Privacy Notice
Last updated 17 September 2026
In short
I collect health information from you in order to produce a reading or an interpretation, and for nothing else. I do not sell it, share it for advertising, or use it to train anything. It is held in the UK and the EEA. You can ask me to delete it at any time and I will.
The detail is below, because you are entitled to it, and because a practice that asks for this kind of information should be willing to explain what happens to it.
Who I am
LUISA HOWELL LTD, registered in England and Wales, company number 17388260, at 860 Coronation Road, London NW10 7PS.
The company is the data controller for the information described here, which means it decides why and how your information is processed. In practice that is me, Luisa Howell.
You can reach me at contact@luisahowell.com.
Registration with the Information Commissioner’s Office has been applied for. The registration reference will be added here when it is issued.
What I am, and what I am not
I am a Registered Associate Nutritionist (ANutr). I am not a doctor and this is not a medical service. I read patterns of biological regulation and offer an interpretation of them. Nothing I provide is a diagnosis, and nothing here replaces care from a clinician.
That matters for your information as well as your health. Data protection law gives the term “health professional” a specific, closed meaning, and a Registered Associate Nutritionist is not within it, so I cannot rely on the health and social care provisions in that law. I rely on your explicit consent instead, which means you keep more control, not less, and you can withdraw it whenever you like.
What I collect
When you complete The Assessment. Your answers to the questions, which include information about your health, symptoms, sleep, digestion, energy, menstrual cycle and any diagnosed conditions. Your first name and email address. Whether you consented, when, and to which version of the wording.
When you apply for The Interpretation. Everything in the application form, including what you have already tried, anything currently being investigated by a doctor, and your answers to the safety questions.
When you complete clearance. Your current medication, anything under investigation, whether you are currently under the care of a mental health professional, and any blood or test results you send me.
When you become a client. Your full history, test results, whatever tracking you share, and the notes I make while working on your case, including during the thirty day calibration window.
Automatically, whenever you visit. Standard technical information: your IP address, browser type, and which pages you looked at. This keeps the site working and secure. It is not used to build a profile of you.
Almost all of the above is what the law calls special category data, because it concerns your health. It carries a higher level of protection and is treated accordingly.
Why I collect it, and what allows me to
To produce your reading or your interpretation. Your explicit consent, given by ticking the box before you submit. For clients, processing is also necessary to perform the contract between us.
To decide whether I can safely work with you. Some answers stop the assessment or decline an application. That exists to protect you, and relies on the same explicit consent.
To send you occasional writing, if you asked for it. A separate consent, ticked separately. If you did not tick it, you will not receive it. Every email has an unsubscribe link and using it stops them immediately.
To keep records of my own work. Legitimate interests, and in some cases a legal obligation. I need to be able to show what I advised and why.
To keep the site secure and working. Legitimate interests.
How the reading is produced
Your answers are scored by a fixed set of rules, which identify which regulatory pattern appears to be carrying the most weight. That part is automated.
One automated step can affect you directly: if an answer indicates something that belongs with a doctor first, the questionnaire ends there and asks you to see your GP. No reading is produced in that case.
Beyond that, no reading is ever sent to you without me reading it first. I review every one before it is released.
Where your information is held
Your information is held and processed in the United Kingdom and the European Economic Area.
The database is in London. The application that produces your reading runs in London. Emails are sent from Ireland. This website is hosted in the European Union. Transfers between the UK and the EEA are permitted without additional safeguards under the UK’s adequacy regulations.
Some of the companies that provide these services are headquartered outside the UK. Each is bound by a contract that includes the safeguards UK law requires for international transfers, and each processes your information only in the locations named above.
Who else sees it
I work alone. Nobody else reads your answers.
The following services run the practice. Each acts on my instructions under contract, and none of them may use your information for their own purposes.
Service · What it does · Where
Supabase · Stores the database · London, UK
Vercel · Runs the assessment application · London, UK
Resend · Sends the emails · Ireland
Framer · Hosts this website · European Union
Beyond that, I will only disclose your information if the law requires it, or if I believe there is a serious and immediate risk to your life or someone else’s. If that ever happened I would tell you, unless telling you would make things worse.
I do not sell your information. I do not share it with advertisers. I do not use it to train artificial intelligence models, mine or anyone else’s.
How long I keep it
What · How long · Why
A completed assessment · 24 months from submission · So a later reading can be compared against an earlier one
An assessment that was stopped early · 30 days · You did not receive a reading, so there is nothing to hold
An application that was declined · 90 days · Long enough to answer a question about the decision
Clearance answers where we did not proceed · 90 days · As above
Client records · 8 years from the end of our work together · Professional record keeping and insurance
Marketing consent · Until you withdraw it
When an assessment reaches 24 months, your answers, your reading, your name and your email address are deleted. What remains is a set of scores with nothing in it that identifies you. Everything else in the table is deleted rather than archived.
If you ask me to delete something sooner, I will, unless I am required to keep it. I will tell you if that applies.
Your rights
You have the right to:
Ask what I hold about you, and receive a copy
Have anything inaccurate corrected
Have your information deleted
Ask me to restrict what I do with it
Receive it in a portable format, or have it sent to someone else
Object to processing based on legitimate interests
Withdraw your consent at any time
Withdrawing consent does not undo anything already done, but it stops everything from that point on.
To exercise any of these, email contact@luisahowell.com. I will respond within one month. There is no charge.
If you are not satisfied with how your information has been handled, you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. I would rather you came to me first, but you are under no obligation to.
Security
Your information is held in an encrypted database with access restricted to a single administrator account. Your reading is reached through a private link that expires after ninety days. Anything you send me as a client is held in the same restricted environment and is never forwarded by email. Two factor authentication is enabled on every service listed above.
No system is perfectly secure. If there were ever a breach affecting your information, I would tell you and the ICO within the timescales the law requires.
Cookies
This site uses only the cookies necessary to make it work. There is no advertising tracking and no third party analytics that identify you.
Children
This practice is for adults. I do not knowingly collect information from anyone under eighteen. If you believe a child has submitted information, tell me and it will be deleted.
Changes
If this notice changes, the date at the top will be updated. If a change materially affects how your information is used, I will email you rather than rely on you noticing.