HOLISTICALLY NORMAL

Website Privacy Policy & UK GDPR Privacy Notice

Document Reference: HN-WEB-001
Version: 1.0
Effective Date: July 2026
Review Date: July 2027
Document Owner: Chelsea Brown, Advanced Nurse Practitioner

 

Our Commitment to Your Privacy

At Holistically Normal, protecting your privacy is as important as providing safe, evidence-based care.

Whether you are exploring our website, making an enquiry or becoming a client, we are committed to handling your personal information responsibly, securely and transparently. We recognise that much of the information you choose to share with us is personal and, in some cases, sensitive health information. We treat that information with the same professionalism, confidentiality and respect that underpins every aspect of our clinical practice.

This Privacy Notice explains what information we collect, why we collect it, how we protect it and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

 

Who We Are

Holistically Normal is a nurse-led midlife health and skin clinic providing personalised consultations, restorative skin treatments and holistic wellbeing support.

The Data Controller responsible for your personal information is:

Chelsea Brown
Advanced Nurse Practitioner
Holistically Normal

Email: hello@holisticallynormal.com

Website: www.holisticallynormal.com

 

What Information We Collect

Depending on how you interact with our website or services, we may collect:

Personal Information

• Name

• Email address

• Postal address (where applicable)

• Date of birth (where required)

• Information submitted through contact forms

• Appointment enquiries

• Communication preferences

Health Information

If you enquire about your symptoms, complete health questionnaires or book a consultation, we may collect health information relevant to the services you have requested.

Health information is classified as Special Category Personal Data under UK GDPR and is afforded additional legal protection.

We only request information that is necessary to:

• Respond to your enquiry.

• Determine whether our services are appropriate.

• Prepare safely for your consultation.

• Deliver personalised, evidence-based care.

 

How We Collect Your Information

Information may be collected when you:

• Complete a website contact form.

• Book an appointment.

• Contact us by email.

• Subscribe to our newsletter.

• Download resources.

• Communicate with us through our website.

Our website may also automatically collect technical information such as:

• IP address

• Browser type

• Device information

• Website pages visited

• Time spent on the website

• Cookie preferences

This information helps us understand how visitors use our website so we can improve its performance and user experience.

 

Why We Process Your Information

We use your information to:

• Respond to your enquiries.

• Arrange consultations and appointments.

• Deliver safe, effective healthcare and wellbeing services.

• Maintain accurate clinical records.

• Communicate with you regarding your care.

• Improve our website and services.

• Meet legal, regulatory and professional obligations.

• Send marketing communications only where you have given your consent.

We will never sell your personal information to third parties.

 

Our Lawful Basis for Processing

Under UK GDPR, we process personal information using one or more of the following lawful bases:

Consent

For example:

• Newsletter subscriptions.

• Marketing communications.

• Downloadable resources.

You may withdraw your consent at any time.

Contract

Where processing is necessary to provide services you have requested or booked.

Legal Obligation

To comply with legal, financial, professional and regulatory responsibilities.

Legitimate Interests

To improve our website, services and client experience while protecting your rights and freedoms.

Healthcare Provision

Where health information is processed for the provision and management of healthcare services.

 

Clinical Records & Confidentiality

If you become a client of Holistically Normal, information relating to your consultations, assessments, treatment plans and ongoing care will become part of your confidential clinical record.

As a registered healthcare professional, Chelsea Brown has both legal and professional responsibilities to maintain accurate clinical records, protect patient confidentiality and ensure information is only accessed where there is a legitimate clinical or legal reason to do so.

If your website enquiry results in a consultation being booked, information you have already provided may be securely transferred into your clinical record to avoid asking you to repeat the same information and to support safe continuity of care.

 

Cliniko & Information Security

Holistically Normal uses Cliniko, a secure practice management system designed specifically for healthcare professionals, to manage appointments and maintain clinical records.

Cliniko supports our commitment to UK GDPR compliance through features including encrypted data transmission, secure data storage, user authentication, role-based access controls and audit logging where appropriate.

In addition, we protect your information through:

• Password-protected systems.

• Restricted access to authorised personnel only.

• Secure software updates and maintenance.

• Appropriate organisational and technical security measures.

• Ongoing review of our information governance processes.

While no electronic system can ever be guaranteed to be completely secure, we take appropriate steps to minimise risks and protect your personal information.

 

Sharing Your Information

We only share your information where necessary.

This may include:

• Trusted service providers who support our business operations.

• Payment processing providers.

• Website hosting providers.

• Cliniko for appointment management and clinical record keeping.

• Regulatory bodies where legally required.

• Healthcare professionals involved in your care, but only with your consent unless otherwise required by law.

All third-party providers are expected to maintain appropriate security and confidentiality standards.

 

International Data Transfers

Some trusted third-party providers may process information outside the United Kingdom.

Where this occurs, we ensure appropriate safeguards are in place in accordance with UK GDPR, including recognised adequacy regulations or approved contractual safeguards where required.

 

Data Retention

We only keep your information for as long as necessary.

Website enquiries are retained only for the period reasonably required to respond to your enquiry and manage any follow-up communication.

Clinical records are retained in accordance with current legal, professional and regulatory record retention requirements applicable to independent healthcare providers.

Marketing information is retained until you withdraw your consent.

 

Marketing Communications

We will only send marketing communications where you have actively chosen to receive them.

You may unsubscribe at any time by:

• Selecting the unsubscribe link within our emails.

• Contacting us directly.

Your decision will not affect your access to our services.

 

Cookies

Our website uses cookies to improve functionality, remember your preferences and help us understand how visitors use our website.

Where legally required, non-essential cookies will only be placed on your device after you have provided your consent.

Further information can be found in our separate Cookie Policy.

 

Children’s Privacy

Holistically Normal’s website and services are intended primarily for adults.

We do not knowingly collect personal information from children through our website without appropriate parental or legal guardian involvement where required.

 

Data Breaches

Although we take extensive measures to protect your information, no system is entirely risk-free.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will respond promptly in accordance with UK GDPR requirements, including notifying the Information Commissioner’s Office (ICO) and affected individuals where legally required.

 

Your Rights

Under UK GDPR you have the right to:

• Request access to your personal information.

• Request correction of inaccurate information.

• Request erasure where applicable.

• Request restriction of processing.

• Object to certain types of processing.

• Request data portability where applicable.

• Withdraw consent where processing relies on consent.

• Lodge a complaint with the Information Commissioner’s Office (ICO).

 

Website Information Disclaimer

The information provided on this website is intended for general educational purposes only and should not be considered individual medical advice.

Every person is different, and recommendations appropriate for one individual may not be appropriate for another. Information published on this website should not replace a consultation with a suitably qualified healthcare professional.

If you are experiencing a medical emergency, please contact the appropriate emergency services immediately.

 

Complaints

If you have any questions or concerns about how your personal information has been handled, we encourage you to contact us in the first instance so we have the opportunity to resolve the matter.

You also have the right to complain to the Information Commissioner’s Office (ICO).

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Website: https://ico.org.uk

 

Changes to This Privacy Notice

This Privacy Notice may be updated periodically to reflect changes in legislation, regulatory guidance or the services offered by Holistically Normal.

The latest version will always be published on our website.

 

Contact Us

Holistically Normal

Chelsea Brown
Advanced Nurse Practitioner

Email: hello@holisticallynormal.com

Website: www.holisticallynormal.com

 

At Holistically Normal, confidentiality is more than a legal obligation—it is a fundamental part of the trust our clients place in us. We are committed to handling your personal information with integrity, professionalism and respect at every stage of your journey with us.