Skip to main content

Athlete Privacy Notice

Athlete Privacy Notice

Section 1: Introduction
Section 2: EIS Services
Section 3: Sharing your personal data (world class programme athletes)
Section 4: EIS back office functions
Section 5: processing data without consent
Section 6: How long your personal data will be retained for and used when you no longer receive services from us
Section 7: Your Rights
Section 8: Your responsibilities

Section 1: Introduction

View the full Athlete Privacy Policy in PDF form.

The English Institute of Sport Limited (“EIS”) provides sport science, medical and technology services to athletes on a World Class Programme (WCP) or on a pathways/talent programme. In order to provide the services, EIS will process athlete personal data which means it collects, records, holds, otherwise makes available and uses data relating to the athletes to whom it provides services. It is essential for it to do so in order to provide its services effectively, as agreed under contract with your Sport’s National Governing Body (“NGB”). EIS’s processing activities are carried out in accordance with the Data Protection legislation, and with EIS’s internal policies.

The data held by the EIS is taken from the details you provide when you start your programme, to which will be added data that accumulates during and, where applicable, after, your time on the athlete world class programme or pathways programme. You give your consent for the EIS to process your personal data through the Athlete Consent Form.

The EIS has provided this Privacy Notice to inform you how your personal data will be processed, the registration purposes for which the data has been collected, the third parties to whom it may be passed, the other data controllers with whom your data is shared and how long EIS will hold on to your data. It also explains your rights and responsibilities in respect of the data and how you can opt out of some aspects of the processing, where applicable. The official purposes for which the EIS processes personal data are notified to the Information Commissioner, and can be viewed on the Office of the Information Commissioner’s Register.

To find the EIS’s registration you can use the search form for the Register. Just enter the EIS’s Number, which is Z7755332.

Lawful bases for processing

The lawful basis on which the EIS is able to carry out the processing of your data will vary depending on the processing at hand. EIS has identified that its processing will fall under at least one of the following lawful bases set out in Article 6 of the General Data Protection Regulation (GDPR):

Article 6(a) Consent – you sign a consent form to accept the processing purposes set out in this athlete privacy notice. If, in the future, EIS process your data for any new purpose then your consent for the new purpose will be obtained at the time.

Article 6(c) Legal obligation – under regulations set by the Care Quality Commission, (in particular Regulation 17 of the Health and Social Care Act 2008), this requires that the EIS maintain good governance, which includes maintaining accurate, complete and detailed records in respect of each person using the service.

Article 6(d) vital interests – as explained in section 5 below, there may be limited circumstances where EIS would need to process your data in order to protect your vital interests and where your consent could not reasonably be obtained.

Article 6(f) Legitimate interests – EIS may carry out processing that is necessary and in EIS’ legitimate interests, where it cannot be achieved under the other headings, for example, where there is a clear benefit to you or others, and it is reasonably expected, such as processing a payment where necessary or answering an enquiry using your details. Where EIS processes your health or medical data (which is defined as “special category” personal data under GDPR), it will require an additional condition for processing under Article 9 of the GDPR, as well as one from the above.

We are satisfied that Articles 9(2)(a), 9(2)(h) and 9(2)(j) of the GDPR are likely to be the most appropriate lawful bases to process such data, depending on the activity at hand. Article 9(2)(a) states that the data subject has given ‘explicit consent’ to the processing of those personal data for one or more specified purpose, and we obtain this consent to receive EIS services by asking you to accept this privacy notice. Explicit consent obtained in the manner described will be relied upon for sharing your personal data with other parties, and where we ask you to complete surveys to improve EIS services etc.

Article 9(2)(h) provides for where the processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, which will cover a vast array of treatment scenarios.

Article 9(2)(j) provides where the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

This will cover where we are processing personal data for innovation and/or research reasons, in order to improve the services EIS provide in the field of high performance sports science and medicine.


The data processed by the EIS and the purposes for which it is processed within EIS may include the following, depending on your programme and which services you receive from EIS:

Section 2A: Talent / Pathways Services

If you are a member of a ‘Talent’ team, a Performance Pathways athlete (any age) or any other athlete that falls outside of the World Class Programme (WCP), you will not receive the full programme of EIS services listed in this notice for the WCP athletes. For example, you might receive a combination of EIS services from Physiotherapy and Nutrition, and some limited S&C oversight, but not all the disciplines listed for the WCP athletes.

Your data will either be held on a secure medical records database developed by EIS to hold sensitive data, a secure sharing platform or on the EIS practitioner’s encrypted laptop, however only the EIS practitioners working with your NGB’s talent athletes, would be able to access your personal data. EIS would suggest if you are in any doubt as to what services are provided by EIS to you as a talent or pathways athlete, check with your contact in the sport, then refer to the corresponding headings below.

Performance Pathways (Performance Foundation / Talent Identification) is a centralised strategic support services managed by UK Sport (UKS) and supported by EIS. Its staff members sit across both UKS and EIS. Those staff members will have access to the data, and the data will therefore be shared within the team, or with other EIS or UKS teams to the extent required to support the Performance Pathways programme.

Any data processed by the performance pathway team will be processed in accordance with the
UKS Data Protection Protocol.

Section 2B: World Class Programme Services

Athletes on the world class programme may receive services from some or all of the EIS disciplines noted below and further described in the table in Appendix A to this notice. Such services which will be delivered by EIS employees or suitably skilled and experienced contractors working under strict contract terms of confidentiality on behalf of EIS:

  • Medical services, including access to EIS doctors
  • Physiotherapy
  • Strength & Conditioning
  • Physiology
  • Psychology
  • Performance Lifestyle
  • Biomechanics
  • Performance Analysis
  • Performance Nutrition
  • Performance Innovation

Athletes receiving any of the services noted above will have their personal data processed by the relevant discipline as further detailed in the table in Appendix A. In addition, EIS may process athlete data to provide services to your NGB, these services ensure continual improvement in the provision of leading sport science, medicine and technology to UK elite athletes:

  • Athlete Health
  • Sport Intelligence
  • Research

These services and the data processed by them are further described in the table set out in Appendix A. EIS may contact you by email in order to provide you with the relevant EIS services, this may include emails requesting that you complete a survey, but only where deemed necessary for the vital delivery and future improvement of EIS services. EIS would never contact you, or allow a third party to contact you, for direct marketing purposes.

It should be noted that all EIS employees and contractors are bound by strict obligations of confidentiality under their employment contract or contractor agreement. In addition, membership of their relevant professional body, such as our doctor’s membership of the GMC, requires our employees to be responsible for the confidentiality of all athlete’s records. The data will only be shared within EIS and with third parties as set out in Section 3 and for the purposes specified, but you may at any time request that your records are restricted to specific named individuals.

You must understand that such restrictions may have an effect on EIS’s ability to provide services to you and we would reserve the right to withdraw the provision of any services. This would be explained to you should you make the request.

Section 3: Sharing your personal data (world class programme athletes)

The EIS may disclose appropriate personal data, including special categories of personal data, to EIS colleagues in other disciplines or to third parties while you are on the world class programme, it may also be shared with your NGB. The EIS is responsible for ensuring that the transfer and security of this data is fully compliant with UK Data Protection legislation.

Sharing data within EIS

EIS practitioners will work within multi-disciplinary teams across the EIS, with the aim of ensuring that all their work is aligned to optimising the determinants required for you to win in your sport or event. For example, details of physiotherapy rehabilitation plans may also be shared with EIS S&C practitioners as this is necessary for those S&C practitioners to safely provide you with their services.

The data may also be shared with more senior staff and occasionally with external experts, for the purposes of audit and quality assurance. EIS Doctors, physiotherapists, nutritionists, psychologists and soft tissue therapists use a secure system developed for EIS, called PDMS (Performance Data Management System) to record, view, access and update medical and health data.

PDMS is also used to share data across the multi-disciplinary teams but access to specific data is restricted to those with a specific purpose to access that data, for example medical records can only be accessed by medical personnel (the only exceptions being where you have
consented otherwise or for administration or system development purposes). Data on PDMS may also be viewed, accessed and updated by your NGB medical personnel.

Your NGB will have obtained your consent for this access. You may however request that certain medical data is restricted to “doctors only”, “named practitioners only”, or “my eyes only” (the latter restricting access to the practitioner whom inputted the information) Unless you make a request not to have this, an overall ‘Medical Availability Status’ – in the form of a red, amber, yellow, green status – will be available to medical and non-medical staff of EIS and the NGB who have access to your data on PDMS. PDMS is managed by EIS administrators who also control access. All users must accept an “Acceptable Use Policy”.

It also has a number of in-built security features. You can also access PDMS via an online app, once you have been issued with log in details. The EIS administrators will also have access to your data in order to provide reports and EIS’s external software developers will also have access in order to manage and develop the PDMS system generally.

Where applicable, the data held on PDMS may also be accessed by the administrator of the medical insurance policy which has been put in place for you as an athlete on the world class programme.

All personnel who have access to PDMS are bound by obligations of confidentiality contained in their contracts with EIS and, where applicable, by codes issued by their regulatory and professional bodies. Where EIS practitioners do not use PDMS for data capture, it will be kept on individual practitioner’s encrypted laptop or encrypted external hard drive or other secure IT system managed by EIS or for EIS by a third party under strict contract terms.

Sharing data with other parties

EIS may share your personal data with other data controllers such as your NGB, and approved third parties, for example EIS multi-disciplinary teams support the athlete and coaches and work proactively to ensure that the coach can have a full understanding of the athlete they are coaching, therefore data is shared with your coach and NGB. EIS may also seek expert specialist advice from third parties such as research institutions or medical experts.

Further details of the third parties we share data with are set out in Appendix B to this notice. All data is shared under strict contract terms concerning confidentiality. The NGBs and other bodies which receive services from EIS can be viewed in Appendix C. Your data will however only be shared, as explained above, with your own NGB.

Section 4: EIS back office functions

The back-office functions of EIS may have access to a limited amount of athlete personal data in order to support EIS delivery of services. This is further detailed in Appendix C.

Section 5: Processing data without consent

As outlined above, consent will not be the only legal basis on which we will process your personal data and should not trump the other legal
bases. For example, if EIS were required urgently to process your data for a purpose, such as to provide life-saving treatment, which is not outlined in this privacy notice because it was unreasonable or not possible to obtain your consent at the time, or it was required by law ie. when another legal basis will apply.

Other than for athletes under 18 years of age, vulnerable adults or those who lack legal capacity and except in the most exceptional of circumstances, the EIS will not disclose an athlete’s personal data to parents, guardians or any other relative. If you have provided a nominated contact in the event of a medical problem or emergency then some personal data may be provided.

SECTION 6: How long your personal data will be retained for and used when you no longer receive services from EIS

EIS will retain your full athlete medical records, which will include allinformation about the services received as an athlete on programme, for 25 years from the date of last intervention. Where possible and where information is considered valuable for future use, steps will be taken to have such data pseudonymised (ie. the personal data will be held in such a way that the data can no longer be attributed to a specific data subject without the use of additional information).

The reasons for retaining athlete medical records/ information for a period of 25 years is due to the extreme nature of training that an athlete will endure during sporting life. This means the need to track back over a long period of time to establish any long term health consequences (both physical and mental) of high intensity training in Olympic and Paralympic athletes may arise.

If records were to be kept for less time, there would be no way of looking back to establish the extent of an athlete’s treatment history during this time where necessary for legal or research purposes.

Section 7: Your Rights

You have certain rights and responsibilities around your personal data including:

Right to be informed

What does this mean?

You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights. This is why we’re providing you with the information in this Privacy Notice

Right of access

What does this mean?

You have the right to obtain access to your personal data (if we’re processing it) and certain other information (similar to that provided in this Privacy Notice). This is so you’re aware and can check that we’re using your personal data in accordance with data protection law.

Right to rectification

What does this mean?

You are entitled to have your personal data corrected if it’s inaccurate or incomplete.

Right to erasure

What does this mean?

This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there’s no compelling reason for us to keep it. This is not an absolute right to erasure; there are exceptions.

Right to restrict processing

What does this mean?

You have rights to ‘block’ or suppress further use of your personal data in certain circumstances. When processing is restricted, we can still store your personal data, but may not use it further.

Right to data portability

What does this mean?

You have the right to obtain and reuse your personal data in a structured, commonly used and machine readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such information transferred directly to a third party.

Right to object to processing

What does this mean?

You have the right to object to certain types of processing, in certain circumstances. In particular, the right to object to the processing of your personal data based on our legitimate interests or on public interest grounds; the right to object to processing for direct marketing purposes (including profiling); the right to object to the use of your personal data for scientific or historical research purposes or statistical purposes in certain circumstances.

Right to withdraw consent

What does this mean?

If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful).

You have the right to exercise any of the rights described above at any time, and you must put this in writing to . Should you do this, EIS will confirm the steps it will take to comply with your request or will explain if there is an applicable exception to the right which means that EIS can not comply with the request. If you wish to access your personal data under the provisions of the GDPR, you should make a subject access request. You can make a subject access request by specifying what personal data you are requesting in writing, and by contacting .

The request will be processed and delivered to you within the statutory time limits for responding.

Data protection officer (DPO)

The EIS nominated DPO is Helen Hughes, who can be contacted at

Section 8: Your Responsibilities

Athletes have a responsibility to ensure that all personal information provided to the EIS is accurate and up to date. You should notify any changes of address, corrections to contact details etc. to the PDMS admin team at or your usual EIS contact.

What happens if EIS decide to change this Privacy Notice?

We will:

  • update all relevant documentation and post any changes on the EIS website
    for any minor changes;
  • Notify all active athletes by email of any material changes, so that you’re always aware of what information we collect, how we use it, and under what circumstances we disclose it.