Privacy Policy

Data controller Moira Newiss
Contact hello@moiranewiss.co.uk
Effective date 25 September 2026

This notice explains how I collect, use, share, retain and protect personal information in connection with my nutritional therapy and health-coaching practice, website, digital resources, MitoMind Community and Course, live group sessions, events, marketing and optional programme evaluation. It also explains your data-protection rights and how cookies and similar technologies are used.

I am the data controller for the personal information described in this notice. I am registered with the Information Commissioner's Office where registration is required. Service providers that process information under my instructions generally act as processors; some payment and technology providers may also act as independent controllers for their own legal, security and fraud-prevention purposes.

1 Scope of this notice

This notice applies when you:

visit www.moiranewiss.co.uk or contact me;
enquire about, book or receive an individual consultation or health-coaching service;
purchase or use a digital resource, workshop, course or subscription;
join or participate in the MitoMind Community and Course;
attend a live session delivered through Zoom or another notified meeting service;
complete a form through Fillout;
voluntarily participate in programme evaluation; or
subscribe to newsletters or other marketing communications.

This notice does not replace the MitoMind Community and Course Terms and Conditions. Refunds, cancellation and statutory withdrawal rights are addressed in those Terms and Conditions. There are also separate terms and conditions that apply to individual consultations and purchases through www.moiranewiss.co.uk.

2 Information I may collect

The information collected depends on how you interact with me and may include:

Identity and contact information, including your name, postal address, email address, telephone number, date of birth and emergency contact where relevant.
Enquiry, booking and account information, including appointments, membership status, login identifiers, subscription status and communications.
Consultation and healthcare information, including health history, symptoms, diagnoses, medication and supplement use, dietary and lifestyle information, test results, clinical notes, agreed plans and correspondence with other healthcare professionals where authorised.
Purchase and transaction information, including products or services purchased, price, payment status, invoices, refunds, cancellations and limited payment information supplied by Stripe, PayPal or ThriveCart. I do not normally receive or store your full payment-card number.
Course and community information, including enrolment, course progress, resources accessed, attendance, posts, comments, moderation records and support communications.
Audio, video, chat or transcript information where a Zoom or other live session is recorded with appropriate notice and consent.
Optional evaluation information, including survey answers, outcome measures, feedback and health or wellbeing information that you expressly choose to provide for evaluation.
Marketing preferences and records of consent, withdrawal, email opens or link activity where supported and lawfully enabled.
Technical information, including IP address, device and browser information, security logs, cookie identifiers and website or checkout activity.

3 How information is obtained

I usually receive information directly from you through emails, telephone calls, website enquiries, consultation conversations, Fillout forms, checkout pages, account registration, community participation, Zoom sessions and evaluation surveys. With your authority, I may receive information from your GP, another healthcare professional, a laboratory or testing provider. Technology, payment and email providers may also supply transaction, account, delivery, security and usage information.

4 Purposes and lawful bases

UK data-protection law requires an Article 6 lawful basis for each use of personal information. Health and mental-health information is special-category data and also requires an Article 9 condition. The principal bases I expect to use are summarised below.

Responding to enquiries and taking steps before a contract

Article 6 basis: Steps at your request before entering a contract; legitimate interests where appropriate

Additional condition where health data is involved: Normally not applicable unless you choose to provide health information; explicit consent may be used where necessary

Providing consultations, nutritional therapy and individual health coaching

Article 6 basis: Performance of a contract; legal obligations; legitimate interests in safe professional practice

Additional condition where health data is involved: Necessary for provision of health care by or under the responsibility of a professional subject to confidentiality, where applicable; explicit consent where required

Administering the MitoMind Community and Course

Article 6 basis: Performance of a contract; legitimate interests in operating, securing and improving the service

Additional condition where health data is involved: Explicit consent for optional health information voluntarily disclosed, unless another lawful condition applies

Community moderation, safeguarding and responding to serious safety concerns

Article 6 basis: Legitimate interests; legal obligation; vital interests where strictly applicable

Additional condition where health data is involved: Vital interests where the person is physically or legally incapable of consent, or another applicable safeguarding or substantial-public-interest condition

Processing payments, subscriptions, refunds and accounting records

Article 6 basis: Performance of a contract; legal obligation; legitimate interests in preventing fraud and resolving disputes

Additional condition where health data is involved: Not normally applicable

Recording a live session

Article 6 basis: Consent or, for an agreed essential recording, performance of a contract

Additional condition where health data is involved: Explicit consent where the recording contains health information

Optional course evaluation

Article 6 basis: Consent

Additional condition where health data is involved: Explicit consent where answers include health or mental-health information

Email newsletters and promotional communications

Article 6 basis: Consent, or legitimate interests where electronic-marketing law permits

Additional condition where health data is involved: Health information is not used for marketing without separate explicit consent

Website analytics and non-essential cookies

Article 6 basis: Consent

Additional condition where health data is involved: Not normally applicable

Complaints, legal claims, insurance and regulatory matters

Article 6 basis: Legal obligation; legitimate interests in establishing, exercising or defending legal claims

Additional condition where health data is involved: Healthcare, legal-claims or substantial-public-interest conditions where applicable

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal. If information is necessary to provide a requested consultation or fulfil a contract, I may be unable to provide that element of the service without it.

5 Consultations and client records

For individual nutritional therapy or health-coaching work, I may need detailed information about your health, medication, diet, lifestyle and circumstances. I use it to assess your needs, deliver and document the agreed service, communicate with you, support continuity and safety, meet professional standards and respond to complaints or legal claims.

I will not normally share identifiable clinical information with a GP, laboratory or other healthcare professional without your permission. I may disclose information without consent where required by law or where a lawful safeguarding, vital-interests or public-interest basis applies. Any such disclosure will be limited to what is necessary.

6 MitoMind Community and Course

For members, I process identity and contact details, purchase and subscription information, account and enrolment details, course progress, attendance, community contributions, support messages and moderation information to provide and administer the membership, deliver content, communicate service information, maintain security and enforce the community terms.

The community and course are educational and are not intended to create clinical records. Members are not required to provide a medical history and should not post medical records, laboratory reports, full medication lists, addresses, dates of birth or other unnecessary identifying or sensitive information.

Health information shared voluntarily

Members may nevertheless choose to mention aspects of their physical or mental health, symptoms, diagnoses, medication or personal experiences in community posts or live discussions. This information may be special-category health data. Where you voluntarily share it, I process it only as necessary to host and moderate the community, facilitate the discussion, respond to safety concerns and provide the educational programme. On purchasing the program you are advised not to share this data and if you choose to do so this is taken as your explicit consent that you are happy to share it.

Community posts are visible to other authorised members. I require members to respect confidentiality, but I cannot guarantee that every member will do so. Share only information that you are comfortable disclosing in a group setting. I may remove information that is excessive, unsafe, inappropriate or inconsistent with the community terms. Where the platform permits, you may delete your own post or ask me to remove it. I will not use identifiable health disclosures for marketing, testimonials, research or case reports without separate explicit consent.

7 Live sessions and Zoom

I use Zoom for some consultations, coaching calls, workshops and community sessions. Zoom may process participant names, email addresses, IP addresses, device information, meeting metadata, chat messages and audio or video transmitted during a session. Zoom may process information in the United States and other countries under its contractual transfer safeguards.

If a session will be recorded, participants will be told before recording starts and Zoom will display a recording notification. Where consent is the basis, you may decline to be recorded by keeping your camera and microphone off, using any alternative attendance arrangement offered, or leaving the recorded session. Recordings will not be used for external marketing without separate consent from identifiable participants.

I also use the live videoconferencing technology hosted in ThriveAcademy. Again if recorded participants will be informed before it starts and again you may decline to be recorded by keeping your camera and microphone off, or leaving the recorded session.

8 Fillout forms

For individual nutritional therapy consultation and the MitoMind course and community I use Fillout, operated by Restly, Inc., to enable completion of health status questionnaires, as agreed with individuals, and for optional course evaluation. Fillout may process form responses, contact details, IP addresses, device information and other information entered into a form. Form information may be stored in the United States.

A Fillout form will explain its purpose and identify mandatory and optional questions. Where a form collects health information, I will limit questions to what is necessary, and provide any additional information needed at the point of collection.

9 Optional programme evaluation

I may invite course or community participants to complete evaluation questionnaires so I can understand participation, acceptability, experience and possible changes in health or wellbeing. Participation is entirely optional. Choosing not to participate, skipping an optional question or withdrawing from evaluation will not affect course access, membership or the support you receive.

Before collecting evaluation information, I will explain the purpose, information requested, whether answers are identifiable or anonymous, who will have access, how results will be used, the retention period and how consent can be withdrawn. If identifiable health information is requested, I will seek explicit consent. Identifiable evaluation responses will not be used as clinical records and will not be published as individual case material without separate consent.

Where practicable, evaluation results will be anonymised or aggregated after analysis. Truly anonymised information that can no longer identify an individual is not personal data and may be retained to understand and report programme performance. Any future research or publication activity beyond ordinary service evaluation will be explained separately and will use any additional consent or governance required.

10 Payments and subscriptions

ThriveCart may be used to host checkout pages, create accounts, manage subscriptions and provide access to course content. Stripe processes card payments and PayPal may be offered as an alternative payment method. These providers process payment, device, identity, transaction, fraud-prevention and compliance information under their own privacy terms and, where applicable, as processors acting for me. I do not normally receive or store complete card or bank-account details.

ThriveCart records may include your name, email address, billing information, purchase history, invoices, subscription status, refunds, checkout choices and account activity. ThriveCart states that it hosts checkout pages as a processor on behalf of its customers. It may also process information for platform security, fraud prevention, legal compliance and its own service administration under its published terms.

11 Who information may be shared with

I share personal information only where necessary and lawful. Recipients may include:

ThriveCart and its course, community and customer-account services;
Stripe and, if enabled, PayPal for payments, subscriptions, fraud prevention and financial compliance;
Fillout for forms and optional evaluation;
Zoom for online consultations and live sessions;
Wix and website hosting, security, analytics and form services;
email, scheduling, cloud-storage, IT support and professional-administration providers;
laboratories, testing companies, supplement suppliers or healthcare professionals where relevant and lawfully authorised;
BANT, CNHC, professional advisers and insurers where necessary for professional standards, complaints or claims; and
courts, regulators, law-enforcement, emergency, safeguarding or other authorities where disclosure is required or lawfully justified.

Other community members will be able to see the profile information and contributions you choose to make visible within the community. They are not permitted to copy or disclose another member's information outside the community without permission.

12 International transfers

Some providers, including ThriveCart, Zoom, Fillout, Stripe and PayPal, may process information outside the United Kingdom, including in the United States. Where UK personal information is transferred to a country without UK adequacy regulations, I will rely on an appropriate safeguard where required, such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, a valid data-protection framework or another legally permitted mechanism. Providers may use subprocessors in other countries. Their current privacy and subprocessor information should be consulted for details.

13 Retention and deletion

I retain identifiable personal information only for as long as reasonably necessary for the purpose for which it was collected, professional and insurance requirements, accounting and tax obligations, complaints, safeguarding and legal claims. The normal periods are below, but information may be kept longer where required by law, a regulator, insurer, dispute, investigation or legal hold, or deleted sooner where there is no continuing lawful need.

Individual consultation and client records

Normal retention approach: Eight years after the last consultation, in line with current CNHC guidance; longer if required by professional indemnity insurance or law. Records relating to a child follow the applicable longer age-based period.

Enquiries that do not become clients or members

Normal retention approach: Normally up to 12 months after the last meaningful contact, unless needed for a complaint, safeguarding matter or legal claim.

Contracts, invoices, transaction and accounting records

Normal retention approach: Normally six years after the end of the relevant accounting or tax period, or longer where legally required.

Membership and course account information

Normal retention approach: For the active membership or access period and normally up to 12 months afterwards, except transaction, complaint, moderation or legal records retained for a longer applicable period.

Course progress and technical activity

Normal retention approach: For the access period and normally up to 12 months afterwards, unless retained in anonymised form or required to operate continuing or lifetime access.

Community posts and comments

Normal retention approach: While the community account and discussion remain active, subject to member deletion tools, moderation needs and platform functionality. On a valid request, identifiable content will be removed or anonymised where reasonably possible unless retention is legally justified.

Moderation, safeguarding and serious incident records

Normal retention approach: Normally up to six years after the matter closes, depending on seriousness, legal limitation periods, insurance and professional requirements.

Zoom cloud recordings

Normal retention approach: Only for the period stated when recording is announced and normally no longer than 12 months, unless a shorter period is specified or longer retention is separately agreed and justified. Recordings selected for deletion may remain temporarily in provider backups or trash.

Identifiable optional evaluation responses

Normal retention approach: For the period stated with the evaluation and normally no more than 24 months after the relevant programme or evaluation closes, after which they are deleted or anonymised where practicable.

Marketing records

Normal retention approach: Until you unsubscribe or withdraw consent, with a minimal suppression record retained so that the opt-out can be respected.

Website and security logs

Normal retention approach: Normally up to 12 months, unless needed to investigate security, fraud or misuse.

ThriveCart, Stripe, PayPal, Zoom, Fillout and other service providers may retain transaction, account, security, support, backup or compliance information for periods set by their own published retention policies and legal obligations. For example, payment providers may be required to retain transaction and anti-money-laundering records after an account or customer relationship ends. Where I control deletion within a provider, I will apply the periods above; where I do not, requests will be passed on or addressed through the provider's available controls where appropriate.

14 Cookies and similar technologies

Cookies are small data files or similar technologies placed on or accessed from your device. I and my providers may use them for the purposes below.

Strictly necessary

Purpose: Security, fraud prevention, checkout operation, account login, session management, load balancing and remembering privacy choices

Consent: These are required for the service and do not normally require consent, but information must still be provided

Preferences

Purpose: Remembering settings such as language, display or account preferences

Consent: Consent where legally required

Analytics

Purpose: Understanding website, checkout or course use and improving performance

Consent: Used only after consent where required

Marketing and affiliate tracking

Purpose: Measuring campaigns, attributing referrals or showing relevant advertising

Consent: Used only after consent where required

Wix may set cookies needed to operate and secure the website. If enabled, Google Analytics or similar tools may set analytics cookies after the appropriate choice. ThriveCart may set essential cookies to operate checkout, security, authentication and customer accounts. If third-party analytics, advertising or affiliate scripts are enabled on a ThriveCart checkout, ThriveCart's cookie controls may be used to prevent those scripts loading until consent is given. Fillout, Zoom, Stripe and PayPal may also set essential or optional cookies on pages they operate.

You can use the cookie banner or preference controls presented on the relevant website or hosted page. You can also delete or block cookies through your browser, although blocking necessary cookies may prevent checkout, login, forms or other functions from working. Because provider technologies change, the live cookie controls and provider notices should be consulted for the most current cookie details.

15 Marketing

I may send newsletters or promotional emails where you have consented or where another lawful electronic-marketing rule applies. You can unsubscribe at any time by using the link in an email or contacting me. Service messages about a booking, purchase, membership, safety, security or material contractual change are not marketing and may still be sent where necessary.

16 Security and confidentiality

I use reasonable technical and organisational measures appropriate to the sensitivity of the information, including access controls, password protection, encryption where available, secure service providers, confidentiality requirements, data minimisation and restricted access. No internet service is completely secure, and members should avoid posting unnecessary sensitive information in a community or ordinary email.

If a personal-data breach occurs, I will assess the risk and notify the ICO within the legally required period where the reporting threshold is met. Where a breach is likely to create a high risk to an individual, I will also notify affected people as required.

17 Your data protection rights

Depending on the circumstances, you may have the right to:

be informed about how your information is used;
request access to your personal information;
ask for inaccurate or incomplete information to be corrected;
request deletion of information in certain circumstances;
request restriction of processing;
object to processing based on legitimate interests or to direct marketing;
receive certain information in a portable format;
withdraw consent at any time where consent is relied upon; and
complain to the Information Commissioner's Office.

These rights are not absolute. For example, consultation records may need to be retained to comply with professional requirements or to establish, exercise or defend legal claims. I will normally respond to a valid request within one month, although the law permits an extension for certain complex or numerous requests. I may ask for information needed to verify identity.

18 Automated decision making

I do not use personal information to make solely automated decisions that produce legal or similarly significant effects. Payment and technology providers may use automated fraud-prevention or security tools under their own privacy notices.

19 Children

The MitoMind Community and Course is intended for adults aged 18 and over. Individual services for a person under 18 will be accepted only where specifically agreed and where the necessary parental responsibility, consent, confidentiality and safeguarding arrangements have been addressed.

20 Questions complaints and contact details

To ask a question, exercise a data-protection right, withdraw consent or raise a concern, contact:

Moira Newiss
Email: hello@moiranewiss.co.uk

If you are dissatisfied with my response, you may complain to the Information Commissioner's Office at ico.org.uk. You may also seek advice from the ICO before making a complaint.

21 Changes to this notice

I will review this notice periodically and update it when my services, providers or legal obligations change. The effective date at the top identifies the current version. Material changes will be brought to the attention of affected clients or members where appropriate.

22 Service provider privacy information

Current provider information is available from ThriveCart at https://thrivecart.com/legal/thrivecart/; Zoom at https://www.zoom.com/en/trust/privacy/; Fillout at https://www.fillout.com/privacy; Stripe at https://stripe.com/gb/privacy; PayPal UK at https://www.paypal.com/uk/legalhub/paypal/privacy-full; and Wix at https://www.wix.com/about/privacy. Information about UK data-protection law and individual rights is available from the Information Commissioner's Office at https://ico.org.uk/.