PRIVACY POLICY

Website, Courses, Digital Content, Clinic Toolkit™ and Services

The Health Sciences Academy Ltd
Company No. 08191975 | England and Wales
Registered office: 585a Fulham Road, London, England, SW6 5UA
ICO registration: ZA038393

Please read this Policy together with our Terms and Conditions and any privacy information shown at the point where we collect specific data. If a short or product-specific notice conflicts with this general Policy for a particular processing activity, the more specific notice will apply to that activity.

1. ABOUT US AND SCOPE

1.1 The Health Sciences Academy Ltd ("THSA", "we", "us" or "our") is the organisation responsible for this Privacy Policy. For most personal data described here, THSA acts as the data controller.

1.2 This Policy applies to our main Website at https://thehealthsciencesacademy.org, its sub-domains and successor platforms, our learning and e-commerce environments, Clinic Toolkit™, THSA communities, webinars, forms, questionnaires, support channels, communications and other Services that refer to this Policy.

1.3 This Policy explains our handling of personal data. It does not govern the intellectual property licence for our Content or your permitted use of our materials. Those matters are governed by our Terms and Conditions and any product-specific licence.

1.4 External websites, apps and services that we do not control have their own privacy practices. You should read their privacy information before providing personal data to them.

2. KEY DEFINITIONS

2.1 "Personal Data" means information relating to an identified or identifiable living person. It includes information that can identify a person directly or indirectly when combined with other information.

2.2 "Special Category Data" means personal data that receives additional protection under data protection law, including data concerning health, racial or ethnic origin, religious or philosophical beliefs, genetic or biometric data used for identification, political opinions, trade union membership, or sex life or sexual orientation.

2.3 "Processing" includes collecting, recording, storing, organising, using, analysing, disclosing, transmitting, combining, restricting, deleting or otherwise handling personal data.

2.4 "Controller" and "Processor" have the meanings given by applicable data protection law. In general, a Controller decides why and how personal data is used, while a Processor handles personal data on a Controller's instructions.

2.5 "Practitioner Client Data" means personal data entered into or processed through Clinic Toolkit™ by a practitioner, advisor or other professional about that professional's own client or prospective client.

2.6 "AI-enabled Tool" means software that uses artificial intelligence, machine learning or similar automated techniques, including generative AI, large language models, automated transcription, classification, recommendation, anomaly detection or automated decision support.

3. OUR ROLE AS CONTROLLER AND PROCESSOR

3.1 THSA is generally the Controller for information about Website visitors, prospects, learners, graduates, purchasers, subscribers, event attendees, community members, support contacts and people who communicate directly with us.

3.2 Where a practitioner uses Clinic Toolkit™ to manage their own professional relationship with a client, the practitioner will normally determine the purpose of that client processing and will generally act as Controller for Practitioner Client Data. THSA may act as Processor when it hosts or otherwise processes that data to provide the Clinic Toolkit™ service.

3.3 THSA may separately act as Controller for limited Clinic Toolkit™ operational data that we need for account administration, billing, platform security, service reliability, abuse prevention and compliance with law. Where required, the respective roles and processor obligations may also be set out in product-specific terms or a data processing agreement.

3.4 Practitioners are responsible for giving their clients appropriate privacy information and establishing the lawful basis and, where relevant, Special Category Data condition for information they choose to collect through their professional practice.

3.5 If we carry out research or another project with a university, professional body or other organisation, the parties may act as independent controllers, joint controllers or controller and processor depending on the project. Where this materially affects participants, we will provide appropriate project-specific information.

4. PERSONAL DATA WE MAY COLLECT

4.1 The personal data we collect depends on how you interact with us. We aim to collect only information that is reasonably relevant to the purpose for which it is used.

• Identity and contact data, such as name, postal address, country, email address, telephone number and, where relevant, company details and VAT or tax information.
• Account and enrollment data, such as login details, account identifiers, Course selections, access status, enrollment dates and learner preferences.
• Learning and academic data, including Course activity, progress, quiz and assessment responses, results, assignments, certificates, appeals, academic-integrity information and support interactions.
• Transaction and billing data, including orders, Purchase Prices, refunds, credits, vouchers, Installment Plans, Subscriptions, billing address, payment status and transaction identifiers. Complete card data is normally processed directly by specialist payment providers rather than stored by THSA.
• Professional and demographic information you choose to provide, such as profession, job title, company, areas of interest, experience, gender or other profile information.
• Communications and support data, including emails, chat messages, form submissions, complaints, requests, notes of calls and information you provide to learner support or other THSA teams.
• Research, survey and feedback data, including questionnaire, poll, assessment, evaluation, survey and study responses.
• Technical, usage and security data, such as IP address, browser and device information, operating system, referring and exit pages, access timestamps, login events, download activity, site activity, approximate location derived from IP address, security signals and cookie or similar technology identifiers.
• Marketing and preference data, including newsletter subscriptions, consent records, opt-outs, communication preferences, campaign interactions and interests inferred from lawful interaction data.
• Accessibility and individual support information you choose to provide when requesting an adjustment or additional support. Depending on the information supplied, this may include Special Category Data such as health or disability information.
• Practitioner Client Data entered into Clinic Toolkit™, which may include identity, contact, health, nutritional, lifestyle, assessment, questionnaire, historical, social, familial or other information selected by the practitioner for legitimate professional purposes.

5. HOW WE COLLECT PERSONAL DATA

5.1 We collect information directly from you when you create an Account, enroll, purchase, complete a form or assessment, attend an event, join a community, contact us, request support, participate in research, subscribe to communications or otherwise interact with THSA.

5.2 We collect some technical and usage information automatically when you use our Websites and Services, through server logs, security tools, cookies and similar technologies, subject to applicable consent requirements and legal exemptions.

5.3 We may receive information from service providers that help us process payments, deliver Courses, administer accounts, authenticate users, provide support, fulfil orders, manage communications, host events or secure our Services.

5.4 Where another organisation purchases or sponsors access for you, refers you to us, or administers your professional recognition, we may receive limited information necessary to administer that arrangement. We may also obtain information from public or professional sources where lawful and reasonably necessary.

5.5 We may receive audience insights from communication, analytics and other service providers, including information derived from publicly available sources, third-party data and statistical modelling. Such insights may include demographic, professional and social media information, and may be used to understand our audience and improve the relevance of our communications and Services, subject to applicable data protection law.

6. WHY WE USE PERSONAL DATA AND OUR LAWFUL BASES

6.1 We only process personal data where we have a lawful basis. The appropriate basis depends on the purpose and circumstances. Consent is not the only lawful basis and, where we rely on another basis, withdrawing consent does not necessarily require us to stop that separate processing.

6.2 Where we rely on legitimate interests, we consider the purpose, necessity and impact on individuals and use appropriate safeguards. You may have a right to object, as explained in Section 17.

7. SPECIAL CATEGORY DATA AND ACCESSIBILITY SUPPORT

7.1 Some information you choose to provide may be Special Category Data. This is particularly relevant where you provide health or disability information for learner support, health or lifestyle information in research, or Practitioner Client Data through Clinic Toolkit™.

7.2 Where Special Category Data is processed, we identify both an Article 6 lawful basis and a separate condition permitted under Article 9 of the UK GDPR and applicable UK law. Depending on the circumstances, this may include explicit consent, scientific research with appropriate safeguards, legal claims or another condition provided by law.

7.3 If you request accessibility or individual learning support, we may ask for information reasonably necessary to understand the request. We aim to limit access to people who need the information to consider or deliver the support, and we do not use support-related health or disability information for unrelated marketing.

7.4 You are not required to provide more sensitive information than is reasonably necessary. In some cases we may be able to discuss an adjustment without retaining detailed medical information. If evidence is reasonably required, we will explain why and handle it proportionately.

7.5 Accessibility and support information will be retained only for as long as reasonably necessary for the support, associated administration, legal obligations, complaints or legal claims, subject to our retention approach in Section 15.

8. AI, AUTOMATED TOOLS AND PROFILING

8.1 THSA may use AI-enabled or automated tools in a controlled manner where they can improve security, accessibility, support, operational efficiency, analysis or Service functionality. Any use of personal data through such tools remains subject to applicable data protection law.

8.2 Unless we separately tell you otherwise and have a lawful basis, THSA does not use identifiable learner data, private support communications or Practitioner Client Data to train public or general-purpose AI models. We do not authorise processors acting for us to use that information for their own general model training.

8.3 Where an AI-enabled provider processes personal data on our behalf, we seek to apply data minimisation, appropriate contractual controls, access restrictions and security measures. We will not intentionally disclose Special Category Data to an AI-enabled provider merely because doing so is convenient.

8.4 AI or automation may assist with tasks such as support triage, drafting, translation, accessibility, anomaly detection, fraud prevention, security monitoring, analytics or identifying unusual account activity. Automated signals may be used to flag matters for review but are not necessarily treated as conclusive evidence by themselves.

8.5 If THSA makes a solely automated decision about you that has a legal or similarly significant effect, we will do so only where permitted by law and will provide the safeguards required at the time, which may include information about the decision, an opportunity to make representations, a right to challenge it and access to meaningful human intervention.

8.6 If we introduce a materially different AI use involving personal data, we will review the privacy impact and update or supplement the privacy information before the new processing begins where required.

8.7 The restrictions on learners providing THSA Content to external AI systems are intellectual property and licence matters governed by our Terms and Conditions. This Privacy Policy does not expand those permissions.

9. CLINIC TOOLKIT™ AND PRACTITIONER CLIENT DATA

9.1 Clinic Toolkit™ is designed to support eligible practitioners in managing their own client work. Practitioners should collect only client information that is appropriate for their professional purpose and must comply with their own privacy, confidentiality, consent, record-keeping and professional obligations.

9.2 THSA does not use Practitioner Client Data for direct marketing to the practitioner's clients and does not contact those clients for THSA marketing merely because their information is stored in Clinic Toolkit™.

9.3 Access by THSA personnel to Practitioner Client Data is restricted to circumstances where access is reasonably necessary to provide authorised support, maintain or secure the platform, investigate a technical or security issue, comply with law, enforce applicable terms or act on the practitioner's documented instructions.

9.4 If THSA uses Practitioner Client Data for research or analysis beyond providing the practitioner's service, we will do so only where a separate lawful basis and any required Special Category Data condition are available. Where possible, information used for broader analysis will be anonymised or aggregated so that individuals are not reasonably identifiable.

9.5 Practitioners should not enter personal data into Clinic Toolkit™ unless they are entitled to do so. They remain responsible for responding to their clients' rights requests where they act as Controller, with THSA providing reasonable processor assistance where required by law and the applicable service arrangements.

10. RESEARCH, SURVEYS AND STATISTICAL ANALYSIS

10.1 THSA conducts and supports research intended to improve education, nutrition practice, learner experience and related scientific understanding. Research may involve surveys, questionnaires, assessments, Course activity or other information described to participants.

10.2 Where personal data is used for research, we identify the appropriate lawful basis and, for Special Category Data, an additional legal condition. We apply safeguards appropriate to the research, which may include data minimisation, access controls, pseudonymisation, separation of identifiers and research data, and ethics or governance review.

10.3 Pseudonymised information remains personal data where re-identification is reasonably possible and is protected accordingly. Data that has been irreversibly anonymised so that individuals are no longer reasonably identifiable is no longer personal data and may be retained, analysed, shared or published for research and statistical purposes.

10.4 Research results published by THSA or research partners will normally be presented in anonymised or aggregated form. We will not publish information that directly identifies an individual research participant unless we have a separate lawful basis and have clearly explained that use in advance.

10.5 We may collaborate with universities, researchers or other reputable organisations. Where personal data is shared, we use appropriate agreements and define the parties' roles. Where a partner receives only properly anonymised data, data protection law may no longer apply to that anonymised dataset.

11. MARKETING AND COMMUNICATION PREFERENCES

11.1 We send marketing emails, texts or similar electronic communications only where permitted by applicable data protection and electronic marketing rules. Depending on the circumstances, this may be based on consent or a lawful soft opt-in for our own similar products and services.

11.2 Where we ask for marketing consent, it will be separate from acceptance of our Terms and Conditions. We may use a confirmation or double opt-in step to verify a subscription and maintain evidence of the preference recorded.

11.3 You can opt out of marketing at any time using the unsubscribe or preference link in our communications, by replying where appropriate, or by contacting us. Opting out of marketing does not prevent us from sending service, transaction, security, legal, enrollment or account communications that are necessary for another purpose.

11.4 We may retain a minimal suppression record after an opt-out so that we can respect the request and avoid accidentally adding the same address back to marketing lists.

11.5 We do not sell, rent or loan personal data to unrelated third parties for their own direct marketing.

12. COOKIES AND SIMILAR TECHNOLOGIES

12.1 Our Websites and Services may use cookies, pixels, local storage, software development kits and similar technologies for security, authentication, preferences, functionality, analytics, performance and, where used, advertising or campaign measurement.

12.2 Technologies that are strictly necessary to provide a service requested by you, or that fall within another applicable legal exemption, may be used without consent where the law permits. Where consent is required for analytics, advertising or other non-essential technologies, we will seek it through an appropriate consent mechanism before using them.

12.3 You can normally review or change non-essential cookie choices through the cookie settings or consent tool made available on the relevant Website. Browser controls may also allow you to block or delete cookies, although blocking necessary technologies may affect functionality.

12.4 Cookie providers, purposes and lifetimes can change as our technology changes. Where practical, the current cookie settings interface or Cookie Notice will provide more specific and up-to-date information than this general Policy.

13. WHEN WE SHARE PERSONAL DATA

13.1 We share personal data only where reasonably necessary for a legitimate purpose, where you direct us to do so, or where the law permits or requires it. Sharing does not mean that we sell your personal data.

• Learning platforms, website hosts, cloud infrastructure, content delivery, storage, authentication and security providers.
• Payment processors, billing providers, tax and accounting systems, fraud-prevention services and financial institutions involved in a transaction.
• Email, customer relationship management, support, communication, webinar, community, survey and fulfilment providers.
• Analytics and technology providers, subject to cookie and device-access rules where applicable.
• Professional advisers, insurers, auditors, accountants and legal representatives where reasonably necessary.
• Accrediting, professional or recognition bodies where relevant to a Service and where the disclosure is authorised, necessary or otherwise lawful.
• Universities and research partners under appropriate research and data-sharing arrangements, or using anonymised information where suitable.
• Regulators, courts, law-enforcement bodies, government authorities and other persons where disclosure is required by law or reasonably necessary to establish, exercise or defend legal rights.
• A purchaser, investor, lender or adviser involved in a proposed or completed business reorganisation, investment, merger, acquisition or sale, subject to appropriate confidentiality and data-protection safeguards.

13.2 Where a service provider acts as our Processor, we require an appropriate contract and expect the provider to process personal data only on documented instructions, keep it secure, assist with relevant rights and compliance obligations, and delete or return it as required by the arrangement and applicable law.

14. INTERNATIONAL DATA TRANSFERS

14.1 Some service providers, group resources or research partners may process personal data outside the United Kingdom. A transfer outside the UK does not by itself mean that the data is less protected, but additional transfer rules may apply.

14.2 Where a restricted international transfer requires safeguards, we use a lawful transfer mechanism appropriate to the circumstances. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, binding corporate rules or another mechanism recognised under UK law.

14.3 Where required, we also assess whether the transfer provides a level of protection that is not materially lower than the protection available under UK data protection law and apply supplementary measures where appropriate.

14.4 You may contact us for further information about the safeguards relevant to a particular transfer where the law gives you that right.

15. HOW LONG WE KEEP PERSONAL DATA

15.1 We keep personal data for no longer than is reasonably necessary for the purpose for which it is used, taking account of legal, tax, accounting, academic, contractual, research, security, complaint and legal-claims requirements. We maintain retention criteria rather than keeping every category for the same period.

15.2 When retention is no longer justified, we delete, anonymise or otherwise put the data beyond normal operational use. Deletion from active systems may not remove data immediately from encrypted backups, which may expire on a separate controlled cycle.

16. SECURITY AND DATA BREACHES

16.1 We use technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. Measures may include encryption in transit and, where appropriate, at rest; multi-factor authentication; access controls; least-privilege permissions; security monitoring; backups; supplier controls and staff procedures.

16.2 No internet, cloud or electronic storage system can be guaranteed to be completely secure. We therefore do not promise absolute security, but we review and improve safeguards according to the sensitivity of the information and the risks reasonably identified.

16.3 If we become aware of a personal data breach, we assess the likely risk to individuals, contain and investigate the incident, keep appropriate records and notify the Information Commissioner or affected individuals where applicable law requires us to do so.

16.4 If you believe your Account or personal data has been compromised, please contact us promptly and avoid sending sensitive information through an insecure channel.

17. YOUR DATA PROTECTION RIGHTS

17.1 Depending on the processing and the law that applies, you may have rights to be informed, obtain access to your personal data, correct inaccurate data, request deletion, restrict processing, receive certain data in a portable format, object to processing, withdraw consent and obtain safeguards in relation to significant automated decisions.

17.2 The right to object to direct marketing is particularly important. If you object to our use of your personal data for direct marketing, we will stop using it for that purpose, subject to retaining a minimal suppression record where appropriate.

17.3 These rights are not absolute in every situation. For example, we may need to retain information to comply with law, establish or defend legal claims, maintain the integrity of academic records, or protect the rights of another person. If an exemption or restriction applies, we will explain it where required.

17.4 A subject access request is normally free of charge. We may charge a reasonable administrative fee or refuse a request only where the law permits, such as for a manifestly unfounded or excessive request or certain requests for further copies.

17.5 We normally respond to data-rights requests without undue delay and within the applicable statutory period. Under current UK law, this is generally one month from the relevant time, with a possible extension of up to two further months for complex or numerous requests where the legal conditions are met. We may ask for proportionate information to verify identity before releasing personal data.

17.6 To exercise a right, use our Contact page or write to the registered office marked for the attention of Privacy. Please describe the request clearly enough for us to identify the relevant information.

18. CHILDREN AND YOUNGER USERS

18.1 Our professional education Services are primarily intended for adults and older learners. Where a person under 16 uses our Websites or Services, this should be with appropriate parent or guardian involvement as described in our Terms and Conditions and any product-specific requirements.

18.2 Where we know that we process children's personal data, we take account of age and vulnerability, use privacy information that is appropriate to the audience, and apply proportionate safeguards. We do not knowingly use children's personal data for behavioural marketing or significant automated profiling without a lawful basis and appropriate protections.

18.3 A parent or guardian may contact us about a child's personal data, but the rights belong to the child where the child has sufficient understanding to exercise them. We may need to consider the child's capacity and applicable law before responding to a representative.

19. THIRD-PARTY LINKS, PLATFORMS AND SOCIAL MEDIA

19.1 Our Websites and communications may link to third-party websites, research, social media, payment services, video platforms or other external services. Those third parties may act as independent Controllers and their own privacy notices will apply to their processing.

19.2 If you choose to make information publicly visible in a forum, social network, comment area or other public feature, other people may copy or use that information. Please consider carefully what you publish. THSA cannot control independent use by third parties after information has been made public by the user.

19.3 Where an external platform is integrated into a THSA Service, we will take reasonable steps to use appropriate providers and contracts where we act as Controller, but the provider may also process certain data for its own lawful purposes under its own privacy information.

20. CHANGES OF OWNERSHIP OR BUSINESS STRUCTURE

20.1 If THSA is reorganised, financed, merged, acquired, sells assets or transfers part of its business, relevant personal data may be disclosed during due diligence and transferred as part of that transaction where lawful and reasonably necessary.

20.2 We will seek to protect personal data through confidentiality and data-protection arrangements during such a process. A new Controller must use transferred personal data consistently with applicable data protection law and provide new privacy information where required.

21. CHANGES TO THIS PRIVACY POLICY

21.1 We review this Privacy Policy periodically and may update it to reflect changes in law, technology, Services, suppliers or our processing activities. The effective date shown at the top identifies the current version.

21.2 A Privacy Policy is a notice about processing rather than a contract that you must accept. If a change introduces a materially new use of personal data, we will bring that use to your attention before it begins where applicable law requires us to do so, and we will seek consent where consent is the appropriate lawful basis.

21.3 Historic versions may be retained by THSA for compliance and evidence purposes.

22. CONTACT DETAILS AND THE INFORMATION COMMISSIONER

22.1 Privacy enquiries, rights requests and data protection complaints can be submitted at https://www.thehealthsciencesacademy.org/en/contact. You may also write to our registered office, marked for the attention of Privacy.

22.2 Our ICO registration number is ZA038393.

22.3 You may complain to the Information Commissioner's Office at https://ico.org.uk.