Last updated: 16 June 2026

Sole trader Marie-Claude Kacy — ToaSana Nutrition
SIREN: 884 531 625
Registered business address: 138 Avenue Victor Hugo, 75016 Paris, FRANCE
Email address: marie@toasananutrition.com

1. Purpose of this Policy
This Privacy Policy explains how Toasana Nutrition collects, uses and retains the personal data of its clients, prospective clients and website visitors, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and French Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (Loi Informatique et Libertés).
As at the date of this Policy, the website toasananutrition.com does not use audience-measurement cookies or advertising cookies.

2. Data Controller
Marie-Claude Kacy, a practitioner in nutritional therapy and naturopathy, registered with the Association of Naturopathic Practitioners (ANP) and the General Naturopathic Council (GNC) in the United Kingdom, and with the Scientific Institute for Intelligent Nutrition (SiiN) in France, trading as Toasana Nutrition, is the data controller responsible for all personal data collected in connection with the provision of her services.
Consultations are provided entirely online to clients in France, the United Kingdom and internationally, with the exception of Canada and the United States.

3. Data Collected
In order to provide safe, personalised care, Toasana Nutrition may collect the following categories of data:
Identification data (name, address, contact details, date of birth, general practitioner's contact details)
Medical and health history, symptoms and test results
Dietary habits, lifestyle, treatments, dietary supplements and health goals
Consultation notes and correspondence
Payment information (where applicable)

4. Legal Bases for Processing
Personal data is processed on the following legal bases:
Performance of a contract (Article 6(1)(b) GDPR): to provide the services requested by the Client.
Legitimate interests (Article 6(1)(f) GDPR): for the administrative management of client files and the proper operation of the practice.
Legal obligation (Article 6(1)(c) GDPR): to comply with legal and professional record-keeping requirements.
Explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR): for the processing of the Client's health data, which constitutes a special category of data within the meaning of Article 9 GDPR. The Client may withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

5. Use of Data
Data collected is used to:
Provide safe, personalised nutritional and naturopathic support.
Assess the relevance of individualised health advice.
Communicate with the Client in connection with their programme of care.
Maintain accurate clinical records.
Process payments and manage appointments.
Comply with applicable professional, insurance and legal obligations.
Send communications or newsletters, subject only to the Client's prior consent.
Data is never sold or used for commercial purposes without the Client's explicit consent.

6. Data Processors and Data Hosting
In the course of its activity, Toasana Nutrition engages technical service providers for the administrative and clinical management of client files. These providers act as data processors within the meaning of Article 28 GDPR and are bound by contract to strict obligations of confidentiality, security and incident notification.
In addition to these principal tools, Toasana Nutrition may also, strictly within the limits of the tasks entrusted to them and, where applicable, with the Client's prior consent, engage:
a payment service provider, for the processing of payments;
a videoconferencing provider, for the conduct of remote consultations;
an accountant and a professional indemnity insurer, in connection with Toasana Nutrition's legal and professional obligations;
laboratories responsible for carrying out functional tests requested by the Client (blood, urine or microbiome analyses, etc.);
suppliers of dietary supplements or recommended products, where the Client wishes to be put in contact with them or to place an order through them;
logistics providers responsible for shipping such products, where necessary for delivery to the Client.
In all cases, each provider is transmitted only the data strictly necessary for the task entrusted to it. The Client is informed that their contact details will be passed to a supplement supplier or logistics provider only at the Client's request or with the Client's prior consent.
The Client may, on simple request to marie@toasananutrition.com, obtain an up-to-date and complete list of the processors involved in the processing of their data.

7. Data Security
Toasana Nutrition implements appropriate technical and organisational measures, in accordance with Article 32 GDPR, to ensure the confidentiality, integrity and availability of the personal data processed. These measures include, in particular:
Hosting of French clients' health data on a certified HDS (Hébergeur de Données de Santé) infrastructure.
Encryption of data in transit and at rest on the platforms used.
Strong authentication for access to professional tools.
Password protection and up-to-date antivirus software on devices.
Regular data backups.
A confidentiality obligation imposed on all processors.
However, as no online communication system can guarantee absolute security, the Client is advised that standard email exchanges are not encrypted end-to-end, and is encouraged to use the secure tools made available for the transmission of sensitive information.

8. Online Consultations and Electronic Communications
All consultations are conducted online via recognised platforms equipped with appropriate security measures. The Client is advised that, despite all reasonable precautions taken, no online communication system can guarantee absolute security. If communicating by standard email, please note that such email is not fully encrypted.

9. Data Retention Period
In accordance with professional standards and professional indemnity insurance requirements, clinical records are retained for a period of seven (7) years from the date of the last consultation.
For minor clients, records are retained until the client reaches the age of 25 (or 26, where care ended when the client was 17), so as to allow the exercise of their rights once they reach the age of majority.
At the end of these periods, records are securely deleted or destroyed. In certain cases (ongoing insurance or legal proceedings), the retention period may be extended for the period strictly necessary.
Accounting and tax records are retained for the statutory period of ten (10) years in accordance with the provisions of the French Commercial Code (Code de commerce).

10. Minor Clients
Where a client is under the age of 18, the consent of a parent or legal guardian is required prior to any consultation. The child remains the holder of the data protection rights. Both parents may be entitled to access the child's records, save where restricted by law or by a court order to the contrary.
11. Sharing of Data with Third Parties
ToaSana Nutrition discloses Client data to third parties only in the following circumstances:
With the Client's explicit consent, for example to share information with their general practitioner or another healthcare professional involved in their care.
Where disclosure is required by law, in particular where there is a serious and imminent risk to a person's life or health.
To the technical processors referred to in Article 6 above, strictly within the limits of their assigned tasks and subject to a contractual confidentiality obligation.
For accounting, tax, administrative or professional indemnity insurance purposes, in compliance with the GDPR.

12. Client Rights
In accordance with the GDPR and the Loi Informatique et Libertés, the Client has the following rights:
The right of access to their personal data.
The right to rectification of inaccurate or incomplete information.
The right to erasure, subject to the limitations provided for by law and the retention obligations referred to in Article 9 above.
The right to restriction of processing.
The right to object to processing.
The right to data portability.
The right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
To exercise these rights, the Client may contact Toasana Nutrition by email at: marie@toasananutrition.com.
Any request must be accompanied by the information necessary to verify the identity of the person making the request.
The Client also has the right to lodge a complaint with the competent supervisory authority:
France: Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr.
United Kingdom: Information Commissioner's Office (ICO) — www.ico.org.uk. 
Other European Union countries: the competent national data protection authority of the country of residence.
The Client is advised that clinical records cannot be deleted for as long as their retention is required by law, by insurance requirements, or by the professional standards referred to in Article 9 above.

13. Data Breach Notification
Any confirmed personal data breach will be reported as soon as possible. In accordance with Article 33 GDPR, Toasana Nutrition is required to notify the CNIL within 72 hours, and, where applicable, the competent supervisory authority of the Client's country of residence (in particular the ICO for UK clients). Cette mention est-elle obligatoire puisque je suis soumise au droit français ?
Where a breach is likely to result in a high risk to the rights and freedoms of the Client, the Client will be informed without undue delay, in accordance with Article 34 GDPR.

14. Acceptance of this Policy
Acceptance of this Privacy Policy takes place at the time of booking a consultation, by means of a dedicated checkbox separate from acceptance of the Terms and Conditions of Sale. The processing of health data is subject to specific, explicit consent, obtained by means of a separate checkbox.

15. Updates to this Policy
This Privacy Policy may be updated from time to time to reflect legal, regulatory or operational developments. The version in force is available at all times on the website toasananutrition.com. The Client is invited to review this page regularly.

16. Contact
For any questions relating to this Privacy Policy or to the processing of their personal data, the Client may contact:
Marie-Claude Kacy — ToaSana Nutrition
138 Avenue Victor Hugo, 75016 Paris, France
Email: marie@toasananutrition.com
Website: toasananutrition.com
I confirm that I have read and understood this Privacy Policy and consent to the processing of my personal and health data in accordance with the provisions set out above.

Privacy Policy