Data protection privacy notice for the Disability and Mental Health Service 2023/24

What this privacy notice is about

This is a summary of how we protect your personal data and respect your privacy. This notice is for disabled applicants, offer holders and current students who access The Disability and Mental Health Service.

Note, this privacy notice contains information in addition to the relevant applicant or student privacy notice, and should be read in conjunction with the Privacy notices – Kingston University London.

The Disability and Mental Health Service 2023/24

How we collect your information

We collect your personal data in a number of ways including:

  • directly from you
  • where you have been named as a contact by someone attending The Disability and Mental Health Service
  • from those who have referred you to the service such as medical professionals or personnel within the University
  • from other educational or employment organisations, for example, from your previous or current school, sixth form college, university or employers who may provide information about your disability related needs in relation to your studies at Kingston University

What types of information we collect

We collect the following types of personal data about you:

  • people with whom you have given us permission to communicate
  • location of attendance with the service
  • your department, your year of study, the date you first contacted us
  • dates of appointments, who we suggested you contact, people with whom we have communicated in the service of your care
  • your feedback about your experience of the service
  • information about your race or ethnicity, sexual orientation, gender where it may reveal health data
  • information about your health, including any medical condition, case notes, medication you are taking, your presenting and emerging issues / symptoms, health and sickness records.

How we use your information

We process your personal data for the following purposes:

  • to communicate / arrange meetings or appointments with you
  • to communicate with you in relation to your contact with the service
  • to help us plan services for Kingston University students in the future
  • to ensure we meet any, and all, legal obligations with regards to the service we provide to you
  • to account for our decisions and investigate complaints
  • to ensure the information we hold about you is up to date and accurate
  • to provide our services to you and as part of our work to support you. This may include coordinating with colleagues throughout the University where additional support may be needed, for example, as part of your studies or other University processes
  • to assess the impact and effectiveness of our service to you
  • to monitor student needs and trends of students registered with The Disability and Mental Health Service and across the University
  • to create a service report using pseudonymised data or anonymised data
  • to provide / share your information with others where you request us to do so such as to your Named Advocate, medical professional – or where the University deem it necessary.

What legal basis we have for processing your information

For a contract

We process some of your personal data because it is necessary for the performance of a contract with you or in order to take steps to enter into a contract. In this respect, we use your personal data to provide you with our services.

Other legal bases

We may also provide your personal data where:

  • we have your specific or, where necessary, explicit consent to do so (for example, when you use one of our wellbeing or student support services)
  • it is necessary to protect your vital interests or those of another person
  • if you express special category data about yourself during a lecture or other learning and teaching scenarios; this meets the condition for processing that it has been made public by the data subject.

Who we share your information with

For the purposes referred to in this privacy notice and relying on the legal bases for processing, we may share your personal data with others within the University and certain third parties.

Note, under usual circumstances we do not share your personal data with a third party except when it has been anonymised, where your identity has been removed or where the third party are a supplier / service to the University and suitable contracts are in place to protect your information. We require third parties to respect the security of the data and to treat it in accordance with the law and in line with how the University holds it.

Other third parties

  • non-medical suppliers who work with us to deliver University funded, or government funded (DSA) non-medical support
  • NHS trusts, NHS foundation trusts and Local Authorities for the purpose of information sharing relevant to your disability related needs and to make referrals for additional NHS or Local Authority support you may need.

Information transferred overseas

  • some of the personal data we process about you may be transferred to, and stored at, a destination outside the European Economic Area (EEA)
  • these processes include where the personal data is processed by our staff, contractors or suppliers who are based outside the EEA or who use storage facilities outside the EEA
  • in these circumstances, your personal data will only be transferred where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (for example, standard data protection contract clauses).

How long we keep your information for

We keep your personal data only as long as is necessary. For full details you can access the University retention schedule on the policies and regulations page on our website.

Data will be anonymised or securely destroyed at the end of its retention period.

Your rights

Under the GDPR and the Data Protection Act 2018, you have certain rights:

  • to access the personal data we hold about you
  • to require us to correct the personal data we hold about you
  • to require us to erase your personal data
  • to require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
  • to receive your personal data, which you provided to us, in a structured, commonly used and machine-readable format and the right to transmit that data to another controller
  • to object to any of our particular processing activities where you feel this has a disproportionate impact on your rights
  • to not be subject to a decision based solely on automated processing, including profiling, which has a legal effect on you

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

Right to withdraw consent

In the limited circumstances where consent is the only legal basis for the collection of personal information, you have the right to withdraw your consent for that specific processing at any time.

To withdraw your consent, please contact The Disability and Mental Health Service by email at Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law – which will be explained to you and as explained above.

Your responsibilities

When considering your personal data, students should ensure the information provided to the University remains accurate and up to date.

You should inform the University as soon as possible if details, such as your address, change. 

When handling other people's personal data, students are required to maintain confidentiality and abide by the GDPR principles. These responsibilities are set out in our Data Protection Policy.

Who to contact

Please contact or if you have any queries about this privacy notice or how we process your personal data.

If you then wish to exercise your rights as a data subject, please use the Data Subject Request form on our website under policies and regulations. 

If you are not satisfied, you can make a complaint to the Information Commissioner. You can find out more about your rights under data protection legislation from the Information Commissioner's Office website

Changes to this privacy notice

This privacy notice will be updated on an annual basis. If we make any significant changes in the way we treat your personal information we will make this clear on the Kingston University website or by contacting you directly.

Kingston University is the data controller of your personal data and is subject to data protection legislation, the General Data Protection Regulation (GDPR), Data Protection Act (DPA) 2018 and Privacy and Electronic Communications Regulations (PECR). We are listed on the Information Commissioner's Office (ICO) register of fee payers.

You can find privacy notices and other relevant policies on our website under policies and regulations.

Policies and regulations