The English Institute of Sport Limited (“the EIS”, or “we”) is a private limited company registered in England and Wales with company number 4420052, having its registered office at The Manchester Institute of Health & Performance, 299 Alan Turing Way, Manchester M11 3BS.
The EIS provides sport science, medical and technology services (otherwise referred to in this notice as ‘services’) to athletes on a World Class Programme (WCP) or on a Pathways/Talent programme.
The EIS respects your privacy and is committed to protecting your personal data. The official purposes for which the EIS processes personal data are notified to the Information Commissioner’s Office (the ICO). To view these details, simply enter the EIS’s Registration Number (Z7755332) into the ICO’s public register search form here.
SECTION 2: Who does this privacy notice apply to?
This privacy notice applies to all athletes to whom the EIS provides services (also referred to as ‘you’) to ensure you know how your personal data will be processed, the third parties to whom it may be passed, the other data controllers with whom your data is shared and how long EIS will hold on to your data. It also explains your rights and responsibilities in respect of the data and how you can opt out of some aspects of the processing, where applicable.
The reference to “processing” your personal data, means the EIS may collect, record, store, disclose, share, delete or otherwise use your personal data to provide effective services and as agreed under contract with your sport’s national governing body (“NGB”). The EIS may determine its own purposes and means of the processing of your personal data or it may do so jointly with your NGB.
The EIS is a “data controller” and responsible for ensuring its processing of your data complies with applicable Data Protection Legislation.
The types of personal data the EIS collect and use
The type of personal data processed will vary depending on the services(s) received, and/or transaction involved. Further details are provided in the Appendices to this Notice.
SECTION 3: What is the source of your personal data?
The personal data processed by the EIS is initially collected from direct interactions with you such as the details you provide to us, as well as details provided by your NGB and UK Sport, when you first commence your programme. Subsequent data will be added during your interactions with us either directly from you or by the EIS staff working with you or other third parties instructed by the EIS (all as further detailed in this notice in the appendices below).
SECTION 4: Lawful basis for processing
Every instance of “processing” of personal data under the General Data Protection Regulation 2016 (‘the GDPR’) requires a ‘lawful basis’.
The lawful basis on which the EIS is able to carry out the processing of your data will depend on the circumstances of the processing but will fall under at least one of the following lawful bases set out in Article 6, GDPR.
Article 6(a) Consent – you give your clear and informed consent for the EIS to process your personal data through your signing of the Athlete Consent Form. If, in the future, the EIS processes your data for any new purpose then your consent for the new purpose will be obtained at the time.
Article 6(c) Legal obligation – under regulations set by the Care Quality Commission, (in particular Regulation 17 of the Health and Social Care Act 2008), the EIS are required to maintain good governance, which includes maintaining accurate, complete and detailed records in respect of each person using its services.
Article 6(d) Vital interests – as explained in section 6 below, there may be limited circumstances where the EIS would need to process your data in order to protect your vital interests, without your consent. This basis would only be relied upon where your consent could not reasonably be obtained.
Article 6(f) Legitimate interests – the EIS may carry out processing that is necessary and in the EIS’ legitimate interests, but only where the processing could not be achieved under another basis outlined above, for example, where there is a clear benefit to you or others (not outweighed by your rights), and the processing can be reasonably expected, such as for reasons of good governance, accounting and managing or auditing business operations, including processing a payment, or answering an enquiry using your details.
Where special category personal data is being processed
Where the EIS processes your health or medical data (which is defined as “special category” personal data under the GDPR), it will require another basis for processing under Article 9 of the GDPR, in addition to one of the bases given above, as follows:
Article 9(2)(a) Explicit consent – where you have given ‘explicit consent’ to the processing of personal data for one or more specified purpose, such as the explicit consent you provide to receive services from the EIS, which is obtained by asking you to read and accept the terms of this privacy notice. It will also be relevant where we ask you to take part in a survey or study, and you provide explicit consent to do this.
Article 9(2)(h) Health services – this will be relied upon where the processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, and may cover an array of treatment and/or administrative scenarios/ decisions, if the processing is necessary for these purposes, in view of the fact the EIS is a healthcare provider.
Article 9(2)(j) Archiving purposes in the public interest, scientific or historical research purposes – this will be relied upon where such processing is necessary, proportionate to the aim pursued, and only where specific measures are in place to safeguard the fundamental rights and the interests of the data subject. This will cover where the EIS is processing personal data for innovation and/or research reasons, in order to improve the services that the EIS provide in the field of high-performance sports science and medicine but will not cover direct (participant) research purposes, in which case you will be asked to provide explicit consent for. In addition, where processing your personal data for such purposes, EIS will always take steps to reduce the amount of identifiable information involved.
It should be clear from the above that while we will in the main seek explicit consent to process your personal data for the purposes outlined in this notice, consent may not be the only legal basis on which we will process your personal data.
SECTION 5: EIS Services
The type of personal data processed by the EIS and the purposes for which it is processed within the EIS will vary depending on your programme and the services you receive from the EIS, and include the following:
Section 5A: Talent / Pathways Services
If you are a member of a ‘Talent’ team, a Performance Pathways athlete (any age) or any other athlete that falls outside of the WCP, you will not receive the full programme of services listed in this notice for the WCP athletes. For example, you might receive a combination of EIS services from Physiotherapy and Nutrition, and some limited S&C oversight, but not all the disciplines listed for the WCP athletes. Your data will be held on a secure medical records database developed by the EIS to hold sensitive data, a secure sharing platform or on the EIS practitioner’s encrypted laptop, however only the EIS practitioners working with your NGB’s talent athletes, would be able to access your personal data. The EIS would suggest if you are in any doubt as to what services are provided to you, as a talent or pathways athlete, to check with your contact in the sport, and refer to the corresponding headings below.
Performance Pathways (Performance Foundation / Talent Identification) is a centralised strategic support services managed by UK Sport (UKS) and supported by the EIS. Its staff members sit across both UKS and the EIS. Those staff members will have access to the data, and the data will therefore be shared within the team, or with other EIS or UKS teams to the extent required to support the Performance Pathways programme.
Any data processed by the performance pathway team will be processed in accordance with the UKS Data Protection Protocol.
Section 5B: World Class Programme Services
Athletes on the world class programme may receive services from some or all of the EIS disciplines noted below and further described in the table in Appendix A to this notice. Such services will be delivered by the EIS employees or suitably skilled and experienced contractors working under strict contract terms of confidentiality on behalf of the EIS:
· Medical services, including access to EIS doctors
· Strength & Conditioning
· Performance Lifestyle
· Performance Analysis
· Performance Nutrition
· Performance Innovation
In addition, the EIS may process athlete data to provide services to your NGB, these services ensure continual improvement in the provision of leading sport science, medicine and technology to UK elite athletes:
· Athlete Health
· Sport Intelligence
The EIS may contact you by email in order to provide you with the relevant services, this may include emails requesting that you complete a survey, but only where deemed necessary for the vital delivery and future improvement of services. The EIS would never contact you, or allow a third party to contact you, for direct marketing purposes unless you have provided consent for us to do so.
It should be noted that all EIS employees and contractors are bound by strict obligations of confidentiality under their employment contract or contractor agreement. In addition, membership of their relevant professional body, such as our doctor’s membership of the GMC, requires our employees to be responsible for the confidentiality of all athlete’s records. The data will only be shared within EIS, with other data controllers and with third parties all as set out in this notice and for the purposes specified, but you may at any time request that your records are restricted to specific named individuals. You must understand that such restrictions may have an effect on EIS’s ability to provide services to you and we would reserve the right to withdraw the provision of any services. This would be explained to you should you make the request.
SECTION 6: Sharing your personal data (WCP Athletes)
The EIS may disclose personal data, including special categories of personal data, to EIS colleagues in other disciplines, or to third parties (such as your NGB) while you are on the world class programme, where necessary and where there is a clear lawful basis. The EIS is responsible for ensuring that any such transfer of (including the security of) this data complies with applicable Data Protection legislation.
Sharing Data Within the EIS
EIS practitioners will often work within multi-disciplinary teams across the EIS, with the aim of ensuring that all their work is aligned to optimising the determinants required for you to win in your sport or event. For example, details of physiotherapy rehabilitation plans may also be shared with EIS S&C practitioners as this is necessary for those S&C practitioners to safely provide you with their services. The data may also be shared with more senior staff and occasionally with external experts, for the purposes of audit and quality assurance.
EIS Doctors, physiotherapists, nutritionists, psychologists and soft tissue therapists use a secure system developed for EIS, called PDMS (Performance Data Management System) to record, view, access and update medical and health data. PDMS is also used to share data across the multi-disciplinary teams but access to specific data is restricted to those with a specific purpose to access that data, for example medical records can only be accessed by medical personnel (the only exceptions being where you have consented otherwise or for administration or system development purposes).
Data on PDMS may also be viewed, accessed and updated by your NGB medical personnel. Your NGB will have obtained your consent for this access.
You may however request that certain medical data is restricted to “doctors only”, “named practitioners only”, or “my eyes only” (the latter restricting access to the practitioner whom inputted the information) Unless you make a request not to have this,
an overall ‘Medical Availability Status’ – in the form of a red, amber, yellow, green status – will be available to medical and non-medical staff of the EIS and the NGB who have access to your data on PDMS.
Where applicable, the data held on PDMS may be accessed by the administrator of the medical insurance policy which has been put in place for you as an athlete on the WCP.
Where EIS practitioners do not use PDMS for data capture, the data will be kept on individual practitioner’s encrypted laptop or encrypted external hard drive or other secure IT system managed by the EIS or a third party, under strict contract terms.
Sharing Data with Other Parties
The EIS will share your personal data with other data controllers, including other data controllers with whom it acts jointly such as your NGB. For example, data sharing will occur within EIS multi-disciplinary teams who work proactively to ensure that an athlete’s coach and NGB have knowledge of relevant data collated about the athlete. The EIS may also seek expert specialist advice from third parties such as research institutions or medical experts. All data is shared under strict contract terms concerning confidentiality and may be withheld from a third party according to your instructions.
Other than for athletes under 18 years of age, vulnerable adults or those who lack legal capacity and except in the most exceptional of circumstances, the EIS will not disclose an athlete’s personal data to parents, guardians or any other relative. If you have provided a nominated contact in the event of a medical problem or emergency then relevant personal data may need to be provided accordingly.
Further details of the third parties we share data with are set out in Appendix B to this notice. The NGBs and other bodies which receive services from the EIS can be viewed in Appendix D. Your data will only be shared in an amount that is required ie. we work to the principle of ‘data minimisation’.
SECTION 7: Back-office functions
The back-office functions of the EIS will require access to athlete personal data in order to support the delivery of EIS services, which is further detailed in Appendix C.
SECTION 8: How long will we retain your personal data for, once you no longer receive services from the EIS?
The EIS will retain your full athlete medical records, which will include all information about the services received as an athlete on programme, for 25 years from the date of last intervention.
Where possible and where information is considered valuable for future use, steps will be taken to have such data pseudonymised (ie. the personal data will be held in such a way that the data can no longer be attributed to a specific data subject without the use of additional information).
The reasons for retaining athlete medical records/ information for a period of 25 years is due to the extreme nature of training that an athlete will endure during sporting life. This retention period allows the EIS to track back over a long period of time to establish any long-term health consequences (both physical and mental) of high intensity training in Olympic and Paralympic athletes which may arise and would otherwise be lost.
SECTION 9: Your Rights and Contact details
You have certain rights and responsibilities around your personal data including:
Rights – What does this mean?
1. Right to be informed – You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights. This is why we’re providing you with the information in this Privacy Notice.
2. Right of access – You have the right to obtain access to your personal data (if we’re processing it) and certain other information (similar to that provided in this Privacy Notice). This is so you’re aware and can check that we’re using your personal data in accordance with data protection law.
3. Right to rectification – You are entitled to have your personal data corrected if it’s inaccurate or incomplete.
4. Right to erasure – This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there’s no compelling reason for us to keep it. This is not an absolute right to erasure; there are exceptions.
5. Right to restrict processing – You have rights to ‘block’ or suppress further use of your personal data in certain circumstances. When processing is restricted, we can still store your personal data, but may not use it further.
6. Right to data portability – You have the right to obtain and reuse your personal data in a structured, commonly used and machine readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such information transferred directly to a third party.
7. Right to object to processing – You have the right to object to certain types of processing, in certain circumstances. In particular, the right to object to the processing of your personal data based on our legitimate interests or on public interest grounds; the right to object to processing for direct marketing purposes (including profiling); the right to object to the use of your personal data for scientific or historical research purposes or statistical purposes in certain circumstances.
8. Right to withdraw consent – If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful).
9. Right to complain – If you’re not satisfied with our response to any complaint or believe the EIS’ processing of your personal data does not comply with data protection legislation, you have the right to lodge a complaint with the UK Supervisory Authority, the Information Commissioner’s Office (ICO), who can be contacted using the following details: Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Telephone number: 0303 123 1113 Website: www.ico.org.uk
You have the right to exercise any of the rights described above at any time, including the right to request access to copies of your personal data. Should you wish to do this, please notify us in writing at firstname.lastname@example.org.
On receipt of your request, the EIS will confirm the steps it will take to comply with your request or will explain if there is an applicable exception to the right, which means that the EIS cannot comply with the request. Any such request will be processed within the statutory time limits for responding.
SECTION 10: How can you contact us?
If you have any questions about this Privacy Notice, or if you wish to make a request in respect of any of your rights, please contact the EIS’ Data Protection Officer (‘DPO’). using the above details. Details on how to make a complaint to the UK’s Supervisory Authority are also set out in the table directly above.
Data Protection Officer (DPO): The EIS’ nominated DPO is Helen Hughes and she can be contacted in the following ways:
By Post: Manchester Institute of Health & Performance, 299 Alan Turing Way, Manchester M11 3BS.
By Email: email@example.com
SECTION 11: Your responsibilities
Athletes have an individual responsibility to ensure that all personal information provided to the EIS is accurate and kept up to date. You should notify any changes of address, corrections to contact details etc. to the PDMS admin team at firstname.lastname@example.org or your usual EIS contact.
SECTION 12: What happens if the EIS decide to change this privacy notice?
We keep our privacy notice under regular review to make sure it is up to date and accurate. Following review, we will:
· Update all relevant documentation (including the notice stored on PDMS and on the EIS website) for any minor changes; and
· Notify all active athletes by email of any material changes.