Legal
Privacy policy
What we collect, why, how long we keep it, and how to make us delete it. Short, because we deliberately collect very little.
Last updated 21 September 2026
Who is responsible
The data controller is the practice entity named in your engagement email, whose registered address is given on request, registered with the Information Commissioner’s Office as a data controller. Contact: [email protected].
The short version
- We collect your name and email, and only what you volunteer beyond that.
- We deliberately do not collect health information through this website. The booking form asks about goals, not symptoms.
- We never sell your data and we never share it for marketing.
- You can be deleted from everything with one email.
What we collect, and why
If you subscribe to The Note
Your email address, and your name if you give it. Lawful basis: consent, which you withdraw by clicking unsubscribe in any email. We keep it until you unsubscribe.
If you book an intro call
Your name, email, and your answers to three non-clinical questions about what you would like to change. Lawful basis: steps prior to entering a contract. We keep it for 24 months, then delete it. Please do not enter symptoms, medications or medical history into this form — if you do, we will delete it and ask you to resend without.
If you join The Community or The 90 Days
Your name, email, billing details held by our payment processor, and the records necessary to deliver what you bought. Lawful basis: contract, and legal obligation for accounting records, which we must keep for six years.
Where health information does arise
Inside The 90 Days you may choose to tell us things about your health. Where that happens, the lawful basis is your explicit consent under Article 9(2)(a) UK GDPR, taken separately and in writing, and those records are kept apart from any marketing system. You may withdraw that consent at any time.
If you use the website
Our host records standard server logs including IP address, for security and to keep the site up. We use no advertising cookies.
Who processes it for us
- Our newsletter and membership platform — newsletter and membership
- our payment provider — payments; we never see your card details
- Our scheduling tool — scheduling the intro call
- Our website host — hosting this website
Each is bound by a data processing agreement. Where a processor is outside the UK or EEA, the transfer is covered by the UK International Data Transfer Addendum or equivalent safeguards.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to it. You can ask for it in a portable format. Email us and we will action it within one month, usually much faster.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Security and retention
Access is limited to Dr Reddy and, where strictly necessary, one administrator. Accounts use two-factor authentication. We keep nothing longer than the periods above, except where the law requires it.
