Your data's journey through Nuffield Health Swim School

Discover how your data may be processed through our Swim School services

What information you may be asked to provide

When you come into your local Nuffield Health Club you will be asked to sign up to the Swim School T&Cs and complete a form. This form provides us with the minimum amount of data we need to sign you up as a new swim member.

  • About you (parent or swimmer over 18) - We collect your name, date of birth, postal address, email address, and contact number so we can identify you and differentiate you from other members in our system. We will also use this information to contact you in an emergency or to inform you of classes, arrange booking, payment etc… e.g. the swim teacher has taken ill so a replacement is on their way but they will be 10 minutes late.
  • About your child (where applicable) -  If you are a parent signing up for swimming lessons on behalf of your child, we will need you to complete your details as above but we will also need some information about your child. We won’t need a separate email address or contact number but we will need to know a bit of health information about the swimmer so we can make sure we are aware of any medical conditions or any extra support they may need. In accordance with the T&Cs if you disclose medical information that gives us cause for concern we may need a letter from your GP or doctor confirming that your child is fit enough to have swimming lessons.

Where we may collect your data from

The only information we will collect about you will be information you provide to us at the point you sign up for the Swim School at your local Nuffield Health club. We will not collect information about you from any other sources.

Please note if we require a note from your GP or your child’s GP confirming that the swimmer is fit to swim and suitable for swimming lessons, you will be asked to contact your GP directly and provide us with a copy of their recommendations. We will not contact your GP directly.

Who your information may be shared with

CAP2 supply the system and portal for all of our swimming lessons. The system is called CoursePro which is a specialist management system, specifically designed to manage lessons.

How CAP2 get your information:

  1. The details you provided to the advisor at the Club will be input into CoursePro to allow them to set you up as a new swimmer and your email address will be used to send you a link to set up your portal. So some information will be provided to CAP2 via Nuffield Health.
  2. You will receive an email which provides a link to set up your portal with CoursePro. You will be asked to provide further information e.g. how you want to pay. So some information you will provide directly to CAP2 when setting up the portal    

Fair and lawful processesing

Each organisation is required to demonstrate that they are processing personal data fairly and lawfully, to do this we must have a ‘lawful basis for processing’ personal data. Consent is probably the condition that has gained the most attention but we only rely on consent in limited circumstances e.g. to share information with a third party or your GP.

Swim School will mainly be processing data based on the following lawful basis for processing:  

  • Article 6 (1)(b) Processing is necessary for the performance of a contract to which the individual is party or in order to take steps at the request of the individual prior to entering into a contract.
  • Article 6 (1)(f) Legitimate interests: the processing is necessary because of a legitimate interest or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
  • Article 6 (1)(c) The processing is necessary for compliance with a legal obligation to which Nuffield Health is subject.
  • Article 9 (2)(h) The processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of English Law or pursuant to contract with a health professional.

What does this actually mean?

In order to provide you with the level of support agreed to in our contracts in a safe and effective way we need to process the data discussed, and as such, we are doing so lawfully. This means we may not always ask your consent each time we use your data if what we are doing is linked to your treatment or doing something we must do by law.  

Your rights in respect of your Personal Data


The law gives you certain rights in respect of the information that we hold about you.  Below is a short overview of the key rights available to you. 

  • Data Subject Access Request - with some exceptions designed to protect the rights of others, you have the right to a copy of the personal data that we hold about you.  Where the data is data that you have given to us, you have the right to receive your copy of it in a common electronic format, and to provide copies of it to other people if you wish (Right to Data Portability).
  • Right to Rectification - you have the right to have the personal data we hold about you corrected if it is factually inaccurate.  This right does not extend to matters of opinion, such as assessments of performance or fitness to work.
  • Right to Erasure - in some limited circumstances, you have the right to have personal data that we hold about you erased (the “right to be forgotten”).  This right is not generally available where we still have a valid legal reason to keep the data (for example, because we are obliged to do so by law).
  • Right to Restrict Processing - you also have the right in some circumstances to request that temporary restrictions are placed on how we process your personal data, for example if you contest its accuracy or where we are processing it on the basis of our legitimate interest and you contest our assessment that our interest overrides your rights.

The above is not a complete and exhaustive statement of the law.

When things go wrong

Nuffield Health pride ourselves with the quality of our services and consistent positive customer satisfaction, however, we understand that in a small number of cases you may have cause to raise a concern regarding an element of the service. It is important that Nuffield Health learn from these episodes to continually enhance services and as such we carry out thorough investigations. In order to fully investigate your concern we may need to share information with our compliance team, senior leaders or other parties not part of the Swim Team. For example, if you raised concerns about a member of staff we might need to share this information with our Central HR team, and their professional body, where appropriate. In any case, we will only share a limited amount of information, as little as is necessary to investigate the concern. We may also need to share details of your concern with your Swim Instructor or other members of the Swim Team for the purposes of the investigation.

If the concern has come via a third party e.g. a regulator, body or solicitor, we may need to disclose your data with them in order to resolve, defend or investigate a concern.

How long we will keep your personal data for

  • Children: When children turn 18 they have 3 years to bring a legal claim. As such, we keep our swim school records for any child under the age of 18, until their 18th birthday and then for a further 3 years.
  • Adults: For adults or parent’s data, we will retain this data for a period of 6 years plus the remaining financial year from the point that swim school membership ceases.

Further Information

For further information about how your data may be processed or to ask any questions please raise this with the Swim Manager at your local Nuffield Health club. If you are not satisfied with how we handle your personal data or a request to exercise one of your rights in relation to your data, you can contact the Data Protection Officer on dataprotectionofficer@nuffieldhealth.com

Should you remain dissatisfied you have a right to complain to the Information Commissioner’s Office on 0303 123 1113 or through their website https://ico.org.uk/