PRIVACY POLICY
2.01 Privacy notice
This privacy notice is issued by Rick Miller Limited, Office 2 The Reach, 687 to 693 London Road, Westcliff-on-Sea, Essex, SS0 9PA, United Kingdom.
Rick Miller Limited is the data controller for the personal information described here. Company registration number 08309040. ICO registration number ZA104889.
It covers the websites www.rickmillerdietitian.co.uk and www.millerhealth.london, and the clinical, corporate and medico-legal services provided by Rick Miller Limited under the names Miller Health and Rick Miller, Consultant Dietitian and Expert Witness.
Care delivered in Gibraltar is provided by a separate company and is not covered by this notice. Section 2.09 explains this.
Version 2.3. Published 7 September 2026.
2.02 About this notice
This notice explains what personal information we hold about you, why we hold it, what permits us in law to hold it, who else sees it, and how long we keep it. It also explains the rights you have and how to use them.
This notice is information we give you. It is not a contract and you are not asked to agree to it. The terms on which we provide our services are in our Terms and Conditions, which are separate.
We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
2.03 The information we hold
Depending on which of our services you use, we hold:
Your contact and identity details: name, date of birth, address, email address, telephone number.
Your health information: the reason you came to us, your medical and dietary history, medication and supplements, symptoms, allergies and intolerances, measurements and test results, our assessments, the plans we give you, and our notes of every consultation. Health information is what the law calls special category data and it receives additional protection.
Records of your consultations: where a consultation is held by video call and you have agreed to it being recorded, the recording, the transcript and the written summary your dietitian has checked. Section 2.12 explains this in full.
Your correspondence with us: the emails you send us and we send you, which form part of your clinical record, and our notes of telephone calls. Where you have messaged a dietitian on another channel and it concerned your care, our record of what you said.
Payment information: what you have paid and for what. Card details are handled by our payment provider and we never see or hold your full card number.
Where you were referred to us by a clinician, insurer, solicitor or employer, we also hold the information they sent us. Section 2.05 explains this.
For medico-legal instructions, we hold the case papers, medical records and materials the instructing party sends us.
2.04 Why we hold it, and what permits us in law
We are required to tell you the lawful basis for each purpose. This is that statement.
We do not rely on your consent to hold or to process your clinical record. We rely on Article 9(2)(h), the condition for the provision of health care. That condition applies because your care is provided by, or under the responsibility of, dietitians registered with the Health and Care Professions Council who owe you a professional duty of confidentiality.
We say this plainly because it matters to you in two ways. It means we are not asking you to sign away control of your health information as the price of treatment. It also means that if you withdraw from treatment, we do not delete your clinical record, because we are professionally required to keep it. Section 2.16 explains what you can ask us to do instead.
Consent still governs the things that are genuinely your choice: marketing, photography and case studies, and whether we write to your GP. You can withdraw any of those at any time, and doing so has no effect on your care.
2.05 Where your information comes from
Usually you give it to us, in your enquiry, your health questionnaire, and your consultations.
Where a clinician, insurer, employer, solicitor or another organisation refers you to us, we receive your information from them. We will tell you what we have received at the start of your care.
For medico-legal instructions, we receive your records from the instructing solicitor, insurer or court, under the terms of that instruction.
2.06 Who else sees your information
Only people who need to. Within our practice, that is your dietitian and the small number of colleagues who support your care and our administration.
Outside our practice, in these circumstances only:
Other clinicians involved in your care, where you have asked us to write to them or agreed that we should.
Our associate and subcontracted dietitians, where one of them is delivering part of your care. Each of them works under a written agreement with us that requires them to protect your information and to use it only for your care.
Our service providers, listed at 2.07, who process information on our instructions and on no one else's.
Regulators, courts, insurers and the police, where the law requires it or where it is necessary for legal proceedings.
Diagnostic and testing providers, and other clinics or hospitals, where your care includes a blood test, a scan, a procedure or another investigation. We give them the details they need to identify you and to carry out what has been arranged, and each of them keeps its own record of it. Depending on what your care includes, these may be the National Heart Clinic at 69 Harley Street for blood collection and laboratory analysis, the DEXA provider at 25 Harley Street, the doctor who reviews and reports on your results, and the Phoenix Hospital Group.
Each of these providers is responsible in its own right for the work it does, including for the accuracy of any test result, and holds your information as a controller under its own privacy notice rather than on our behalf. We will tell you which providers are involved, and ask for your written consent, before we send anything.
We do not sell your information, and we do not share it for anyone else's marketing.
2.07 Our service providers
We use the following providers, each under a written data processing agreement:
Google (Google Workspace): email, calendar, video consultations, document storage and the practice's file system.
Stripe: payment processing.
GoDaddy (EMS): marketing email, for those who have opted in.
Wix: our websites.
Anthropic: an artificial intelligence service we use to help prepare drafts and summaries. Section 2.13 explains this.
2.08 Information sent outside the United Kingdom
Some of our providers store or process information outside the UK. Where that happens, the transfer is covered by safeguards approved under UK data protection law, either an adequacy decision by the UK government or the International Data Transfer Agreement or Addendum. You can ask us for details of the safeguard that applies to a particular provider.
2.09 Where your care is delivered in Gibraltar
Care delivered in Gibraltar is provided through a separate Gibraltar company, and Gibraltar has its own data protection law and its own supervisory authority. This notice does not cover that care.
You will be given a separate privacy notice covering care delivered in Gibraltar, telling you which company holds your information and how to exercise your rights over it.
If your care in Gibraltar has already begun and you have not received that notice, please contact us at hello@millerhealth.london and we will provide it.
2.10 How we protect your information
Access is restricted to the people described at 2.06 and is controlled by individual accounts, each secured with a password and two step verification.
Your clinical record is held in encrypted systems inside accounts the practice controls.
We write to you by email from a Miller Health address. Email between mail providers is normally encrypted while it is travelling, but it is not encrypted from end to end, and we cannot control the security of a mailbox we do not run. So we send health information only to an email address you have given us and confirmed, we keep the detail in an attachment or a document rather than in the body of the message where we reasonably can, and if you would rather we did not send a particular document by email, tell us and we will arrange another way.
Our associate dietitians work in accounts and systems the practice controls, under written agreements, and do not keep separate copies of your records or use personal accounts to contact you.
We keep a record of who has access to what, and we review it.
2.11 How long we keep it
Clinical records: eight years after your last treatment, after which the record is reviewed and destroyed. Where you were seen as a child, until your 25th birthday.
Recordings, transcripts and consultation summaries: these are part of your clinical record and are kept for the same period.
Medico-legal records: as directed by the court and as required by our insurers.
Enquiries that do not become care: twelve months from your last contact with us.
Marketing information: until you unsubscribe.
Financial and accounting records: six years, as required by tax law.
Our full retention schedule is set out in our Records Retention Policy, which we will send you on request.
2.12 Recording and transcribing consultations
Consultations held by video call are normally recorded and transcribed. We do this so that your dietitian can give you their full attention during the call rather than writing while you talk, and so that you receive an accurate written summary afterwards.
You will always be asked before recording starts, at the beginning of the call. You can decline, and you can ask for the recording to be stopped at any point. Saying no does not change the care you receive in any way: your dietitian will take written notes instead, and you will still receive a written summary.
The recording and the transcript are held securely as part of your confidential clinical record. Before any summary is sent to you, the dietitian who held the consultation reads and corrects it. We do not send you an unchecked machine transcript.
If anyone else joins your consultation, we will ask them the same question, or we will not record that call.
2.13 How we use artificial intelligence
We use artificial intelligence tools to help transcribe consultations and to help prepare drafts of plans and summaries.
Everything you receive from us is reviewed and approved by your named dietitian, who is professionally accountable for it. No decision about your care is made by a machine, and we do not carry out automated decision making or profiling that produces legal or similarly significant effects for you.
2.14 Email and telephone
We communicate with you by email, to and from a Miller Health address ending @millerhealth.london, and by telephone. These are the only channels we use.
Our dietitians use practice email addresses only. They do not use personal email accounts, personal telephone numbers or messaging apps with clients. If you receive something that appears to come from us from any other address, please tell us.
Email to and from us forms part of your clinical record.
What you write to us, and what we write to you, is filed into your record and kept for the period set out at 2.11. An email to us is not a private note alongside your care; it is part of it.
We do not use WhatsApp, text message or social media messaging with clients. If you contact a dietitian that way, they will reply once to ask you to email them instead, they will not continue the conversation there, and anything clinically significant you have said will be written into your clinical record so that it is not lost.
Anything clinically significant is best raised in a consultation. Email is right for questions, arrangements and sending us documents. It is not a substitute for being assessed, and it is not monitored out of hours or in an emergency. If something is urgent, contact your GP, call 111, or in an emergency call 999.
2.15 Cookies and our websites
Our websites use cookies to make the site work and to help us understand how it is used. You can control cookies through the banner on the site and through your browser settings.
Pages that link to booking or payment providers may set their own cookies, which are governed by those providers' own notices.
2.16 Your rights
You have the right to:
be told how we use your information, which is what this notice does;
ask for a copy of the information we hold about you;
ask us to correct anything that is wrong;
ask us to delete information, in the circumstances where the law allows it;
ask us to restrict what we do with your information;
object to processing we carry out on the basis of our legitimate interests;
ask us to transfer information you gave us to another organisation, where that right applies;
withdraw consent, for anything we do on the basis of your consent, at any time.
Two honest limits. First, we cannot delete your clinical record on request while our professional and legal retention obligations run, because we are required to keep it. If you have a concern about your record, tell us: we can restrict who sees it, correct it, add your own statement of disagreement to it, and stop using it for anything that is not required. Second, some rights, including portability, apply only to some of the information we hold.
To use any of these rights, write to hello@millerhealth.london. We will respond within one month.
2.17 Complaints
If you are unhappy with how we have handled your information, please tell us first at hello@millerhealth.london so that we can put it right.
You can also complain to the Information Commissioner's Office at www.ico.org.uk, or by telephone on 0303 123 1113. You do not have to come to us first.
2.18 Changes to this notice
We review this notice at least once a year and whenever we change how we work. The version number and date at the top tell you which version you are reading. Where a change materially affects you, we will tell you directly rather than rely on you noticing it here.
2.19 Contact
Rick Miller Limited
Office 2 The Reach, 687 to 693 London Road, Westcliff-on-Sea, Essex, SS0 9PA
We have not appointed a Data Protection Officer, and are not required to. Data protection questions are handled by Rick Miller.
