Privacy Policy
Last updated: September 2026
This privacy notice tells you what to expect us to do with your personal information. It covers this website and the wider practice, including services delivered through Practice Better.
Contact details
Kiara Bishop, Naturopathic Nutritionist.
Email: hello@kiarabishop.com
Who we are
Kiara Bishop is a provider of naturopathic nutrition services, registered with the Association of Naturopathic Practitioners (ANP). Kiara Bishop is the data controller for the personal information collected and processed in the course of providing these services. This practice works with adults aged 18 and over.
What information we collect, use, and why
We collect or use the following information to provide our services:
- Names and contact details
- Health information, including symptoms, medical history, dietary requirements, and allergies
- Where relevant to functional testing: genetic information and other sensitive health data
If you only use the contact form on this website without going on to book a consultation, we collect just the name, email address, and message you provide, used solely to respond to your enquiry.
Lawful basis and data protection rights
Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. Our lawful basis is consent, we ask for your permission after giving you the relevant information, and you can withdraw that consent at any time.
Because health information is "special category data" under UK GDPR, we rely on your explicit consent specifically for collecting and using this, which you give when booking a consultation and completing your intake information.
In formal terms, we process your data under Article 6(1)(b) of the UK GDPR (processing necessary to provide the services you've requested) and, for health information specifically, Article 9(2)(h) (processing necessary for the provision of health or treatment).
Depending on the lawful basis, you have the following rights, you can read more about each on the ICO's website:
- Right of access — request a copy of the personal information we hold about you
- Right to rectification — ask us to correct or complete inaccurate information
- Right to erasure — ask us to delete your personal information
- Right to restriction of processing — ask us to limit how we use your information
- Right to object — object to how we're using your personal data
- Right to data portability — ask us to transfer your information to you or another organisation
- Right to withdraw consent — withdraw consent at any time where consent is our lawful basis
To make a request, contact us using the details above. We'll respond without undue delay, and in any event within one month of receiving a valid request. Where a request is complex, this may be extended by up to two further months, we'll let you know within the first month if this applies. We may ask you to verify your identity before releasing any records, and information will normally be provided electronically. Requests are free of charge unless manifestly unfounded or excessive.
Who we share your information with
Your personal information may be shared with the following trusted third parties where necessary to deliver our services:
- Practice Better — our client management and booking platform, which stores and processes your personal data on our behalf. Practice Better is GDPR compliant and acts as a data processor. See their privacy policy at practicebetter.io.
- Formspree processes contact form submissions from this website and forwards them to our email inbox.
- Functional testing laboratories — where you choose to proceed with functional lab testing (such as a DUTCH hormone test or microbiome analysis), your relevant details will be shared with whichever testing provider is most appropriate for the test in question, solely to process and interpret your results.
- Balens — our professional indemnity insurer, who may need relevant information in the event of a claim or complaint.
- Google Fonts is used to display the typefaces on this site; your browser connects directly to Google's servers to load these.
No other third parties will receive your personal data without your explicit consent.
International transfers
Some functional testing providers, including the DUTCH hormone test, are based outside the UK and EEA (in the United States). If you choose to proceed with this kind of testing, your relevant details are transferred there solely to process your order and results. This only happens with your explicit consent, given at the time testing is arranged, and UK or EEA-based alternatives can be discussed if you'd prefer to avoid an international transfer. Personal data is not transferred internationally for any other purpose.
Use of AI tools
Where AI-assisted tools are used to support the administration of this practice, any session content such as transcripts or notes is anonymised or pseudonymised first, meaning no personally identifiable information is included.
Where we get personal information from
Directly from you.
Cookies
This website does not use tracking or advertising cookies. Some of the third-party services listed above may set essential cookies as part of their normal operation, which we don't control directly.
How long we keep information
Client health records are kept for seven years from the date of your last consultation, in line with ANP guidance and standard professional indemnity insurance requirements, after which they are securely destroyed. In certain cases, such as where records may be relevant to an insurance claim or legal proceeding, they may be retained for longer. Contact form enquiries that don't lead to a booking are kept only as long as needed to respond to you.
How to complain
If you have any concerns about how we've used your personal data, contact us using the details above. If you remain unhappy after raising a complaint with us, you can also complain to the ICO:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
Reporting breaches
Any breach of this policy or of data protection law will be reported as soon as we become aware of it. We have a legal obligation to report data breaches to the ICO, the UK's supervisory authority, within 72 hours.
Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last revised.
This policy was drafted as a starting point based on how this practice currently operates, cross-checked against the ANP's own Privacy Notice template and the ICO's guidance. It's worth a professional check given it covers health data, but there are no outstanding placeholders left to fill in.