Privacy Policy

Nutricia knows that you care how your personal data is used and we recognize the importance of protecting your privacy.

This Privacy Statement explains how Nutricia collects and manages your personal data as a Data Controller. It contains information on what data we collect, how we use it, why we need it, and how it can benefit you.

Contact us if you have any queries and comments, or if you want to make a request regarding any of your data subject rights.

This privacy statement was last updated on April 8, 2022.

At Nutricia we are committed to protecting your right to privacy. We aim to protect any personal data we hold, to manage your personal data in a responsible way and to be transparent in our practices. Your trust is important to us. We have therefore committed ourselves to the following basic principles:

You have no obligation to provide any personal data requested by us. However, if you choose not to, we may not be able to provide you with some services or products:

• You have no obligation to provide any personal data requested by us. However, if you choose not to, we may not be able to provide you with some services or products
• We only collect and process your data for the purposes set out in this Privacy Statement or for specific purposes that we share with you and/or that you have consented to
• We aim to collect, process, and use as little personal data as possible
• When we do collect your personal data, we aim to keep it as accurate and up to date as possible
• If the personal data we collect is no longer needed for any purposes and we are not required by law to retain it, we will do what we can to archive with access severely restricted, delete, destroy or permanently de-identify it
• Your personal data will not be shared, sold, rented, or disclosed other than as described in this Privacy Statement.

This Privacy Statement applies to patients and/or carers/relatives acting on behalf of a patient registered on the Nutricia Homeward service. If you are a healthcare professional, please click here to view the privacy statement relevant to you.

Depending on our relationship, we will collect and use your personal data in different ways:

a)  Nutricia Homeward patients and prospective patients
b)  People who contact us with enquiries (e.g. via our consumer contact centres)
c)  Visitors to our Nutricia Homeward websites and users of our apps and services.

This Privacy Statement describes the following important topics relating to your personal data:

1. Who are we?
2. What personal data do we collect and how?
3. The purpose and legal basis for collecting and using personal data
4. Profiling and automated decision making
5. Links to other websites
6. Sharing personal data with third parties
7. Sharing personal data internationally
8. How we protect your personal data
9. How long we store your personal data
10. Your rights
11. Cookies and other technologies
12. How to contact us
13. Changes to our Privacy Statement
14. Glossary.

Nutricia Limited is responsible for the personal data that you share with us or is shared by your healthcare professional when registering you to the Nutricia Homeward service. When we say “Nutricia”, “us”, “our” or “we”, we are referring to Nutricia Limited, a subsidiary of Danone SA. In accordance with regulations applicable to the processing of personal data, Nutricia is the “data controller”.

Nutricia Limited, Newmarket House, Newmarket Avenue, White Horse Business Park, Trowbridge, Wiltshire, BA14 0XQ.

The personal data we collect varies depending on our relationship with you, the purpose of the collection and the product or service we are providing you. Please see the section(s) below that best describes our relationship with you for further details of the personal data that we collect.

Generally, we may collect the following types of personal data from you directly or indirectly from your healthcare professional, carer or relative.

You may give us personal data about yourself by visiting our websites or applications, creating an account with us, ordering products or services from us, entering, or participating in a survey, submitting an enquiry or request to us, contacting us by phone, email or other means, filling in our forms (both online and offline).

Some of this data is collected via cookies and similar tracking technologies - see our Cookie Statement for further details on this.

Where it is unreasonable or impracticable for us to collect the personal information from you directly, or where you have authorised such collection, we may also collect your personal information from third parties for the purposes set out in this Privacy Statement. For example, we may need to collect personal information about you from, where applicable, your healthcare professional(s) (for example during your registration with Nutricia Homeward or when your healthcare professional updates your record within Nutricia Homeward Connections), your managing hospital and where applicable, your parent, legal guardian and/or designated carer or from public agencies to verify information that you have provided to us.

Where you provide personal information about a third-party individual to us, you must ensure that the third-party individual is aware of this Privacy Statement, understands it and agrees to accept it. If you provide personal information about a third-party individual and that individual does not have the capacity to understand and agree to these terms (for example, a child), you warrant that you are authorised to disclose that information to us for our collection, use and disclosure for the purposes set out in this Privacy Statement.

We, or your healthcare professional, carer, or relative acting on your behalf, may collect and use some information about you such as the following:

a) personal contact data, such as your name, title, email address, physical address and telephone number(s)
b) patient account ID
c) date of birth
d) gender
e) nationality
f) specific language or other communication requirements
g) unique identifiers (such as your NHS or hospital number)
h) carer name and contact details (where relevant)
i) names and contact details of responsible healthcare professional(s);
j) order information and shipping data, such as your name, email address, postal address and telephone numbers
k) information related to your health as provided directly by you or indirectly by your healthcare professional, carer or relative – this information may include but is not limited to: any declared illness or disability, relevant medical history as disclosed by you or your healthcare professional and welfare details, GP and/ or support worker details, or training attendance. Please see the "special categories of data" section below for more information
l) details of patient care provided by Nutricia - including calls made or received, home visits (where relevant), reported healthcare issues and clinical assessments and images
m) details of deliveries made to you - including dates, quantities, and specific delivery instructions
n) information about what products or services you have been prescribed or purchased from us, including flavour preferences
o) communication, contact and delivery preferences
p) patient / carer assessment of service provided via satisfaction survey or complaints
q) information about people other than you, such as personal data about your carer, next of kin, parents, children, other family members, other professionals known to you (such as District Nurse, school, social worker etc.) when such information is provided directly to us by you or indirectly by a healthcare professional
r) Nutricia Choice patients – although you may submit payment information such as credit card details in connection with making a purchase, Nutricia does not collect or store your payment information.  If you choose to make an online purchase from Nutricia, you may be given the option to make payment directly through a third-party payment provider used by Nutricia. We do not control, review or store your payment information when you engage in a payment transaction with us; and
s) the personal data in relation to visitors to our websites and users of our apps and services as set out in the section below.

Please note we will rely on the details of your healthcare professional being up to date and share information with that healthcare professional on that basis. Your managing dietician is responsible for keeping this information up to date should your healthcare professional or managing Trust change.

It is also important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

We, or third parties on our behalf, may collect and use some information about you such as the following:
a) your name including your title
b) your postal address
c) your email address
d) your telephone number(s)
e) your date of birth and/or age
f) your contact preferences
g) information provided when you correspond with us (such as via our customer service lines or social media) which might include call recordings if you call us directly – to the extent this includes information about your health, please see the "special categories of data" section below
h) information about people other than you, such as personal data about your family members, when you provide such information directly to us; and
i) any updates to information provided to us.

We, or third parties on our behalf, may collect and use information about you such as the following:

a) personal contact data, such as your name, email address, physical address, and telephone number(s)
b) account login details, such as your user ID, email username and password
c) communication data between you and us, which may include details of our conversations via chat and contact forms available on our websites and/or apps
d) social media or 3rd party account profile information where you use your social media or 3rd party account to create an account and login or where you share this with us
e) where you submit content to our websites and/or apps (such as a personal testimonial or review)
f) health data where you provide this to us – please also see the "Special categories of data" section below
g) your entry into a survey, contest, promotion or competition (including the entry itself, which may be a photo, comment or answer to a question)
h) information about people other than you, such as personal data about your family members, when you provide such information directly to us
i) any updates to data provided to us; and
j) personal data created and recorded as you use our websites, apps and/or services, including:

1. technical information– this includes the Internet Protocol (IP) address used to connect your device to the internet address; the type of device you use; the website address and country from which you access information; the files requested; browser type and version; browser plug-in types and versions; operating system; and platform; and
2. information about your visit and your behaviour on our websites and/or apps (such as the pages that you click on) – this may include time and length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs, information shared with others, including through email and social media), methods used to browse away from the page, traffic data, location data, weblogs and other communication data and information provided when requesting further service or downloads.  

In principle Nutricia does not seek to process sensitive data relating to you in the ordinary course of our business. However, in order for Nutricia to provide elements of the Nutricia Homeward service to you as requested by your healthcare professional, Nutricia may need to collect and process sensitive data relating to you. Some of the personal data that we collect about you or which you provide to us may be special categories of data, often relating to health and wellbeing. 

We will only process this type of data when processing is necessary for the purposes of (GDPR Article 9 (2)(h)) preventive or occupational medicine, the provision of health or social care or treatment or the management of health; or pursuant to contract with a health professional; or in any other circumstances permitted by law (such as defence of legal claims); or for purposes to which you give your explicit consent.

Nutricia may collect personal data including special categories of data about children below the age of 13 years of age from the parent or guardian directly or indirectly from the child’s healthcare professional.

Our websites are designed and intended for use by adults. Where one of our websites is intended for use by a younger audience, we understand the importance of taking extra precautions to protect the privacy and safety of children. 

We collect your personal data so that we can provide you with the best experience and to provide you with a high quality of customer service.  We may also collect your personal data to comply with legal obligations or in the context of a contractual relationship that we have with you.

For those registered with the Nutricia Homeward service our legal basis for processing your data in reference to the service is Legitimate Interests.

Depending on the processing activity the legal basis for processing your data may be:

• Contractual necessity
• Legitimate interests
• Consent (where required)
• Compliance with legal obligations
• UK GDPR Article 9 (2)(h) - processing is necessary for the purposes of preventive or occupational medicine, the provision of health or social care or treatment or the management of health or pursuant to contract with a health professional

The table below shows the purposes for which we collect and use your personal data, as well as the legal bases for our use for your personal data. Please note that we may process your personal data for more than one legal basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal basis, we are relying on to process your personal data where more than one ground has been set out. Further information as to our legal bases is set out below the table. Please note that not all the uses below will be relevant to every individual:

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose, as detailed above. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We consider that the legal bases for using your personal data as set out in this Privacy Statement are as follows:

a) Legitimate interests: our use of your personal data is necessary for our legitimate interests or the legitimate interests of others. Our legitimate interests might include the following:

    i. delivering the clinical homecare service which the NHS and other providers have commissioned

    ii. running, growing and developing our business

    iii. operating and ensuring the security of our websites and apps

    iv. ensuring a safe working environment for our staff and visitors 

    v. providing services to our customers

    vi. placing, tracking and ensuring fulfilment of orders with our suppliers

    vii. investing in and rolling out new products to benefit the communities in which we operate; and

    viii. for internal group administrative purposes.

Whenever we collect and use your personal data on the legal basis of legitimate interests, we take care it does not outweigh your rights as an individual.
b) Contractual necessity: our use of your personal data is necessary to perform our obligations under any contract with you or to take steps prior to entering a contract with you.
c) Compliance with legal obligations: our use of your personal data is necessary for complying with our legal obligations.
d) Consent: We may process your personal data on the basis of your consent. Where you have given consent, but you later change your mind, you may withdraw your consent by contacting us and we will stop doing processing your personal data in this way. However, if you withdraw your consent, this may impact our ability to provide our products and associated services to you.

We do not process NHS data using automated means.

If we intend to make use of such methods that have a legal effect or significant impact, we will of course inform you and give you an opportunity to object to these processes in advance. You are also free to contact us for further information on such processing.

Our Nutricia Homeward website and app may contain hyperlinks to third party websites, plug-ins or applications that are not operated by us. These hyperlinks are provided for your reference and convenience only and do not imply any endorsement of the activities of such third-party websites or any association with their operators. 

This Privacy Statement only applies to the personal data that we collect or which we receive from third party sources and over which we act as a data controller, and we cannot be held responsible for personal data about you that is collected and stored by third parties. Third party websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal data to these websites. 

We do not endorse or otherwise accept any responsibility or liability for the content of such third-party websites or third-party terms and conditions or policies.

When we share your personal data with Nutricia affiliates and other organizations as described below, we make sure we only do so with organizations that safeguard and protect your personal data and comply with applicable privacy laws in the same or similar way that we do.

Your personal data will never be sold or rented. We may, however, share or disclose your personal data as described in this Privacy Statement or when required by law and/or government authorities.

In order to provide the Nutricia Homeward service, your personal data will be shared with the following third parties for the purposes described:

In addition, your personal data may also be shared with the following third parties for the purposes described:

a) Other Nutricia companies/entities as part of the Danone SA group: 

Where it is in our legitimate interests to do so for internal administrative purposes (for example, ensuring consistent and coherent delivery of products to our patients, (operations, compliance, auditing, and monitoring)).
b) Third party service providers and subcontractors: 

Including those which:

i. assist us to carry out your requests, respond to your inquiries, fulfil your orders, provide you with samples, such as and customer support providers

ii. perform core information technology and other business-related services, such as ERP/website/app/CRM platform providers, cloud hosting providers, system maintenance, management and evaluation service providers, data analysts, payment processors, utility providers, insurers

iii. provide analytics and optimization services relating to our websites and apps.
c) Business transfer recipients: 

Including third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners can only use your personal data in the same way as set out in this Privacy Statement. 
d) Legal disclosure recipients: 

Where we are obliged by law to disclose your personal data (e.g. to government or law enforcement bodies) or where disclosure is required to protect our rights or those of our staff, customers or other third parties. 

For example, Nutricia may be issued with a “Request for Information” from third parties such as a healthcare professional, social worker or safeguarding team involved with your care, Care Quality Commission, Care Inspectorate Scotland, or your legal representatives. This may require us to disclose certain information including health care provision records for the specific purposes outlined in the request, such as in response to a safeguarding incident, a coroner’s inquest, court order, police investigation, NHS Trust investigation or inspection.

We will consider all such requests and, in accordance with the applicable laws Nutricia will review the Request for Information and assess its validity. Where we have a statutory basis for collecting and sharing your personal data, we do not need to ask for your permission to collect and share it, however we will only ever share your data on a basis of need and in line with the legislation. 

Save as expressly detailed above, we will never share, sell, or rent any of your personal data to any third party without notifying you and, where necessary, obtaining your consent.

Your personal data may be used, stored and/or accessed by staff operating outside the UK or the EEA working for us, other members of our group or trusted third parties. 

If we provide any personal data about you to any such non-UK and non-EEA members of our group or trusted third-parties, we will take appropriate measures to ensure that the recipient protects your personal data adequately, such as:

a) ensuring that there is an adequacy decision by the UK Government in the case of transfers out of the UK 
b) having in place standard model contractual arrangements with the recipient which have been approved by the UK Government for transfers out of the UK; or
c) any other safeguarding mechanism permitted by law.

We understand that the security of your personal data is important. We make our best efforts to protect your personal data from misuse, interference, loss, unauthorized access, modification, or disclosure. We have implemented a number of security measures to help protect your personal data. For example, we implement access controls, use firewalls and secure servers, and we encrypt personal data.

In the course of provision of your personal data to us, your personal data may be transferred over the internet.  Then, once we have received your personal data, we will use strict procedures and security features to prevent unauthorized access to it. 

Where we have given you (or where you have chosen) a password which enables you to access your online account, you are responsible for keeping this password confidential. 

The length of time for which we retain personal data depends on the purposes for which we collect and use it, for the duration of your contractual relation with us and/or as required to comply with applicable laws and regulations, tax, accounting or reporting requirements as well as to establish, exercise or defend our legal rights. We keep your personal data for no longer than necessary

Healthcare provision data no longer required for patient care will be retained with restricted access in line with NHS data retention policy and other relevant requirements pertaining to patient records, retention periods and product traceability.

For example, where you register for an account with Homeward Online, we will keep the personal data related to your registration, so we can perform the specific request. After that, we will keep the personal data for a period which enables us to handle or respond to any complaints, queries or concerns relating to the registration.

We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

You are also free to contact us for further information on such processing.

Where we process your personal data, you are entitled to a number of rights and can exercise these rights at any point. We have provided an overview of these rights below together with what this means for you. You should be aware that making changes may affect the service that we can provide. However, your rights will remain the same, if you wish to amend your changes at any time then you are free to do so via our contact page.

We will consider all such requests and, in accordance with the applicable laws, and aim to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. We may also rely on certain exemptions to complying with your requests in certain circumstances, for example if we need to keep using the information to comply with our own legal obligations or to establish, exercise or defend legal claims.  If an exemption applies, we will notify you when responding to your request.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

You have the right to obtain clear, transparent, and easily understandable information about how we use your personal data, and your rights. This is why we are providing you with the information in this Privacy Statement.

You have the right to access the personal data we hold about you, as well as correct, update or complete it at any time.

Your personal data is portable. This means it can be moved, copied, or transmitted electronically. However, this right only applies to personal data you have provided to us and where the processing: (i) is based on your consent or takes place for the performance of a contract; and (ii) it takes place by automated means. In the event whereby Nutricia are no longer contracted by the NHS/CCG to provide the Nutricia Homeward service then the data held may be transferred through your data portability rights to the new provider in accordance with Article 20 of the UK GDPR.

You have right to request that we delete your data if:

a) your personal data is no longer necessary in relation to the purposes for which we collected it; or
b) you withdraw any consent that you had previously given us to process your personal data, and there is no other legal ground to process that personal data; or
c) you object to us processing your personal data for Danone’s legitimate interests (such as improving overall user experience on websites); or
d) the personal data is not being processed lawfully; or
e) your personal data needs to be deleted to comply with the law.

Please note however that this right is not an absolute right, and we may have legitimate, legal, and regulatory reasons to retain your personal data. If you wish to delete the personal data we hold about you, please let us know and we will take reasonable steps to respond to your request in accordance with legal and NHS requirements.

Under certain circumstances you have the right to restrict the processing of your personal data if:

a) you do not believe the personal data we have about you is accurate, or
b) you consider that the personal data is not being processed lawfully, but instead of deleting the personal data, you would prefer us to restrict processing instead, or
c) we no longer need your personal data for the purposes we collected it, but you require the data in order to establish, exercise or defend legal claims, or
d) you have objected to the processing of your personal data and are awaiting verification on whether your interests related to that objection outweigh the legitimate grounds for processing your data.

Under certain circumstances, you have the right to object to certain types of processing based on grounds relating to your particular situation when such processing is based on our or another's legitimate interest. If you exercise this right, we will stop using your personal data for this purpose, unless we can demonstrate compelling legitimate grounds to continue processing your personal data that would outweigh your interests, rights, and freedoms. You have the right to object to the processing of your personal data for direct marketing activities (for example, by clicking on the unsubscribe link in our emails).

Where we rely on your consent to process personal data, you have the right to withdraw consent at any time, without affecting our processing of your personal data before you withdrew consent.

You have the right to lodge a complaint directly with supervisory authority about how we process personal data. While we would be grateful if you lodged any complaints with us, you have the right to lodge a complaint directly with the UK Information Commissioner’s Office about how we process personal data. 

You can contact the Data Protection officer at Nutricia Ltd using this link.

For more information about your privacy and data protection rights, or if you are not able to resolve a problem directly with us and wish to make a complaint, please contact the Information Commissioner’s Office at:

Website: https://ico.org.uk/for-the-public

Mailing Address: Wycliffe House Water Lane, Wilmslow Cheshire SK9 5AF

Phone Numbers: +44 303 123 1113

Email Address:  casework@ico.org.uk

We may also collect personal data about you through the use of cookies and other technologies. This may occur when you visit our website or third-party sites, view our online content, or use our/third-party mobile applications and may include the following information:

• Information about your device browser and operating system, or
• The IP address, device ID and Mac ID of the device you are using, or
• Web pages of ours that you view, or
• Links that you click while interactive with our services and emails you open, or
• Time and date of activity.

Please see our cookie policy for more information on this.

If you have any questions, comments or complaints regarding this Privacy Statement or the processing of your personal data, please contact us here or write to us at:

Data Protection Officer, Nutricia Ltd. Newmarket House, Newmarket Avenue, White Horse Business Park, Trowbridge, Wiltshire, BA14 0XQ

You can also contact us via at: DPO.UKIE@danone.com .

Finally, you can contact our Danone Data Protection Office via email at dpo.group@danone.com or write to us at Data Protection Office, Danone SA, 17 Boulevard Haussmann, 75009, Paris, France.

We may update our Privacy Statement from time to time (for example, to comply with changes in laws or regulations, our practices, procedures and organizational structures, requirements imposed or recommended by supervisory authorities or otherwise). Any changes we make to our Privacy Statement in the future will be posted on this page and will be applicable on the effective date of implementation.  Where we are legally required to do so, we will notify you of any changes. Please check back frequently to see any updates or changes to our Privacy Statement.  

This Privacy Statement was last updated on April 8, 2022.

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.

Automated decision making and profiling essentially means that decisions are taken automatically without human intervention. We will not make decisions based solely on automated decision making to the extent that they have a legal effect or significant impact on you without first notifying you and providing you with clear information about any such automated decision-making, including our lawful basis for carrying it out and the ability to have a human intervention for reviewing the decision.