NCA Nutrition Clinic Data Processing Agreement

This form describes how your personal data will be collected, handled and stored by NCA. We ask you to read this so that you can give your informed consent to our use of your personal data.

HOW WE GATHER, USE & STORE DATA AT THE NCA NUTRITION CLINIC
This appendix was last reviewed in March 2020.

1. Introduction

The NCA Nutrition Clinic needs to gather and use certain information about its clients.
This appendix to the main NCA policies (located at https://nca.ac.uk/the-college/college-policies/data-protection-policy) describes how this personal data will be collected, handled and stored.

1.1 Personal Data

NCA Nutrition Clinic may hold data for the following purposes:
- Provision of direct healthcare
- Research
- Marketing and newsletters
- Case histories (use of anonymised case studies in in-class teaching)
- Contract administration

How We Obtain Your Personal Data
- By completing a nutritional therapy questionnaire
- During a nutritional therapy consultation
- Through email, over the telephone or by post
- By direct video stream during your consultation, and by recording this video if you give us permission to do so.

This may include the following information:
- name, address, date of birth, gender, contact details, GP name and address
- details of contact we have had with you, such as referrals and appointment requests
- health information including your previous medical history, dietary, lifestyle, supplement and medicine details, biochemical test results, clinic notes and health improvement plans

Following completion of your appointments with the NCA Nutrition Clinic we retain your personal data for the period defined by our professional association BANT (British Association for Nutrition and Lifestyle Medicine) and the CNHC (Complementary and Natural Healthcare Council) for the purposes set out above, and in case of potential future appointments, requests for data access or complaints.

We may also use your data for the purposes of student research, including MSc dissertation research. During such research, your data may be viewed by academic supervisors and assessors, who are under a duty of confidentiality. Research may be published in medical journals, but you will not be identifiable in any publications.

Our lawful basis for obtaining, storing and processing your health information is Condition (j) in Article 9 (2) of the General Data Protection Regulations (Archiving, research and statistics with a basis in law); and Condition (a) (Explicit consent) as given by you in the Consent Form (the “NCA Nutrition Clinic Terms of Client Engagement”). By signing the Consent Form you are giving us permission to obtain, store and process your data as described in this document, for the purposes described above.

2. Responsibilities

Northern College of Acupuncture is the ICO (Information Commissioners Office) registered data controller for all personal data held by us.

3. Data Recording, Security and Storage

3.1 Data accuracy and relevance
NCA Nutrition Clinic staff will ensure that any personal data we process is accurate, adequate, relevant and not excessive, given the purposes (above) for which it was obtained. We will not process personal data obtained for one purpose for any unconnected purpose unless the individual concerned has agreed to this or would otherwise reasonably expect this.

3.2 Data security
NCA Nutrition Clinic will, as far as is reasonably possible, keep personal data secure against loss or misuse. Where other organisations process personal data as a service on our behalf, we will establish what, if any, additional specific data security arrangements need to be implemented in contracts with those third-party organisations.

All reasonable steps are taken to ensure staff and student NCA email accounts are secure and password protected.

3.3 Storing data securely

• In cases when data is stored on printed paper, it will be kept in a secure place where unauthorised personnel cannot access it. All Clinic paper records are stored in a locked filing cabinet when not in use in Clinic. Older materials are archived in the locked attic room, with restricted access. All client paperwork (aside from the front page of the Nutrition & Health Questionnaire, which does not leave NCA premises) is anonymised.
• Printed data will be put beyond use by shredding when it is no longer needed. Digital data will be securely destroyed when it is no longer needed.
• Data stored on a computer will be protected by strong passwords: all digital versions of paperwork are anonymised and stored on the Nutrition course section of the College Virtual Learning Environment portal which is only accessible to Nutrition students & staff, and is password protected.
• Data stored on CDs or memory sticks will be encrypted or password protected and locked away securely when they are not being used
• Cloud services used to store personal data will be assessed for compliance with GDPR principles.
• Data will be regularly backed up.
• All possible technical measures will be put in place to keep data secure.

3.4 Data retention

NCA Nutrition Clinic will retain written personal data in accordance with the guidelines of the British Association for Nutrition & Lifestyle Medicine (BANT). Current guidelines state records must be kept for 8 years after the date of the last appointment with the NCA Nutrition Clinic, or in the case of child clients, until that person’s 25th birthday. If a client is age 17 at the time of the last appointment, the records must be kept until their 26th birthday.
Video recordings will be stored and used in accordance with the consent given by the client at their initial appointment.

4. Accountability and Transparency

NCA Nutrition Clinic will ensure accountability and transparency in all our use of personal data.
We will regularly review our data processing activities and implement measures to ensure privacy by design including data minimisation, pseudonymisation, transparency and continuously improving security and enhanced privacy procedures.

5. Consent

NCA Nutrition Clinic will ensure that consents are specific, informed and written in plain English such that individuals clearly understand why their information will be collected, who it will be shared with, and the possible consequences of them agreeing or refusing the proposed use of the data.

We will regularly review consents and seek to refresh them regularly or if anything changes.

6. Direct Marketing

NCA Nutrition Clinic will comply with both data protection law and The Privacy and Electronic Communications (Amendment) Regulations 2018 when sending electronic marketing messages. PECR restricts the circumstances in which we can market people and other organisations by phone, text, email or other electronic means.

We will provide a simple way to opt out of marketing messages and be able to respond to any complaints.

7. Subject Access Requests

NCA Nutrition Clinic will provide an individual with a copy of the information requested, free of charge. This will occur within one month of receipt. Any data being processed automatically can be provided when requested in a commonly used and machine-readable format.

If complying with the request is complex or numerous, the deadline can be extended by two months, but the individual will be informed within one month.

We can refuse to respond to certain requests, and can, in circumstances of the request being manifestly unfounded or excessive, charge a fee. If the request is for a large quantity of data, we can request the individual specify the information they are requesting.

Once a subject access request has been made, we will not change or amend any of the data that has been requested.

8. Transferring data internationally

We will not transfer personal data outside of the EEA (including the UK) without specific consent.