1. About This Privacy Policy
1.1.1 Mission MNT is committed to protecting the privacy, confidentiality and security of the personal information entrusted to us by our clients. Mission MNT is registered with the Information Commissioner's Office (ICO) as a Data Controller (Registration Number: ____________________).
1.1.2 This Privacy Policy explains how Mission MNT collects, uses, stores and protects personal information when providing nutrition, dietetic and training services, and explains the rights individuals have in relation to their personal information.
1.1.3 Mission MNT processes personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) where applicable. As a healthcare service, Mission MNT also operates in accordance with the professional and ethical requirements relevant to the services it provides, including the standards and requirements applicable to Health and Care Professions Council (HCPC) registered professionals.
1.1.4 Because Mission MNT provides services involving personal health and medical information, this Privacy Policy also explains how information requiring additional protection, including special-category health data, is handled. Mission MNT recognises the importance of maintaining confidentiality and ensuring that personal information is only accessed, used or shared where there is an appropriate and lawful reason to do so.
1.1.5 This Privacy Policy applies to personal information collected and processed by Mission MNT in connection with its services, including information provided during registration, onboarding, consultations, client check-ins, nutrition and training assessments, ongoing support, communications and other interactions with Mission MNT.
2. Who We Are and Our Regulatory Responsibilities
2.1.1 Mission MNT provides professional nutrition, dietetic and training services, including support for clients undertaking weight-management programmes alongside prescribed medication. Services are provided by appropriately qualified professionals working within their individual scope of practice, knowledge, skills, experience and professional competence.
2.1.2 Mission MNT's dietetic services are provided by a Health and Care Professions Council (HCPC) registered Dietitian. The HCPC regulates dietitians in the UK and sets professional standards relating to conduct, competence, confidentiality, communication, consent, record keeping, professional boundaries and safe practice. The Dietitian is required to work within their individual scope of practice and to recognise when a client's needs fall outside that scope, including where referral or involvement of another appropriately qualified professional is required.
2.1.3 Mission MNT complies with the BDA Code of Professional Conduct, including its guidance on scope of practice, confidentiality and record keeping. BDA guidance recognises that scope of practice is individual and is determined by a professional's education, training, knowledge, skills and experience. The Dietitian remains professionally responsible for exercising appropriate clinical judgement and for ensuring that advice provided is appropriate to their competence and scope of practice.
2.1.4 Mission MNT is registered with the Information Commissioner's Office (ICO) as a Data Controller and processes personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), where applicable.
2.1.5 ICO Registration Number: ______________________________
2.1.6 The professional registration of a Mission MNT Dietitian does not mean that the Dietitian is responsible for all aspects of a client's healthcare. Mission MNT provides nutrition, dietetic and training services within its defined scope. It does not replace the client's GP, prescribing clinician, pharmacist, emergency services or other healthcare professionals where their involvement is required. In particular, prescribing, medication selection, dosing, titration, switching, discontinuation, dispensing and delivery remain the responsibility of the appropriate prescribing and pharmacy professionals.
2.1.7 Mission MNT aims to ensure that personal information is processed lawfully, fairly and transparently, while maintaining the confidentiality, privacy and security expected of a professional healthcare service. HCPC standards require registrants to treat service-user information as confidential and to maintain full, clear and accurate records that are protected from loss, damage or inappropriate access.
3. Who Is Responsible for Your Personal Information
3.1.1 Mission MNT is the data controller for personal information it collects and processes in connection with its nutrition, dietetic and training services. Mission MNT determines what information is required, why it is processed and how it is handled, and limits access to individuals who have an appropriate professional or operational reason to access it. Where external organisations process information on Mission MNT's behalf, they may act as data processors, with appropriate arrangements in place to protect that information.
3.1.2 Mission MNT is separate from Phlo Clinic, which remains responsible for personal information it processes in connection with its own clinical, prescribing, pharmacy, dispensing and delivery services. Mission MNT does not act as the controller for Phlo's pharmacy or prescribing records. Where relevant information is shared between Mission MNT and Phlo, each organisation remains responsible for the information it processes within its own role and information will only be shared where there is an appropriate lawful basis and a relevant purpose. Individual Mission MNT professionals also retain their own professional responsibilities regarding confidentiality, clinical judgement and record keeping.
4. What Personal Information We Collect
4.1.1 Mission MNT may collect personal information that is necessary to provide and manage its nutrition, dietetic and training services. This may include your name, date of birth, contact details, relevant medical history, current and previous medication, allergies, dietary information, weight, height, BMI and other relevant anthropometric measurements, nutritional intake, physical activity and exercise information, training history, goals, progress information, progress photographs (where provided), consultation notes and other information relevant to your individual assessment and care.
4.1.2 We may also collect information relating to your use of Mission MNT's services, including appointment and onboarding information, communications with Mission MNT, information provided through forms or questionnaires, records of advice and support provided, payment and transaction information, and information relating to complaints or queries. Where you contact Mission MNT by email or WhatsApp, relevant information contained within those communications may also form part of your client record where it is necessary to provide or document your care. Where you have been referred to Phlo Clinic for medication support, Mission MNT may also receive relevant information from Phlo regarding your prescribing or medication status, where this is necessary to support your ongoing dietetic care.
4.1.3 Some of the information we collect may constitute special-category personal data, particularly information concerning your physical or mental health, medical conditions, medication and other information relating to your health. This information requires additional protection under UK data protection law and is only collected and processed where there is an appropriate lawful basis and additional condition for processing special-category data. Where progress photographs are collected, these are treated as sensitive personal information and are only collected with your separate, explicit consent.
5. WhatsApp, Email and Electronic Communications
5.1.1 Mission MNT may contact clients by WhatsApp, email, telephone or other appropriate electronic communication methods where the client has provided their contact details in connection with receiving Mission MNT's services. This includes making initial contact following registration or referral, arranging and confirming onboarding appointments, providing service information, conducting check-ins, responding to questions and providing nutrition or training support. These communications are service-related communications and are not direct marketing where they are limited to providing or administering the services the client has requested.
5.1.2 Clients may choose to communicate with Mission MNT using WhatsApp, email or other available communication methods, and relevant communications may contain personal or health information. Mission MNT will handle information received through these channels appropriately and may retain relevant communications where necessary to provide, monitor or document the service. Clients should take reasonable steps to keep their own devices, accounts and access credentials secure, as electronic communications cannot be guaranteed to be completely secure.
6. Health and Special-Category Data
6.1.1 Mission MNT provides nutrition, dietetic and training services that may require us to collect and process information about your physical health, medical history, medication, allergies, dietary requirements, injuries, physical activity and other information relating to your health. Under UK data protection law, information concerning a person's health is treated as special-category personal data and requires additional protection.
6.1.2 We only process health and other special-category information where there is an appropriate lawful basis and a separate condition permitting the processing of special-category data under UK GDPR and, where applicable, the Data Protection Act 2018. We only collect information that is relevant and proportionate to the services being provided, and access is restricted to those who have an appropriate reason to use it. Mission MNT also recognises the professional duty to maintain confidentiality when handling health information and to use information safely and appropriately, consistent with both HCPC standards and BDA professional guidance on the handling of client health information.
6.1.3 Where clients choose to provide progress photographs, this is entirely optional and is treated as sensitive personal information similar to special-category data. Photographs are only collected, stored and used with separate, explicit consent, and are used solely for the purpose of monitoring your progress unless you agree otherwise.
6.1.4 Health information may be used to assess nutritional and training needs, provide individualised advice, monitor progress, identify potential concerns, support safe practice and coordinate care where appropriate. Where information needs to be shared to protect a client, another person or the wider public, Mission MNT will consider the circumstances carefully and share information only where there is an appropriate professional or legal justification. HCPC standards specifically require dietitians to maintain confidentiality while recognising circumstances where information needs to be shared to safeguard service users, carers or the wider public.
7. How We Collect Your Information
7.1.1 Mission MNT collects most personal information directly from you when you register for our services, complete onboarding information, take part in consultations or check-ins, provide information during assessments, communicate with us, or otherwise use our nutrition, dietetic or training services. We may also collect information through forms, questionnaires, our website and other systems used to provide and manage our services.
7.1.2 We may also receive relevant information from Phlo Clinic, your GP, another healthcare professional or another organisation involved in your care, where there is an appropriate lawful basis for doing so. We may collect certain technical information automatically when you use our website or digital services, such as information relating to your device, IP address, website activity and cookies, where applicable. Where personal information is obtained from a source other than you, Mission MNT will provide the relevant privacy information in accordance with applicable data protection requirements.
8. How We Use Your Information
8.1.1 Mission MNT uses personal information to provide, manage and improve its nutrition, dietetic and training services. This may include assessing individual nutritional and training needs, calculating relevant nutritional requirements, developing personalised advice and programmes, monitoring progress, maintaining appropriate professional records, arranging and managing appointments and check-ins, responding to queries, and communicating with clients about the services they have requested.
8.1.2 We may also use information where necessary to support safe and appropriate care, identify concerns, coordinate services with Phlo Clinic or other healthcare professionals, comply with professional and legal obligations, manage complaints or incidents, maintain the security of our systems and improve our services. Information will only be used for purposes that are relevant to the services provided and in a way that is proportionate to those purposes. The ICO requires organisations to be clear about each purpose for which personal information is processed and the lawful basis relied upon.
8.1.3 Mission MNT will not use personal or health information for purposes that are incompatible with the reason it was collected unless there is a lawful basis to do so. Where information is used for purposes such as analysis, service improvement or research, Mission MNT will consider whether the information can be anonymised or otherwise minimised so that individuals are not unnecessarily identifiable.
9. Lawful Bases for Processing
9.1.1 Mission MNT will only collect and use personal information where there is a valid lawful basis under UK data protection law. The lawful basis used will depend on the purpose for which the information is being processed and the relationship between Mission MNT and the individual. Relevant lawful bases may include where processing is necessary to provide services requested by a client, to comply with a legal obligation, to protect someone's vital interests, to pursue legitimate interests where appropriate, or where valid consent has been provided. Mission MNT will determine and document the appropriate lawful basis before processing personal information for a particular purpose.
9.1.2 Where Mission MNT processes special-category data, including information concerning health, an Article 6 lawful basis must be identified together with a separate condition under Article 9 of the UK GDPR. Where required, additional conditions and safeguards under the Data Protection Act 2018 will also apply. The appropriate condition will depend on the specific purpose and circumstances of the processing; Mission MNT will not rely on consent simply because health information is involved where another lawful condition is more appropriate.
9.1.3 Where consent is used, it will be obtained in a manner that meets the requirements of UK data protection law and will be specific to the purpose for which it is requested. Withdrawing consent will not affect processing that Mission MNT is otherwise entitled or required to undertake under another lawful basis. Mission MNT will maintain appropriate records of its lawful bases and special-category conditions to demonstrate compliance with its data protection responsibilities.
10. Clinical and Dietetic Records
10.1.1 Mission MNT maintains appropriate clinical and dietetic records to support the safe, effective and continuous provision of services. Records may include information gathered during assessments, consultations and check-ins, nutritional assessments and calculations, relevant medical and medication information, advice provided, agreed interventions, progress, professional decisions, communications and other information necessary to document the services provided. Records are maintained in accordance with applicable legislation and relevant professional guidance.
10.1.2 Records will be full, clear, accurate and completed promptly following consultations or other relevant interactions. The Dietitian uses professional judgement to determine what information is relevant and should be recorded, and records may be updated where necessary to ensure they remain accurate and clinically useful. Any amendments to records will be made in a way that maintains a clear and appropriate record of the information and decision-making involved.
10.1.3 Clinical and dietetic records are confidential and will be protected against loss, damage or inappropriate access. Records may be used to support continuity of care, communicate appropriately with other professionals, demonstrate professional decision-making, respond to complaints or investigations, meet legal or regulatory requirements, and respond to valid requests for access to personal information. Mission MNT will retain records for an appropriate period based on legal, regulatory and professional requirements and the nature of the services provided.
10.1.4 Access to client records is primarily restricted to the Dietitian responsible for a client's care. Limited administrative access may also be granted to designated Mission MNT personnel, such as a system administrator, where necessary to maintain business continuity — for example, to support a safe handover of care in the Dietitian's absence, or for essential system administration. Any personnel granted such access are bound by confidentiality obligations equivalent to those of the Dietitian.
10.1.5 Where a Dietitian's engagement with Mission MNT ends, Mission MNT will retain the records they created in accordance with this Policy, and will provide the Dietitian with reasonable access to those records where necessary — for example, to respond to a professional conduct matter or complaint relating to care they provided.
11. Confidentiality and Professional Standards
11.1.1 Mission MNT treats all client information as confidential and expects personal and health information to be accessed and used only where there is an appropriate professional, clinical or legal reason to do so. The HCPC requires registered professionals to treat service-user information as confidential and to protect it when working remotely or communicating electronically.
11.1.2 Confidential information will only be disclosed where there is an appropriate justification. This may include the client's permission, where the law allows or requires disclosure, where disclosure is in the client's best interests, or where it is in the public interest, such as where necessary to protect public safety or prevent harm to another person. This reflects both HCPC standards and BDA guidance, which recognises a professional duty to share information where there is a risk of harm to the client, Mission MNT staff, or others. Where identifiable information is shared, Mission MNT will consider what information is necessary and seek to limit disclosure to the minimum required for the relevant purpose.
11.1.3 Mission MNT's Dietitian is professionally responsible for exercising their own judgement when deciding whether information should be accessed, recorded or disclosed. Where a concern about a client's safety or risk of harm arises, information may need to be shared with an appropriate person or organisation even where the client does not consent, where there is a sufficient professional or legal justification. Decisions about confidentiality and disclosure will be made on an individual basis, taking account of the circumstances, applicable law and relevant professional standards.
12. Sharing Information with Phlo Clinic
12.1.1 Mission MNT works alongside Phlo Clinic, a separate and independently regulated organisation, to provide an integrated nutrition, dietetic, training and medication-support service. Mission MNT and Phlo Clinic are each responsible for their own data protection obligations in respect of the information they process, and each acts as an independent data controller.
12.1.2 Where a client has registered with Phlo Clinic and been assessed as eligible for its services, Phlo Clinic may refer the client to Mission MNT for nutrition, dietetic or training support. Where this occurs, Phlo Clinic will share relevant information with Mission MNT necessary to provide that support, which may include the client's contact details and relevant clinical or eligibility information. It is Phlo Clinic's responsibility to ensure it has an appropriate lawful basis, and where required, the client's consent, before sharing information with Mission MNT for this purpose. Mission MNT relies on Phlo Clinic having obtained any necessary consent or lawful basis for this initial transfer, and will handle any information received in accordance with this Policy from the point it is received.
12.1.3 Where, in the course of providing dietetic or training services, Mission MNT identifies that a client may benefit from medication support, Mission MNT may refer the client to Phlo Clinic. This will only take place with the client's separate, explicit consent, obtained specifically for the purpose of that referral. Outside of a referral made with the client's consent, Mission MNT will only share identifiable information with Phlo Clinic without the client's express permission in exceptional circumstances — such as where necessary to protect someone from serious harm, or where the law otherwise permits or requires disclosure. Any such disclosure will be limited to the information necessary for the relevant purpose.
12.1.4 Once a client is engaged with both organisations, Mission MNT and Phlo Clinic may share relevant clinical information with each other on an ongoing basis where necessary to support safe and coordinated care — for example, information about a client's progress, concerns, or medication-related effects relevant to dietetic or training advice. This sharing is limited to what is necessary for the purpose of safe care and is separate from any commercial or business information described below.
13. Sharing Information with Healthcare Professionals
13.1.1 Mission MNT may share relevant personal or health information with a GP, pharmacist, prescribing clinician, dietitian, healthcare professional or other appropriately qualified professional involved in a client's care, where there is an appropriate lawful basis for doing so. Information may be shared to support safe and coordinated care, respond to a clinical concern, clarify relevant health information, or enable another professional to make an appropriate clinical decision. Mission MNT will consider the purpose of the disclosure and share only information that is necessary and relevant to that purpose.
13.1.2 Where appropriate, Mission MNT will seek the client's permission before sharing identifiable information. There may, however, be circumstances where information needs to be shared without permission, including where the law permits or requires disclosure, where it is in the client's best interests, or where sharing is necessary to protect the client, another person or the wider public. The Mission MNT Dietitian remains professionally accountable for decisions about confidentiality and information sharing and will use their professional judgement when determining whether disclosure is appropriate.
13.1.3 Where information is shared, Mission MNT will take reasonable steps to ensure that it is accurate, relevant and limited to what is necessary. Where appropriate and practicable, Mission MNT will keep a record of significant disclosures and the reason for sharing the information.
14. Third-Party Service Providers and Data Processors
15. HubSpot and Electronic Clinical Records
15.1.1 Both 14 and 15 will need to include specific software information.
16. Data Minimisation and Accuracy
16.1.1 Mission MNT will only collect and process personal information that is adequate, relevant and necessary for the purposes for which it is being used. We will avoid collecting or retaining information that is excessive or unrelated to the services being provided, with particular care taken when handling health and other special category information. Personal information will be reviewed where appropriate to ensure that it remains relevant to the purpose for which it is held.
16.1.2 Mission MNT will take reasonable steps to ensure that personal information is accurate and, where necessary, kept up to date. Where information is provided by a client or another source, we will record it accurately and, where relevant, consider the reliability and source of the information. Clinical and professional records may contain professional opinions or assessments; these will be recorded as such and should not be treated as factual statements where they represent professional judgement.
16.1.3 If you believe that information Mission MNT holds about you is incorrect, incomplete or misleading, you can ask us to correct or update it. We will consider requests relating to accuracy carefully and take appropriate steps to correct inaccurate information where required. Historical information will not necessarily be removed simply because circumstances have subsequently changed, where retaining an accurate historical record is necessary for legitimate professional, legal or clinical purposes.
17. Data Security
17.1.1 Mission MNT recognises that the information it processes may include confidential health information and other sensitive personal information and therefore takes appropriate technical and organisational measures to protect it against unauthorised or unlawful access, use, alteration, disclosure, loss, destruction or damage. The level of security applied will take account of the nature and sensitivity of the information, the purposes for which it is processed and the risks to individuals. This reflects the UK GDPR security principle and the requirement to implement security measures appropriate to the risks presented by the processing.
17.1.2 Mission MNT is solely responsible for selecting, securing, configuring and governing the systems, infrastructure and processes used to store and manage personal information, including determining access controls, retention settings and security policies. Where a healthcare or training professional records clinical or professional content within these systems, they do so exercising their own professional judgement as to that content, but within the governance framework, systems and policies that Mission MNT determines and controls; this arrangement does not extend to the professional any responsibility for the security, integrity or availability of the underlying systems.
17.1.3 Security measures may include access controls and permissions, strong authentication and passwords, secure devices and systems, appropriate encryption, software and security updates, secure storage and transmission of information, confidentiality obligations, staff awareness and training, secure disposal of information and procedures for identifying, responding to and recovering from security incidents. Access to personal information will be limited to authorised individuals who have a legitimate professional or operational need to access it, with access removed or amended when it is no longer required. Security measures will be reviewed and updated where appropriate to reflect changes in technology, systems, risks and the services provided.
17.1.4 Mission MNT also recognises that security is a shared responsibility when information is communicated electronically or accessed through a client's own device or account. We will take appropriate measures within our control, but no electronic system or method of communication can be guaranteed to be completely secure. Where a security incident involving personal information occurs, Mission MNT will assess the incident promptly, take appropriate steps to contain and mitigate any potential harm, investigate what happened and determine whether notification to the ICO or affected individuals is required. The security of client information is treated as both a data protection responsibility, which Mission MNT holds as data controller, and an important aspect of professional confidentiality and safe practice, which rests with each professional in relation to the content they record.
18. Where Your Information Is Stored — notes
18.1.1 I do not have access to the software information to be specific enough about this section, so I have researched some points about what to be included.
18.1.2 Confirm which systems/providers store client information.
18.1.3 Confirm where the data is stored (UK, EEA, US, etc.).
18.1.4 Check whether providers or support teams can access data from outside the UK.
18.1.5 Confirm security, backups and deletion arrangements.
18.1.6 Only include specific claims once the software/provider details have been confirmed.
19. International Data Transfers — notes
19.1.1 Same as 18.
19.1.2 Check whether any client data is stored or accessed outside the UK.
19.1.3 Find out which countries are involved.
19.1.4 Check what protections are in place.
19.1.5 Add the relevant details once the software information is available.
20. How Long We Keep Your Information
20.1.1 Mission MNT will retain personal information only for as long as it is necessary for the purposes for which it was collected, taking into account legal, professional, regulatory and operational requirements. The UK GDPR does not prescribe a single retention period for all personal information, so retention periods will be determined according to the type of information, why it is held and any applicable requirements.
20.1.2 Clinical and dietetic records will generally be retained for a minimum of 8 years from the date of the last entry or the end of a client's care, in line with professional record keeping guidance and the period within which a claim relating to that care could reasonably be brought.
20.1.3 Other information, such as general communications, administrative records and website information, will be retained only for as long as it remains necessary for its relevant purpose, and will typically be held for a shorter period than clinical records. Mission MNT will not retain personal information indefinitely or simply because it may be useful in the future.
20.1.4 Mission MNT will periodically review the information it holds and will securely delete, destroy or anonymise information when it is no longer required, subject to any information that must continue to be retained for legal, professional or other legitimate purposes. Retention periods and criteria will be reviewed as Mission MNT's services and regulatory requirements develop.
21. Your Data Protection Rights
21.1.1 Clients have several rights in relation to the personal information Mission MNT holds about them. Depending on the circumstances and the lawful basis on which information is processed, these may include the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability and the right to object to certain processing. Clients may also have rights relating to automated decision-making and profiling where applicable. These rights are subject to certain conditions and exemptions under data protection law.
21.1.2 Clients can exercise their applicable rights by contacting Mission MNT using the contact details provided in this Privacy Policy. Mission MNT may need to verify the client's identity before responding to a request. Each request will be considered in accordance with applicable legal requirements, and Mission MNT will explain where a particular right does not apply or where an exemption or restriction prevents a request from being fulfilled in full. Where personal information has been shared with another organisation, such as Phlo Clinic, Mission MNT will take appropriate steps to notify that organisation of any rectification, erasure or restriction request, where required and where it is reasonable to do so.
21.1.3 Clients may request erasure of their personal information at any time, including before the retention periods described in this Policy have ended. However, where Mission MNT has a legal, professional or regulatory obligation to continue retaining information, such as clinical or dietetic records held during the retention periods described in this Policy. That obligation will usually take precedence, and the request may not be actioned in full during that period. Where this is the case, Mission MNT will explain why, and will still action any other applicable right, such as restricting further use of the information beyond what is necessary for that retention purpose.
21.1.4 Where a client has provided consent for a particular use of personal information, that consent may be withdrawn at any time. Withdrawal of consent does not affect processing that took place before consent was withdrawn and does not prevent Mission MNT from continuing to process information where another lawful basis applies.
22. Subject Access Requests
22.1.1 Clients have the right to request a copy of the personal information Mission MNT holds about them. A subject access request can be made verbally or in writing, including by email or other appropriate communication methods. Mission MNT may request reasonable information to verify the client's identity before providing personal information, particularly where this is necessary to prevent information being disclosed to the wrong person.
22.1.2 Mission MNT will respond to a valid subject access request without undue delay and normally within one calendar month of receiving the request, or within one month of receiving any information reasonably required to verify identity. This period may be extended by up to a further two months where a request is particularly complex or a number of requests have been received from the same client, with the client being informed of the extension and the reason for it within the initial one-month period.
22.1.3 Mission MNT will provide the information securely and will only refuse or restrict access where an applicable legal exemption or restriction applies. Where clinical or professional records include a professional's opinion, clinical judgement or assessment, this will be provided to the client as recorded; this reflects a professional opinion at the time it was made rather than a statement of fact, consistent with how such records are described elsewhere in this Policy.
22.1.4 A reasonable fee may only be charged in the limited circumstances permitted by data protection law, including where a request is manifestly unfounded or excessive or where additional copies are requested. Each request will be considered individually and any decision to refuse, restrict or charge a fee will be supported by appropriate justification.
23. Data Breaches and Security Incidents
23.1.1 Mission MNT takes the security of client information seriously and has procedures in place to identify, assess, contain and respond to suspected or confirmed personal data breaches and other security incidents. This may include unauthorised access, accidental disclosure, loss, alteration, destruction or inappropriate use of personal information. All suspected incidents will be assessed promptly to determine the nature of the incident, the information involved and the potential risk to affected clients.
23.1.2 Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, Mission MNT will consider whether the breach must be reported to the Information Commissioner's Office. Where required, a report will be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where a breach is likely to result in a high risk to affected clients, Mission MNT will also consider whether the affected clients need to be informed directly.
23.1.3 Mission MNT will take reasonable steps to contain and mitigate the effects of an incident, investigate its cause, document the incident and implement appropriate measures to reduce the likelihood of recurrence. Where an incident involves information held or processed by a third-party provider, Mission MNT will work with that provider as appropriate and consider any notification or reporting obligations that arise.
23.1.4 Where a breach involves clinical or professional records, Mission MNT will also consider the implications under the Health and Care Professions Council's standards on maintaining secure records, and under British Dietetic Association guidance on protecting client information, in addition to Mission MNT's own data protection obligations. The relevant registered professional will be informed of any incident affecting records they are responsible for, so that any professional or regulatory reporting obligations they hold personally can also be considered.
24. Cookies and Website Data
24.1.1 Mission MNT may collect limited technical information about your device when you visit our website, including where available your IP address, operating system, browser type and screen size. This is used for system administration, to help tailor your experience of the website, to provide customer support, and to understand website usage at an aggregate level.
24.1.2 For the same purposes, Mission MNT may use cookies, which are small files stored on your device. Cookies help us provide a smooth user experience, understand how our website is used, and improve our services over time. They may enable us to recognise you when you return to our website, remember information you have entered, what form it was entered in, understand how visitors use our website and store your preferences.
24.1.3 Below is an overview of the types of cookies Mission MNT and any third parties may use:
24.1.4 Strictly necessary cookies. Some cookies are essential to make our website function and cannot be switched off. We cannot provide our website without this type of cookie.
24.1.5 Functional cookies. These are used to recognise you when you return to our website and to remember your preferences.
24.1.6 Analytical or performance cookies. These help us understand how our website is used so we can maintain and improve it. We may use our own analytics tools or third-party analytics providers, such as (Include specific websites here e.g. hubspot or google analytics) to collect this information on our behalf.
24.1.7 Where required by law, Mission MNT will obtain your consent before using non-essential cookies, through a cookie consent tool on our website that allows you to accept or decline different categories of cookies. You can change your cookie preferences at any time through this tool. You may also refuse cookies by changing your browser settings, though this may affect your ability to use parts of our website.
25. Marketing and Promotional Communications
25.1.1 Mission MNT may use personal information to send marketing and promotional communications about its services, but only where this is permitted under applicable data protection and electronic communications legislation. Marketing communications may include information about Mission MNT's services, updates, educational content, offers or other promotional material.
25.1.2 Where consent is required, Mission MNT will obtain specific and informed consent before sending marketing communications by electronic means, including by email, text message or WhatsApp. This consent will be separate from acceptance of the services or this Privacy Policy, and separate from consent to receive service-related communications such as booking confirmations, welcome messages or check-in reminders. Clients will be able to withdraw marketing consent at any time, without affecting their ability to receive the services or any service-related communications.
25.1.3 Administrative and service-related communications, such as appointment confirmations, onboarding information and communications relating to the provision of services, are not treated as marketing where they do not contain promotional material.
25.1.4 Mission MNT will provide a clear and straightforward way to opt out of marketing communications and will respect requests to stop receiving them. An opt-out from marketing will not prevent Mission MNT from continuing to send communications that are necessary to provide or administer the services being received. Clients also have the right to complain to the Information Commissioner's Office about the handling of marketing communications, in addition to the other complaint rights described in this Policy.
26. Research, Analytics and Anonymised Data
26.1.1 Mission MNT may use information for service evaluation, quality improvement, statistical analysis and research-related purposes, where this is appropriate and permitted under applicable data protection law. Where possible, Mission MNT will use anonymised information for these purposes so that individual clients cannot be identified. Genuinely anonymised information is not considered personal data under the UK GDPR.
26.1.2 Where personal or pseudonymised, information is required for these purposes, Mission MNT will ensure that there is an appropriate lawful basis and that any additional requirements applicable to health information are met. Data will be minimised and appropriately protected, and pseudonymised information will continue to be treated as personal data for as long as an individual could reasonably be re-identified from it.
26.1.3 Mission MNT will not use client information for research or analysis in a way that makes decisions about an individual client's care or services without an appropriate basis for doing so. Where information is used for research or statistical purposes, appropriate safeguards will be considered to protect the rights and freedoms of clients, and clients retain the right to object to this use of their information where it is based on Mission MNT's legitimate interests, as described elsewhere in this Policy.
27. Complaints, the ICO, HCPC and BDA
27.1.1 Clients should raise any complaint about Mission MNT's services in the first instance directly with Mission MNT, so that the matter can be reviewed and an appropriate response provided. Complaints relating specifically to the handling of personal information will be managed in accordance with Mission MNT's data protection responsibilities.
27.1.2 Where a client remains dissatisfied with how Mission MNT has handled a data protection complaint, they may raise the matter with the Information Commissioner's Office, which generally expects an organisation to be given the opportunity to address a complaint first.
27.1.3 Where a complaint concerns the professional conduct or fitness to practise of an HCPC-registered Dietitian, a client may raise a concern directly with the Health and Care Professions Council, which is the statutory regulator with authority to investigate a dietitian's fitness to practise and, where necessary, take action affecting their registration. A client may also raise a concern about a Dietitian's professional conduct with the British Dietetic Association, which maintains its own procedures for concerns relating to its members' conduct; this is a separate process from the Health and Care Professions Council's statutory role, and relates to the Dietitian's membership standing rather than their legal right to practise.
28. Changes to This Privacy Policy
28.1.1 Mission MNT will review and update this Privacy Policy to reflect changes to its services, systems, data processing activities, legal requirements or professional standards.
28.1.2 Where a change is significant, Mission MNT will take reasonable steps to notify clients directly, such as by email or through the client's usual communication channel with Mission MNT, in addition to updating this policy. Minor or clarificatory changes may be made by updating this Policy without individual notification.
28.1.3 The most recent version of this Privacy Policy will be available through Mission MNT's website and other appropriate channels and will show the date it was last updated.
29. How to Contact Mission MNT
29.1.1 Clients can contact Mission MNT regarding their personal information, this Privacy Policy, their data protection rights or any other privacy-related query using the contact details below.
29.1.2 Mission MNT
Address: Bedford House, Fulham Green, 69–79 Fulham High Street, London, SW6 3JW
Email: support@missionmnt.com
Telephone:
29.1.3 Mission MNT will respond to enquiries and requests in accordance with applicable data protection and professional requirements.