Privacy Policy

Last updated: 20/09/2026

This Privacy Policy explains how Rhiannon Bullen ("I", "me", "my") collects, uses, and protects your personal data when you use this website or my dietetic services.

1. Who I Am

I'm Rhiannon Bullen, a HCPC-registered Dietitian (registration number: DT033176). I am the data controller responsible for your personal data.

Contact: rhiannonbullen@outlook.com

2. What Information I Collect

Depending on how you interact with me, I may collect:

Website usage data

  • IP address, browser type, and device information

  • Pages visited and time spent on the site

  • Cookie data (see Section 7)

Booking and contact information

  • Name, email address, phone number

  • Appointment date/time and booking history

Health and clinical information (special category data)

  • Medical history and current diagnoses

  • Current medications

  • Dietary history, lifestyle, and nutrition-related information

  • Notes taken during and between appointments

3. How I Use Your Information

I use your information to:

  • Provide and manage your dietetic appointments and ongoing care

  • Communicate with you about bookings, invoices, and your care

  • Maintain accurate clinical records, as required by my professional regulator (HCPC)

  • Improve my website and services

  • Meet legal and professional obligations

4. Legal Basis for Processing

Under UK GDPR, I rely on the following legal bases:

  • Contract: to provide the services you've booked with me.

  • Legal obligation: to comply with professional record-keeping and regulatory requirements (e.g. HCPC standards).

  • Provision of health care (Article 9(2)(h) UK GDPR): processing of your health data is carried out by me as a professional bound by a duty of confidentiality, for the purpose of providing your care.

  • Consent: for any optional processing beyond your care, such as marketing communications, where applicable.

  • Legitimate interests: for website analytics and improving my services, where this does not override your rights.

You may withdraw consent (where consent is the basis for processing) at any time by contacting me, though this may affect my ability to continue providing care.

5. How Long I Keep Your Information

I retain clinical records in line with HCPC and NHS record-keeping guidance, which generally recommends retaining adult health records for a minimum of 8 years after the last entry (longer in some circumstances, e.g. for records relating to children). Website and marketing data is retained only for as long as necessary for the purpose it was collected.

6. Who I Share Your Information With

I do not sell your personal data. I may share information with:

  • Cliniko, my practice management system, which handles booking, video consultations, clinical notes, and invoicing — bound by its own data protection obligations.

  • Your GP or other healthcare professionals, but only with your consent or where necessary for your safety and continuity of care.

  • Regulatory or legal bodies, where required by law (e.g. the HCPC, in the event of a complaint or investigation).

Current third-party providers I use include:

  • Cliniko — my practice management system, used for appointment booking, video consultations (via Cliniko's built-in Telehealth feature), storing clinical notes, and invoicing.

Cliniko is based in Australia; where your data is transferred outside the UK, Cliniko has appropriate safeguards in place under UK GDPR (further detail is available in Cliniko's own privacy policy).

7. Cookies

Cookies are small pieces of data stored on your device when you visit a website. This website is built on Squarespace.

I have restricted non-essential cookies on this site. This means no analytics, performance, marketing, or advertising cookies are placed on your device, and I do not collect data about how you browse or interact with the site.

The only cookies placed are strictly necessary cookies, which are required for the website to function correctly. Under the Privacy and Electronic Communications Regulations (PECR), these do not require your consent. A full list of the cookies Squarespace may place is available in Squarespace's cookie guidance.

You can review, block, or delete cookies through your browser settings at any time. Please note that blocking strictly necessary cookies may affect how parts of this website function.

8. Data Security

I take appropriate technical and organisational measures to protect your personal data, including secure storage of clinical records and restricted access to your information.

9. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data I hold about you

  • Request correction of inaccurate data

  • Request deletion of your data (subject to my legal/professional retention obligations)

  • Restrict or object to certain processing

  • Request a copy of your data in a portable format

  • Withdraw consent at any time

To exercise any of these rights, please contact me at rhiannonbullen@outlook.com.

10. Changes to This Policy

I may update this Privacy Policy from time to time. The latest version will always be available on this website.

11. Contact

If you have any questions about this Privacy Policy or how your data is used, please contact me at rhiannonbullen@outlook.com.