1. Purpose of This Notice

This Privacy Policy explains how Toasana Nutrition collects, uses, and stores your personal data in accordance with the EU General Data Protection Regulation (GDPR — Regulation 2016/679), the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and any other applicable data protection laws.

It applies to all clients, prospective clients, and visitors to toasananutrition.com. This website does not use cookies.

2. Data Controller

Marie-Claude Kacy, nutritional therapist, operates under the trading name Toasana Nutrition. She is the data controller for all personal data collected and processed in the course of providing professional services.

Toasana Nutrition offers online consultations to a French, British, and international clientele.

3. Information We Collect

To provide safe and personalised nutritional support, Toasana Nutrition may collect the following categories of data:
Identification details (name, contact information, date of birth, GP contact)
Medical history, health conditions, symptoms, and relevant test results
Diet, lifestyle, medication, supplements, and health goals
Consultation notes and correspondence
Payment information (where applicable)

4. Lawful Basis for Processing

Personal data is processed on the following legal bases:
Contract (Article 6(1)(b) GDPR): to deliver the services you have requested.
Legitimate interests (Article 6(1)(f) GDPR): to maintain client records and manage the practice safely and professionally.
Consent (Articles 6(1)(a) and 9(2)(a) GDPR): for processing sensitive health data. You may withdraw consent at any time.
Legal obligation (Article 6(1)(c) GDPR): to comply with applicable legal and professional record-keeping requirements.

For special category data (health information), processing is additionally based on:
Article 9(2)(h) — healthcare purposes: processing necessary for the provision of health treatment.

5. How Your Information Is Used

Your data is used to:
Provide safe and personalised nutritional care
Assess the suitability of individualised health recommendations
Communicate with you regarding your care
Maintain accurate clinical records
Process payments and manage appointments
Meet professional, insurance, and legal obligations
Send newsletters or updates, subject to your prior consent

Toasana Nutrition is committed to protecting your personal data in a manner consistent with professional confidentiality obligations and GDPR requirements. Appropriate security measures are in place to protect stored data.

Your data will never be sold or used for commercial purposes without your explicit consent.

With your consent, your data may be shared with third parties for the following purposes:
Arranging functional tests (blood, urine, or other analyses)
Booking and administrative management
Logistics providers for product delivery
Suppliers of supplements or other recommended products

6. Data Storage and Security

All personal data is stored securely on:
Password-protected devices
Encrypted clinical software
Secure cloud storage

In line with professional standards and insurance requirements, clinical records are retained for:
7 years from the date of the last consultation
For minors: until age 25 (or 26 if aged 17 at the end of treatment)

After these periods, records are securely deleted or destroyed. Retention may be extended where records are relevant to an insurance claim or legal proceedings.

7. Online Consultations and Electronic Communication
Online consultations are conducted via reputable platforms with appropriate security measures. While all reasonable precautions are taken, no internet-based communication system can be guaranteed to be completely secure. Standard email is not fully encrypted — please bear this in mind when corresponding by email.

8. Minor Clients

Where the client is under 18 years of age, consent from a parent or legal guardian is required before any consultation can take place. The child remains the data subject under data protection law. Both parents may have the right to access the child's records unless a legal restriction or court order limits this access.

9. Sharing Your Data

Toasana Nutrition will not share your data with third parties unless:
You have given explicit consent (for example, to share information with your GP or another healthcare professional)
Disclosure is required by law (for example, in cases of serious risk of harm)
It is necessary for accounting or administrative purposes (for example, with a professional indemnity insurer or accountant, subject to GDPR compliance)

As Toasana Nutrition operates internationally, any transfer of personal data outside the European Economic Area (EEA) — including to the United Kingdom or any other third country — is subject to appropriate safeguards under GDPR Articles 44–49, such as European Commission Standard Contractual Clauses or applicable adequacy decisions.

10. Your Rights

Under the GDPR and applicable data protection law, you have the right to:
Access the personal data held about you
Request portability of your data
Request correction of inaccurate information
Request erasure of your data (where legally permissible)
Restrict or object to certain forms of processing
Withdraw consent at any time
Lodge a complaint with the relevant supervisory authority:
     France: Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr
     United Kingdom: Information Commissioner's Office (ICO) — www.ico.org.uk

Please note that clinical records cannot be deleted where retention is required by law, insurance, or professional standards.

11. Updates to This Policy

This Privacy Policy may be updated periodically to reflect legal or procedural changes. The current version is available on request or at toasananutrition.com.

12. Data Breach Notification

Any confirmed data breach will be reported as soon as it comes to our attention. In accordance with Article 33 of the GDPR, Toasana Nutrition is required to notify the CNIL within 72 hours. Where a breach is likely to result in a high risk to your rights and freedoms, you will also be informed without undue delay.

13. Contact

For any questions regarding the handling of your personal data, please contact:

Marie-Claude Kacy
Toasana Nutrition
Email: marie@toasananutrition.com
Website: toasananutrition.com


Last updated: May 2026

Privacy Policy