Website Privacy Policy
This Privacy Policy explains how Ellen Curran Dietitian ("I", "me", "my") collects, uses and protects personal data when you visit ellencurrandietitian.com ("the Website"). I am committed to handling your information in line with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
1. Who I am
I am Ellen Curran, a CORU-registered dietitian and member of the Irish Nutrition and Dietetic Institute (INDI), operating as a sole trader under the trading name "Ellen Curran Dietitian". I am the data controller for the personal data described in this policy.
Contact details:
- Email: hello@ellencurrandietitian.com
- Address: 49 Langford Park, Summerhill, Co. Meath, A83 K403, Ireland
- CORU registration number: DI057771
Ellen Curran Dietitian is a fully virtual practice. All appointments take place online and there is no clinic at this address, which is for correspondence only. Email is the quickest way to contact me.
2. What information the Website collects
The Website itself is largely informational (Home, About, 1:1 Support, Corporate, Articles, Contact). It collects personal data in the following limited circumstances.
2.1 Corporate / workplace enquiry form
If you complete the "Workplace nutrition support" enquiry form, I collect:
- Full name
- Company or organisation name
- Work email address
- Team size
- Any details you provide about what you are looking for
This information is sent directly to my business email inbox (hello@ellencurrandietitian.com) so that I can respond to your enquiry. It is not stored anywhere else on the Website.
2.2 General enquiry form ("Get in Touch")
If you complete the general enquiry form in the "Get in Touch" section of the Website, for anyone who would rather email before booking a discovery call, I collect:
- Full name
- Email address
- Any details you provide about what you are looking for
This information is sent directly to my business email inbox so that I can respond to your enquiry. It is not stored anywhere else on the Website. Please do not include health information in either enquiry form; we can discuss your health privately on a discovery call (see Section 3).
2.3 Booking a discovery call or consultation
The "Book Free Discovery Call" and related buttons on the Website link to Nurish (operated by Craftech Media Solutions Ltd), the platform I use for bookings, video consultations, messaging and client records. When you book through Nurish, I collect your name, email address and appointment details, and anything you choose to enter in the optional free-text field about the support you are looking for.
Nurish processes this information on my behalf as my data processor, under a Data Processing Agreement that meets the requirements of Article 28 GDPR. I remain the data controller. Nurish's own terms and privacy notice apply to your use of the Nurish platform itself.
If you go on to book a programme, my Client Agreement & Privacy Notice, which you receive and agree to at booking, explains in full how I handle your personal and health information as a client.
2.4 Automatically collected data
Like most websites, basic technical data (such as IP address, browser type and pages visited) may be logged automatically by my hosting provider for security and performance purposes.
2.5 Cookies and analytics
This Website does not currently use analytics, advertising or tracking cookies of any kind. Only strictly necessary cookies required for the Website to function (if any) are used. If this changes, I will update this policy and ask for your consent before any non-essential cookies are set.
3. Health information (special category data)
Information about your health, diet or medical history is "special category" personal data under GDPR and receives extra protection.
- Enquiry forms and email: please do not include health information. If you do, I will use it only to reply to you, and will delete it in line with Section 7 unless you become a client.
- Discovery calls: health information is often relevant when we discuss whether my service is right for you. I will ask for your explicit consent before we discuss it, and will use it only to assess whether the service suits you and to prepare for any consultation you book.
- Clients: once you book a programme, my Client Agreement & Privacy Notice governs how I handle your health information.
4. Legal basis for processing
Depending on the context, I rely on the following legal bases under GDPR:
- Legitimate interests (Article 6(1)(f)): to respond to enquiries you send through the corporate or "Get in Touch" forms or by email, and to keep the Website secure and working properly. You have chosen to contact me, and your information is used only for that purpose.
- Steps before entering a contract (Article 6(1)(b)): to arrange a discovery call or consultation that you have asked to book.
- Explicit consent (Article 9(2)(a)): for any health information discussed during a discovery call, as described in Section 3. You can withdraw this consent at any time.
The legal bases for processing client records are set out in my Client Agreement & Privacy Notice.
5. Who I share information with
I do not sell your personal data. I share it only with:
- Service providers acting as my data processors under written agreements: my website hosting provider, my email provider, Nurish (bookings, video calls, messaging and records) and Stripe (payments, where you book a paid service).
- Professional or legal advisers, regulators (such as CORU) or other authorities, where I am required to do so by law.
6. International transfers
Some of my service providers, or the sub-processors they use, may process personal data outside the European Economic Area (EEA). For example, Nurish uses SendGrid, based in the United States, to send email notifications such as appointment reminders, and Nurish's hosting includes data centres in London.
Where personal data is transferred outside the EEA, I make sure it is protected by an appropriate safeguard: an EU adequacy decision (such as the decision covering the UK, or the EU–US Data Privacy Framework for certified US companies) or the European Commission's Standard Contractual Clauses. Contact me if you would like more information about these safeguards.
7. How long I keep your information
- Enquiries and discovery calls (where you do not become a client): kept for as long as needed to respond to and follow up on your enquiry, and then deleted, typically within 12 months.
- Technical/security logs: retained only as long as necessary for security purposes, in line with my hosting provider's standard practice.
- Clinical and consultation records for clients: retained for 8 years from the date of your last consultation, in line with INDI's guidance (which refers to the ICGP's record-retention recommendations for healthcare practitioners).
8. Your rights
Under GDPR, you have the right to:
- Access the personal data I hold about you
- Have inaccurate data corrected
- Request erasure of your data, in certain circumstances (subject to my professional record-keeping obligations)
- Restrict or object to certain processing, including processing based on legitimate interests
- Request a copy of your data in a portable format
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, contact me at hello@ellencurrandietitian.com. You also have the right to lodge a complaint with the Data Protection Commission (www.dataprotection.ie) if you believe your data has been handled unlawfully.
9. Security
I take reasonable technical and organisational measures to protect personal data submitted through the Website against unauthorised access, loss or misuse.
10. Children
The Website is not directed at children, and I do not knowingly collect personal data from children through it.
11. Changes to this policy
I may update this Privacy Policy from time to time, for example if the Website's functionality changes (such as adding analytics or advertising tools). The "last updated" date at the top of this page will reflect the most recent revision.
12. Contact
If you have any questions about this Privacy Policy, please contact me at hello@ellencurrandietitian.com.