Privacy notice for disability and mental health service users

We collect your personal data in a number of ways including:

• directly from you
• from you via your UCAS application, direct University application and OSIS record
• where you have been named as a contact by someone registered with The Disability and Mental Health Service
• from those who have referred you to the service such as medical or diagnostic professionals, external support teams or personnel within the University
• from other educational or employment organisations, for example, from your previous or current school, sixth form college, university or employers who may provide information about your disability related needs in relation to your studies at Kingston University
• from your funding body e.g. Student Finance England where you have given them consent to share information on your Disabled Students Allowance (DSA) application and associated support
• where named persons or next of kin e.g. family have shared information on your behalf with your consent

We collect the following types of personal data about you:

• people with whom you have given us permission to communicate with
• location of engagement with the service
• your department, course, year of study, the date you first contacted us
• interactions with the service e.g. emails, phone calls etc along with details of support signposting and information provided
• any attempts that we have made as a service to engage you in support
• people with whom we have communicated with in the service of your care
• your feedback about your experience of the service
• information about your race or ethnicity, sexual orientation, gender where it may reveal health data
• information about your health, including any medical condition, case notes, medication you are taking, your presenting and emerging issues / symptoms, health and sickness records
• dates and notes of appointments in order to refer to this for effectively supporting you
• information about external support that you are in receipt of, e.g. Disabled Student Allowances (DSA) in order to assist you with setting up these support provisions and to liaise with external bodies on your behalf where required e.g. your funding body or support providers.

We process your personal data for the following purposes:

• to communicate / arrange meetings or appointments with you
• to communicate with you in relation to your engagement with the service
• to help us plan services for Kingston University students in the future
• to ensure we meet any, and all, legal obligations with regards to the service we provide to you
• to account for our decisions and investigate complaints
• to ensure the information we hold about you is up to date and accurate
• to provide our services to you and as part of our work to support you under our Equality Act (2010) duty for providing Reasonable Adjustments. This may include coordinating with colleagues throughout the University where additional support may be needed, for example, as part of your studies or other University processes
• to refer you for external support (with your written consent) where appropriate
• to assess the impact and effectiveness of our service to you
• to monitor student needs and trends of students registered with The Disability and Mental Health Service and across the University
• to create a service report using pseudonymised data or anonymised data
• to provide / share your information with others where you request us to do so such as to your Named Trusted Contact, medical professional or external support providers – or where the University deem it necessary e.g. should you or another person be in immediate risk of harm.

Legal obligation

We process your information in order to meet our Equality Act (2010) duty in the making of Reasonable Adjustments.

For a contract

We process some of your personal data because it is necessary for the performance of a contract with you or in order to take steps to enter into a contract. In this respect, we use your personal data to provide you with our services.

Other legal bases

We may also process your personal data where:

• we have your specific or, where necessary, explicit consent to do so (for example, to share your information with student support services).

Special category data

Where we process special category data, including health data, we do so under the condition of substantial public interest – support for individuals with a particular disability or medical condition, or where we have your explicit consent to do so.

For the purposes referred to in this privacy notice and relying on the legal bases for processing, we may share your personal data with others within the University and certain third parties.

Note, under usual circumstances we do not share your personal data with a third party except when it has been anonymised, where your identity has been removed or where the third party are a supplier / service to the University and suitable contracts are in place to protect your information. We require third parties to respect the security of the data and to treat it in accordance with the law and in line with how the University holds it.

Where personal data is shared with internal parties outside of the Disability and Mental Health Service or external third parties, this will only be carried out on the receipt of explicit written consent from the owner of the data. 

Third parties

We may share some of your personal data with the following providing written consent is given to the Disability and Mental Health Service:

• non-medical suppliers who work with us to deliver University funded, or government funded (DSA) non-medical support
• NHS trusts, NHS foundation trusts and Local Authorities for the purpose of information sharing relevant to your disability related needs and to make referrals for additional NHS or Local Authority support you may need
• Placement providers, if there are requirements for disclosure of personal data (you will be informed if this applies to you)

Information transferred overseas

Some of the personal data we process about you may be transferred to, and stored at, a destination outside the European Economic Area (EEA).

These processes include where the personal data is processed by our staff, contractors or suppliers who are based outside the EEA or who use storage facilities outside the EEA.

In these circumstances, your personal data will only be transferred where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (for example, standard data protection contract clauses).

We keep your personal data only as long as is necessary. For full details you can access the University retention schedule on the policies and regulations page on our website.

Data will be anonymised or securely destroyed at the end of its retention period.

Under the GDPR and the Data Protection Act 2018, you have certain rights:

• to access the personal data we hold about you
• to require us to correct the personal data we hold about you
• to require us to erase your personal data
• to require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
• to receive your personal data, which you provided to us, in a structured, commonly used and machine-readable format and the right to transmit that data to another controller
• to object to any of our particular processing activities where you feel this has a disproportionate impact on your rights
• to not be subject to a decision based solely on automated processing, including profiling, which has a legal effect on you

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

Right to withdraw consent

In the limited circumstances where consent is the only legal basis for the collection of personal information, you have the right to withdraw your consent for that specific processing at any time.

To withdraw your consent, please contact The Disability and Mental Health Service by emailing the Disability and Mental Health Service Manager at [email protected]. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law – which will be explained to you and as explained above.

When considering your personal data, students should ensure the information provided to the University remains accurate and up to date.

You should inform the University as soon as possible if details, such as your address, change. 

When handling other people's personal data, students are required to maintain confidentiality and abide by the GDPR principles. These responsibilities are set out in our Data Protection Policy on our website under Policies and procedures.

Please contact [email protected] or [email protected] if you have any queries about this privacy notice or how we process your personal data.

If you then wish to exercise your rights as a data subject, please use the Data Subject Request form on our website under policies and regulations. 

If you are not satisfied, you can make a complaint to the Information Commissioner. You can find out more about your rights under data protection legislation from the Information Commissioner's Office website.