The Nest Wellness Limited ("The Nest")

Client Privacy Notice

Last updated: 28th May 2025

1. Introduction

This Privacy Notice explains how The Nest Wellness Limited (“The Nest”, “we”, “us” or “our”) collects, uses, stores and shares your personal information when you book or attend an appointment with us, contact us, or otherwise engage with our services.

The Nest provides reflexology treatments (delivered by Nathalie Romain) and lifestyle medicine consultations (delivered by Dr Diane Biondini in a private wellness capacity). Our services are intended to support wellbeing and lifestyle change. They are not emergency, acute or hospital-based medical services, and if you require urgent medical advice or treatment you should contact your GP, NHS 111 or the emergency services as appropriate. This Privacy Notice should be read together with our Booking Terms & Conditions.

We are the data controller responsible for your personal data. We handle your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Where we provide services to anyone under the age of 18, we do so only with the involvement of a parent or legal guardian as appropriate. In those cases, we may collect and use the parent or guardian’s contact details, consent information and any other information reasonably needed to book, manage and provide the services safely and appropriately.

2. What Information Is Collected

We may collect and process the following categories of personal information:

Identity and contact details – such as your name, date of birth, postal address, email address and telephone number.
Appointment information – details of the services you book, dates and times of appointments, and any notes relating to your bookings.
Health and consultation information – information you provide on intake and consultation forms or during appointments, including medical conditions, injuries, medications, allergies, recent surgery, mental health concerns, pregnancy, and changes in your health.
Lifestyle information – where relevant to a lifestyle medicine consultation, information about nutrition, physical activity, sleep, stress, alcohol, smoking, social connection and related lifestyle factors.
Payment information – records of payments, deposits and gift voucher use. Card details are processed by our payment provider and are not stored by us.
Correspondence – records of your communications with us, including emails, text messages and any feedback or complaints.
Marketing preferences – where you have given consent to receive marketing, a record of that consent and your preferences.

Health, lifestyle and consultation information is treated as special category data under the UK GDPR and is subject to additional safeguards.

3. How We Collect Your Information

We collect personal data:

When you book an appointment using our scheduling platform or by contacting us directly.
When you complete consultation, intake or health questionnaires.
During appointments, including information you share verbally with the practitioner.
When you make a payment or redeem a gift voucher.
When you correspond with us by email, telephone or text message.

When you provide feedback or make a complaint.

4. How and Why We Use Your Information

We use your personal data for the following purposes, relying on the lawful bases set out below:

If you do not provide certain information we request, especially relevant health or lifestyle information, we may be unable to offer services, proceed with an appointment, or do so safely and appropriately.

(a) Providing our services

Purpose: managing bookings, providing reflexology treatments and lifestyle medicine consultations, communicating with you about your appointments, and providing aftercare guidance.
Lawful basis: performance of a contract with you (Article 6(1)(b) UK GDPR).
For health and special category data: we generally rely on your explicit consent (Article 9(2)(a) UK GDPR) to collect and use the health and lifestyle information needed to provide our services safely and appropriately. In limited circumstances, we may also process special category data where necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) UK GDPR).

(b) Taking payment

Purpose: processing payments, deposits and refunds, and keeping financial records.
Lawful basis: performance of a contract, and compliance with our legal obligations (e.g. tax and accounting law).

Purpose: maintaining treatment and consultation records in line with professional standards and any insurer or professional body requirements.
Lawful basis: our legitimate interests in running our practice safely and professionally, and compliance with legal and professional obligations. Where these records include health or lifestyle information, we rely on your explicit consent for the core delivery of services and Article 9(2)(f) UK GDPR where records are needed for complaints, insurance matters or legal claims.

(d) Managing complaints, insurance and legal claims

Purpose: responding to feedback and complaints, defending or pursuing legal claims, and dealing with insurance matters.
Lawful basis: our legitimate interests, compliance with legal obligations, and – for special category data – the establishment, exercise or defence of legal claims (Article 9(2)(f) UK GDPR).

(e) Marketing

Purpose: where you have agreed, sending you information about our services, offers and news.
Lawful basis: your consent. You can withdraw your consent at any time by contacting us or using the unsubscribe link in any marketing message.

5. Who We Share Your Information With

We do not sell your personal data. We share information only where necessary, and only with parties who are required to keep it confidential and secure. Depending on how we operate our business, recipients may include providers of booking, practice management, payment processing, email, cloud storage or other administrative systems, as well as the categories of recipient listed below.

Our scheduling platform provider, which hosts our booking system and client records on our behalf as a data processor.
Our payment provider, which processes card payments and deposits.
Our professional indemnity and public liability insurers, and our professional body (the Association of Reflexologists), where this is necessary in connection with a claim, complaint or regulatory matter.
Our professional advisers (such as accountants and, where necessary, legal advisers).
Regulators, law enforcement or other authorities, where we are required or permitted to disclose information by law.

Some of our service providers may store or process personal data outside the UK. Where that happens, we take reasonable steps to ensure that an appropriate level of protection is in place in accordance with UK data protection law, for example by relying on adequacy regulations or appropriate contractual safeguards.

6. Data Storage & Security

Client information is stored securely using our scheduling platform and, where relevant, in secure paper or electronic records.
Access to client records is restricted to the practitioners and is protected by appropriate technical and organisational measures.
We take reasonable steps to protect personal data from loss, misuse, unauthorised access, alteration or disclosure.

7. How Long We Keep Your Information

We keep personal data only for as long as is necessary for the purposes set out in this Privacy Notice and to comply with our legal, professional and insurance obligations.

In particular:

Health and treatment records for adult clients are retained for a minimum of 8 years from the date of your last appointment, in line with guidance from the Association of Reflexologists and our professional indemnity insurer.
Records relating to clients who were under 18 at the time of treatment are retained until the client’s 25th birthday, or for 8 years after the last appointment, whichever is later.
Financial and payment records are retained for at least 6 years to comply with tax and accounting law.
Marketing records are retained until you unsubscribe or withdraw your consent.

After the relevant retention period, records are securely deleted, destroyed or anonymised.

8. Your Rights

Under UK data protection law, you have the following rights:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete data.
Right to erasure – to ask us to delete your data, subject to our legal, professional and insurance obligations.
Right to restrict processing – to ask us to limit how we use your data in certain circumstances.
Right to object – to object to processing based on our legitimate interests, and to object to direct marketing at any time.
Right to data portability – to receive certain data in a structured, commonly used and machine-readable format.
Right to withdraw consent – where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details in section 10. We may need to verify your identity before responding. We aim to respond within one month.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you believe your personal data has been handled unlawfully. Further information is available from the ICO. We would, however, appreciate the opportunity to address your concerns first.

9. Changes to This Privacy Notice

We may update this Privacy Notice from time to time, for example to reflect changes in our services, in the law, or in regulatory or professional guidance. The most up-to-date version is available on request, and the “last updated” date at the top of this notice will be revised accordingly.

10. Contact Details

If you have any questions about this Privacy Notice, or wish to exercise any of your rights, please contact us:

The Nest Wellness Limited

14 Copse Avenue, West Wickham, BR4 9NL

Company number: 17051436

Email: info@thenestwellness.co.uk

Telephone: 07931 146 605