We also collect Aggregated Data which does not directly or indirectly reveal your identity; however, if combined with Personal Data, we treat it as Personal Data.

 

5. Special Category Data (Health Data) and Legal Basis

• Data Collected: Health information (medical history, conditions, blood tests, dietary information), biological sex.

• Purpose of Collection: To provide detailed and tailored wellness support. We use this data to identify any potential contraindications or ensure that the wellness consultation is appropriate for your specific health situation.

 

Lawful Basis for Processing (UK GDPR)

• Special Category (Health) Data: To process your health data, we rely on Contractual Necessity (Art. 6(1)(b)) to perform our agreement with you, and your Explicit Consent (Art. 9(2)(a)) to handle sensitive health information. While you have the right to withdraw consent, providing this information is a contractual requirement for us to deliver our services.

• Legal Claims & Insurance (Art. 9(2)(f)): Where consent is withdrawn for active consultations, we continue to retain specific health data under the condition that it is necessary for the establishment, exercise, or defence of legal claims. This is necessary for professional insurance requirements and for the establishment, exercise or defence of legal claims, including under the Limitation Act 1980.

 

Important Note on Health Data Processing

Providing your health data is necessary for us to deliver our services. Where we rely on your explicit consent to process special category data, you have the right to withdraw that consent. However, if you do so, we will be unable to continue providing our services.

 

If you withdraw or object to this processing:

• Service Termination: We will be unable to continue providing our services as we cannot fulfil our contractual obligations to you.

• Mandatory Retention: Record Retention: We will cease using your data for ongoing consultation and wellbeing support services, but may retain relevant records securely where necessary for insurance purposes, legal claims, safeguarding professional practice, and compliance with applicable legal obligations. Records are normally retained for 7 years after the end of services (or until age 25 for minors) in accordance with professional insurance requirements and limitation periods applicable to legal claims.

 

Children and Vulnerable Adults:

• Service Eligibility: Our Service is designed for and directed at individuals aged 18 and over. We do not knowingly provide services directly to minors.

• Age of Consent: Although UK data protection law permits certain services to rely on consent from children aged 13 and over, our services are intended for individuals aged 18 and over and we do not rely on consent from individuals under 18.

• Under 18s: Our Service is directed at individuals aged 18 and over. We do not knowingly process Personal Data from minors under 18 unless a parent or legal guardian engages the Service on their behalf and provides explicit written consent. We will take reasonable steps to verify parental responsibility. For any data processed regarding a minor, we apply higher protection measures, including stricter data minimisation, restricted access controls, and additional safeguarding considerations appropriate to the sensitivity of the data

• Third-Party Representation: If you are sharing data on behalf of a child or an individual lacking capacity, you must ensure they have been informed of their rights in age-appropriate, clear language. We may require evidence of legal authority (e.g., birth certificate or Power of Attorney) before processing.

 

Professional Boundary:

Eldine Wilson offers wellness support and education; the service does not constitute medical advice. If you have any concerns about your health, you must consult your General Practitioner (GP) or another qualified medical professional.

 

6. How We Collect Your Personal Data

• Direct Engagement: When you register or sign up to use our services (digitally or in person), create an account, or obtain login information.

• Professional Communications: Via email, telephone, or secure communication platforms (e.g., encrypted WhatsApp/Zoom).

• Financial Transactions: We collect payment and invoice data through third-party processors. Note: We do not store full credit card details on our own systems.

• Voluntary Wellness Disclosures: When you complete forms, questionnaires, or provide verbal health history during consultations.

• Third Parties or Publicly Available Sources: We may receive certain types of data about you from third parties, subject to appropriate legal safeguards. In such cases, we will provide you with this Privacy Policy within a reasonable period, as required under UK GDPR.

• Referrals: If a relative or practitioner provides your data to us, we will provide you with a copy of this Privacy Policy at our first point of contact and verify your consent before any further processing of health-related information occurs.

• Aggregated Data: We may receive Aggregated Data from analytics providers (like Google Analytics) which is aggregated and, where possible, anonymised or pseudonymised and based outside the UK.

 

Use of Messaging Platforms (e.g. WhatsApp)
At your request, we may communicate with you via messaging platforms such as WhatsApp.

While such platforms may offer encryption, they are not specifically designed for the transmission of sensitive health data. By choosing to communicate via these channels, you acknowledge and accept the potential privacy risks.

 

We recommend limiting the sharing of sensitive health information via messaging platforms where possible. Where appropriate, we may direct you to more secure methods of communication for transmitting detailed health data.

 

We will not request or require you to send Special Category Data via messaging platforms.

 

7. International Data Transfer

Your Personal Data may be transferred to and processed in countries outside the United Kingdom (UK). We primarily process data within the UK; however, we may use third-party service providers located in other jurisdictions.

• Lawful Mechanisms for Transfer: To ensure your data remains protected to a standard equivalent to the UK GDPR, we only transfer data using the following safeguards:

• Adequacy Regulations: We transfer data to countries that the UK Government has officially recognised as providing an adequate level of protection (e.g., the EEA).

• UK-US Data Bridge: For US-based providers, we rely on their certification under the UK Extension to the Data Privacy Framework where available.

• Appropriate Safeguards: Where no adequacy decision exists, we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

• Contractual Necessity: Where the transfer is essential to fulfil the specific services you have requested, we only rely on Article 49(1)(b) where the transfer is occasional and strictly necessary to perform a contract with you.

• Transfer Assessments: Where required, we assess international transfers to ensure appropriate safeguards are in place in accordance with UK data protection law.

 

8. Disclosure and Legal Requirements

We may disclose Personal Data to third parties in the following limited circumstances:

• Compliance with Law: To comply with a court order, statutory obligation, or a valid request from a public authority. Under the Data (Use and Access) Act 2025, we may disclose data where a public body confirms the information is necessary for their lawful public tasks.

• Recognised Legitimate Interests (2025 Act): We may disclose data to third parties without a balancing test where it is necessary for Recognised Legitimate Interests under UK law, specifically:

• Crime Prevention & Fraud: To detect or prevent fraud or other criminal activity.

• Safeguarding: To protect the safety of an individual at risk or the public.

• Protecting Rights (Legitimate Interests): To protect and defend the rights, property, or safety of Eldine Wilson, our clients, or the public, or to protect against legal liability. Processing under this purpose is based on our Legitimate Interests.

• Health Data Constraint: We apply a higher threshold for the disclosure of Special Category (Health) Data. Such data will only be disclosed to authorities where there is a specific legal mandate (e.g., a warrant) or where it is necessary to protect the Vital Interests (life) of you or another person.

 

Note: Any disclosure is limited to the minimum Personal Data necessary to achieve these purposes.

 

9. Data Storage and Retention

The personal information we collect is stored centrally on secure servers within the EU and the UK. Data may also be stored on paper and files in a secure location.

We maintain a strict data retention policy:

• Personal Data is only retained for as long as we have a justifiable business or legal reason to store it.

• Data with no legal or business purpose is erased immediately.

 

We retain and use your Personal Data to:

• Comply with our legal obligations

• Resolve disputes and enforce our agreements and policies

• Support ongoing business relationships

 

We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

• International Maintenance: Your information may be maintained on computers located outside of the UK or EEA. Where data is processed in third countries, we ensure protection is not materially lower than UK standards, using legal mechanisms such as UK Adequacy Regulations, the International Data Transfer Agreement (IDTA), or the UK-US Data Bridge.

• Retention Considerations:

  • The amount, nature, and sensitivity of the data

  • The potential risk of harm from unauthorised use or disclosure

  • The purposes for which the data was collected and whether those purposes can be achieved by other means

  • Applicable legal, regulatory, tax, and accounting requirements

• Specific Retention Periods:

  • Financial & Transaction Data: We retain this for 7 years to comply with UK tax law (HMRC) and accountancy requirements.

  • Adult Client Health Records: In accordance with professional insurance standards for Aromatherapy and Kinesiology, we retain these for 7 years from the date of your last consultation.

  • Children’s Records: If we provide services to a minor, we retain their records until their 25th birthday (or as required by specific safeguarding legislation).

  • Anonymised Data: Once data is fully anonymised (meaning you can no longer be identified), we may retain it indefinitely for statistical or research purposes.

  • Data Disposal: Upon the expiry of the relevant retention period, we will securely delete or irretrievably anonymise your Personal Data. Under the Data (Use and Access) Act 2025, we ensure that any data held in backups is "put beyond use" until it is overwritten in accordance with our technical cycle.

  • Legal Holds: We may retain data for a longer period if we reasonably believe there is a prospect of litigation or if we receive a formal complaint. In such cases, we will only retain the data strictly necessary for the defence of legal claims.

 

10. Service Providers and Analytics

We use trusted third-party Service Providers to facilitate our Service. These providers are contractually obligated under Article 28 (UK GDPR) to process your data only on our documented instructions and to maintain strict confidentiality. We do not share your data for financial gain and will never sell your data.

• Recipients of Data:

  • Service Providers providing accounting, IT, marketing, communication, analytical, or legal services

  • Entities authorised by law (e.g., courts, regulatory authorities)

• Third-Party Data Sharing:

  • Health data may be shared with Nordic Laboratories (Privacy Policy), Genova Diagnostics (Privacy Policy), Regenerus Labs (Privacy Policy) , The Drs Laboratory (Privacy Policy) for analysis services.

  • These transfers are protected by Data Processing Agreements and, where data leaves the UK, appropriate safeguards such as the UK-US Data Bridge or Standard Contractual Clauses.

• Professional Support & Education:

  • We may share personal data for professional support or specific educational statistics. This is done only with your explicit consent.

• Peer Review: Anonymised case histories (where you cannot be identified) may be shared with peers for professional development.

• Consent for Products: If we recommend specific nutritional products from third parties, we will only share your contact details to facilitate the order with your explicit affirmative consent (provided during your consultation or via digital confirmation).

• Marketing Communications: You will only receive marketing communications from us if you have opted-in to receive them. We do not use your health data for marketing purposes unless you have given us specific, separate permission to do so. You can "Unsubscribe" via the link in any email.

 

11. Protection Against Legal Claims

We may process and retain your Personal Data where necessary to assert or defend against potential legal claims.

• Legal Basis: Legitimate Interests (Art. 6(1)(f)) necessary to protect our legal rights or respond to claims.

• Retention: Records are typically kept for 7 years to align with the primary limitation periods under the Limitation Act 1980. We may retain specific records beyond standard retention periods where we reasonably identify a risk of latent professional negligence claims or ongoing legal risk, including where limitation periods may be extended or where proceedings are anticipated or ongoing. Retention will be limited to what is strictly necessary for the purpose.

 

12. Anonymised and Pseudonymised Data

In certain instances, Personal Data may be collected and processed as part of datasets for statistical analysis, educational resources, or market research. To protect your privacy, we use data-minimisation techniques:

• Anonymised Data: Identifiers are irreversibly removed. This data is not personal data, and UK GDPR does not apply. We use the "motivated intruder" test to ensure re-identification is not reasonably likely.

• Pseudonymised Data: We mask identifiers (e.g., using Client IDs). This remains Personal Data under the UK GDPR, and we apply full security measures to the "key" that allows re-identification.

 

13. Payment Processing

When providing Services or Products, we may use third-party payment processors to handle transactions.

• Processor Privacy & Security: Our payment processors adhere to PCI-DSS standards.

• Third-Party Processors: Stripe and PayPal. Data is handled securely according to their policies.

• Data Storage: We do not see or store your full credit card numbers. We only retain Transaction Data (e.g., date, amount, and the last 4 digits of the card) to fulfil our legal obligations to HMRC.

 

14. Your Data Protection Rights

Under the UK GDPR and the Data (Use and Access) Act 2025, you have the following rights:

1. Right to Access (Subject Access Request): You may request a copy of the data we hold. We may ask you to clarify your request if it involves a large volume of data.

2. Right to Rectification: You can request to correct inaccurate or incomplete information.

3. Right to Erasure ('Right to be Forgotten'): You can request deletion where there is no overriding legal reason for us to keep it (e.g., HMRC or insurance requirements).

4. Right to Object: Particularly regarding direct marketing or processing based on Legitimate Interests.

5. Right to Restrict Processing: You can request to 'pause' the use of your data in specific scenarios.

6. Right to Data Portability: You have the right to receive your data in a structured, machine-readable format.

7. Right to Withdraw Consent: Where we rely on consent (e.g., for health data), you can withdraw it at any time.

8. Rights Related to Automated Decision-Making and Profiling: You have the right not to be subject to decisions based solely on automated processing that significantly affects you. (We do not currently engage in automated decision-making or profiling.)

• Exercising Your Rights:

  • To exercise any of these rights, please contact us at eldinewilson@gmail.com.

  • Identity Verification: We may require proof of identity. The statutory one-month response period will be paused until we receive this verification or any necessary clarification.

  • Response: We generally respond within one month, but complex or multiple requests may take longer. In such cases, we will keep you informed.

  • Automated Decisions: We do not currently use automated processing to make decisions that have a legal or significant effect on you. Should we do so in the future, you have the right to request human intervention.

  • If you wish to make a request, please specify which right you are exercising and provide enough information for us to locate your records (e.g., the email address used for communications/bookings).

• Fees:

  • Requests are typically free. However, under the 2025 Act, we may charge a reasonable fee or refuse to act if a request is "Vexatious or Excessive" (e.g., repetitive or intended to cause distress).

 

15. Children’s Privacy

Our Service is primarily directed at adults. We do not knowingly process Personal Data from anyone under the age of 18 without verifiable parental or guardian consent.

• Age Verification: In accordance with the Data (Use and Access) Act 2025, we implement age-assurance measures at the point of service inquiry to identify minors.

• If you are under 18: You may only use our services and provide health data if your parent or legal guardian provides Explicit Written Consent.

• Parental Responsibility: If you are a parent providing data for a minor, we will require you to verify your legal authority before we begin processing their Special Category (Health) Data.

  • Given the sensitivity of Special Category Data (such as health information), parental or guardian consent is required for all minors under 18, regardless of the UK digital age of consent (13 years).

• Protection of Minors: We apply "Higher Protection Matters" to all data relating to minors. This includes stricter data minimisation and restricted access. If we discover we have inadvertently collected data from a minor without the required consent, we will delete that information immediately.

• Requests Regarding Children's Data: Parents may exercise data rights on behalf of their children. Please note that under the 2025 Act, we may pause our response time while we verify parental responsibility or seek the child's own views (where they are of sufficient maturity).

 

We take the privacy of children seriously and handle all data relating to minors with the highest level of care.

 

16. Security of Data

We take the security of your wellness and health data extremely seriously. We implement robust technical and organisational measures in accordance with Article 32 of the UK GDPR and the Data (Use and Access) Act 2025:

• Technical Measures: Encryption, strong password protection on systems (including VPNs), and secure storage of both physical and digital documents.

• Access Controls: Access to your health records is strictly limited to authorised personnel on a "Need-to-Know" basis. We maintain internal logs of who accesses sensitive data.

• Physical Security: Any paper-based records (e.g., from in-person sessions) are stored in locked, fire-proof cabinets.

• Confidentiality: All personnel processing Personal Data are formally bound by a strict duty of confidentiality.

• Data Breach Protocol: We have a formal response plan for suspected breaches. If a breach occurs that poses a risk to your rights, we will notify you and the Information Commissioner’s Office (ICO) within 72 hours.

• Electronic Communications: While we use secure platforms, the transmission of information via the standard internet can never be 100% secure. We recommend using a secure portal [or password-protected documents] for sharing sensitive health logs. Any data you send via unencrypted email is at your own risk.

 

17. Your Duty to Inform Us of Changes

Please inform us of any changes to your Personal Data during your relationship with us to ensure accurate service and legal compliance.

 

18. Changes to Privacy Policy

We regularly review and update this Privacy Policy.

 

Updates will be reflected in our sent terms or on our website, and the date at the top will be revised.

Significant Changes: If we make material changes to how we process your sensitive health data, we will provide a more prominent notice (e.g., via email or a pop-up on our service portal) before the change becomes effective.

 

19. How to Contact Us

Data Controller: Eldine Wilson

Postal Address:  9 Langham Place, London W4 2QL

Email for Data Enquiries: eldinewilson@gmail.com

Telephone Number: 07711861330

ICO Contact: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF | Tel: 0303 123 1113 | Website: www.ico.org.uk

Data Protection Leadership: Due to the sensitive nature of the health data we process, we have appointed an internal Data Privacy Lead to oversee our compliance. If you have any specific technical questions about how your medical history is encrypted or stored, you can direct your inquiry to eldinewilson@gmail.com specifically.

 

20. Complaints Procedure

If you have any concerns about our use of your Personal Data, you can make a formal complaint to us at eldinewilson@gmail.com.

 

Under the Data (Use and Access) Act 2025, we follow a structured complaints process:

• Acknowledgment: We will acknowledge receipt of your data-related complaint within 5 business days and provide a substantive response within 30 days.

• Investigation: We will investigate the matter and provide you with a substantive response or an update on the progress of your complaint without undue delay.

• Outcome: We aim to resolve all complaints internally. If we are unable to resolve your concern, we will provide you with a final response explaining our position.

 

Your Right to Complain

You have the right to lodge a complaint with the UK supervisory authority at any time if you believe your data protection rights have been infringed.

 

The UK supervisory authority is the Information Commissioner's Office (ICO).

 

We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.

 

If you remain dissatisfied after exhausting our internal complaints procedure, or if we fail to acknowledge your complaint within 30 days, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection issues.

• ICO Website: https://www.ico.org.uk

• ICO Helpline: 0303 123 1113