Contact

Privacy Notice

  • Home
  • Privacy Notice

Last updated: August 2026

This privacy notice tells you what to expect us to do with your personal information. It covers both the people we work with as clients and visitors to this website.

Contact details

RLT Nutrition is a nutritional therapy practice run by Ruth Trimbitas (Dip.NT, MNNA, mFNTP). RLT Nutrition is the data controller for the personal information described in this notice.

What information we collect, use, and why

We collect or use the following information to provide client care and our nutritional therapy services:

  • Name, address and contact details
  • Gender
  • Date of birth
  • Health information (including medical conditions, allergies, medical requirements and medical history)
  • Information about care needs (including disabilities, home conditions, medication and dietary requirements and general care provisions)
  • Test results (including psychological evaluations, scans, bloods, x-rays, tissue tests and genetic tests)
  • Payment details (including card or bank information for transfers and direct debits)
  • Insurance policy details
  • Records of meetings and decisions

We also collect the following special category information for this purpose. This information is subject to additional protection due to its sensitive nature:

  • Genetic information
  • Health information

We collect or use the following personal information for client portal functionality:

  • Names and contact details
  • Addresses
  • Medical history
  • Payment details
  • Account information, including registration details
  • Information used for security purposes

We also collect the following special category information for client portal functionality:

  • Genetic information
  • Health information

We collect or use the following personal information to comply with legal requirements:

  • Name
  • Contact information
  • Financial information
  • Insurance details
  • Any other personal information required to comply with legal obligations

We also collect the following special category information to comply with legal requirements:

  • Genetic information
  • Health information

We collect or use the following personal information for information updates, marketing or market research purposes:

  • Names and contact details
  • Marketing preferences
  • Records of consent, where appropriate

We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details
  • Payment details
  • Service history
  • Client accounts and records
  • Financial transaction information
  • Correspondence

We also collect the following special category information for dealing with queries, complaints or claims:

  • Genetic information
  • Health information

Visiting this website

You can read every page on this website without telling us who you are. We do not use analytics, advertising, tracking pixels or social media trackers, and nothing on this site profiles you or follows you to other websites.

Cookies. This website does not set any cookies on your device. Because there are no analytics or advertising cookies to consent to, we do not show a cookie banner. A session cookie is used only in the password-protected practitioner area, which is not part of the public site.

Fonts and other page assets. Every font, image, stylesheet and script this site uses is served from our own server in the United Kingdom. The site makes no requests to third-party content delivery networks, so reading these pages does not disclose your IP address to any other organisation.

Enquiry form. If you send us a message through the contact form, the name, email address, telephone number and message you provide are emailed to us so that we can reply. Nothing from the form is stored on the website itself. Please do not send detailed health information through the contact form — once you become a client we will collect it securely through our client portal.

Discovery call bookings. If you book a free discovery call, the name, email address, telephone number and any notes you give us are saved as an appointment in our practice calendar, which runs on our own server in the United Kingdom.

Server logs. Our web server keeps standard technical logs, including visitors’ IP addresses, so that we can keep the site secure and diagnose faults. These logs are deleted automatically after 14 days and are not used to identify or profile visitors.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. Which lawful basis we rely on may affect your data protection rights, which are set out in brief below.

  • Your right of access — you have the right to ask us for copies of your personal information. You can also request other information, such as details about where we get personal information from and who we share it with. Some exemptions apply, which means you may not receive all the information you ask for.
  • Your right to rectification — you have the right to ask us to correct or complete personal information you think is inaccurate or incomplete.
  • Your right to erasure — you have the right to ask us to delete your personal information.
  • Your right to restriction of processing — you have the right to ask us to limit how we use your personal information.
  • Your right to object to processing — you have the right to object to the processing of your personal data.
  • Your right to data portability — you have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
  • Your right to withdraw consent — where we use consent as our lawful basis, you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the details at the top of this notice.

You can read more about your data protection rights, and the exemptions that may apply, on the ICO’s website.

Our lawful bases for the collection and use of your data

To provide client care and our nutritional therapy services:

  • Contract — we have to collect or use the information so that we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation — we have to collect or use your information so that we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

For client portal functionality:

  • Contract — as above.
  • Legal obligation — as above.

To comply with legal requirements:

  • Legal obligation — we have to collect or use your information so that we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

For information updates, marketing or market research:

  • Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Legitimate interests — we are collecting or using your information because it benefits you, our practice or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests: we have a legitimate interest in contacting former and existing clients with information about our services, nutrition tips, and updates similar to the services they have previously received from us. This helps us maintain an ongoing relationship with clients, keep them informed of relevant developments in our practice, and support their continued health and wellbeing goals. This processing is limited to existing clients who have previously used our services and have not opted out of receiving such communications. We provide a clear and simple way to opt out at the point personal information is first collected, and in every subsequent marketing communication. We do not use this basis to market to individuals who have never used our services, and any such contact relies on their explicit consent instead. We have balanced our interest in maintaining client relationships against the individual’s right to privacy, and consider this processing to be within their reasonable expectations, low-risk, and something they can easily object to or opt out of at any time. Our newsletter may include a brief reference to our separate corporate wellbeing services (Nourish Your Business), for those who may find this relevant. This is signposting only, not direct marketing of that service.

For dealing with queries, complaints or claims:

  • Contract — we have to collect or use the information so that we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legitimate interests — we are collecting or using your information because it benefits you, our practice or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests: we have a legitimate interest in collecting and using personal information to respond to queries, investigate and resolve complaints, and handle any claims made against us. This allows us to address concerns raised by clients or others, maintain high standards of service, meet our professional and ethical obligations as a member of the NNA, and protect our legal position where a claim is made. This processing is limited to what is necessary to properly investigate and respond to the specific query, complaint or claim. We have considered the impact on the individual’s privacy and believe this processing is proportionate, expected, and in the interests of resolving matters fairly for both the individual and our practice.

For more information on our use of legitimate interests as a lawful basis, you can contact us using the details at the top of this notice.

Where we get personal information from

  • Directly from you
  • Other health and care providers
  • Insurance companies
  • Third-party laboratories

We receive personal information, including test results, from third-party laboratories that carry out testing requested as part of a client’s nutritional therapy programme (for example blood tests, stool tests, and nutrigenomic or genetic testing). This information reaches us either through secure access to the laboratory’s own results portal or by email, and we then upload it to the client’s secure account on our client portal.

Where a client is claiming the cost of our services through private health insurance, we may also receive or exchange relevant information with their insurance provider to support that claim.

How long we keep information

We keep your personal information for as long as necessary to provide our services to you, and for a period afterwards in line with our professional and legal obligations.

In most cases this means we retain client consultation records, test results and related information for 7 years from the date of your last contact with us, in line with the requirements of our professional indemnity insurance and the standard limitation period for civil claims in England and Wales.

Other categories of information are retained for different periods depending on their purpose. Financial records are kept for 6 years in line with HMRC requirements. Marketing data is deleted or anonymised after 2 years of inactivity, or immediately if you ask us to stop contacting you. Website server logs are deleted after 14 days.

A full breakdown of our retention periods is set out in our Data Retention Schedule, which is available on request.

Who we share information with

Data processors — organisations that handle personal information on our behalf, only on our written instructions, and which may not use it for their own purposes:

  • Old Forge Technologies — manages our IT systems and provides technical support, and manages and maintains our client portal and website, including the personal information stored on those systems. This is governed by a written data processing agreement.
  • Microsoft — provides our email service (Microsoft 365), so anything you email us is stored in that mailbox.

Others we share personal information with:

  • Other health providers (for example GPs and consultants)
  • Insurance companies, brokers and other intermediaries
  • Third-party laboratories carrying out testing requested as part of your programme

We do not sell your personal information, and we do not share it with anyone for their own marketing purposes.

Where your information is held. Our website, client portal and practice calendar all run on servers located in the United Kingdom. Some of the services we rely on, such as our Microsoft 365 email, are provided by international companies that may process limited information outside the UK. Where that happens, we only use providers that offer the safeguards required by UK data protection law.

How we protect your information

  • All traffic to and from this website and our client portal is encrypted in transit using TLS.
  • Client records and test results are held in our client portal, which requires an individual account and password.
  • Access to our systems is restricted to named accounts, and administrative areas require a separate login.
  • Servers are kept up to date with security patches and are monitored.
  • Backups are taken so that information can be restored after a failure, and are deleted on a regular rotation.
  • Our IT provider is bound by a written data processing agreement that requires it to notify us of any personal data breach within 24 hours, so that we can meet our own reporting duties.

No system can be guaranteed completely secure, but we review these measures regularly, and we will tell you — and the ICO where we are required to — if a breach is likely to affect you.

Duty of confidentiality

We are subject to a common law duty of confidentiality. However, there are circumstances in which we will share relevant health and care information. These are where:

  • you have provided us with your consent (we take it as implied in order to provide you with care, or you have given it explicitly for other uses);
  • we have a legal requirement (including court orders) to collect, share or use the data; or
  • on a case-by-case basis, the public interest in collecting, sharing and using the data overrides the public interest served by protecting the duty of confidentiality (for example, sharing information with the police to support the detection or prevention of serious crime).

Professional standards and regulation

Ruth Trimbitas is a Registered Nutritional Therapist and a full member of the Naturopathic Nutrition Association (NNA, member no. 1581). The practice is also registered with the Federation of Nutritional Therapy Practitioners (FNTP, no. 104823462) and is insured with Balens.

We handle personal information in line with:

  • UK GDPR
  • Data Protection Act 2018
  • The Privacy and Electronic Communications Regulations 2003 (PECR)
  • The professional and ethical standards of the NNA

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Our Data Protection Complaints Procedure explains how we handle complaints and how long we take to respond.

If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the Information Commissioner’s Office (ICO):

You do not need to complain to us first before contacting the ICO, although we would always welcome the opportunity to resolve your concern directly.

Reviewing this notice

We review this notice periodically to make sure it remains accurate. It was last reviewed in August 2026.

Please read it alongside our Terms of Business, Clinical & Medical Disclaimer, Data Protection Complaints Procedure and Inclusion & Accessibility Statement.