Who are we?
The Institute for Healthy Urban Living at the University of Westminster offers unparalleled opportunities for innovation and collaboration aimed at sustainable and socially integrated advancements in urban health and wellbeing, globally. With a solid foundation in established research and education, the Institute unites twelve schools and over 100 research groups across the Arts, Sciences, Built Environment and Business to focus on addressing urban health challenges in the UK and worldwide. The diverse cultural and ethnic makeup of the University staff and students provide much sought after opportunities for unique problem solving capability.
It’s a City Thing
Strategically located in central London, the Institute leverages its physical and digital resources to facilitate both local and global partnerships. This unique positioning allows for practicable and collaborative research and knowledge exchange. At a city level, we aim to impact the design and development of urban environments, supporting a regenerative and bio-aware approach. Our wish to link with active community groups across large cities will underpin our route to impact. At the personal level, the Institute engages city dwellers directly, offering individual health assessments, treatments, and the dissemination of critical health and wellbeing knowledge.
Our Approach
The Institute builds on traditional interdisciplinary working to add a novel “Industry on the Inside” approach to all activity. We engage non-academic stakeholders in project genesis, design and delivery on an equal footing with academic stakeholders. By embedding both industry and community citizens within our framework, we both form and strengthen connections between academia, industry and the community, bringing a truly transdisciplinary approach. This way of working naturally fosters novel and innovative methodologies, along with partnerships that target interventions where they are most needed. Most importantly, this ensures maximum impact and a tangible difference to real people.
Privacy Notice – Institute for Healthy Urban Living (IHUL)
Data Controller: University of Westminster (Institute for Healthy Urban Living)
Address: 115 New Cavendish St, London W1W 6UW, United Kingdom
ICO Registration Number: Z8450604
Data Protection Contact: Annalise Johns, Associate Director, IHUL
Email: IHUL@westminster.ac.uk
Version Date: 11 November 2025
1. Introduction
At the Institute for Healthy Urban Living (IHUL), part of the University of Westminster, we collect and process your personal information to provide safe and effective fitness and health assessments. We take your privacy seriously, comply with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, and never sell your data.
This Privacy Notice explains what data we collect, why we collect it, how it is used, and your rights regarding that information.
2. The Personal Data We Collect
We collect two categories of data from you: General Personal Data and Special Category Data (Health Data).
| Category | Data Type | Purpose of Collection |
| General Personal Data | Full name, email address, phone number, age, booking details, payment records | To manage your bookings, communicate session updates, and fulfil our contractual obligations to you. |
| Special Category Data (Health Data) | Questionnaire responses on physical activity level, general health, injuries, and symptoms | To assess your fitness safely, identify risks, and enable practitioners to design a personalised programme. |
We may also collect usage or booking data through our online systems to improve service delivery. We only collect the minimum information necessary to deliver our services safely.
We do not use your health data for marketing, profiling, or automated decision-making.
3. Lawful Basis for Processing (UK GDPR)
We must satisfy two legal tests under the UK GDPR: one for general data (Article 6) and one for health data (Article 9).
A. General Personal Data (Article 6)
Lawful Basis: Contract (Article 6(1)(b))
Explanation: We process your personal data to fulfil our contractual obligations to you as a client of IHUL. Without this data, we could not provide our services.
B. Special Category Data (Article 9)
Condition: Provision of Health or Social Care (Article 9(2)(h))
Explanation: Health data is processed only where necessary for the provision of care or assessment by trained professionals bound by confidentiality.
4. Data Sharing and Confidentiality
Internal Sharing: Your data is shared within IHUL with staff directly involved in your care (e.g., personal trainers, physiotherapists) on a strict need-to-know basis. All staff are trained in data protection and confidentiality.
Third Parties: We do not share your data externally except:
- When required by law (e.g., HMRC, police), or
- With your explicit written consent (e.g., to share information with your external physiotherapist).
We may use trusted third-party data processors to host booking or communication systems. These providers are contractually bound to process data only under our instructions and maintain appropriate security.
International Transfers: We do not transfer your personal data outside the UK. If this changes, we will ensure compliance through adequacy decisions or approved safeguards.
5. Your Rights
Under UK GDPR, you have several rights concerning your personal data:
| Your Right | Summary |
| Right to be Informed | You have the right to know how we use your data (this Privacy Notice fulfils that requirement). |
| Right of Access (Subject Access Request) | You can request a copy of all the data we hold about you. |
| Right to Rectification | You can ask us to correct any inaccurate or incomplete data. |
| Right to Erasure | You may request deletion of your personal data, subject to legal retention requirements. |
| Right to Restrict Processing | You may request that we limit how your data is used. |
| Right to Object | You may object to certain forms of processing. |
| Right to Data Portability | You can request your data in a machine-readable format or ask us to transfer it to another provider. |
| Right to Lodge a Complaint | You may raise concerns with the University’s Data Protection Officer or the Information Commissioner’s Office (www.ico.org.uk). |
To exercise any of these rights, please contact: IHUL@westminster.ac.uk.
6. Data Security
We apply heightened security to protect your data, including:
- Access Control: Only authorised staff may access your records.
- Digital Security: Data stored on encrypted servers with multi-factor authentication.
- Physical Security: Paper records stored in locked cabinets within secure areas.
- Staff Training: Annual data protection and confidentiality training.
- Incident Response: In the event of a data breach, we will follow the University’s Data Breach Procedure and notify affected individuals and the ICO where required.
7. Data Retention
We retain your personal data only as long as necessary for its purpose and to meet legal or regulatory obligations.
| Data Type | Retention Period | Rationale |
| Training & Health Records | 7 years from the end of your contract or last session | Industry best practice for continuity of care and legal defensibility. |
| Financial/Transactional Data | 6 years from the end of the financial year | Required by UK tax law (HMRC). |
| Marketing Consent Records | Retained while consent is active + 1 year after withdrawal | To evidence compliance with consent requirements. |
After these periods, data is securely deleted or destroyed in line with University data handling policy.
8. Contact and Complaints
If you have questions or concerns about how your data is used, please contact IHUL in the first instance at IHUL@westminster.ac.uk.
You may also contact the University’s Data Protection Officer or lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.
Last Updated: 11 November 2025