At Nutricia, we are committed to protecting your right to privacy. We aim to protect the personal data that we hold, manage it responsibly, and maintain transparency in our practices. Below you will find a quick summary of our Homeward Privacy Statement, but please read the full statement for more details.
Homeward Service Privacy Statement
Key Points
Why we use your personal data: We use your personal information (including special categories of personal data such as information about your health) to provide the Homeward Service and ensure we provide effective support to you.
Who has access to your personal data: To provide you with the Nutricia Homeward service, we may share your personal information with third parties that are working on our behalf such as couriers or other healthcare providers and third-party service providers. Your personal data will not be shared, sold, rented or disclosed other than as described in this Privacy Statement.
Security of your personal data: We take the security of your data seriously and handle it in compliance with the law.
Transferring your data internationally: We keep your information in the UK and the EEA. Rest assured, your information remains under strict legal protections and is handled with care.
How to exercise your privacy rights: You have a number of privacy rights available to you. If you would like to make a request, please complete the form here: https://www.danone.co.uk/contact-us/data-subject-rights-request.html.
Terminology we use: Our privacy statement contains several data protection terms and acronyms. To assist with any confusion, we have created a helpful glossary (here) for definitions.
Our Privacy Commitment
Your trust matters to us. The information we collect, termed 'personal data' under data protection laws and 'personal confidential data' under the Caldicott Principles, must be treated in confidence and with respect per these regulations.
We protect your privacy by upholding these data protection principles:
- Your information is always used lawfully, fairly and in a transparent way.
- We will only collect and use your information for valid reasons that we have clearly shared with you as set out in this Privacy Statement. We will not use your information in any way that is incompatible with those purposes.
- We collect and use the least amount of personal information necessary for those purposes.
- We aim to keep your data accurate and up to date, which is why we may ask you to confirm your information.
- We will keep your information secure and if we no longer need it and we aren’t legally required to keep it, we’ll archive it with severely restricted access, destroy it, or permanently de-identify it.
- Your Privacy Matters: Your personal information will not be shared, sold, rented, or disclosed except as described in this privacy statement.
- No obligation: You’re not obligated to share your personal data with us. However, without it, we might not be able to provide you with the Homeward service.
In addition to complying with UK data protection laws, we also comply with the Caldicott Principles, which set out that we must:
- Justify the purpose(s) for using confidential information;
- Not use patient identifiable information unless it is absolutely necessary;
- Use the minimum necessary patient identifiable information;
- Restrict access to patient identifiable information on a strict need-to-know basis;
- Ensure everyone with access to patient identifiable information is aware of their responsibilities;
- Comply with the law;
- Be aware that the duty to share information can be as important as the duty to protect patient confidentiality; and
- Ensure you are informed about how your information is used.
Table Of Contents
This Privacy Statement covers the following key topics about your personal data (you can click on each title for more information). Each section includes a summary (“The Essentials”) to help you quickly locate the information that is most relevant to you.
This privacy statement explains how Nutricia collects and manages your personal information as a Data Controller. It contains details on who we are, how and why we collect, use store and share your personal information. It also explains your rights and how to contact us or the ICO if you have any concerns that we are unable to address.
To provide the Nutricia Homeward service, we collect and use personal information primarily for healthcare and administration purposes. Sometimes, there are instances where processing your personal information is necessary or legally required even without consent.
This privacy statement applies to:
- Current or former patients registered on the Nutricia Homeward service
- Carers, relatives or friends supporting these patients
- Users of our patient portal and electronic patient record system, MyConneX
- Individuals who contact us about the Homeward Service; and
- Visitors to the Nutricia Homeward website, www.nutriciahomeward.co.uk .
This statement does not apply to healthcare professionals (HCPs), who have a separate privacy statement. You can view the HCP privacy statement here.
The Essentials: Nutricia is responsible for managing your personal data when providing the Nutricia Homeward service to you.
We are Nutricia Limited trading as Danone UK (referred to in this privacy statement as "Nutricia," "us," "our," or "we").
Our registered office is located at Nutricia Ltd, Newmarket Avenue, White Horse Business Park, Trowbridge, Wiltshire, BA14 0XQ.
We are a 'data controller' regarding the information we hold about you. This means that we are responsible for protecting your personal information, deciding its use and complying with all the data protection laws and regulations in the United Kingdom.
Nutricia is part of the Danone Group. For more information about Danone, visit https://www.danone.co.uk.
The Essentials: Our DPO, Alison Burke, can be contacted at DPO.UKIE@danone.com.
Our DPO is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
If you have any concerns or questions about our use of your personal information, you can contact our DPO, Alison Burke, DPO.UKIE@danone.com or by writing to:
Data Protection Officer
Nutricia Limited
Newmarket Avenue,
White Horse Business Park,
Trowbridge,
Wiltshire,
BA14 0XQ
The Essentials: Nutricia collects personal information such as contact details, health records, and communication preferences to provide the Homeward Service. We gather information from various sources including healthcare professionals, carers, and interactions with our customer service. It's important that this information is kept accurate and up to date.
Personal information is any information that can be used to identify you. The personal data we collect varies depending on our relationship with you; therefore, this section is divided into three categories to outline the data we collect on:
a) Homeward Service Users: current or former patients of Nutricia Homeward, including carers, relatives, friends assisting with patient care, or users of our patient portal, such as MyConneX.
b) Individuals who contact us about the Homeward Service who are not current or former Homeward Service Users.
c) Visitors to our Nutricia Homeward website, www.nutriciahomeward.co.uk who are not current or former Homeward Service Users.
Homeward Service Users: current or former patients of Nutricia Homeward, including carers, relatives, friends assisting with patient care, or users of our patient portal, such as MyConneX.
We, or third parties on our behalf, may collect the following personal information:
- Personal details such as your name, title, gender, date of birth, NHS/CHI number and patient account ID.
- Contact details such as your address, telephone number(s) and email.
- Details of each contact we have with you (or your healthcare professional or your representative) including hospital, community or home visits, telephone consultations, training records, responses to our patient satisfaction surveys and all communications with our customer service teams. Telephone calls may be recorded. Where Artificial Intelligence (AI) enabled customer service tools are used, we may also create transcripts, records of interactions and customer service insights relating to those communications.
- Details of your nutritional regimen including product name, preferences, quantity, delivery frequency and feeding method.
- Infinity Pump log (if applicable) including Health data (special category data): therapy and feeding information where linked to an individual, Personal data: device identifiers where linked to a patient, technical data: device performance, alerts, and usage logs
- Records of your health and wellbeing such as relevant medical history, any declared illness or disability, allergies, prescription exemption reasons, safeguarding information, including reports from other healthcare providers.
- Details of patient care including any interventions administered by Nutricia’s nursing team, investigations conducted, reported healthcare issues, clinical assessments, and accompanying images.
- Images or photographs provided to support your care or a complaint investigation, such as images of complaint samples, product issues, equipment concerns or, where relevant to your care, photographs of a stoma site or surrounding skin shared with or taken by our nursing teams.
- Details of deliveries made to you including product details and quantities, delivery dates, delivery status, and delivery instructions or preferences.
- Communication preferences such your preferred contact details or time, language or other communication requirements.
- Relevant information from people who care for you including other health and care providers (for example, registered GP or school/nursery), carers, relatives or friends such as name, contact details and relationship to you.
- Information about your relatives and friends such as your dependants, next of kin and emergency contact numbers
- Account Details: username, email and password
- Technical Information: Internet Protocol (IP) address used to connect to the internet, device type, website address, country from which you access our system, requested files, browser type and version, browser plug-ins, operating system, and platform
- Visit and Behaviour Information: Use of our accessibility toolbar; pages clicked, time and length of visits to specific pages, interaction data (scrolling, clicks, mouse-overs), browsing methods, traffic data, location data, weblogs, and information provided for additional services or downloads.
- Nutricia Choice patients: in addition to the above, you may provide payment information, such as credit card details, to make a purchase. Nutricia does not store your payment information. Payments are made directly through our third-party payment provider. We do not control, review, or store your payment information during these transactions.
If we do not have accurate and current information, this may impact the services we provide, such as timely deliveries. Therefore, it is important that you inform us of any changes to your personal information including your contact details, to ensure that our records remain precise and up to date. It is essential that your details are accurate and up to date. Always check that your personal details are correct and please inform us of any changes as soon as possible.
We also rely on the accuracy of your healthcare professional's details and share information accordingly. It is the responsibility of your managing dietitian to ensure this information remains up to date in the event of any changes to your healthcare professional or managing trust.
If you provide personal information about a third party (such as a family member or caregiver), please ensure they are aware of and agree to this privacy statement. If the individual cannot understand or agree (for example, a child), you must have the authority to share their information for the purposes outlined in this privacy statement.
Special categories of personal data
The Essentials: Your health information may be processed under this category.
Special categories of personal data require a greater level of protection. This includes information on racial or ethnic origin, religious beliefs, sex life or sexual orientation, and health.
In line with UK GDPR Article 9 (2)(h), we will only process special categories of personal data when it is required for the provision of health or social care or treatment; or the management of health or social care systems and services; or in any other circumstances permitted by law (such as defence of legal claims); or for purposes to which you have given your explicit consent.
To provide the Nutricia Homeward service, Nutricia may process your health information under this category. However, Nutricia does not usually collect other special categories of data, unless it is necessary for providing the Nutricia Homeward services.
Individuals who contact us about the Homeward Service (who are not Homeward Service users)
We, or third parties on our behalf, may collect the following personal information when you contact us about the Homeward Service:
- Personal details such as your name, title
- Contact details such as your address, email, telephone number(s)
- Details of each interaction we have with you, such as information provided during your communications with us (including through our customer service lines or social media platforms) or call recordings.
- Information about your family and friends such as your dependants if you provide this information to us.
Visitors to the Nutricia Homeward website (who are not Homeward Service users)
We, or third parties on our behalf, may collect the following personal information when you visit our website:
- Personal details such as your name, title
- Contact details such as your address, email, telephone number
- Communications shared via website contact forms
- Technical Information: Internet Protocol (IP) address used to connect to the internet, device type, website address, country from which you access the website form, requested files, browser type and version, browser plug-ins, operating system, and platform
- Visit and Behaviour Information: Use of our accessibility toolbar; pages clicked, time and length of visits to specific pages, interaction data (scrolling, clicks, mouse-overs), information shared with others (including via email and social media where relevant), browsing methods, traffic data, location data, weblogs, and information provided for additional services or downloads.
The Essentials: We collect your personal information from various sources including directly from you, your healthcare professionals, and the NHS Personal Demographic Service (PDS) (more details below). This information helps us provide accurate and comprehensive care tailored to your needs.
We collect this information about you from various sources, including:
- From you directly via any direct interaction with the Homeward Service including MyConneX (our electronic patient record system and patient portal)
- From your carers, relatives or friends who provide us with information about you
- From anyone who has the authority to act on your behalf such as a power of attorney or deputy
- From your healthcare professional such as during Nutricia Homeward registration or when updating your record in MyConneX
- From your GP
- From other healthcare professionals and officers in the local authority, social services department and emergency services; and
- From any other (current and/or previous) healthcare and care providers.
- From the Personal Demographic Service (PDS) or ‘NHS Spine’ – see below for more details.
- From Infinity Pump log (if applicable)
- Through secure image capture or sharing tools, where images are needed to support complaint handling, product or sample assessment, nursing care, clinical review or continuity of care.
Information collecting from the NHS PDS
Your NHS number or basic information such as your name, address and date of birth may be accessed through an NHS England service called the Personal Demographic Service (PDS) or ‘NHS Spine’. Upon registration your referring dietitian may enter your NHS/CHI number or your name and DOB into MyConneX which has a direct link to the NHS Spine. This is a one-time, one-way connection.
If the NHS/CHI number is active and accurate, your details will be found and the information held on the NHS spine, including your name, NHS number, gender, date of birth, GP surgery and home address will auto fill in the relevant fields on the registration form.
Once retrieved from the PDS, your NHS number and basic personal data are stored in MyConneX. This data is retained according to our record retention policies; see section 14 for more details.
The use of joined up information across health and social care brings many benefits. In this instance it enables your referring dietitian to provide Nutricia Homeward with accurate information about you when registering you with Nutricia Homeward.
You have the right to object to the processing of your NHS number in this way. This will not stop you from receiving care but will result in the benefits outlined above not being realised. To help you decide, your referring dietitian should discuss this with you and how this may affect our ability to provide you with care, and any other options that you have.
If you wish to opt-out from the use of your NHS number in this way, you can request this from your dietitian at any time.
Information collecting from Infinity III pump
We process device and therapy data recorded by enteral feeding pumps to investigate incidents, ensure patient safety, and maintain product performance.
This may include device identifiers (such as serial numbers and case references), detailed therapy information (including feed volumes, delivery rates, and timestamps), device usage data, and system‑generated alerts or alarms.
These records may also include technical investigation details and service history
Where linked to an individual, therapy and usage data may constitute health data.
We use this information to:
- Investigate incidents and complaints
- Ensure patient safety and continuity of care
- Monitor and improve device performance
- Comply with legal and regulatory obligations
The Essentials: Nutricia collects children's information from parents or healthcare professionals to provide the Nutricia Homeward service. However, our website and app are designed and intended for adult use.
Nutricia collects personal data, including health information concerning children under the age of 16. This information is obtained either directly from their parents or guardians, or indirectly through the child’s healthcare professional when they are registered with the Nutricia Homeward service. However, our websites and MyConneX app are intended for adult use.
The Essentials: Nutricia processes personal information based on legitimate interests and healthcare provision to deliver the Nutricia Homeward service, as commissioned by the NHS or other providers. This may include nutrition supply, nursing services, patient support, order fulfilment, and communication with you. Data processing is also used for ensuring safe operations and enhancement of our products and services. These activities are supported by various legal bases such as contractual necessity, consent, and legal obligations. When you contact us by telephone, we use Artificial Intelligence (AI) enabled systems, to support customer service operations. These tools may help deliver standard messages, identify the reason for a call, route calls to the appropriate team, generate summaries of interactions, identify common enquiry themes, and provide relevant information to our customer service teams. These tools are designed to support our staff and operate with appropriate human oversight. They do not make decisions about your care or services.
We use the types of personal information listed above for a number of purposes, each of which has a ‘lawful basis’.
For Nutricia Homeward service users, we process your data based on legitimate interests (UK GDPR Article 6(1)(f)) and for provision and managing health or social care treatment or services as per UK GDPR Article 9 (2)(h).
We may also rely on the following legal bases for processing:
- Contractual necessity
- Legitimate interests
- Consent (where required)
- Legal obligations
Whenever we collect and use your personal information on the legal basis of legitimate interests, we take care it does not outweigh your rights as an individual. Our legitimate interests involve using your personal information to:
a. Deliver the Nutricia Homeward clinical homecare service, commissioned by the NHS and other providers.
b. Provide services to our customers.
c. Place, track, and fulfil orders with suppliers.
d. Run, grow, and develop our business.
e. Operate and secure our websites and apps.
f. Ensure a safe working environment for staff and visitors.
g. Invest in new products to benefit our communities.
h. Handle internal group administration.
The table below outlines why we collect and use your personal data, along with the lawful bases for doing so.
Please note that not all the purposes listed below will apply to everyone and we may process your personal information for more than one lawful basis depending on that purpose. Please contact us if you’d like more information about the specific lawful basis.
| Why we use your information | Our lawful basis for using your information |
To provide the Nutricia Homeward Service:
|
|
To manage your prescriptions: We use your personal data to manage your prescriptions on your behalf to fulfil your order. If we have your email address, you will receive communications regarding your prescriptions. |
|
To communicate with you: We will use your personal information to contact you or anyone who has authority to act on your behalf, regarding the Nutricia Homeward service, your health, care, appointments, orders or deliveries. We will send you service communications including information about your orders, deliveries and tracking updates (some of which may be sent by our delivery partners like DPD), prescriptions (where relevant), changes to our operational hours, product availability, as well as changes to our terms and conditions or privacy statement. We may correspond with you over the telephone, email or text message or through postal mail. Telephone calls may be handled using AI enabled tools to assist our customer service teams to deliver information and route your call to a human agent where needed. These tools support our staff and do not replace human decision making. Please note that if we have your email address, email will be our primary method of communication with you. |
|
To keep and maintain an accurate record of your interactions with us: To help inform decisions that we make about your care, including make recommendations/referrals to your HCP, decisions around medical intervention and prescriptions and to plan your care and treatment. To ensure patients are provided and delivered the correct products and to enable continued provision of care to the patient. Where appropriate, our nursing teams may also use secure image capture tools, to take or receive photographs relevant to your care, for example of a stoma site or surrounding skin, to support assessment, advice, escalation to healthcare professionals, continuity of care and accurate record keeping. To record any consent given to us and to manage your requests regarding data subject rights. |
|
To investigate concerns or complaints: To ensure that any concerns or complaints you may have about are appropriately investigated and responded to.This may include asking you, your representative or a healthcare professional to securely capture images, where this is needed to understand and investigate the concern, for example images of complaint samples, products, equipment or related materials. |
|
| For identification: When communicating with us, we will collect your information to verify your identity before discussing a patient’s account and to maintain the integrity of data. |
|
To provide you with MyConneX:
|
|
To work effectively with other organisations who may be involved in your care:
|
|
To improve our Homeward services: We may use your personal data to send you feedback surveys. You may choose to complete our patient satisfaction survey to help us to improve the services we provide to you and others. |
|
To process payments: Applicable to Nutricia Choice users only. While you provide payment information such as credit card details when making a purchase, Nutricia does not collect or store this information. Any telephone recordings are also paused during this process. |
|
For safeguarding and regulation: We may use your personal data for the purpose of safeguarding and regulation of care, where required, to protect Nutricia, your vital interests, or those of another person. |
|
To train and monitor our staff: Your records help us to teach, train and monitor staff and the quality of their work (including providing staff with anonymous feedback from patient surveys) to audit and improve our services and ensure it meets user needs. |
|
For health and safety of our employees:
|
|
To manage and improve our processes and operations:
|
|
To improve our product and services We may use your personal data to manage, develop, and improve our products, services, and communications. |
|
For reporting and commercial planning: We may use your personal information for internal reporting, forecasting, business administration, ensuring adequate insurance coverage for our business, ensuring the security of company facilities, and identifying and implementing business efficiencies. We do not process health information for these purposes. |
|
For our legal defence: We may use your personal information:
|
|
For security & fraud prevention: We may use your information when monitoring and auditing Homeward or system usage. |
|
For technical support, analytics and improvements: We may use your information to provide, improve, maintain, and provide technical support in relation to our platforms, websites, and apps such as:
We do not process health information for these purposes. |
|
For network and information security: To may use your personal information to operate and ensure the security of our websites and apps. |
|
We generally use your personal information solely for the purposes it was initially collected (as outlined above). However, we may use your information for another purpose, provided that this purpose is compatible and related to the purposes set out in this privacy statement. For example, if we initially collected your information to provide you with a service, we might also use it to improve that service by analysing usage patterns and customer feedback.
If we ever need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.
On occasion, we may use your personal information without your knowledge or consent for other purposes where such use is required or permitted by law. For instance, in certain scenarios, we might be obligated to share information with regulatory authorities or law enforcement agencies as part of legal proceedings or investigations. This ensures compliance with legal and regulatory standards and helps us maintain the integrity and security of our services.
The Essentials: Subject to adequate safeguards, your personal information may be shared with our Nutricia group companies, third-party service providers and subcontractors, your healthcare professional or others involved in your direct care, or other third-party organisations (such as authorities, but only where they are legally entitled to access the information).
Sometimes it is necessary for us to share information with service providers acting on our behalf or other organisations. If we do this, we make sure we only do so with organisations that safeguard and protect your personal data in the same or similar way that we do.
Except as specified in this privacy statement, we will not share, sell, or rent your personal data to any third party without notifying you and obtaining your consent if needed.
Your personal data may be shared with the following third partie who work on our behalf to help us provide the Homeward Services:
- Service providers related to our core Homeward business-related services: such as logistics, delivery providers and third-party couriers to pick, pack and make deliveries of your requested products and our pharmacy partner to fulfil your orders and survey providers to gather feedback on our Homeward service.
- Service providers on an ad hoc basis: such as image capture providers on an ad hoc basis for complaint investigations, product or sample assessment, nursing care, clinical support, escalation or record keeping language interpretation or translation services, secure shredding providers, lone working device provider to ensure the safety of our nursing teams when conducting home visits.
- Bulk mailing providers: to communicate with patients to provide you with relevant Homeward information.
- Subcontractors: such as locum nursing providers, customer support providers to assist us to carry out your requests, respond to your inquiries, manage complaints and fulfil your or your HCP’s orders on your behalf.
- Service providers related to core information technology and other related services such as external IT providers, electronic patient records systems to store and process patient information such as MyConneX, website, app or CRM platform providers, cloud hosting providers, software providers, audit providers to monitor system usage and security events, archiving and back up providers, systems maintenance providers, analytics and optimisation services relating to our websites and apps, accessibility platforms and telephone call recording, automated call handling, and AI enabled customer service tools used for monitoring, interaction summaries, service analytics, and service delivery purposes.
- Professional advisors: such as lawyers or insurers, in the exercise or defence of legal claims.
- Other internal Nutricia companies within our Danone group: We may share pseudonymised data for internal administrative purposes such as product delivery, compliance, auditing and monitoring.
- Business transfer recipients: Including third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners can only use your personal data in the same way as set out in this Privacy Statement.
In addition, we may share your information with third parties directly involved in your care such as:
- Your friends, family and others: including anyone who has the authority to act on your behalf such as a power of attorney or deputy, where appropriate to do so for the provision of your health or social care, in the vital interests of you or others (or with your consent where applicable).
- Healthcare professionals and multi-disciplinary teams that are involved in your direct care, we will share information about you with other healthcare providers such as other NHS Trusts, your GP, community staff/district nurses, hospital staff, social services and local authorities.
We may also share your information with independent third parties such as:
- Regulators / safeguarding authorities/commissioners: such as child and adult safeguarding services (e.g. MASH), the Care Quality Commission and Public Health. We share your personal data with these public bodies where we are required to do so by law or a regulatory obligation.
- The police and other law enforcement agencies: in limited circumstances we may share your personal data with the police if required for the purposes of criminal investigations and law enforcement or where disclosure is required to protect our rights or those of our staff, customers or other third parties.
- Courts (including a Coroner’s Court) and to tribunals: for the investigation of deaths (coroner) and processing of legal claims.
For example, we may receive a "Request for Information" from third parties such as healthcare professionals, social workers, safeguarding teams involved in your care, the Care Quality Commission, the Care Inspectorate Scotland, the police, or your legal representatives. This request might necessitate the disclosure of specific information, including healthcare provision records, for purposes outlined in the request, such as in response to a safeguarding incident, a coroner’s inquest, a court order, a police investigation, an NHS Trust investigation, or an inspection.
We will consider all such requests carefully. In accordance with applicable laws, Nutricia will review the Request for Information and assess its validity. Where there is a statutory basis for sharing your personal data, we are not required to obtain your permission to collect and share it. However, we will only disclose your data based on necessity and always in compliance with legislation – see below. In all cases, where personal information is shared, either with or without your consent, a record will be kept.
Sharing your information without your consent
There are circumstances where we need to share your information without your consent. For example:
- When the health and safety of others (including members of staff) is at risk;
- To protect public health;
- When the law requires information to be passed on;
- For the prevention or investigation of serious crime;
- Under a court order;
- When sharing is in the public interest; or
- Where there are safeguarding concerns for vulnerable people.
The Essentials: We do not transfer your information outside the UK and EEA.
We primarily keep your information in the UK and in some instances, in the EEA. We always ensure appropriate measures to protect your data, including:
a) confirming an adequacy decision by the UK Government for transfers out of the UK;
b) using standard contractual clauses approved by the UK Government; or
c) any other legal safeguarding mechanism.
The Essentials: You have various rights in relation to your personal data, such as access to your personal data (including portability in some cases), the right to correct or delete some personal data, the right to limit our processing in certain cases (e.g. through objecting to direct marketing or through withdrawing consent) and the right to lodge a complaint with us directly or to a data protection authority.
Where we process your personal data, you are entitled to a number of rights established in the relevant applicable laws and can exercise these rights at any point. We have provided an overview of these rights below together with what this entails for you. You can exercise any of your rights by contacting us here https://www.danone.com/gb/en/legal-pages/contact/dsr-form.html.
The right to be informed
You have the right to obtain clear, transparent and easily understandable information about how we use your personal data, and your rights. This is why we are providing you with the information in this Privacy Statement.
The right to access your personal data and correction
You have the right to access the personal data we hold about you, as well as correct, update or complete it at any time.
The right to deletion of your personal data
You have right to request that we delete your personal data. However, this is not an absolute right and we may have legitimate, legal and regulatory reasons to retain your personal data.
The right to object
Under certain circumstances, you have the right to object to certain types of processing based on grounds relating to your particular situation when such processing is based on our or another's legitimate interest. If you exercise this right, we will stop using your personal data for this purpose, unless we can demonstrate compelling legitimate grounds to continue processing your personal data that would outweigh your interests, rights and freedoms. You have the right to object to the processing of your personal data for direct marketing activities (for example, by clicking on the unsubscribe link in our emails).
The right to withdraw consent
Where we rely on your consent to process personal data, you have the right to withdraw consent at any time, without affecting our processing of your personal data before you withdrew consent.
The right to restriction of processing
Under certain circumstances you have the right to restrict the processing of your personal data if:
a) you do not believe the personal data we have about you is accurate; or
b) you consider that the personal data is not being processed lawfully, but instead of deleting the personal data, you would prefer us to restrict processing instead; or
c) we no longer need your personal data for the purposes we collected it, but you require the data in order to establish, exercise or defend legal claims; or
d) you have objected to the processing of your personal data and are awaiting verification on whether your interests related to that objection outweigh the legitimate grounds for processing your data.
The right to data portability
Your personal data is portable. This means it can be moved, copied or transmitted electronically. However, this right only applies to personal data you have provided to us and where the processing: (i) is based on your consent or takes place for the performance of a contract; and (ii) it takes place by automated means.
The right to lodge a complaint with the data controller (for UK residents only)
If you have any concerns about how we use your personal data, you now have the right to raise a complaint with us at any time.
You can do this by completing our online form available here: https://www.danone.com/gb/en/legal-pages/contact/dsr-form.html.
We will:
- acknowledge your complaint within 30 calendar days
- investigate your concern and keep you informed
- provide you with a response as soon as possible
We encourage you to contact us first so we can try to resolve your concern.
You also have the right to lodge a complaint with the Information Commissioner’s Office if you are not satisfied with our response or believe your data has been handled unlawfully.
The right to lodge a complaint with a supervisory authority
If you think that we have not met the data protection or privacy requirements, you have the right to make a complaint to the Information Commissioner’s Office (the “ICO”). You can contact the ICO here:
Website: https://ico.org.uk/for-the-public
Mailing Address: Wycliffe House Water Lane, Wilmslow Cheshire SK9 5AF
Phone Numbers: +44 303 123 1113
Email Address: casework@ico.org.uk
To process your request, we might need more information from you. We may ask for proof of identity or additional verification. This security step ensures your personal data is not shared with anyone who is not authorised to receive it.
We consider all requests in accordance with the relevant laws and aim to address them within one month from our receipt. Occasionally, it could take us longer than a month if your request is particularly complex. If this is the case, we will inform you if we need more time and explain the reasons why.
Please note that not all rights are absolute, and we may refuse to comply with or charge a reasonable fee for a request that is unfounded or excessive (repetitive).
We may also rely on certain exemptions not to comply with your requests, for example, if you request us to erase your information but we need to keep using it to comply with our own legal obligations or to establish, exercise, or defend legal claims. If an exemption applies, we will notify you when responding to your request.
For more information about your privacy and data protection rights, you can always contact our Data Protection Officer, Alison Burke, directly via at: DPO.UKIE@danone.com.
The Essentials: We take the security of your personal data seriously and use various measures like role-based access, multifactor authentication, firewalls, and encryption to protect it.
We understand that the security of your personal data is important. We make our best efforts to protect your personal data from misuse, interference, loss, unauthorised access, modification, or disclosure. We have implemented a number of strict security measures to help protect your personal information. For example, we implement role-based access controls, use multifactor authentication, use firewalls, secure servers, and encrypt your information at rest and in transit.
To ensure that your information is kept confidential, safe and secure, all our staff are given training in data protection and information governance before they start handling personal data. Current staff must also undertake regular refresher training courses tailored to their individual roles.
Where we have given you, or where you have chosen, a password which enables you to access your online MyConneX or similar account, it is important that you keep this password confidential and do not share it with anyone.
Additionally, we advise you to:
- Regularly change your password to enhance security.
- Log out of your account after each session, especially when using a shared or public device.
- Report any suspicious actions or concerns to us immediately.
By following these guidelines, you also help to ensure the protection and security of your personal information and maintain the integrity of your account.
The Essentials: We only keep your information for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
We only keep your information for as long as is necessary to fulfil the purposes for which it was collected. This length of time varies based on the purposes for which it was gathered, including compliance with applicable laws or regulations, accounting, tax or reporting requirements, as well as to establish, exercise, or defend our legal rights.
Information that is no longer required for patient care will be retained with access severely restricted in accordance with the NHS Records Management Code of Practice. Additionally, we may retain your personal data for a longer period in the event of a complaint or if we reasonably foresee the possibility of litigation in connection with our relationship with you.
Specific details regarding retention periods for different types of personal information are available in our retention policy, which can be obtained from our Data Protection Officer by emailing DPO.UKIE@danone.com.
The Essentials: We may use automated or AI enabled tools to support customer service operations, including call routing, interaction summaries, service analytics, administrative support, and quality monitoring. These tools assist our staff and operate with appropriate human oversight. They do not make decisions about your care, treatment, or eligibility for services.
We do not currently carry out solely automated decision making or profiling that produces legal or similarly significant effects on you.
If we introduce automated decision making or profiling that has a legal or similarly significant effect on you, we will update this privacy statement and provide clear information about how the process works, the lawful basis relied upon, and any rights available to you, including human review where required by law.
With your consent where required, we may collect personal information using cookies and other tracking technologies (such as pixels, web beacons, page tags) on our website or on MyConneX. This may include:
- Information about your device, browser, and operating system
- The IP address, device ID, and Mac ID of your device
- Web pages you view on our site
- Links you click while using our services and the emails you open
- Time and date of your activity
Please see our dedicated cookie policy for more information on this.
The Essentials: Our websites and apps may link to other sites for convenience, but Nutricia is not responsible for these sites or their data practices. Always check third-party privacy policies before sharing your personal data.
Our Nutricia Homeward website and apps may link to third-party sites, plug-ins, or applications. These links are for your convenience only and do not imply our endorsement or association with them.
This privacy statement covers the personal data we collect or receive as a data controller. We are not responsible for data collected by third parties. Be sure to read the terms and privacy policies of third-party websites before sharing your personal data with them.
We do not endorse or accept responsibility for third-party content, terms, or policies.
Nutricia's websites and apps may include links to third-party sites for convenience, but Nutricia is not responsible for these third-party sites or their data practices. Always review third-party privacy policies before sharing personal data.
We may update our privacy statement occasionally to reflect changes in our practices, procedures, organisational structures, laws, regulations or recommendations by supervisory authorities.
Any changes to our privacy statement will be posted on this page and will take effect from the date they are implemented. If we make significant changes, we will inform you as required by law. Please check this page regularly to stay updated on any modifications to our privacy statement.
This privacy statement was last updated on 16 June 2025.
Lawful basis A lawful basis under the UK General Data Protection Regulation (GDPR) means the legal reasons we have for processing your personal data. Here's what it means:
Legitimate Interest means we process your data to run our business best and safely. We consider your rights and any impact on you before doing this. We won't use your data if our interests are overridden by the impact on you unless we have your consent, or it's required by law. Contact us for more details on this.
Performance of a Contract means we process your data to fulfil a contract or take steps before entering into a contract with you.
Complying with Legal Obligations: means we process your data to meet legal requirements.
These lawful bases ensure that your data is used in a fair, transparent, and legal manner.
Automated decision making
Automated decision-making means decisions made without human intervention. We won't make decisions based solely on this if it has a significant impact on you without notifying you first. We'll provide clear information and an option for human review of the decision.
Artificial Intelligence (AI) enabled or automated tools
AI enabled or automated tools means systems that use predefined rules, algorithms, or machine learning technologies to support administrative, customer service, and operational activities. Examples may include call routing, interaction summaries, service analytics, and information prompts presented to our staff. These tools are designed to assist staff do not make final decisions without human oversight.