Depending on your relationship with Athena, we may collect and process:

• your name, job title and organisation;
• professional and business contact details;
• information contained in enquiries, correspondence or meeting requests;
• information relating to contracts, projects, invoices and payments;
• information provided when registering for or attending training, events or meetings;
• feedback, evaluations and testimonials;
• information about how you use our website, including technical information such as your IP address, browser and device information;
• professional information contained in reports, correspondence or other documents provided to us in connection with our services; and
• where necessary for particular professional engagements, sensitive or special category information, including information concerning health.

In some areas of our work, particularly clinical governance reviews, serious incident investigations, patient safety work, medicolegal matters and coronial support, information supplied to us may relate to patients, residents, prisoners, service users, members of staff, witnesses or other individuals.

‍

This information may sometimes include health information, safeguarding information or information relating to criminal allegations, proceedings or convictions.

‍

Please do not submit confidential clinical information, medical records or patient-identifiable information through our general website contact form. Where such information is required for an engagement, Athena will provide or agree an appropriate secure method for transferring it.

• Directly from you;
• from an organisation for which you work;
• from organisations that engage Athena;
• from healthcare providers, care providers, legal advisers or other professional organisations;
• from professional advisers, witnesses or other individuals involved in an engagement;
• from publicly available professional sources;
• through our website and associated technologies; or
• through professional networking, conferences and events.

Where we receive personal information from a client organisation as part of an investigation, review or other engagement, that organisation may be responsible for determining the lawful basis on which information is disclosed to Athena.

• respond to enquiries and requests for information;
• assess whether Athena can provide a requested service;
• enter into and manage contracts;
• provide clinical advisory and professional services;
• conduct governance and assurance reviews;
• undertake serious incident, patient safety and related reviews;
• provide medicolegal and coronial support;
• prepare reports, recommendations and professional advice;
• deliver and administer education and training;
• maintain professional and client relationships;
• arrange meetings and events;
• issue invoices and maintain financial records;
• manage conflicts of interest and professional obligations;
• establish, exercise or defend legal claims;
• maintain the security and operation of our website and systems;
• improve our services; and
• contact professional or organisational clients about relevant Athena services where permitted by law.

We will not use personal information for purposes incompatible with those for which it was collected unless permitted or required by law.

‍

Contract – where processing is necessary to enter into or perform a contract with you.

Legal obligation – where processing is necessary for us to comply with a legal or regulatory obligation.

Legitimate interests – where processing is necessary for our legitimate business and professional interests, provided those interests are not overridden by your rights and interests. These may include operating Athena, managing professional relationships, responding to enquiries, protecting our systems and developing our services.

Consent – where appropriate, we may ask for your consent. Where processing relies upon consent, you may withdraw that consent at any time.

Other lawful bases permitted under applicable data protection legislation may apply in particular circumstances.

‍

Depending on the particular engagement, this may include processing necessary:

• for the establishment, exercise or defence of legal claims;
• for purposes connected with health or social care where the relevant legal requirements are met;
• for reasons of substantial public interest where a relevant statutory condition applies; or
• where another condition permitted by law is applicable.

‍

Where Athena processes special category information on behalf of a client organisation as its data processor, the client remains responsible for establishing the appropriate legal basis for that processing.

We seek to minimise the use of identifiable information and will use anonymised or pseudonymised information where appropriate and practicable.

‍

For example, information may be contained in:

• clinical records;
• incident reports;
• investigation documentation;
• witness statements;
• complaints;
• safeguarding records;
• legal correspondence;
• coronial documentation; or
• other professional records supplied for review.

We process such information only where it is relevant and necessary for the professional service being provided and subject to applicable confidentiality and data protection requirements.

Our role under data protection law will depend upon the particular engagement. Athena may act as a processor on behalf of a commissioning organisation or, for certain professional functions, may determine aspects of its processing independently.

‍

We may share information where necessary with:

• organisations commissioning Athena’s services;
• appropriately authorised individuals working for or on behalf of Athena;
• professional advisers, including legal and accounting advisers;
• secure IT, communications and document-management providers;
• insurers;
• regulators, courts, coroners or other competent authorities where required or appropriate; and
• other organisations where disclosure is required by law.

Where third parties process personal information on our behalf, we require them to handle it appropriately and securely.

‍

The level of security applied reflects the nature and sensitivity of the information concerned.

Where an engagement involves confidential clinical, safeguarding, legal or other sensitive material, appropriate arrangements for secure transfer, access and storage will be agreed as necessary.

Access to confidential information is restricted to individuals who require it for legitimate professional purposes.

Different retention periods may apply to different categories of information.

Information relating to professional engagements may be retained for an appropriate period following completion of the engagement where this is necessary for professional, legal, regulatory or insurance purposes.

When information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.

Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer complies with applicable data protection legislation, including the use of recognised safeguards where required.

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information;
• request restriction of processing;
• object to certain processing;
• request transfer of information in a portable format;
• withdraw consent where processing is based on consent; and
• object to certain forms of direct marketing.

These rights are not absolute and may be subject to exemptions or limitations under data protection law, particularly where information is processed in connection with legal proceedings, professional obligations or the rights of other individuals.

To exercise your rights, please contact us using the details above.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.

Where we use non-essential cookies, including analytics or marketing technologies, we will provide appropriate information and obtain consent where required by law.

‍

Further information may be provided through our cookie notice or cookie-management tool.

You can ask us to stop sending marketing communications at any time by using the unsubscribe mechanism provided or by contacting us directly.

We will not sell your contact information to third parties for marketing purposes.

Athena is not responsible for the privacy practices or content of those websites. We recommend reviewing the relevant privacy information when visiting third-party websites.

The current version will be published on our website and the date at the top of this page will indicate when it was last updated.

Athena Clinical Advisory Ltd
Company number: 17298031
71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom

Email: hello@athenaclinical.co.uk