Privacy Policy

Website of a nutrition consultancy based in Switzerland

At a glance: These terms govern your use of this website. They are not medical advice and our services are not a substitute for medical care. Your personal data is handled as described in our Privacy Policy. A separate signed agreement governs any consulting engagement. Swiss law applies.

Operator and contact details

Forrest Personalised Nutrition, sole proprietorship, Nyon Region, Vaud, Switzerland.

Last updated: September 2026

This Privacy Policy explains how we collect, use, store, and share your personal data, and your rights in relation to it. It applies to visitors to our website and to clients of our consulting services.

1. How we collect your personal data

We collect personal data in the following ways:

  • By completing a health and intake questionnaire before or during your first consultation.

  • Through email, telephone, or during in-person or video consultations.

  • Documents you share with us, such as lab results or medical reports.

  • By booking a consultation through our online booking system (currently Google Calendar).

  • By submitting a contact form on our website.

  • Through our social media pages, if you message us, comment, or otherwise interact with our content there. Note that social-media platforms are separate controllers with their own terms.

The personal data we collect may include:

  • Basic details such as your name, address, contact details, and date of birth.

  • Information relating to your health, including gut health, hormonal and perimenopausal history, symptoms, dietary habits, intolerances, and relevant medical history. This is special-category / sensitive personal data (see section 2).

We do not currently collect information about you from other sources. We do not currently operate a newsletter or mailing list; if this changes, we will update this policy and seek your consent before adding you to any such list.

2. How we use your personal data and the legal basis

We use your information to manage and deliver our consulting relationship with you. The legal bases on which we process your personal data are:

  • Contract: to deliver the nutrition consulting service you have requested, including scheduling, intake, and follow-up (Article 6(1)(b) of the EU GDPR / UK GDPR, and the corresponding basis under the Swiss Federal Act on Data Protection, FADP).

  • Legal obligations: to comply with applicable Swiss and, where relevant, EU/UK law (for example, record-keeping and accounting obligations).

  • Legitimate interests: for business administration, security, and service improvement, balanced against your rights (Article 6(1)(f) GDPR / FADP).

  • Consent: for anything outside the above, such as publishing a testimonial or, in future, sending you occasional updates. You may withdraw consent at any time.

Special-category (sensitive) data. Because your intake and consultation data includes health information, it is special-category data under Article 9 of the EU GDPR / UK GDPR and sensitive personal data under the Swiss FADP. We process it on the basis of your explicit consent (Article 9(2)(a)), which you give when you complete our intake questionnaire and engage our services, and which you may withdraw at any time. Withdrawing consent does not affect the lawfulness of processing already carried out.

Where the EU GDPR or UK GDPR applies (for example, because we offer services to, and target, individuals in the EU or UK), we comply with it. We extend equivalent protections to all clients regardless of location.

3. Sharing your data with third parties

We keep your information confidential. We only disclose it to third parties with your express consent, except where we are required to do so by law, or where a service provider processes it on our behalf to help us deliver our services.

Our current service providers (data processors) include:

  • Our website hosting and form platform (currently Squarespace).

  • Our booking and records platform (currently Google Calendar / Google Workspace).

Each provider is engaged under a data-processing agreement and only processes your data on our instructions, under appropriate confidentiality and security obligations. We do not sell your personal data.

4. International transfers

Some of our service providers (for example, Squarespace and Google) may process personal data outside Switzerland or the EU/UK, including in the United States. Where this happens, we rely on a recognised transfer safeguard:

  • For transfers to the United States, we rely on the EU-U.S. Data Privacy Framework (and the UK extension, the UK-U.S. Data Bridge) where the recipient is certified, or otherwise on the European Commission’s Standard Contractual Clauses (SCCs).

  • We confirm that appropriate contractual or organisational measures are in place for each transfer.

You may request a copy of the safeguards we rely on by contacting us at the email above.

5. How long we keep your data

We retain personal data only for as long as necessary for the purposes set out in this policy, taking into account any legal or statutory retention obligations, and then securely delete or anonymise it. Current retention periods:

  • Client health and consultation records: [e.g. 10 years after the end of the engagement] (confirm exact period with Swiss counsel — cantonal and professional rules may apply).

  • Basic contact and accounting data: [e.g. 10 years per Swiss retention rules].

  • Data collected only for a booking or enquiry that does not lead to an engagement: deleted after [e.g. 12 months].

We reassess retention needs regularly. Information that is no longer required is securely disposed of.

6. Security

We take reasonable technical and organisational measures to protect your personal data, including:

  • Restricting access to authorised personnel only.

  • Storing client records in password-protected, access-controlled accounts (currently Google Workspace).

  • Using encrypted connections (HTTPS) for data in transit, as provided by our platforms.

  • Requiring our service providers to maintain appropriate security arrangements under contract.

We maintain a record of our processing activities, as required of controllers under the Swiss FADP.

7. Data security breaches

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay, and, where required, affected individuals. We will also comply with the 72-hour notification timelines under the EU/UK GDPR where it applies.

8. Your data protection rights

You have the following rights in relation to your personal data, which you can exercise by contacting us at the email above:

  • Access: to be told what data we hold about you and to receive a copy.

  • Rectification: to have inaccurate or incomplete data corrected.

  • Erasure: to ask us to delete your data in certain circumstances.

  • Restriction: to ask us to limit processing in certain circumstances.

  • Data portability: to receive your data in a structured, machine-readable format, in certain circumstances.

  • Objection: to object to processing based on legitimate interests or carried out for certain purposes.

  • Withdraw consent: at any time, where we rely on consent.

We respond to requests without undue delay and in any event within one month of receipt (extendable by a further two months where requests are complex or numerous, in which case we will inform you of the extension).

If you are unhappy with how we handle your data, you have the right to complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, where the EU/UK GDPR applies, to your local data-protection supervisory authority (for the UK, the Information Commissioner’s Office, ICO).

9. Cookies and website analytics

Our website, built on Squarespace, uses cookies. They fall into two categories:

  • Necessary cookies, which allow the site to function and be served securely. These are always active and cannot be disabled.

  • Non-essential cookies (analytics and performance), which help us understand how visitors use the site. These are only set after you give consent, and you can accept or decline them through the cookie banner on our website.

We use the analytics built into Squarespace. The statistical reports it produces do not use personally identifiable information. We do not use third-party advertising or tracking pixels.

If we add other tools in future, such as Google Analytics or a social-media pixel, we will update this section and the cookie banner before they are deployed.

10. Children

Our services are not directed at children under 18. We do not knowingly collect personal data from children under 18 without verified parental or guardian consent. Where we accept a minor as a client, we follow the additional consent and data-protection requirements set out in the client agreement.

11. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects concerning you.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will indicate the date of the last update at the top of this policy and post a clear notice on our website of any significant changes.

13. Contact us

If you have questions or comments about this Privacy Policy, or wish to exercise your rights, please contact us: