Leeds Beckett University - City Campus,
Woodhouse Lane,
LS1 3HE
Privacy Notice for University Clinics
This is the privacy notice for University Clinics relating to Sports Therapy, Speech and Language Therapy and Human Performance
This privacy statement covers the information and services relating to the Leeds Beckett University Clinics for Sports Therapy, Speech and Language Therapy and Human Performance - Targeted Applied Services & Assessments.
We, Leeds Beckett University, respect your privacy and are committed to protecting your personal data.
This privacy notice provides information on how we will look after your personal data when you use our service and tells you about your privacy rights and how the law protects you.
The Sports Therapy, Speech and Language Therapy and Human Performance - Targeted Applied Services & Assessments Clinics are services based in Leeds Beckett University (LBU) and LBU is the data controller for the information you provide or has been provided in your referral. Details of your rights under UK data protection legislation, including details of LBU’s Data Protection Officer, your rights as a data subject, and your right to complain to the Information Commissioner’s Office are available in LBU's privacy notice.
If you have any questions or concerns about participation within Sports Therapy Clinic and how your personal data will be collected and managed, please contact sportstherapyclinic@leedsbeckett.ac.uk
If you have any questions or concerns about participation within the Speech and Language Therapy Clinic and how your personal data will be collected and managed, please contact SLTClinic@leedsbeckett.ac.uk
If you have any questions or concerns about participation within Human Performance Hub and how your personal data will be collected and managed, please contact humanperfomance@leedsbeckett.ac.uk
Personal data means any information about an individual from which that person can be identified.
We may collect, use, store and transfer different kinds of personal data about you (visitors and clients) to the Clinics which we have grouped together as follows from:
- Identity Data includes your name, title, date of birth, gender and copies of identity documentation
- Contact Data includes your address, email and telephone number(s). This also includes contact information provided in relation to third parties, for example; emergency or trusted contact information
- Financial Data includes bank account and payment card details. Not captured or processed by Sport Therapy or Speech and Language Therapy clinics
- Public Health Data includes data that we may need to collect about you
- Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us. Not captured or processed by Sport Therapy or Speech and Language Therapy clinics
- Profile Data includes purchases made by you, your interests, educational and employment history, equality data, medical and health data, preferences and feedback and survey responses
- Usage Data includes information about how you use our services including attendance, complaints and investigations. This will include health data relating to treatment and outcomes
- Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences
- Images includes CCTV and surveillance, film and photography
We also collect, use and share aggregated data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing one of our services.
Most of the personal information we process is provided to us directly by you for one of the following reasons:
- Supporting you through your care and through your personal goals during your therapy/intervention. Including injury examination, assessment and treatment
- Performance analysis
- Sports massage and screening services
- To audit, monitor and improve our services
- To comply with any other legal, professional or regulatory obligations imposed on the service
Due to the nature of the services provided by the Clinics we will collect personal details and details relating to your health so that we are able to provide the best advice, skills development and care possible.
We also receive personal information indirectly, from the following sources in the following scenarios:
- Referrals from team coach, therapist (external)
- Referrals from parents
- Referrals from medics
We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
Note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal basis, we are relying on to process your personal data where more than one basis has been set out in the table below.
| Purpose / activity | Type of data | Lawful basis for processing including basis of legitimate interest |
|
Managing visitors and enquiries. |
Identity Contact |
Article 6 (1f) Processing is necessary for the purpose of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedom of the data subject which require protection of personal data, in particular where the data subject is a child. |
|
Registering you as a client/member and maintaining a record of services accessed. |
Identity Contact Profile Usage |
Article 6 (1b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Article 6 (1c) Processing is necessary for compliance with a legal obligation to which the controller is subject. Article 9 (2a) Explicit consent. |
|
Supporting you through your care including injury examination, assessment, performance testing, health evaluation and treatment. |
Identity Contact Profile Usage Images |
Article 6 (1d) Processing is necessary in order to protect the vital interests of the data subject or another natural person. Article 6 (1e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. |
|
To enable payment for our services. Currently this only applied to Human Performance Clinic - Targeted Applied Services & Assessments. |
Financial Data Transaction Data |
Article 6 (1b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. |
|
To facilitate student participation, learning, assessment and development - Including the participation in events and competitions. For further information in relation to how personal data for students is processed see the specific Student Privacy Notice. |
Identity Contact Profile Usage |
Article 6 (1b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Article 6 (1f) Processing is necessary for the purpose of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedom of the data subject which require protection of personal data, in particular where the data subject is a child. |
|
Secure access and use of services - Including surveys and feedback to measure the patient experience. |
Identity Contact Images |
Article 6 (1e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Article 6 (1f) Processing is necessary for the purpose of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedom of the data subject which require protection of personal data, in particular where the data subject is a child. Article 9 (2g) Reasons of substantial public interest (with a basis in law). |
|
Sending you service related information. |
Identity Contact |
Article 6 (1f) Processing is necessary for the purpose of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedom of the data subject which require protection of personal data, in particular where the data subject is a child. |
|
Personal safety - emergency contact/trusted contact and arrangements including; insurance, safeguarding, allergies, illnesses, health, disability. |
Identity Contact Public Health |
Article 6 (1d) Processing is necessary in order to protect the vital interests of the data subject or another natural person. Article 6 (1e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. |
|
Managing health and safety for epidemics and emergencies. |
Identity Contact Public Health |
Article 6 (1e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. |
|
To aid research where the research participant has given consent to opt into the research activity. |
Identity Contact Profile Images |
Article 6 (1a) The data subject has given consent to the processing of their personal data for one or more specific purposes. Article 6 (1e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Article 6 (1f) Processing is necessary for the purpose of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedom of the data subject which require protection of personal data, in particular where the data subject is a child. Article 9 (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject. Article 9 (j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject |
|
Statistical analysis for regulatory reporting and equal opportunity monitoring. |
Identity Profile Usage |
Article 6 (1e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Article 6 (1a) The data subject has given consent to the processing of their personal data for one or more specific purposes. Article 9 (2a) Explicit consent. |
Information will be shared with third parties only when necessary as part of the provision of our services to you and/or we have a legal or regulatory requirement to do so. We anticipate that we will share information with the following third parties for the following purposes:
- The third party used to provide a repository for your data is WriteUpp (Pathway Software Ltd)
We may share your data with private health care providers for example BUPA, who request the right to access data to manage claims, administer their scheme and/or comply with the terms of their Agreement. Where individuals are accessing services via private health care providers for example BUPA, the private healthcare provider may be request access to and/or a copy of your medical records.
Emergency services and regulatory bodies for the purpose of accident reporting, first aid provision and complying with health and safety investigations and reporting.
We do not anticipate the transfer personal data outside of the United Kingdom/European Economic Area (EEA). If such transfer is required we shall only do so with adequate legal protections in place.
We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. At the end of a retention period, your personal data will be deleted securely and safely.
The repository for your data is held in a secure external cloud hosted environment (WriteUpp, Pathway Software Ltd), stored within the EEA (UK). Within the Human Performance Hub - your data is held in a secure cloud hosted MS booking system and AptVision stored within the EEA (UK).
Your personal data will be retained in accordance with the retention periods set out in our Records Retention Schedule and is recorded in the university Information Asset Register. For records relating to treatment provided to the individual, these will be kept for termination of relationship (or last files added) plus eight years.
The university recognises and respects individual rights under the UK General Data Protection Regulation (GDPR). For further information please see our overarching Privacy Notice and Privacy webpage detailing your privacy rights.
Please see our overarching Privacy Notice for information on how to complain.
We keep our privacy notices under regular review. This privacy notice was last updated on 12 September 2023.
Related links
Please see the University Policy page that includes all the current LBU Privacy notices within which you will find the Student Suicide Prevention – Information sharing statement.
