Privacy Notice

Who we are

Ellen Bennett, PhD, RD, trading as Beyond the Button, is the controller responsible for the personal information described in this notice.

Contact: ellenbennettrd@gmail.com

Beyond the Button provides online dietetic, addiction-informed and health-coaching services.

Information we collect

Depending on your relationship with us, we may collect:

• Your name, contact details and date of birth.
• Appointment, cancellation and attendance information.
• Information needed to provide dietetic, addiction-informed or coaching services.
• Health, medical, dietary and lifestyle information you provide.
• Assessment results, consultation notes, care plans, correspondence and other clinical records.
• GP, referrer and emergency-contact details where relevant.
• Payment and transaction information. Beyond the Button does not receive your complete card details from Stripe.
• Information contained in professional or organisational enquiries.
• Basic technical and security information generated when you use the website or our service providers.

We normally collect information directly from you. We may also receive relevant information from a referrer, GP, another healthcare professional or a person authorised to act for you. Where appropriate, we will tell you that we have received it.

How and why we use your information

Enquiries and bookings

We use contact and enquiry information to answer questions, provide requested information and take steps towards arranging a service. The lawful bases are Article 6(1)(b) of the UK GDPR, where you are considering or entering into a contract with us, and Article 6(1)(f), our legitimate interest in responding to professional and general enquiries.

Providing services and keeping clinical records

We use appointment, health and clinical information to assess your needs, provide services, communicate with you, prepare recommendations or care plans and maintain an appropriate clinical record.

The lawful basis for ordinary personal information is Article 6(1)(b), because processing is necessary to provide the service you have requested. Health information is special-category information. It is processed under Article 9(2)(h) of the UK GDPR, together with the applicable provisions of the Data Protection Act 2018, because it is necessary for the provision or management of health or social care by, or under the responsibility of, a health professional subject to confidentiality obligations.

Core clinical care is not normally based on your data-protection consent. However, we will seek permission where professional confidentiality rules require it, for example before making a non-routine disclosure to another person.

Legal, professional and financial responsibilities

We may use information to maintain financial records, respond to complaints, meet professional and regulatory standards, cooperate with insurers and comply with the law. The applicable bases are Article 6(1)(c), compliance with a legal obligation, or Article 6(1)(f), our legitimate interests in managing the practice and establishing or defending legal claims. Where health information is involved, we rely on Article 9(2)(h) or Article 9(2)(f), as appropriate.

Safety and safeguarding

In exceptional circumstances, information may be used or disclosed where this is necessary to protect someone’s vital interests, respond to a serious risk of harm or meet a safeguarding or other legal responsibility. The applicable bases may include Article 6(1)(c) or 6(1)(d) and Article 9(2)(c) or 9(2)(g), together with the relevant conditions in the Data Protection Act 2018.

Website and information security

Limited technical information may be used to keep the website and practice systems secure and investigate misuse. This is based on Article 6(1)(f), our legitimate interest in protecting the practice, its systems and its clients.

We do not use personal information to make decisions about you based solely on automated processing that produces legal or similarly significant effects.

Who can access or receive your information

Information may be accessed by or shared with:

• Ellen Bennett.
• Nicola Lock, where she is involved in providing your coaching service. We will share only information reasonably necessary for that purpose.
• WriteUpp, which Ellen uses for electronic clinical records and practice management.
• Cal.com, which provides appointment scheduling.
• Stripe, which processes card payments.
• Google services, which provide email, calendars and online meetings.
• FormSubmit, which delivers professional-enquiry form submissions to Ellen’s email address.
• The website-hosting provider.
• Accountants, professional advisers and insurers where reasonably necessary.
• Healthcare professionals, referrers or other people involved in your care where disclosure is appropriate and lawful.
• Regulators, courts, law-enforcement bodies or safeguarding authorities where disclosure is required or permitted by law.

Access is limited according to each person’s role, and individual user accounts must not be shared. Service providers may act as processors on our instructions or, for certain activities, as separate controllers under their own privacy notices. Where another practitioner is responsible for their own professional records, they may also act as a separate controller and provide their own privacy information. Personal information is not sold.

International transfers

Some service providers may process information outside the United Kingdom. Where personal information is transferred to a country that does not have UK adequacy regulations, an appropriate legal safeguard is used where required. This may include the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses or another safeguard permitted by UK data-protection law. You may contact us for further information about the safeguards applying to a particular provider.

How long we keep information

We keep information only for as long as necessary for the purpose for which it was collected and to meet professional, insurance, tax and legal requirements. Normally:

• Adult clinical records are retained for eight years after the end of treatment or last professional contact, unless a longer or different period is required.
• Different periods may apply to records concerning children, safeguarding matters or people who lack capacity.
• Financial and transaction records are normally retained for six years.
• Professional enquiries that do not lead to work are normally deleted within 12 months.
• Booking enquiries that do not result in treatment are normally deleted within 12 months, except where information must be retained for payment, complaint or legal purposes.
• FormSubmit states that form submissions are retained on its systems for 30 days.

Information may be retained for longer where a complaint, legal claim, safeguarding concern, professional requirement or insurer’s instruction makes this necessary. Information is then securely deleted or anonymised.

Security

We take reasonable technical and organisational measures to protect personal information. These include individual user accounts, access restrictions, multi-factor authentication, appropriate clinical-record software and contracts with relevant service providers.

No method of electronic storage or communication is completely risk-free. Please do not send clinical information through general website forms or ordinary email unless we have specifically asked you to do so.

Information you need to provide

Certain contact, booking and payment information is required to arrange a service. Relevant health information is also required where it is necessary to provide safe and appropriate care. You are not legally required to use our services or provide this information, but we may be unable to accept a booking or provide a service without it.

Your rights

Depending on the circumstances, you may have the right to:

• Receive a copy of your personal information.
• Have inaccurate or incomplete information corrected.
• Request deletion of information.
• Request restriction of processing.
• Receive information you provided in a portable format.
• Withdraw consent where a particular activity is based on consent.
• Object to processing based on our legitimate interests.

These rights are not absolute. For example, we may need to retain clinical information despite a deletion request where professional, insurance or legal requirements apply. To exercise a right, email ellenbennettrd@gmail.com. We may need to verify your identity before releasing information.

Complaints

Please contact us first if you have questions or concerns about how your information has been handled. You may also complain to the Information Commissioner’s Office:

www.ico.org.uk
Telephone: 0303 123 1113
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Cookies

The Beyond the Button website does not currently use advertising or analytics cookies. External services reached through links, including Cal.com, may use cookies under their own privacy notices. If analytics, advertising or other non-essential cookies are introduced, this notice will be updated and consent will be obtained where required.

Beyond the Button does not currently use AI transcription for consultations or coaching sessions.

Changes to this notice

We may update this notice when our services, providers or legal responsibilities change. The current version and its update date will be published on this page.