Last updated: 8 October 2026

This notice explains how your personal information is collected, used, stored and protected when you visit this website, contact me or use my menopause and wellbeing services. It also explains your rights and how to raise a privacy concern. Personal information is handled in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025.
 

1. Who is responsible for your information

The data controller is Agota Benedek, trading as Herba Holistic and operating Menopause Naturally, based in London, United Kingdom. This means I am responsible for deciding why and how your personal information is used in my business.

Email: herbaholisticuk@gmail.com
Website: https://www.herbaholistic.co.uk
Please use these contact details for privacy questions, requests concerning your information or data protection complaints.
 

2. Information collected and where it comes from

Depending on your interaction with the website or services, the following information may be collected:

• Contact and enquiry details: your name, email address, telephone number if supplied, and the information you include in a message.

• Service information: consultation arrangements, correspondence, agreed support plans and relevant follow-up notes.

• Health and wellbeing information: information needed for personalised support, such as menopause symptoms, relevant medical history, medicines, supplements, lifestyle and any symptom records you choose to share.

• Administrative information: invoices, payment references and records needed for accounting, where you purchase a service.

• Website information: IP address, browser and device details, security logs and, depending on your cookie choices and the tools enabled, information about how you use the website.

• Consent and preference records: your marketing choices, cookie choices and any consent given for handling health information or publishing a testimonial.

Most information comes directly from you. Technical information may be collected automatically by the website platform. If you contact me through social media, I receive the details and messages you share through that platform. Downloading a blank symptom tracker does not itself give me access to the information you later write in it. If you choose to send me a completed tracker, its contents will be treated as health information.
 

3. Why your information is used and the legal basis

Your information is used only for identified purposes:

• Responding to enquiries: legitimate interests in answering questions and communicating with people who contact the business. Where an enquiry concerns a service you wish to purchase, taking steps at your request before entering a contract may apply instead.

• Providing and administering services: performance of a contract, including necessary arrangements, communication and follow-up. Health information also requires the separate protection explained below.

• Accounting and statutory records: compliance with legal obligations, including applicable tax requirements.

• Website security and essential administration: legitimate interests in keeping the website and business secure and functioning properly, while considering your rights and expectations.

• Optional newsletters or promotional emails, if offered: consent, requested separately from an enquiry or consultation.

• Optional analytics and marketing technologies, if enabled: consent where required by PECR and UK GDPR. Essential technologies are used only where an applicable legal exception permits them.

• Publishing an identifiable testimonial, if agreed: your consent, including explicit consent if it reveals health information.

• Handling complaints and legal claims: legal obligations where applicable, or legitimate interests in investigating concerns and establishing, exercising or defending legal claims.

You do not have to provide optional information or agree to marketing, however, I may be unable to answer your enquiry or provide a requested service without the details necessary for that purpose. Required information and the consequences of not providing it will be explained when it is requested.
 

4. Health information and confidentiality

Information about your health is special category personal data and receives additional protection. For personalised menopause and wellbeing support, I will ask for your explicit consent under Article 9(2)(a) of the UK GDPR before collecting and using health information. The ordinary legal basis for information objectively necessary to deliver your requested service is performance of a contract under Article 6(1)(b). Optional uses of health information require their own appropriate basis and explicit consent. Simply sending an enquiry, accepting this notice or agreeing to receive emails does not constitute explicit consent for all uses of your health information. Please avoid including detailed medical information in a general contact form or social media message; an appropriate way to share it can be arranged.

You may withdraw your consent by contacting me. This does not affect processing lawfully carried out beforehand. If the information is genuinely necessary for personalised support, withdrawing consent may mean that the relevant service cannot continue.

Where health information must be retained or used for a legal claim, Article 9(2)(f) may apply alongside the relevant Article 6 basis. Such use is limited to what is necessary for that separate purpose, rather than continuing consent-based support after consent has been withdrawn.

Health information is not used to create advertising audiences or shared with advertisers. It is shared with another practitioner only with your explicit consent, unless another specific lawful requirement or exception applies.

​

5. Online appointment booking

The online appointment booking system is not currently operational. No appointment booking data is collected through that system at present.

Before it is activated, this section will be completed with the booking provider, information collected, purposes and legal bases, recipients, storage locations, international transfer safeguards, retention periods and any payment arrangements. The relevant privacy information will be available before you submit a booking.

Information you send directly by email or through the contact form is covered by the other sections of this notice.

​

6. Service providers and sharing

Your information is not sold or rented. Access is limited to those who need it for the relevant purpose.

The website uses Wix for hosting and website functionality. Messages sent to the contact email are handled through Google's Gmail service. These providers may process information to deliver their services and may also process certain information for their own purposes under their respective privacy notices.

Where necessary, limited information may also be shared with contracted IT or storage providers, an accountant, professional advisers, insurers, or public authorities where disclosure is legally required. Appropriate contractual protections are used where a provider processes information on my behalf. Health information is not routinely included in accounting records.

If you follow an external link or interact with a social media platform, that organisation's own privacy notice applies to its processing.

​

7. International transfers

Providers such as Wix and Google may process information outside the United Kingdom, so information is not necessarily stored exclusively in the UK.

Where a restricted international transfer occurs, it must be covered by UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with any required assessment and additional protections.

​

8. How long information is kept

Information is kept only for as long as needed for its purpose, taking account of legal requirements and any relevant professional or insurance requirements.

• Enquiries that do not lead to a service: enquiry correspondence is retained for up to 12 months after the enquiry is resolved, to respond to related follow-up questions. It is deleted sooner if it is no longer needed. Where a complaint or legal dispute arises, only the relevant information is retained for as long as necessary to resolve the matter and address any associated legal claims.

• Consultation and health records: necessary records of consultations, health information, advice and agreed support plans are normally retained for eight years from the date of your last consultation or follow-up session. This period follows an established complementary healthcare recordkeeping standard and supports access to records and the handling of complaints or legal claims. Records are reviewed periodically, and unnecessary information is removed earlier. At the end of the retention period, records are securely deleted or irreversibly anonymised, unless a specific legal obligation or ongoing legal claim justifies longer retention. Any extension is documented and reviewed.

• Tax and accounting records: normally at least five years after the 31 January submission deadline for the relevant tax year, where the self-employed recordkeeping rules apply. Longer retention may be required in particular circumstances.

• Marketing information: until you unsubscribe or the information is no longer needed. A minimal suppression record may be retained to respect your decision not to receive marketing.

• Consent records, complaints and legal correspondence: for the period needed to demonstrate the relevant consent or resolve the matter and address applicable legal claims.

• Technical logs and cookies: for the periods identified in the website's cookie information and the relevant provider settings.

Records are reviewed and deleted securely or irreversibly anonymised when no longer required. Backup copies are removed through the applicable backup cycle and are not used for ordinary ongoing processing.
 

9. Cookies and similar technologies

This website is hosted by Wix and uses cookies for security and essential website operation. Cookies are small pieces of information stored in your browser.
Cookies identified on 8 October 2026 include Wix’s ssr-caching cookie, which supports page rendering and caching and had a duration of 20 seconds during the check; Wix’s sec-fetch-unsupported cookie, which identifies browser limitations affecting security features and lasts for the browsing session; and Cloudflare’s __cf_bm cookie, which protects the website from malicious automated traffic and expires after 30 minutes of inactivity. Cookie durations may vary, and additional cookies may be set by individual website features.
You can view, block or delete cookies through your browser’s privacy settings. Blocking essential cookies may affect security or prevent some website features from working properly. Session cookies normally expire when the browsing session ends, depending on your browser’s settings.
Strictly necessary cookies do not require consent where the relevant legal exception applies. Optional analytics, advertising and third-party technologies are subject to applicable consent requirements. Browser settings do not replace any consent mechanism the website is required to provide.

​

10. Protecting your information

Appropriate technical and organisational measures are used to protect personal information, including controlled access, protected accounts and devices, and secure handling of records. Only information relevant to the stated purpose is collected. No internet transmission or storage system can be guaranteed completely secure. If a personal data breach occurs, it will be assessed and reported to the ICO and affected individuals where legally required.

Identifiable health information is not published in testimonials or case studies without separate explicit permission.

​

11. Your rights and choices

Depending on the circumstances and the legal basis, you may have the right to access your personal information, correct inaccuracies, request deletion, restrict its use, receive a portable copy of certain information, and withdraw consent. You may object to processing based on legitimate interests. You have an absolute right to object to the use of your personal information for direct marketing. These rights are not all unconditional, for example, some records may need to be retained to meet a legal obligation or address a legal claim. If a request cannot be fulfilled, I will explain the reason and your options.

To exercise your rights, contact menopause_support@herbaholistic.co.uk. Requests are normally handled free of charge and without undue delay, usually within one month. Where the law permits an extension, I will explain this within the initial period. Reasonable proof of identity may be requested where needed to protect your information.

The business does not make decisions about you based solely on automated processing that have legal or similarly significant effects.

​

12. Privacy complaints and updates

If you have a concern about how your information is handled, email menopause_support@herbaholistic.co.uk or write to the correspondence address above. You may describe the problem in your own words; no special form is required. I will acknowledge your complaint within 30 days, investigate appropriately, keep you informed where necessary and communicate the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: https://ico.org.uk/make-a-complaint/. 

This notice will be updated when services, providers or data handling arrangements change, the date at the top shows the latest revision. Where a change materially affects how your information is used, the relevant information will be provided before the new processing begins and fresh consent sought where required.