Privacy and cookie policy

1. Introduction

This policy explains how Rind and Root Ltd collects, processes, stores and shares personal data. It applies to personal data we collect through our website, application forms, email and telephone calls. We use personal data in accordance with UK data-protection legislation.

If you follow a link to another website, it is outside our control. Its own privacy policy will determine how that organisation uses your personal data.

What we do

We provide nutritional therapy services through consultations, dietary and lifestyle analysis, and biochemical testing. Our work focuses on preventative healthcare, optimising physical and mental health, and supporting chronic health conditions through personalised dietary therapy, nutraceutical prescription and lifestyle advice. We also offer certain supplements for sale in the online shop.

2. How we obtain your data

Information you provide

You may provide personal data by:

• completing a nutritional therapy questionnaire;
• signing a terms-of-engagement form;
• taking part in a nutritional therapy consultation;
• contacting us by email, telephone or post; or
• making a credit-card or online payment.

This may include:

• your name, address, contact details and next-of-kin details;
• referrals, appointment requests and other contact history;
• health information, including medical history, dietary, lifestyle, supplement and medicine details, biochemical test results, clinic notes and health-improvement plans;
• GP contact information; and
• bank details.

We use this information to provide direct healthcare services and inform you about our services and offerings, where we have your consent or a legitimate interest. You have the option to opt out of marketing communications. Once your healthcare is complete, we retain it for the period specified by our professional association and registrant body, the ANP, so we can administer any complaint.

Legal basis for processing:

• Legitimate interests: for providing healthcare services and managing professional records
• Legal obligation: to comply with accounting, tax, or professional record keeping requirements
• Contractual necessity: for administering and delivering the online course, processing payments, and fulfilling our obligations under the course agreement
• Compliance with professional obligations: retaining healthcare data to meet requirements of our professional association (ANP) and registrant body (GNC), including processing information in the event of a complaint. In this case, the legal basis of our holding your personal data is for contract administration.

Information from other sources

We may receive sensitive medical information, including biochemical test results, from testing companies in order to provide direct healthcare. We may also receive information from other healthcare providers when you have given your express consent. Without that consent, we may be unable to coordinate your care with theirs.

3. How we use your personal data

We act as a data controller when using your personal data to provide direct healthcare, and as a controller and processor when handling data from testing companies and other healthcare providers. We protect your personal data, including health and contact details, in line with our duty of professional confidence and the UK GDPR.

We may use personal data where there is an overriding public interest, for example to safeguard an individual or prevent serious crime, or where required by law, such as under a court order. We may send marketing communications such as newsletters only where you have given us your expressed consent.

4. Sharing your data

We keep your information confidential and disclose it to third parties only with your express consent, except where disclosure is necessary to:

• our professional association, ANP, to process a complaint;
• contractors and advisers who provide services to us and are bound to keep the information confidential;
• anyone to whom we transfer our rights and duties under an agreement with you; or
• any legal, crime-prevention or regulatory agencies where required or permitted by law.

As part of providing direct healthcare, we may share limited, non-sensitive information with supplement companies and biochemical testing companies. We ask for your express consent before sharing information with your GP or another healthcare provider. If we believe that life is in danger, we may share information with an appropriate authority to protect vital interests.

We may share your case history in an anonymised form with our peers for the purpose of professional development. This may be at clinical supervision meetings, conferences, online forums, and through publishing in medical journals, trade magazines or online professional sites. We will seek your explicit consent before processing your data in this way.

Biochemical testing providers

Where you choose to undertake functional or biochemical testing as part of our services, we may share relevant personal information, health information and sample information with carefully selected third-party testing providers for the purpose of arranging, processing and interpreting your test.

For microbiome testing, we may use Microba Life Sciences Pty Ltd, a testing provider based in Australia. Where this applies, relevant personal, health and sample data may be transferred to and processed in Australia for the purpose of processing your stool sample, generating your microbiome report and making the results available for interpretation. This may include your name, contact details, date of birth, test order details, main symptom details, sample information, microbiome results and related health information where necessary for the test to be carried out and interpreted.

We will only share information that is necessary for the relevant test and associated service. Where personal data is transferred outside the UK, we will take steps designed to protect your information in accordance with UK GDPR requirements, including using appropriate contractual safeguards where required. Microba’s own privacy information can be found here: microba.com/privacy.

5. Your rights

You have the right, subject to applicable exemptions, to see, amend, delete or receive a copy of personal data that identifies you. You can also ask us to correct inaccurate data, restrict processing that is not required by law or ANP guidance, receive your data in a structured, commonly used, machine-readable format, or object to processing.

To make a subject access request or exercise any of these rights, write to the Data Controller at julia@rindandroot.com. We aim to respond within 20 working days once we have received the information needed to process your request. In limited circumstances, some information may be withheld.

We do not carry out automated decision-making using your personal data.

6. Keeping your data secure

We only use information that may identify you in accordance with UK GDPR. We use personal data only where there is a legitimate basis, and in a fair and lawful way. We maintain the common-law duty of confidence for identifiable healthcare information. We use secure locations, limit access to authorised personnel, encrypt devices where appropriate, and require external data processors to maintain and demonstrate suitable security arrangements.

Rind and Root Ltd has a legal obligation to report qualifying data breaches to the UK supervisory authority, the Information Commissioner's Office, within 72 hours.

We are registered with the Information Commissioner’s Office (ICO) as a data controller and collect data for a variety of purposes. A copy of the registration is available through the ICO website (search by business name).

7. Retention

We retain confidential records for the period specified by guidance from our professional association, the ANP.

By law we have to keep basic information about our customers for six years after they cease being customers for tax purposes.

8. Analytics and advertising

We count visits to this website ourselves, to see which pages are read and where visitors come from (for example a search engine or Instagram). This sets no cookie and stores nothing on your device. Each page view records the page address and the site that linked to it; to count each visitor once a day, we keep a one-way hash of your network address and browser type made with a random key that changes daily and is then deleted, so the hash cannot be traced back to you afterwards. Your network address itself is never stored.

We may also use Google Analytics, Google Ads and the Meta Pixel to understand how the site is used and how our adverts perform. None of them sets a cookie until you agree in the cookie banner, and the Meta Pixel is not loaded at all without your consent. The cookies section below lists which of them are switched on today, and you can change your answer at any time from the “Cookie settings” link at the foot of every page.

9. Cookies

The short version: this site sets the few cookies it needs to work and asks before setting anything else. It carries no advertising or third-party tracking. Our use of cookies is governed by the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR, both regulated by the Information Commissioner's Office.

“Cookie” here is shorthand for anything stored on or read from your device — classic cookies, but also your browser's local storage. PECR treats them the same way, so we do too.

Cookies we set without asking

PECR allows a narrow exception for storage that is strictly necessary to provide a service you have asked for. That removes the need for consent, not the need to tell you, so here they are in full.

Cookies we ask about first

These are switched off until you turn them on. Declining them leaves the site completely usable — nothing is held back behind a consent wall.

• Functional

  Remembers small choices you have made, so the site does not ask twice.

  • · Remembering that you closed a newsletter popup, so it stays closed for a while

• Analytics

  Anonymous statistics about which pages are read, to help decide what to write next.

  • · Google Analytics (_ga, _ga_*), if Analytics is switched on in the admin panel

• Advertising

  Lets us measure which adverts led to an enquiry, and show our adverts to people who have visited.

  • · Google Ads conversion measurement (_gcl_au), if advertising is switched on in the admin panel
  • · Meta Pixel for Facebook and Instagram adverts (_fbp), if the pixel is switched on in the admin panel

What we deliberately do not do

• No advertising or retargeting pixels — no Meta Pixel, no Google Ads tag.
• No cookie for our own count of page visits, which stores nothing on your device (see the section above).
• No selling or sharing of browsing behaviour with anyone.
• No embedded social feeds that track you. The Instagram section on this site is built from images we save ourselves, so Instagram is not told that you visited.
• No cookie wall. Refusing costs you nothing but the conveniences listed above.

Changing your mind

Your choice is stored for twelve months, after which we will ask again. You can change it at any moment — withdrawing consent is meant to be as easy as giving it — here, or from “Cookie settings” at the foot of every page:

Cookie settings

You can also clear or block cookies in your browser settings. Blocking the strictly necessary ones will stop parts of the site working: we will have no way to remember that you refused, so you will be asked on every page.

10. Complaints

If you have a complaint about how we use your personal data, email julia@rindandroot.com and we will do our best to help.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO. The ICO’s address:

The ICO’s online presence is at Information Commissioner's Office.