Standard Operating Procedure (SOP):Data Compliance and GDPR for COGNITION Prescribers

Purpose

This SOP outlines the data protection responsibilities of nutritional therapists acting as COGNITION Prescribers for the Food for the Brain Foundation. It ensures compliance with the UK General Data Protection Regulation (UK GDPR) and promotes secure, ethical handling of client data.

1.  Scope

This SOP applies to all nutritional therapists and practitioners who:

Recommend or prescribe the Cognitive Function Test (CFT), COGNITION programme, or finger-prick biomarker tests
Share or receive client information through Food for the Brain systems (e.g. via unique tracking URLs or referrals)

2. Your Responsibilities as a Practitioner

As a Prescriber, you are considered a Data Controller for any client data you collect, and a Data Processor when interacting with Food for the Brain platforms.

You must:

Obtain informed consent before collecting or sharing personal data
Keep all client data secure and confidential
Use secure systems (e.g., encrypted email, secure cloud platforms)
Avoid sending sensitive data via unprotected channels
Respect client rights, including the right to access, rectify, or delete data

3. Client Consent

Before sharing information or recommending COGNITION services:

Ensure clients understand:
What data is being collected
Why it is being collected
How it will be used, stored, and shared
Provide a clear privacy statement or use our approved template
Inform clients that they must register their own test kits to access personal results

4. Data Shared with Food for the Brain

Only anonymised or client-initiated data will be visible to practitioners through REDCap in the future. Your unique tracking link ensures clients are “tagged” to your account without exposing personal data.

You will not be able to view clients’ individual data unless:

The client gives written consent
They share results with you directly

5. Data Retention & Disposal

Retain personal data only as long as needed for your professional services
Securely delete data when no longer required
Use password-protected systems or encrypted storage for all digital files

6. Recordkeeping

Maintain a record of:

Client consent (verbal or written)
Any data shared with Food for the Brain
Any access to test results or data re-shared by clients

7. Breaches and Reporting

If you suspect a data breach:

Inform Food for the Brain immediately at: prescribingcognition@foodforthebrain.org
Follow the ICO guidance on breach reporting: www.ico.org.uk

8. Confirmation of Agreement

To remain an active Prescriber, you must confirm that you have read and understood this SOP by confirming you will abide by the SOP on the form you submit:

Questions?If you have questions or require further guidance on data protection or secure practices, please contact our support team at prescribingcognition@foodforthebrain.org.