Privacy Policy:
 

Flynn Nutrition respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and share personal information when you visit our website, contact us, book an appointment or receive dietetic or nutrition services from us. It also explains your rights under UK data protection law.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and applicable amendments to those laws, including the Data (Use and Access) Act 2025.

Last updated: 21 August 2026
 

1. Who we are
 

Flynn Sport Nutrition and Dietetics is the data controller responsible for deciding how and why your personal information is used in connection with our services.
 

Trading name: Flynn Nutrition
Legal entity: Flynn Sport Nutrition and Dietetics LTD
Company number: 17484623
Registered/business address: 55 Graigola Road, SA7 9HS
Data protection contact: Antonia Flynn
Email: contact@flynn-nutrition.com
ICO registration reference: [insert once registered, if applicable]
 

References in this policy to “Flynn Nutrition”, “we”, “us” or “our” mean the data controller identified above.
 

2. The information we collect:
 

The information we collect depends on how you interact with us and the services you receive.

Identity and contact information

This may include:

• your full name;

• date of birth;

• postal address;

• email address;

• telephone number;

• preferred method of communication;

• emergency contact details;

• details of a parent, guardian or representative where appropriate; and

• details of your GP, consultant or other healthcare professionals involved in your care.
   

Appointment and administrative information:
 

This may include:

• appointment dates and times;

• booking history;

• referral information;

• correspondence with us;

• cancellation or non-attendance information;

• invoices and payment information;

• insurer, employer, organisation or funding information where relevant; and

• information needed to manage your account or relationship with Flynn Nutrition.
   

We do not normally store complete payment-card information ourselves where payments are processed through a third-party payment provider.

Health and clinical information
 

As registered healthcare professionals, we may need to collect information about your physical and mental health in order to provide safe and appropriate dietetic care.
 

This may include:

• medical diagnoses and medical history;

• current symptoms;

• medications and supplements;

• allergies and intolerances;

• relevant blood results, investigations and clinical correspondence;

• gastrointestinal symptoms;

• menstrual, reproductive or fertility-related information where relevant to your care;

• mental health and eating-related information where relevant;

• dietary intake, eating patterns and food preferences;

• nutritional requirements;

• weight, height, body composition or other anthropometric measurements where clinically appropriate;

• physical activity, exercise and sporting information;

• training and competition information where relevant;

• lifestyle, sleep and wellbeing information;

• nutritional assessment findings;

• agreed goals and treatment plans;

• clinical progress;

• communications relating to your care; and

• information supplied by other healthcare professionals or people appropriately involved in your care.
   

Information about health is classed as special category personal data and receives additional protection under data protection law.
 

We will aim to collect only information that is relevant and necessary for the purpose for which it is being used.
 

Website and technical information:
 

When you use our website, certain technical information may be collected automatically. This may include:

• IP address;

• browser type and version;

• device type;

• operating system;

• approximate location derived from IP information;

• pages visited;

• date and time of access;

• referring website;

• interactions with our website; and

• cookie or similar technology information.
   

Further information is provided in the Cookies and website technologies section below.
 

3. Where we obtain information from:
 

We usually obtain information directly from you.

Where appropriate, we may also receive information from:

• your parent, guardian, carer or authorised representative;

• your GP;

• consultants and other healthcare professionals;

• NHS services;

• another dietitian;

• a referring healthcare provider;

• an insurer;

• an employer or organisation funding your care;

• another organisation that has referred you to Flynn Nutrition; or

• other people involved in your care where there is an appropriate lawful basis for them to provide the information.
   

Where information is obtained from another source, we will handle it in accordance with this Privacy Policy and our professional duties of confidentiality.
 

4. Why we use your information:
 

We may use personal information to:

• respond to enquiries;

• provide information about our services;

• arrange and manage appointments;

• assess whether our services are appropriate for you;

• carry out dietetic and nutritional assessments;

• provide dietetic treatment, advice and support;

• prepare personalised recommendations or care plans;

• monitor progress and clinical outcomes;

• maintain accurate clinical records;

• communicate with you about your care;

• communicate appropriately with healthcare professionals involved in your care;

• manage referrals;

• liaise with insurers or funding organisations where relevant;

• process payments and invoices;

• manage our accounts and meet tax obligations;

• provide appointment reminders and other service communications;

• manage complaints, concerns and incidents;

• comply with safeguarding responsibilities;

• establish, exercise or defend legal claims;

• comply with professional, regulatory and legal obligations;

• maintain the safety and security of our systems;

• improve the quality and administration of our services;

• carry out appropriate clinical audit and service evaluation, using anonymised information wherever reasonably possible; and

• send marketing communications where permitted by law.
   

We will not use personal information for a purpose that is incompatible with the reason for which it was originally collected unless we have a lawful basis to do so.
 

5. Our lawful bases for using personal information:
 

Data protection law requires us to have a lawful basis for processing personal information.

Depending on the circumstances, we may rely upon the following bases under Article 6 of the UK GDPR.

Contract – Article 6(1)(b):
 

We may process information where this is necessary:

• to take steps at your request before entering into an agreement with you; or

• to provide services that you have asked us to provide.
   

For example, this may apply when you enquire about our services, book an appointment or receive privately funded dietetic care.
 

Where another organisation rather than you has contracted with Flynn Nutrition to fund or arrange services, Article 6(1)(b) will not necessarily apply to all processing and another lawful basis may be used.
 

Legal obligation – Article 6(1)(c):
 

We may process information where necessary to comply with an obligation imposed on us by UK law.

This may include certain financial, tax, regulatory, safeguarding or legal requirements.

Vital interests – Article 6(1)(d)
 

In exceptional circumstances, we may use or disclose information where this is necessary to protect someone's life or vital interests and another lawful basis is not appropriate.

Legitimate interests – Article 6(1)(f)
 

We may process information where this is necessary for a legitimate business or professional purpose and where our interests are not overridden by your rights and interests.

This may include:

• administering and protecting Flynn Nutrition;

• maintaining appropriate business records;

• managing referrals or services funded by third parties;

• preventing fraud or misuse;

• maintaining network and information security;

• handling complaints;

• improving our services; and

• establishing or protecting our legal rights.
   

Where we rely on legitimate interests, we consider the necessity and proportionality of the processing and its potential impact on you.
 

Consent – Article 6(1)(a):
 

We will rely on consent where consent is the appropriate legal basis, particularly for certain optional activities.
 

For example, we may ask for consent for particular forms of marketing communication.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
 

6. How we lawfully process health information:
 

Health information receives additional protection because it is special category personal data.

For information required to provide dietetic assessment, treatment or care, Flynn Nutrition will ordinarily rely on Article 9(2)(h) of the UK GDPR, which permits processing that is necessary for:

• medical diagnosis;

• the provision of health or social care or treatment; or

• the management of health or social care services, where the relevant professional confidentiality requirements are met.
   

Where required, this is supported by the relevant health and social care condition contained in Schedule 1, Part 1 of the Data Protection Act 2018.
 

Our dietitians are registered healthcare professionals and are subject to professional duties of confidentiality.
 

We do not normally rely on your consent as the legal basis for maintaining the core clinical information necessary to provide your care.
 

This is separate from your clinical consent to receive dietetic assessment or treatment.

In other circumstances, special category information may also be processed where another condition applies, including where necessary:

• to establish, exercise or defend legal claims;

• to protect someone's vital interests;

• for safeguarding or other substantial public-interest purposes where permitted by law; or

• where you have given explicit consent for a particular optional use.
   

7. Clinical confidentiality and sharing information:
 

We treat information about your health and care as confidential.

We will only share personal information when there is an appropriate reason to do so and will limit disclosure to information that is relevant and necessary.

Depending on your circumstances, information may be shared with:

• dietitians working within Flynn Nutrition;

• authorised administrative or support staff;

• your GP;

• your consultant;

• another healthcare professional involved in your care;

• a referring healthcare professional or organisation;

• an insurer or funding organisation where appropriate;

• service providers acting on our instructions;

• our accountants, insurers, solicitors or professional advisers;

• professional or regulatory bodies where required;

• safeguarding services;

• emergency services; or

• courts, law-enforcement bodies, regulators or other authorities where disclosure is required or permitted by law.
   

Where another healthcare professional is involved in your care, relevant clinical information may be shared where this is necessary and appropriate for the provision of safe and coordinated healthcare.

Where an employer, sports organisation, insurer or other third party funds your care, this does not automatically entitle that organisation to unrestricted access to your clinical record. We will establish what information, if any, may appropriately be shared and will respect applicable confidentiality and data protection requirements.

We will not sell your personal information.
 

8. Safeguarding and serious risk:
 

There may be circumstances in which our professional or legal responsibilities require us to disclose information without seeking your prior permission.

This may include situations where we reasonably believe that disclosure is necessary to:

• protect you or another person from serious harm;

• safeguard a child or adult at risk;

• respond to an immediate medical emergency;

• comply with a court order or other legal requirement; or

• meet another overriding legal or professional obligation.
   

Where appropriate and safe to do so, we would normally seek to discuss such a disclosure with you.
 

9. Service providers and organisations processing information for us:
 

We may use carefully selected third parties to provide services that support the operation of Flynn Nutrition.

These may include providers of:

• website hosting and website forms;

• appointment booking;

• electronic clinical records;

• secure cloud storage;

• business email;

• video consultations;

• telephone or messaging services;

• payment processing;

• accounting and invoicing;

• electronic forms and questionnaires;

• IT support and cybersecurity;

• website analytics; and

• email marketing.
   

Where a provider processes personal information on our behalf, we will take reasonable steps to ensure that appropriate data protection arrangements are in place.
 

Current key service providers:

• Website platform/hosting: [insert]

• Clinical record system: [insert]

• Booking system: [insert]

• Email/cloud services: [insert]

• Video consultation platform: [insert]

• Payment processor: [insert]

• Accounting system: [insert]

• Forms/questionnaire system: [insert]

• Analytics provider: [insert]

• Marketing provider: [insert, if applicable]
   

This section should be updated if the systems used by Flynn Nutrition materially change.

Some providers may act as independent data controllers for particular processing activities rather than solely as processors acting on our instructions. Their own privacy policies may also apply.
 

10. International transfers:
 

Some technology providers may store or process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer complies with UK data protection law.
 

Depending on the destination and provider, this may include reliance on:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved EU Standard Contractual Clauses; or

• another legally permitted transfer mechanism.
   

Where required, we will also consider whether additional safeguards are needed.

You may contact us if you would like further information about safeguards applying to an international transfer involving your information.
 

11. Email, messaging and video consultations:
 

We may communicate with you by email, telephone, text message, video consultation or another agreed communication method.
 

Although we take reasonable steps to protect confidentiality, no internet-based communication system can be guaranteed to be completely secure.
 

We therefore ask that you avoid sending unnecessary sensitive medical information through general website contact forms, social-media messages or other informal communication channels.
 

Where a particular messaging platform is used for communication with us, the provider of that platform may process information under its own privacy arrangements.
 

Social-media direct messages should not be used for emergencies or urgent clinical concerns.
 

12. Website cookies and similar technologies:
 

Our website may use cookies and similar storage or access technologies.

Some technologies are necessary for the website to function, maintain security or provide a service that you have requested.
 

UK law also permits certain limited uses of storage and access technologies without consent where a specific legal exception applies, including certain technologies used solely to produce statistical information to improve a website or to remember appearance or functionality preferences. Where required by law, we will provide appropriate information and a simple means of objecting.
 

For technologies that do not fall within a legal exception, we will obtain consent before they are placed or accessed where PECR requires us to do so.

In particular, consent may be required for technologies used for purposes such as:

• advertising;

• behavioural tracking;

• profiling;

• cross-site tracking; or

• analytics that go beyond an applicable statistical-purpose exception.
   

Where a cookie-management tool is available on our website, you can use it to manage your preferences.
 

Further information about individual technologies, providers, purposes and retention periods should be set out in our Cookie Policy/Cookie Settings.
 

13. Marketing:
 

Appointment reminders, clinical correspondence, invoices and other messages directly connected with providing our services are service communications and are not marketing.

Where we send promotional emails, texts or similar electronic marketing to individuals, we will comply with UK GDPR and PECR.
 

We may send marketing where:

• you have given the appropriate consent; or

• the law permits us to rely on the existing-customer or “soft opt-in” provisions for similar products or services and all applicable conditions are met.
   

You can opt out of marketing at any time by using the unsubscribe method provided in the communication or by contacting us.
 

Opting out of marketing will not affect essential communications about your appointments or care.

We may retain a minimal suppression record where necessary to ensure that your marketing preference continues to be respected.
 

14. Children and young people:
 

Where Flynn Nutrition provides services to children or young people, we may collect information from the child or young person and from a parent, guardian or other person with parental responsibility.

We will handle information concerning children with particular care.
 

How information is provided, accessed and shared will depend on the circumstances, including:

• the child's age and understanding;

• their capacity or competence;

• parental responsibility;

• the nature of the care being provided;

• professional duties of confidentiality;

• safeguarding requirements; and

• applicable law.
   

A parent or guardian does not necessarily have an unrestricted right to all information held about a child or young person. Requests will be considered in accordance with the child's own information rights, confidentiality, capacity and best interests.
 

Where appropriate, privacy information will also be explained to the child or young person in a way that is suitable for their age and understanding.
 

15. How we protect personal information:
 

We use proportionate technical and organisational measures designed to protect information against:

• unauthorised access;

• unlawful use or disclosure;

• accidental loss;

• destruction;

• alteration; and

• damage.
   

Depending on the systems being used, these measures may include:

• password-protected devices and accounts;

• multi-factor authentication;

• encryption;

• access controls;

• individual user accounts;

• secure cloud services;

• restricted sharing permissions;

• secure backups;

• device security and software updates;

• secure disposal;

• confidentiality procedures;

• staff or contractor confidentiality requirements; and

• limiting access to people who need information for their role.
   

No electronic system can be guaranteed to be completely secure, but we review security arrangements in proportion to the sensitivity of the information we hold.
 

16. How long we keep information:
 

We do not keep identifiable personal information indefinitely.

Retention periods are determined by the nature of the information, why it is held, professional guidance, clinical requirements, legal obligations, limitation periods and the requirements of our professional indemnity insurance.
 

Our usual retention periods are:
 

Adult clinical records:

Normally 8 years following the end of treatment or last clinical contact.

Records may be retained for longer where there is a justified clinical, safeguarding, professional, insurance, regulatory or legal reason.
 

Children and young people's clinical records:
 

Normally until the person's 25th birthday, or 26th birthday where treatment ended when the young person was aged 17, unless a longer period is justified.
 

Records requiring a longer clinical retention period:
 

Certain categories of healthcare information may appropriately require a longer retention period because of the nature of the care provided.
 

Where a longer period applies, we will retain the information only for as long as that longer period remains necessary and will document the reason.
 

Enquiries that do not result in treatment:
 

Normally up to 12 months from the last meaningful contact, unless there is a reason to retain the information for longer.
 

Routine administrative communications:
 

Normally up to 12 months following the end of care, unless the information forms part of the clinical record or is required for another legitimate purpose.
 

Financial, accounting and tax records:

Normally at least 6 years, or for such longer period as is required under applicable accounting or tax rules.
 

Complaints, incidents and legal matters:
 

Information may be retained for longer where necessary to investigate or respond to a complaint, regulatory matter, safeguarding concern, insurance matter or actual or potential legal claim.
 

Marketing information:
 

Marketing information is retained while you remain subscribed or while we otherwise have a lawful basis to use it.
 

Where you opt out, we may retain limited information on a suppression list to ensure that we continue to respect your preference.
 

When information reaches the end of its required retention period, it will be securely deleted, destroyed or anonymised as appropriate.
 

17. Anonymised information:
 

We may use information that has been properly anonymised for purposes such as:

• service evaluation;

• audit;

• quality improvement;

• business planning; and

• understanding the effectiveness of our services.
   

Where information has been anonymised so that an individual is no longer identifiable by reasonably available means, it is no longer personal data for the purposes of UK GDPR.

We will not represent identifiable clinical information as anonymous simply because names have been removed.
 

18. Your data protection rights:
 

Depending on the circumstances and the lawful basis being used, you may have the right to:

• access personal information that we hold about you;

• correct inaccurate or incomplete information;

• request erasure of information in certain circumstances;

• request restriction of processing in certain circumstances;

• object to certain processing;

• receive certain information in a portable format where the right to data portability applies;

• withdraw consent where we are relying on consent; and

• make a complaint about our use of your information.
   

These rights are not absolute.
 

For example, the right to erasure will not normally require us to delete a clinical record that we have a lawful and professionally justified reason to retain.
 

Your right to object:
 

Where we rely on legitimate interests to process your personal information, you have the right to object to that processing in certain circumstances.
 

You have an absolute right to object to the use of your personal information for direct marketing.

To exercise any of your rights, contact:
 

Email: [insert privacy email]

We may ask for information reasonably necessary to confirm your identity or authority to act on behalf of another person.

We will respond without undue delay and ordinarily within one month once we have the information reasonably required to deal with your request. The law allows additional time in certain circumstances, including where a request is complex or multiple requests have been made.
 

19. Automated decision-making:
 

Flynn Nutrition does not currently make decisions about your clinical care that have legal or similarly significant effects on you solely by automated means without meaningful human involvement.

If this changes, we will update this Privacy Policy and provide any additional information required by law.
 

20. Personal data breaches:
 

We have procedures for identifying, assessing and responding to suspected personal data breaches.

Where a breach is likely to result in a risk to people's rights and freedoms, we will notify the Information Commissioner's Office where required by law.

Where a breach is likely to result in a high risk to you, we will also inform you where the law requires us to do so.
 

21. Complaints:
 

If you have concerns about how Flynn Nutrition has handled your personal information, we would appreciate the opportunity to address them.

Please contact:

Flynn Nutrition
Email: [insert privacy email]
Address: [insert]

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Information about making a complaint is available from the ICO at ico.org.uk.

Making a complaint to us does not affect your right to contact the ICO.
 

22. Links and third-party websites:
 

Our website may contain links to websites, booking systems, social-media platforms or other services operated by third parties.

We are not responsible for the privacy practices of independent third-party websites. We recommend reviewing the relevant provider's privacy information before submitting personal information to them.
 

23. Changes to this Privacy Policy:
 

We may update this Privacy Policy where our services, systems or legal obligations change.

The current version will be published on our website with the date on which it was last updated.

Where a change materially affects how we use information that we already hold, we will take reasonable steps to bring the change to the attention of affected individuals where required.

Flynn Nutrition
[Legal entity]
[Business/registered address]
[Email]
[Telephone – optional]
[Company number – if applicable]
[ICO registration reference]

Last updated: 21 August 2026