Privacy Policy
Raina O'Mahony Dietitian
Last updated: August 2026
1. Who I am
Raina O'Mahony Dietitian is a private dietetic practice operated by Raina O'Mahony, a sole trader. I provide virtual dietetic services and am registered with the Health and Care Professions Council (HCPC).
For the purposes of UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Raina O'Mahony is the data controller for personal information processed as part of the practice.
If you have any questions about this Privacy Policy or how your personal information is used, please contact rainaomahonydietitian@proton.me.
2. Information I collect
The information I collect will depend on how you interact with my website and services. This may include:
your name, date of birth and contact details;
address and demographic information where relevant;
details of your GP, consultant or other healthcare professionals;
information provided when you make an enquiry, request or book an appointment, or complete a registration form or questionnaire;
health and medical information, including diagnoses, symptoms, medical history, medications, investigations, test results and treatment history;
dietary information, eating habits, lifestyle information and relevant health goals;
consultation notes, dietetic assessments, recommendations and care plans;
correspondence and communications between you and me;
information provided by your GP, consultant, another healthcare professional, health insurer or another person or organisation involved in your care;
health insurance, membership, policy and authorisation information where applicable;
appointment and booking information;
payment, invoice and transaction information; and
technical information relating to use of my website, such as device, browser, IP address, cookies and website analytics information.
Information about your health is special category personal data under UK data protection law and receives additional protection.
3. How I obtain your information
Most personal information is provided directly by you, for example when you visit or use my website, contact me by email or through an enquiry form, request or book an appointment, register for or use Practice Better, complete forms or assessments, attend a consultation, communicate with me about your care or make a payment.
I may also receive relevant information from your GP, consultant or other healthcare professionals, private health insurer, or another organisation or individual involved in arranging or providing your care.
4. Why I use your information
I use personal information where necessary to operate my practice and provide dietetic services. This includes responding to enquiries; assessing whether my services are appropriate for you; registering you as a client; arranging appointments; providing dietetic assessment, advice and care; maintaining clinical records; communicating with you and relevant healthcare professionals; processing payments, invoices and insurance claims; meeting professional, regulatory, legal and insurance requirements; administering my practice; and understanding how my website is used.
I will only collect and use personal information where I have an appropriate lawful basis for doing so.
5. Lawful basis for using your information
Under UK GDPR, I must have a lawful basis for processing personal information. Depending on the purpose and circumstances, I may rely on contract, legitimate interests, legal obligation or consent.
Health information is special category personal data and requires an additional legal condition for processing. Where I process health information for the purposes of providing dietetic care, I may rely on Article 9(2)(h) UK GDPR, which permits processing where necessary for the provision or management of health or social care by, or under the responsibility of, a health professional subject to professional confidentiality obligations.
Consent to receive dietetic treatment is separate from the lawful basis relied upon for processing personal information under UK GDPR.
6. Clinical records
As an HCPC-registered dietitian, I maintain appropriate records of the care and services I provide. These may include assessments, relevant medical and dietary history, consultation notes, correspondence, recommendations, care plans, reports and other information relevant to your dietetic care.
Clinical information is treated as confidential and stored using systems and security measures appropriate to the nature of the information.
7. Practice Better
I use Practice Better, operated by Green Patch Inc., as a data processor and practice-management platform. It may be used for client registration and forms, questionnaires and assessments, appointment booking and management, clinical records, secure communication, invoicing and payments, and virtual consultations.
Information processed through Practice Better may include contact, appointment, billing, payment and personal health information. I have entered into a Data Processing Agreement with Green Patch Inc. covering its processing of personal information on behalf of my practice under UK data protection law. Practice Better also uses approved third-party service providers, known as sub-processors, to provide aspects of its services.
8. Virtual consultations
My dietetic services are primarily provided remotely. Virtual consultations may take place using the secure telehealth functionality available through Practice Better or another appropriate secure platform.
I do not routinely record virtual consultations. If there were a reason to record a consultation, I would inform you beforehand and obtain any consent required before recording takes place.
9. AI-assisted transcription and clinical documentation
I may use an artificial intelligence (AI)-assisted transcription or clinical documentation tool, such as Heidi Health, to assist with note-taking and preparation of clinical documentation during or following a consultation. Information discussed during your consultation, including health information, may therefore be processed by the service provider to generate a transcript, summary or draft clinical notes.
I will inform you before an AI transcription or documentation tool is used during your consultation and will not use it during the consultation without your agreement. AI-generated documentation assists rather than replaces my professional judgement, and I remain responsible for reviewing and correcting information before it is relied upon as part of your clinical record.
Where Heidi Health is used, consultation audio is processed in real time and is not retained as an audio recording. Patient information, consultation sessions and transcripts held within Heidi are configured to be automatically deleted after 30 days. Relevant clinical information is reviewed and transferred to your clinical record where appropriate.
10. Email communication
I use Proton Mail for email communication. Although appropriate measures are taken to protect personal information, no method of electronic communication can be guaranteed to be completely secure. Where particularly sensitive clinical information needs to be exchanged, I may use a more appropriate secure method, such as secure messaging or document sharing through Practice Better.
11. Payments
Payments may be made electronically through Practice Better and its associated payment-processing services, including Stripe, or by bank transfer. Payment providers may process personal and financial information required to complete transactions in accordance with their own applicable privacy arrangements.
I may retain appropriate payment, invoice and transaction records where necessary for accounting, taxation, dispute resolution and other legal or business purposes. I do not require or intend to retain full payment-card details within my own clinical records.
12. Private health insurance
If your dietetic care is funded wholly or partly through private medical insurance, I may collect information including your insurer, membership or policy details and treatment authorisation information.
Where necessary, I may communicate with your insurer to confirm eligibility or treatment authorisation, administer insurer-funded treatment, submit invoices or claims, and provide information reasonably required in connection with funding your care. Health or clinical information will only be shared where there is an appropriate lawful basis and where disclosure is necessary and appropriate.
13. Sharing information with healthcare professionals
Where appropriate for your care, I may communicate with your GP, consultant or another healthcare professional involved in your treatment. This may include sharing relevant dietetic assessments, recommendations, reports or other clinical information.
I will respect your confidentiality and will normally discuss relevant information-sharing with you where appropriate. There may be exceptional circumstances in which information can or must be disclosed without your consent, for example where required by law or necessary to protect you or another person from serious harm.
14. Other organisations that may process information
In operating my practice, I use third-party services which may process personal information on my behalf or act as separate data controllers. These may include Green Patch Inc. (Practice Better) for practice management and clinical services; Heidi Health or another appropriately assessed AI-assisted clinical documentation provider; Stripe and other payment providers; Proton Mail; Squarespace; website analytics providers; private health insurers; professional advisers, accountants and insurers where necessary; and other technology providers required for the secure operation of my practice.
I take reasonable steps to select appropriate providers and ensure personal information is handled in accordance with applicable data protection requirements.
15. International transfers
Some technology services used by my practice may process or store personal information outside the United Kingdom. In particular, information processed through Practice Better may be stored or accessed using infrastructure outside the UK, including in the United States and Canada.
Where Practice Better makes a restricted international transfer of UK personal information, its Data Processing Agreement provides for appropriate transfer mechanisms and safeguards under UK data protection law, which may include the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, as applicable. You may contact me if you would like further information about safeguards relating to your personal information.
16. Website analytics and cookies
My website may use cookies and similar technologies necessary for the website to operate and, where enabled, to help me understand how visitors use it. Analytics information may include pages visited, how visitors reached the website, browser or device information and general website usage information.
Where consent is required for non-essential cookies or analytics technologies, you will be given the opportunity to accept or reject them. Further information may be available through the website's cookie notice or cookie settings.
17. Marketing
I do not currently use personal information collected through my clinical services to send newsletters or general marketing communications. If I introduce email marketing in the future, I will review this Privacy Policy and introduce appropriate consent and opt-out arrangements where required.
18. How long I keep your information
I do not keep personal information for longer than is reasonably necessary, taking account of professional, legal, regulatory and insurance requirements.
Adult clinical records will normally be retained for a minimum of eight years following the end of treatment or last professional contact. Records may be retained for longer where there is an appropriate legal, regulatory, professional or insurance reason to do so.
Where Heidi Health is used, patient information, consultation sessions and transcripts held within Heidi are configured to be automatically deleted after 30 days. Relevant information required as part of the clinical record is retained separately in accordance with the clinical-record retention period above.
Enquiries from people who do not subsequently become clients will generally only be retained for as long as reasonably necessary to administer the enquiry. Financial and transaction records may be retained for the period required to meet applicable accounting, taxation and legal requirements. Information that is no longer required will be securely deleted, destroyed or anonymised as appropriate.
19. How I protect your information
I take appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access. These include appropriate use of secure practice-management systems, access controls, passwords, secure communication methods and security measures on devices used to access client information.
Practice Better's Data Processing Agreement provides for security measures including access controls, multi-factor authentication, encryption of personal information in transit and at rest, security monitoring and incident-management procedures.
20. Your data protection rights
Depending on the circumstances, you may have rights including the right of access, rectification, erasure, restriction of processing, objection, data portability and withdrawal of consent where consent is relied upon.
These rights are not absolute and some may not apply in particular circumstances. For example, I may need to retain clinical records despite a request for deletion where there is an appropriate professional or legal reason for doing so.
If you wish to exercise a data protection right, please contact rainaomahonydietitian@proton.me. I will respond in accordance with the timescales required by data protection law.
21. Complaints
If you have concerns about how I have used your personal information, please contact me in the first instance at rainaomahonydietitian@proton.me.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Further information about making a complaint is available on the ICO website.
22. Changes to this Privacy Policy
I may update this Privacy Policy from time to time, including where my services, technology providers, data-processing activities or legal obligations change. The current version will be made available on my website and the date at the top of this policy will be updated when material changes are made.