Take the Quiz

Privacy Policy

This policy explains what personal information I collect, why I collect it, how I use and protect it, who I may share it with, how long I keep it and the rights you have over it.

I take your privacy seriously and aim to collect only the information I reasonably need to provide my services, communicate with you and run my practice.

Last updated: 12th August 2026.

Who I am

For the purposes of UK data protection law, Jessica Fonteneau Nutrition is the data controller for the personal information described in this policy.

Contact:
info@eczematrap.com
ICO registration number: ZA543800

What information I collect

The information I collect depends on how you interact with me.

This may include:

  • Contact information, such as your name, email address, telephone number and anything you choose to include when you contact me or book a call.
  • Newsletter and resource information, such as your name, email address and information about when you subscribed, requested a resource, opened an email or changed your marketing preferences.
  • Booking and client information, including information you provide when booking, completing forms or questionnaires, communicating with me or working with me as a nutritional therapy client.
  • Health information, including symptoms, diagnoses, medical history, medications, test results, family history, dietary information and other information relevant to your care. Health information is classed as special category personal data and receives additional protection under UK data protection law.
  • Parent or guardian information, where a parent or guardian contacts me or arranges nutritional therapy for a child. This may include the parent or guardian's contact details as well as relevant information about the child.
  • Quiz responses, including answers you provide when completing an eczema or other educational quiz. Depending on the questions asked, some quiz responses may constitute health information and therefore special category personal data.
  • Purchase and transaction information, including what you have bought, when you bought it and information needed to process or record the transaction. Card payments are handled by my payment provider and I don't receive or store your full payment card details.
  • Website usage information, including information collected through cookies and analytics. You can read more about this in my Cookies Policy.
  • Information provided by other people, for example a parent, guardian, healthcare professional or another practitioner, where you have asked them to share information with me or where there is another appropriate lawful basis for doing so.

How I use your information and my lawful basis

UK data protection law requires me to have an appropriate reason, known as a lawful basis, for using personal information. Health information and other special category data require an additional condition before they can be processed.

The bases I rely on depend on why I am using the information.
Enquiries and discovery calls

I use your contact details and the information you provide to respond to enquiries and arrange calls.

My lawful basis is my legitimate interest in responding to people who contact me and, where you are considering a paid service, taking steps at your request before entering into a contract.

Nutritional therapy and other paid services

I use your information to provide the service you have booked or purchased, communicate with you, manage appointments and deliver agreed support.

My lawful basis is the performance of our contract.

Where providing nutritional therapy requires me to process health information, I also rely on the special category condition that permits health information to be processed when necessary for the provision of health care, in accordance with my professional obligations.

Educational quizzes

If you complete an educational quiz, I use the information you provide to generate and deliver your result and any information you specifically request.

Where quiz answers contain health information, I rely on the appropriate lawful basis for providing the quiz and, where required, your explicit consent to process special category health information.
The quiz may use your answers to generate an automated educational result. It isn't used to make a medical diagnosis or a decision that has a legal or similarly significant effect on you.

Newsletters and marketing

I use your name and email address to send newsletters, educational resources and other marketing communications where you have chosen to receive them.

My lawful basis is consent. You can withdraw that consent at any time by using the unsubscribe link in an email or contacting me directly.

Purchases, accounts and tax

I use transaction and purchase information to process purchases, maintain business records and comply with accounting and tax requirements.

My lawful bases are contract and, where relevant, legal obligation.

Professional record keeping

I retain appropriate client records to meet my professional, regulatory and insurance responsibilities.

My lawful basis includes my legitimate interests in maintaining appropriate clinical records, meeting professional standards and protecting both you and me in the event of a complaint or claim.

Website operation and analytics

I may use information collected through the website to maintain its security and functionality and to understand how visitors use it.

The lawful basis depends on the technology involved. Where consent is required for cookies or analytics, information is collected only after that consent has been given.

Please see my Cookies Policy for further information.

Health information and confidentiality

Information about your physical or mental health is special category personal data and is given additional protection under UK data protection law.

Health information may be collected through consultation forms, questionnaires, consultations, secure messages, test results or other information you choose to provide as part of nutritional therapy. Health information may also be collected if you choose to provide it through an educational quiz or enquiry form.

When you are a client, I use your health information only where it is relevant to providing your nutritional therapy service, maintaining appropriate clinical records, communicating with you about your care and meeting my professional obligations.

I treat client information as confidential.

I won't ordinarily share information about your health or care with another healthcare professional, practitioner or third party without an appropriate reason for doing so. Where sharing is not otherwise required by law, I will normally discuss this with you and obtain your agreement first.

There may be exceptional circumstances in which information needs to be disclosed without your consent, for example where disclosure is required by law or where there is a serious and immediate risk to someone's safety and disclosure is permitted under applicable law and my professional obligations.

My clinical client records are stored in Practice Better.

In accordance with current CNHC professional requirements, adult clinical records are normally retained for eight years from the date of the last consultation.

For a child client, records are retained until their 25th birthday, or until their 26th birthday if they were 17 when the work concluded.

Professional indemnity insurance requirements may sometimes require records to be retained for longer.

Where this applies, I will retain them for the period required by my insurer.

How I protect your information

I take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure or misuse.

I use appropriate systems for storing and managing client information, restrict access to personal information and take reasonable steps to make sure the services I use have appropriate security measures in place.

No method of storing or transmitting information electronically can be guaranteed to be completely secure. If

If I become aware of a personal data breach, I will assess it and take the action required under applicable data protection law.

Who I share information with

I don't sell your personal information.
I use trusted third party services to help me run my practice, communicate with clients, process payments and operate this website. I share only the information reasonably necessary for them to provide the relevant service.

Depending on the service and the particular processing activity, a provider may process information on my behalf or may act as a separate data controller for some purposes.

The services I use may include:

  • Practice Better, for bookings, client forms, clinical records and secure messaging.
  • MailerLite, for newsletters, mailing lists and delivery of resources.
  • ScoreApp, for educational quizzes and quiz results.
  • Substack, if you subscribe to or interact with my Substack publication.
  • Google Analytics, for website analytics, subject to the choices you make through the website's cookie controls.
  • Stripe, for processing payments.
  • Lyrical Host, for hosting and operating the website.

I may also share limited information where appropriate with:

  • accountants or bookkeepers for accounting and tax purposes
  • laboratories, healthcare professionals or other practitioners where this is relevant to your care and there is an appropriate lawful basis for sharing the information
  • my professional bodies, insurer, legal advisers or regulators where this is reasonably necessary to meet professional or legal obligations, deal with a complaint or establish, exercise or defend a legal claim
  • law enforcement agencies, courts or other authorities where disclosure is required or permitted by law.

Each organisation has its own responsibilities for protecting the information it receives.

International transfers

Some of the service providers I use may process or store personal information outside the UK.

Where this involves a restricted international transfer under UK data protection law, I take steps to ensure that an appropriate transfer mechanism and safeguards are in place. These may include transfers to countries covered by UK adequacy regulations or the use of approved contractual safeguards.

You can contact me if you would like further information about the safeguards applying to a particular transfer.

How long I keep your information

I don't keep personal information indefinitely. How long I retain it depends on why it was collected and whether I have a professional, legal, accounting or insurance reason to retain it.

My usual retention periods are:

  • Enquiries that don't lead to a client relationship: 12 months after the last contact.
  • Newsletter and marketing information, for as long as you remain subscribed. If you unsubscribe or object to direct marketing, I may retain the minimum information necessary on a suppression list so that your preference continues to be respected.
  • Quiz responses: indefinitely, unless my account becomes inactive, in which case all data is deleted after 6 months.
  • Adult clinical records, normally eight years from the last consultation, unless a longer period is required by my professional indemnity insurer or another applicable requirement.
  • Child clinical records, until the child's 25th birthday, or 26th birthday if they were 17 when the work concluded, unless a longer retention period is required.
  • Accounting and transaction records, for the period required by HMRC and other applicable accounting or tax requirements.
  • Cookie and analytics information, according to the periods explained in my Cookies Policy and the settings of the relevant service.

I review the information I hold periodically and securely delete or anonymise information when I no longer have a reason to retain it.

Your rights

UK data protection law gives you a number of rights over your personal information.

Depending on the circumstances and the lawful basis I rely on, these may include the right to:

  • ask what personal information I hold about you and receive a copy of it
  • ask me to correct inaccurate or incomplete information
  • ask me to delete personal information in certain circumstances
  • ask me to restrict the way I use your information in certain circumstances
  • object to certain uses of your personal information
  • receive certain information in a portable format where the right to data portability applies
  • withdraw your consent at any time where I rely on consent.

These rights aren't all absolute and they don't apply in exactly the same way in every circumstance.

For example, if you have been a nutritional therapy client, I may need to retain your clinical records for the professional and insurance retention periods described above. A request for deletion doesn't automatically override those responsibilities.

If you make a request and I am unable to comply with all or part of it, I will explain why.

I will respond to valid data protection rights requests without undue delay and normally within one calendar month. In certain circumstances, such as where a request is particularly complex or multiple requests have been made, the law allows additional time. If this applies, I will tell you.

To exercise your rights, email:info@eczematrap.com

Your right to object

You have the right to object to certain uses of your personal information.
In particular, you have an absolute right to object to your personal information being used for direct marketing.

You can stop receiving marketing emails at any time by using the unsubscribe link included in my emails or by contacting me at info@eczematrap.com.

Where I rely on legitimate interests for another type of processing, you may also have the right to object. I will consider your request in accordance with applicable data protection law.

How to make a data protection complaint

If you have concerns about the way I have collected, used, stored or shared your personal information, or about the way I have responded to a data protection request, you can make a complaint to me.

Please email: info@eczematrap.com

I will acknowledge a data protection complaint within 30 days of receiving it and will take appropriate steps to investigate and respond without undue delay. I will keep you informed where appropriate and tell you the outcome of my consideration of your complaint.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113

Changes to this policy

I may update this privacy policy if the way I use personal information changes, if I introduce new services or technology, or if relevant legal or regulatory requirements change.

When I make changes, I will update the “Last updated” date at the top of this page.