requires disclosure
• disclosure is necessary to establish, exercise or defend a legal claim
• there is a serious safeguarding concern or risk to life
• you have specifically asked or authorised us to share information

We do not routinely send your Blood Chemistry & Nutrition Review or blood-test results to your GP or another healthcare professional.

If you ask us to share information with another healthcare professional, this would normally be done with your instruction or consent.

Professional confidentiality

Information provided as part of a practitioner service is treated confidentially.

There may be limited circumstances where confidentiality cannot be maintained, for example where:

• disclosure is required by law
• there is a court order
• there is a serious safeguarding concern
• there is a serious and immediate risk to someone’s life
• disclosure is necessary in connection with a professional or legal claim

Where appropriate and legally possible, we would aim to discuss such disclosure with you.

Marketing

We may send newsletters, educational content, information about products or services, or promotional communications where permitted by applicable law.

Where consent is required, we will ask you before sending such communications.

You can change your marketing preferences or unsubscribe at any time.

We do not require you to agree to marketing in order to purchase a product or practitioner service.

Cookies

Our website may use cookies and similar technologies.

Cookies are small files placed on your device that help websites operate correctly and may also provide information about how a website is being used.

Cookies may be used to:

• operate essential website functions
• process purchases
• remember preferences
• understand how visitors use the website
• measure website performance
• provide analytics
• support marketing where you have permitted this

Some cookies are necessary for the website to function.

Where consent is required for non-essential cookies, you will be given an opportunity to manage your preferences through the website’s cookie-management system.

You can also control cookies through your browser settings.

Blocking some cookies may affect the way parts of the website function.

Website analytics

We may use analytics tools such as Google Analytics to understand how people use our website.

Analytics information may include information about:

• pages visited
• approximate location
• browser or device type
• how visitors arrived at the website
• how long visitors spend on particular pages

Where required, analytics technologies will only operate after appropriate cookie consent has been given.

We use analytics information to understand website performance and improve our services.

Links to other websites

Our website may contain links to other websites or services.

This Privacy Policy applies to Personalised Nutritional Therapy.

If you follow a link to another website, that organisation will have its own privacy practices and we recommend reviewing its privacy information.

We are not responsible for the privacy practices of independent third-party websites.

Your data-protection rights

Depending on the circumstances, UK data-protection law may give you the right to:

• ask what personal information we hold about you
• request a copy of your personal information
• ask us to correct inaccurate or incomplete information
• ask us to erase information in certain circumstances
• ask us to restrict processing in certain circumstances
• object to certain uses of your information
• request transfer of information in certain circumstances
• withdraw consent where processing relies upon consent
• complain about the way your information has been handled

These rights are not absolute in every situation.

For example, a request to erase information does not necessarily mean that professional records which we are required or reasonably justified in retaining must immediately be deleted.

To exercise any of these rights, please contact:

sonia@personalised-nutritional-therapy.co.uk

We may need to confirm your identity before releasing personal information.

Accessing your information

You can make a subject access request by emailing:

sonia@personalised-nutritional-therapy.co.uk

or by writing to:

Sonia Hollis trading as Personalised Nutritional Therapy
Seven Grange Lane
Pitsford
Northampton
NN6 9AP

We will respond within the timeframe required by applicable data-protection law, normally within one month of receiving a valid request.

In some circumstances, the law allows additional time or permits particular information to be withheld.

Correcting your information

It is important that the information we hold is accurate where this is relevant to the service being provided.

Please contact us if you believe information we hold about you is inaccurate or needs updating.

Email:

sonia@personalised-nutritional-therapy.co.uk

Withdrawing consent

Where we rely on your consent to process information, you may withdraw that consent at any time by contacting us.

Withdrawal applies to future processing and does not affect processing that lawfully took place before consent was withdrawn.

There may also be information that we need to retain following withdrawal of consent because of professional, insurance, legal or regulatory obligations.

Automated decision-making

We do not make decisions about clients that have legal or similarly significant effects solely through automated processing.

The Blood Chemistry & Nutrition Review is practitioner-reviewed by Sonia Hollis before the final report is provided.

Complaints

If you have a concern about the way your personal information has been collected, used or stored, please contact us first so that we can investigate and respond.

Sonia Hollis
trading as Personalised Nutritional Therapy
Seven Grange Lane
Pitsford
Northampton
NN6 9AP

Email: sonia@personalised-nutritional-therapy.co.uk

ICO registration reference: ZB476627

You also have the right to complain to the Information Commissioner’s Office (ICO), which is the UK’s independent regulator for data protection.

Further information about your rights and how to make a complaint is available from the Information Commissioner’s Office at ico.org.uk.

Professional registration and insurance

Sonia Hollis is registered with the Complementary & Natural Healthcare Council (CNHC).

CNHC registration number:

CNHC02157

Professional indemnity insurance is held with Hiscox.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect:

• changes to the services we provide
• changes to the systems or service providers we use
• changes to legal or regulatory requirements
• changes to our privacy and security arrangements

The latest version will be published on this page.

Last updated: September 2026