Privacy Notice
How Lifespan Nutrition Ltd collects, uses and protects your personal and health data.
Version: 1.0 | Effective Date: 1 September 2026
Data Controller: Lifespan Nutrition Ltd (Company No. 12698638)
ICO Registration: ZC234753
Contact: enquiries@lifespan-nutrition.co.uk
Address: Springbank Clinic, 13 Pembroke Road, Sevenoaks, TN13 1XR
1. Who We Are
Lifespan Nutrition Ltd provides clinical nutrition services under two brands:
- Lifespan Nutrition — paediatric feeding therapy, women's health nutrition, and general nutrition consultations
- SUSTAIN Lifestyle Health and Weight Support — a multidisciplinary lifestyle change service coordinated by Lifespan Nutrition Ltd and delivered by independent practitioners
Lifespan Nutrition services are provided by Dr Melissa Bujtor, HCPC Registered Dietitian (registration number DT036246) and Registered Nutritionist (RNutr), who is regulated by the Health and Care Professions Council and bound by its standards, including the duty of confidentiality. You can verify her registration at hcpc-uk.org.
Lifespan Nutrition Ltd is the data controller for all personal data processed through both services. Where SUSTAIN practitioners (who operate as independent contractors) process your data in the course of their own clinical work, they are independent data controllers for their own clinical records.
This Privacy Notice explains what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have.
2. What Data We Collect
Personal details
- Name, date of birth, gender
- Contact details (email, phone, postal address)
- Emergency contact details
- GP and other healthcare practitioner details
Health and clinical data
- Medical history, current medications, diagnoses, allergies
- Dietary requirements and nutritional information
- Mental health history (SUSTAIN)
- Assessment questionnaire responses
- Session notes and clinical records
- Session recordings (audio and/or video, with your consent)
- Session transcripts (generated from recordings)
- Growth measurements (height, weight, head circumference — paediatric patients)
- AI-generated clinical summaries and feeding profiles
- Clinical reports and recommendations
Administrative data
- Appointment and booking records
- Payment and invoicing records
- Consent records
- Correspondence
3. Why We Collect Your Data and Our Legal Basis
Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing your personal data. We rely on the following:
| Purpose | Lawful Basis | Notes |
|---|---|---|
| Delivering clinical services (assessments, sessions, reports) | Article 6(1)(b) — contractual necessity; Article 9(2)(h) — healthcare provision | Processing by a health professional under an obligation of professional secrecy |
| Recording sessions for clinical documentation | Article 6(1)(a) — explicit consent; Article 9(2)(a) — explicit consent for special category data | You may withdraw consent at any time |
| Using AI-assisted tools for clinical notes and reports | Article 6(1)(b) — contractual necessity; Article 9(2)(h) — healthcare provision | AI-assisted documentation is part of how we deliver and record your care, not an optional extra. Processing is by or under the responsibility of a health professional under an obligation of professional secrecy. Data is pseudonymised before it reaches any AI provider, and a practitioner reviews all output |
| Sharing information with your GP or other professionals | Article 6(1)(a) — consent | Only with your explicit consent unless required by law |
| Sharing information within the SUSTAIN multidisciplinary team | Article 6(1)(a) — consent; Article 9(2)(h) — healthcare provision | Consented to in the SUSTAIN Terms and Conditions |
| Safeguarding and risk management | Article 6(1)(d) — vital interests; Article 9(2)(c) — vital interests | Disclosure without consent where there are serious safety concerns |
| Appointment scheduling and administration | Article 6(1)(b) — contractual necessity | Required to deliver the service |
| Payment processing and invoicing | Article 6(1)(b) — contractual necessity | Required to collect fees for services |
| Complying with legal and regulatory obligations | Article 6(1)(c) — legal obligation | Professional body requirements, tax records, etc. |
4. How We Use AI and Digital Tools
Lifespan Nutrition Ltd uses artificial intelligence (AI) and digital tools as part of standard clinical workflows, including:
- Generating clinical notes from session recordings
- Drafting assessment reports
- Analysing clinical data to support care decisions
- Preparing session materials
Your data is protected in the following ways:
- All patient data is pseudonymised (identifying details removed and replaced with reference codes) before being sent to any AI provider. Names, dates of birth, contact details, NHS numbers, and addresses are stripped out.
- A qualified practitioner always reviews AI-assisted outputs before they are used in your care or shared with you.
- Your data is not used to train third-party AI models.
- All AI processing complies with UK GDPR and the Data Protection Act 2018.
You have the right to ask how your data is processed in connection with any technology used during your care.
5. Who We Share Your Data With
We only share your personal data where necessary and lawful. Recipients may include:
With your consent
- Your GP or prescribing clinician
- Other healthcare professionals involved in your care
- Members of the SUSTAIN multidisciplinary team (if you are a SUSTAIN client)
Service providers (data processors and sub-processors)
We use the following third-party providers to deliver our services. All process data under contract and in accordance with UK data protection law:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Halaxy | Practice management, scheduling, patient records | Patient demographics, appointment data, clinical notes | EU |
| Supabase | Clinical platform database hosting | Patient and clinical data (encrypted at rest) | EU |
| Vercel | Clinical platform application hosting | Transient request data only | EU (West) |
| Google (Gemini API) | AI-assisted clinical text generation | Pseudonymised clinical text only (no identifiable data) | EU / US |
| Anthropic (Claude API) | AI-assisted clinical text generation | Pseudonymised clinical text only (no identifiable data) | US |
| Deepgram | Real-time speech-to-text transcription | Live audio stream (not stored by Deepgram after processing) | US |
| RCPCH | Growth centile calculations (paediatric patients) | Age, sex, and measurement values only (no names or identifiers) | UK |
| Web3Forms | Delivery of website contact-form enquiries (lifespan-nutrition.co.uk) | Your name, email address, and the message you send us | US |
Your medical insurer (where treatment is insurer-funded)
If your treatment is funded by a private medical insurer, we share the clinical information the insurer reasonably requires to authorise treatment and settle claims — typically referral details, diagnosis or presenting concern, treatment dates and invoicing information. Your insurer is a separate data controller and will handle that information under its own privacy notice. We share only what is necessary for the claim.
Without your consent (where required by law)
- Where there are serious concerns about safety (safeguarding, child protection)
- Where required by a court order or legal obligation
- To professional regulatory bodies in response to a formal investigation
6. International Data Transfers
Some of our service providers process data outside the United Kingdom. Where this occurs, we ensure your data is protected by appropriate safeguards:
- United States (Anthropic, Deepgram, and potentially Google): These providers operate under contractual terms that include Standard Contractual Clauses (SCCs) or equivalent safeguards approved under UK data protection law. Data sent to AI providers is pseudonymised — no identifiable patient information leaves the UK.
- EU (Supabase, Vercel, Halaxy): The EU has UK adequacy status, meaning data can flow freely between the UK and EU without additional safeguards.
7. How Long We Keep Your Data
We retain clinical records in accordance with NHS Records Management Code of Practice and professional body guidance:
| Record Type | Retention Period |
|---|---|
| Adult clinical records | Minimum 8 years from the date of last contact |
| Children's clinical records | Until the child's 25th birthday (or 26th if the child was 17 at conclusion of treatment), or 8 years from last contact, whichever is longer |
| Session recordings | Retained in accordance with the above periods; may be deleted earlier once clinical notes have been finalised, unless you request earlier deletion |
| AI-generated summaries | Retained as part of the clinical record |
| Payment and invoicing records | 7 years (HMRC requirement) |
| Consent records | Retained alongside the relevant clinical record |
| Correspondence | Retained alongside the relevant clinical record |
| Enquiries that do not become appointments | 12 months from your last contact with us |
Records are securely destroyed after the applicable retention period.
8. Your Rights
Under UK GDPR, you have the following rights:
| Right | What It Means |
|---|---|
| Access | You can request a copy of the personal data we hold about you |
| Rectification | You can ask us to correct inaccurate or incomplete data |
| Erasure | You can ask us to delete your data, subject to our legal and regulatory retention obligations |
| Restriction | You can ask us to restrict how we process your data in certain circumstances |
| Portability | You can request your data in a structured, commonly used format |
| Objection | You can object to processing based on legitimate interests |
| Withdraw consent | Where processing is based on consent (e.g. session recording, GP sharing), you can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal |
To exercise any of these rights, contact us in writing at enquiries@lifespan-nutrition.co.uk. We will respond within 30 calendar days.
If you are not satisfied with how we handle your request or your data, you have the right to complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
9. Data Security
We take the security of your data seriously. Measures include:
- All data transmitted over the internet is encrypted using TLS (Transport Layer Security)
- Clinical data is stored on infrastructure with encryption at rest (SOC 2 Type II certified)
- Access to patient data is restricted to authorised practitioners only, enforced by role-based access controls
- AI providers receive only pseudonymised data — your identity cannot be determined from what is sent
- Session recording tools use short-lived, scoped access keys that expire within minutes
- We maintain an audit trail of significant actions taken on your data
10. Children's Data
Lifespan Nutrition provides services to children and young people. Where the client is a child:
- We obtain consent from a parent, guardian, or carer before processing their data
- We assess the child's own understanding and capacity in line with Gillick competence principles
- Young people aged 16–17 are presumed to have capacity to consent to their own data processing
- Children's records are retained for the extended periods set out in Section 7
11. Cookies and Website Tracking
Our websites — lifespan-nutrition.co.uk, sustain.lifespan-nutrition.co.uk and drbujtor.com — use:
- Google Analytics (GA4) — to understand how visitors use our sites
- Metricool — for social media and website performance tracking
We ask before setting any analytics cookies. When you first visit, you are asked whether to accept them. Until you accept:
- Google Analytics runs in a cookieless mode — it records basic traffic information but stores nothing on your device
- Metricool is not loaded at all
If you decline, that choice is remembered and honoured. To change a choice you have already made, clear the stored site data for our website in your browser and you will be asked again, or contact us at enquiries@lifespan-nutrition.co.uk.
Our clinical platform (used by practitioners only) does not use marketing cookies.
12. Changes to This Notice
We may update this Privacy Notice from time to time. The current version is published on our websites, is provided to new clients at the point of engagement, and is available on request. Material changes will be communicated to active clients.
13. Contact Us
If you have any questions about this Privacy Notice or how we handle your data:
Email: enquiries@lifespan-nutrition.co.uk
Address: Lifespan Nutrition Ltd, Springbank Clinic, 13 Pembroke Road, Sevenoaks, TN13 1XR
This Privacy Notice was last updated in September 2026.
