PRIVACY POLICY
Last updated: October 2026
Who We Are
Thearson Health Ltd provides independent private dietetic services. Sam Thearson is an HCPC-registered dietitian.
For data protection purposes, Thearson Health Ltd is the data controller for personal information processed as part of the private practice.
Contact: samthearsondietitian@gmail.com
This privacy notice explains what personal information is collected, why it is used, how it is protected and your rights under UK data protection law.
What Information We Collect
Depending on how you use the service, information collected may include:
- your name, date of birth and contact details
- GP and other healthcare professional details
- medical history and diagnoses
- medications and treatment information
- dietary history and nutritional information
- weight, height and other relevant measurements
- blood test results and other clinical information
- appointment notes and clinical correspondence
- referral information
- health insurance information where applicable
- payment and billing information
- information you provide through website enquiries or email
Information may be provided directly by you or, where appropriate, received from a referring clinician, healthcare professional, insurer or another organisation involved in your care.
Information about your health is classed as special category personal data under UK data protection law and is subject to additional protection.
Why We Use Your Information
Personal information may be used to:
- respond to enquiries
- assess whether dietetic support is appropriate
- arrange and manage appointments
- provide dietetic assessment, advice and treatment
- maintain appropriate clinical records
- communicate with you about your care
- prepare dietetic plans, letters or reports
- communicate with other healthcare professionals where appropriate
- manage insurance-funded appointments
- process payments and maintain financial records
- maintain the security and administration of the service
- meet professional, regulatory and legal obligations
Our Lawful Basis for Processing
Under UK data protection law, there must be an appropriate lawful basis for processing personal information.
For ordinary personal information, Thearson Health Ltd may rely on:
Contract
Where processing is necessary to provide a service you have requested or to take steps before entering into that agreement.
Legal obligation
Where information needs to be processed or retained to comply with legal or regulatory requirements.
Legitimate interests
Where processing is reasonably necessary for the administration, security and operation of the private practice and does not override your rights and interests.
Health information and other special category personal data are primarily processed under Article 9(2)(h) of the UK GDPR, which permits processing where necessary for the provision or management of health or social care by, or under the responsibility of, a health professional.
Consent may be used where appropriate for specific optional activities, but consent is not generally relied upon as the legal basis for maintaining clinical records or providing routine dietetic care.
Who We May Share Information With
Personal information is not sold to third parties.
Where necessary and appropriate, information may be shared with:
- your GP
- consultants and other healthcare professionals involved in your care
- referring healthcare professionals
- hospitals or clinical services involved in your treatment
- health insurance providers where your appointment is insurance funded
- organisations providing services necessary to operate the practice, such as clinical record systems, appointment administration, email, payment processing, accounting and website hosting
- professional advisers where required
- regulators, courts, law enforcement agencies or other authorities where there is a legal obligation to provide information
Clinical information will only be shared where there is an appropriate clinical, professional or legal reason to do so.
Where information is sent to another healthcare professional as part of your care, only information relevant to that purpose will normally be shared.
Confidentiality
Information provided during dietetic consultations is treated as confidential.
There may be exceptional circumstances where information needs to be disclosed without prior agreement, for example where disclosure is required by law or where there is a serious concern about the safety of you or another person.
Any such disclosure will be limited to what is necessary and appropriate in the circumstances.
How Long We Keep Information
Clinical records for adult patients are normally retained for 8 years after the end of treatment or last clinical contact.
Some records may need to be retained for longer where required by law, professional guidance, insurance requirements, the nature of the condition or where there is another appropriate clinical or legal reason.
Administrative, financial and enquiry records are retained only for as long as necessary for the purpose for which they were collected and to meet relevant legal, tax, professional or regulatory requirements.
Once information is no longer required, it will be securely deleted or destroyed where appropriate.
Keeping Your Information Secure
Reasonable technical and organisational measures are used to protect personal information against accidental loss, unauthorised access, disclosure, alteration or misuse.
Clinical records are stored and managed in accordance with relevant professional and data protection requirements.
Access to personal information is restricted to those who require it for an appropriate purpose.
Website Enquiries
If you contact the practice through the website, information submitted through the enquiry form will be used to respond to your enquiry and, where appropriate, to arrange an appointment.
You may choose to provide information about your health when making an enquiry. Please avoid including unnecessary sensitive or detailed medical information in an initial website message.
If you subsequently become a patient, relevant information from your enquiry may form part of your clinical record.
Payments and Insurance
Where payment is made for private services, information required to administer the payment and maintain appropriate financial records will be processed.
Where an appointment is funded through private medical insurance, relevant information may be shared with your insurer for purposes such as confirming eligibility, obtaining authorisation, invoicing and administering the claim.
Only information reasonably necessary for these purposes will be shared.
Cookies and Website Analytics
This website may use cookies and similar technologies for essential website functions.
Where analytics or other non-essential cookies are used, these should only be activated where appropriate consent has been obtained.
Visitors should be able to accept or reject non-essential cookies through the website's cookie controls.
Further information about cookies used by the website may be provided through the website's cookie settings or cookie notice.
Your Data Protection Rights
Depending on the circumstances, you may have the right to:
- request access to personal information held about you
- ask for inaccurate or incomplete information to be corrected
- request restriction of processing
- object to certain types of processing
- request deletion of information where the law allows
- request transfer of certain information to another organisation
These rights are not absolute.
For example, a request to delete information may not apply where clinical records need to be retained for professional, regulatory, legal or patient-safety reasons.
If you wish to exercise any of these rights, please contact Thearson Health Ltd using the contact details at the beginning of this privacy notice.
Complaints
If you have concerns about how your personal information has been handled, please contact Thearson Health Ltd in the first instance so that the matter can be investigated.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection and information rights.
Information Commissioner's Office
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint
Changes to This Privacy Notice
This privacy notice may be updated periodically to reflect changes in the services provided, data-processing arrangements, professional requirements or data protection law.
The date at the top of this page will be updated when significant changes are made.