Privacy Notice 

Oxford Brookes University Virtual Student Dietetic Clinic GDPR Privacy Notice 

1. We are the Data Controller 

Oxford Brookes University (OBU) will be known as the Data Controller of any personal identifiable data that you supply to the University. 

This Privacy Notice explains what personal data the University holds about you; what we may use it for, how it may be shared, the reasons why, how long we will keep the information and what your legal rights are in relation to the personal information we hold about you. 

The University publishes additional privacy notices applicable to other groups, facilities and activities. Subject to your circumstances, other notices may also apply to you, so please read this privacy notice in conjunction with other applicable privacy notices that may be accessed via the University website here. 

Under UK Data Protection Law, all organisations must ensure personal data is: 

a) processed lawfully, fairly and in a transparent manner in relation to the data subject;
b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; 

c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; 

d) accurate and kept up to date, with any inaccuracies corrected or erased without delay; 

e) retained only for as long as necessary for the purposes it was collected, unless kept longer for archiving, research, or statistical purposes, with safeguards in place to protect individuals’ rights; 

f) processed securely, with measures in place to prevent unauthorised access, unlawful use, accidental loss, destruction, or damage; 

This Privacy Notice applies to individuals accessing the Nutrition and Dietetics Teaching Virtual Clinic, which is delivered as a supervised educational activity within an approved practice placement module. 

2. Data We Collect 

We may collect and process the following data sources: 

Personal data 

● Your name 

● Your email address 

● Your age 

Special category data 

● Data concerning health (e.g. medical conditions, medications, anthropometric measurements, test results)

● Racial or ethnic origin 

● Religion 

● Genetic data 

Health data enable safe and appropriate dietary assessment and advice, and may be collected during pre-appointment screening and/or during the virtual consultation. Other special category data will only be collected where relevant to the rationale for dietary advice and will be provided voluntarily. 

3. How We Use Your Data 

We may use your data for: 

● To determine eligibility for participation in the Nutrition and Dietetics Teaching Virtual Clinic 

● To support the delivery of a supervised, one-off dietetic consultation within a teaching setting 

● To support student learning, supervision, and assessment as part of an approved University practice placement activity 

● To ensure appropriate governance, safeguarding, and quality assurance of the clinic 

● Where appropriate, to signpost individuals to their GP or NHS services 

4. Why 

We need your data in order to assess eligibility, deliver a supervised dietetic consultation within an educational setting, and ensure appropriate governance, safeguarding, and quality assurance of the service. 

5. Legal Basis for Processing 

We will process your personal data based on: 

● The performance of a task carried out in the public interest under Art. 6(1)(e), namely the delivery of education and training through an approved practice placement module. 

If the University asks you for special category data, such as racial or ethnic origin, religious beliefs, data concerning health, or genetic data, we will process this data because: 

● You have given Explicit Consent under Art. 9(2)(a) for one or more specified purposes (unless prohibited by law). 

Explicit consent for special category data will be obtained separately and clearly before such data is processed. 

6. Sharing Your Data 

We may share your data with: 

● The Practice Placement Module Lead

● The supervising HCPC-Registered Dietitian involved in your consultation 

● MSc Dietetics students delivering and/or shadowing your consultation 

Data used for student assessment purposes will be de-identified before inclusion within digital placement portfolios. 

In circumstances where there is a concern regarding safety, safeguarding, or serious clinical risk, relevant information may be shared with appropriate University services or external services (e.g. NHS services), in line with safeguarding and legal obligations. 

7. Will my data be transferred outside of the EEA? 

Yes. For a defined period (see Data Retention below), your data will be processed and stored using University-approved Zoom and Google Workspace services, with which the University has appropriate security and data processing agreements in place. Some of these services may store data outside the UK. Appropriate safeguards are in place in accordance with UK GDPR requirements. 

8. Any consequences of not providing the requested data? 

Yes. Providing personal and health-related information is voluntary. However, if insufficient information is provided, it may not be possible to determine eligibility or offer an appointment within the clinic. 

9. Will there be any automated decision-making using my data? 

No. 

10. Data Security and Storage 

We are committed to ensuring the security of your personal data. Here at the OBU, we implement a variety of security measures to maintain the safety of your personal information. These measures include: 

● Encryption: We use encryption to protect sensitive data during transmission and storage. 

● Access Controls: Access to personal data is restricted to authorised personnel only, based on their role and responsibilities. 

● Regular Audits: We conduct regular audits and assessments of our data protection practices to ensure compliance with relevant laws and regulations. 

● Secure Storage: Personal data is stored in secure facilities with appropriate physical and technical safeguards. 

● Incident Response: We have procedures in place to respond to data breaches or security incidents promptly and effectively. 

11. Data Retention 

We will retain your personal data for up to six (6) months from the date of screening submission or consultation (whichever occurs later), after which it will be securely deleted in accordance with the University’s document retention policy.

12. What rights do I have regarding my personal data? 

● You have the right to be informed. 

● You have the right of access to your data. 

● You have the right to correct data if it is wrong. 

● You have the right to ask for your data to be deleted. 

● You have the right to restrict the use of the data we hold. 

● You have the right to data portability. 

● The right to object to OBU using your data. 

● You have rights in relation to using your data for automated decision-making and profiling. 

If you have questions or concerns about our use of your personal information. Please contact Oxford Brookes at info.sec@brookes.ac.uk to ask for guidance or make a complaint. 

You can also independently contact the independent Oxford Brookes Data Protection Officer at BrookesDPO@brookes.ac.uk. 

If you are unhappy with how we have processed your personal data, you can complain directly to the ICO at the address shown below. 

The ICO’s address: 

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 

Helpline number: 0303 123 1113 

ICO website: https://www.ico.org.uk