Privacy Policy

Sunshine Nutrition is the trading name of Stephanie Bardell, a Registered Nutritional Therapist (DipION, mBANT, CNHC Registered) providing nutritional therapy online across the United Kingdom.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Stephanie Bardell is the data controller for the information described in this policy. If you have any questions about your data, contact us at stephanie@sunshinenutrition.co.uk.

This policy covers this website. If you go on to work with Stephanie, she will give you separate information about the health records kept for your care.

This is a small website with a few things you can do: send an enquiry, book a free 15-minute discovery call, or ask for one of the free guides by email. That is all we collect:

• Enquiry details — when you use the contact form: your name, email address, phone number if you choose to give one, the message you write, and a record that you ticked the consent box (with the date and the version of this policy in force at the time).
• Discovery-call bookings — when you book a call: your name, your email address, and the date and time you chose. You do not create an account, and we do not ask for anything else.
• Guide requests and mailing-list sign-ups — when you ask us to email you a free guide: your email address, which guide you asked for, and whether you ticked the optional box to hear from us again (with the date and the version of this policy in force). Section 5 explains exactly what that box does.
• Anything you choose to tell us — if your message describes your symptoms or health, that is health information, which UK GDPR treats as special-category data (Article 9). We only ever hold what you decide to write; nothing asks you for it.
• Technical information — our hosting and email providers keep ordinary server logs (including IP addresses) for security and reliability. We store the IP address a contact-form submission came from, so we can block abuse of the form. It is deleted or anonymised along with the enquiry.
• Cookies — one essential cookie: a secure, httpOnly session cookie set only when Stephanie signs in to administer the practice. Visitors never receive it. Separately, if you accept them, Google Analytics sets analytics cookies (section 7). We use no advertising or tracking cookies at all. See our Cookie Notice.

We do not take payments on this website, so we never see or hold any card or bank details. There are no client logins, no file uploads and no online portal.

• To reply to your enquiry — lawful basis: our legitimate interests in answering people who contact us (UK GDPR Art. 6(1)(f)). You also give consent when you tick the box on the form.
• To arrange and hold your discovery call — lawful basis: taking steps at your request before entering into a contract (Art. 6(1)(b)). This includes sending your confirmation and reminder emails.
• To handle any health information you choose to share — lawful basis: your explicit consent (Art. 9(2)(a)), given when you tick the consent box or when you tell us about your health on a call.
• To email you a guide you asked for — lawful basis: taking steps at your request (Art. 6(1)(b)). This is a one-off transactional email; it does not put you on any list.
• To send you news and nutrition tips, only if you asked for them — lawful basis: your consent (Art. 6(1)(a)), given by ticking the box, and withdrawable at any time. See section 5.
• To keep the website secure and prevent abuse (rate limiting, spam filtering) — lawful basis: our legitimate interests in protecting the service and your data (Art. 6(1)(f)).
• To measure how the website is used, if you agree to it — lawful basis: your consent (Art. 6(1)(a)), given by pressing Accept on the cookie banner and withdrawable at any time. Decline and no analytics runs at all; see section 7.

We do not sell your data, we do not use it for automated decision-making or profiling, and we do not add you to a marketing list from an enquiry, a booking, or a guide you asked for. The only way onto that list is to tick the box yourself.

Nothing on this site asks for your health information — but people often describe what they are struggling with when they get in touch, and a discovery call is a conversation about your health. Anything you share that way is special-category data and receives extra care. We rely on your clear, affirmative consent, recorded against the version of this policy in force (currently version 2026-08-31).

You can withdraw your consent at any time by emailing Stephanie at stephanie@sunshinenutrition.co.uk. Withdrawing consent does not affect anything we did lawfully before you withdrew it. Health information is never used for marketing and is never shared without your consent, except where the law requires it or there is a serious risk to someone's safety.

You can ask us to email you any of the free guides on our resources page. The form asks for your email address, and offers you an optional tick box to hear from us again. Those are two separate things, and we keep them separate:

• If you leave the box unticked — we email you the guide and that is the end of it. Your address is not added to any marketing list, and you will not hear from us again unless you get in touch.
• If you tick the box — we email you the guide and add your address to our mailing list, so we can send occasional nutrition tips, news, new resources and information about Stephanie's services. We record the date you ticked it and the version of this policy in force, because consent has to be evidenced.

There is also a sign-up box on the resources page for people who want the updates without a particular guide. It works the same way: the tick is the consent, and nothing is stored without it.

You can unsubscribe at any time — reply to any email we send you, or email Stephanie at stephanie@sunshinenutrition.co.uk, and we will take you off the list. We never sell, rent or share the list, we never send marketing on anyone else's behalf, and health information is never used for marketing (section 4). The guides themselves are ordinary marketing emails — we do not track whether you opened one.

We do not sell your data or share it for anyone else's marketing. We use a small number of trusted service providers ("processors") who process data on our behalf, under contract and only on our instructions:

• Google (Firebase / Google Cloud) — the database that stores enquiries and bookings, and the sign-in used to administer the practice.
• Resend — sends the transactional emails: your booking confirmation and reminder, and the notification that tells Stephanie you have been in touch.
• Vercel — hosts the website itself and its server logs.
• Google Analytics — measures how the site is used, and only if you accepted analytics cookies. If you declined, or have not answered, nothing is sent to Google at all. See section 7.

If you message us on WhatsApp instead, that conversation is handled by WhatsApp under its own privacy terms.

We may also disclose information if we are legally required to (for example a court order), or to protect the vital interests of you or another person.

We would like to know which pages people find useful and how many visitors go on to book a discovery call, so we use Google Analytics 4. Because analytics cookies are not strictly necessary, UK law (PECR) requires your permission first — so we ask, plainly, with an Accept and a Decline of equal weight.

• Before you choose, nothing happens. The Google Analytics script is not loaded, no cookie is set, and your browser makes no request to Google.
• If you accept, Google Analytics records the pages you view, approximate location (country/region), general device and browser information, and a few named actions: clicking a discovery-call button, reaching and finishing the booking form, downloading a fact sheet, opening a quiz.
• Your details are never sent. No name, email address, phone number, message or appointment time is included in any analytics event — the booking events carry no details whatsoever. We also switch Google's advertising features off, so your visit is not used for ad audiences or remarketing.
• You can change your mind at any time using "Cookie preferences" in the footer. Withdrawing stops the collection and expires the analytics cookies already in your browser.

Google acts as our processor here and is based outside the UK — see section 8. The full detail, including the cookie names and how long they last, is in our Cookie Notice.

Our database and file storage are provided by Google Cloud and are currently located in the United States (the nam5 multi-region for the database, us-east1 for file storage). Our email provider and website host also process data outside the UK, as does Google Analytics if you have accepted it.

We tell you this plainly rather than claim otherwise. Where your data is transferred outside the UK, we rely on the safeguards recognised under UK data protection law — the UK International Data Transfer Agreement / Addendum incorporated into our providers' terms, and, where relevant, adequacy decisions — so your data keeps an equivalent level of protection. The amount of data involved is deliberately small: a name, an email address, and whatever you chose to write.

We keep information only for as long as we need it. Our proposed schedule for the data this website collects is:

• Enquiries — up to 24 months from your last contact, then deleted or anonymised.
• Discovery-call bookings — up to 24 months after the appointment. After that the appointment may be kept as an anonymous diary entry (a date and a status, with no name or contact details) so the practice's own calendar history stays intact.
• Server and security logs — kept for a short period by our hosting and email providers under their own retention schedules.

These periods are currently under review with our professional body and insurer, and may be extended for records connected to ongoing care. If they change, we will update this policy and the version above.

If you become a client, the clinical records Stephanie keeps for your care are a separate matter with their own (longer) retention period, and she will explain it to you directly.

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectify data that is inaccurate or incomplete.
• Erase your data ("the right to be forgotten"), subject to anything we must keep by law.
• Restrict or object to our processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent, at any time, for anything we process on the basis of your consent.

Because there are no accounts on this website, there is nothing to log into and no self-service button to press — and that is deliberate. To exercise any of these rights, just email Stephanie at stephanie@sunshinenutrition.co.uk from (or quoting) the address you contacted us with. She handles the request personally and will respond within one month.

When you ask us to erase your data, we remove your name, email address, phone number and message from every enquiry and booking held against your address. Where an appointment slot has to stay in the practice diary, it remains only as an anonymous entry that cannot be traced back to you. We keep a minimal, pseudonymised record that the request was made and honoured — that is how we can prove we did it.

Information is encrypted in transit. Our database denies all direct public access by default: nothing can read it except our own server code, and the only person who can sign in to view enquiries and bookings is Stephanie, through an admin login protected by a separate permission on her account. The website sends strict security headers (including a Content-Security-Policy) and rate-limits the public forms so they cannot be flooded. We hold no card details, because we take no payments here.

Our services are intended for adults aged 18 and over. We do not knowingly collect data from children. Support for a young person is arranged only with the involvement and consent of a parent or guardian.

We may update this policy from time to time. When we make a material change we update the version and date at the top. Where a change affects how we use information you gave us with your consent, we will ask for fresh consent before relying on it.

For any privacy question or to exercise your rights, contact Stephanie Bardell at stephanie@sunshinenutrition.co.uk.

If you are unhappy with how we have handled your data, you have the right to complain to the UK's supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.