Privacy notice for disability and mental health service users

We collect your personal data in a number of ways including:

• directly from you
• from you via your UCAS application and OSIS record
• where you have been named as a contact by someone attending The Disability and Mental Health Service
• from those who have referred you to the service such as medical professionals or personnel within the University
• from other educational or employment organisations, for example, from your previous or current school, sixth form college, university or employers who may provide information about your disability related needs in relation to your studies at Kingston University

We collect the following types of personal data about you:

• people with whom you have given us permission to communicate
• location of attendance with the service
• your department, your year of study, the date you first contacted us
• dates of appointments, who we suggested you contact, people with whom we have communicated in the service of your care
• your feedback about your experience of the service
• information about your race or ethnicity, sexual orientation, gender where it may reveal health data
• information about your health, including any medical condition, case notes, medication you are taking, your presenting and emerging issues / symptoms, health and sickness records.

We process your personal data for the following purposes:

• to communicate / arrange meetings or appointments with you
• to communicate with you in relation to your contact with the service
• to help us plan services for Kingston University students in the future
• to ensure we meet any, and all, legal obligations with regards to the service we provide to you
• to account for our decisions and investigate complaints
• to ensure the information we hold about you is up to date and accurate
• to provide our services to you and as part of our work to support you. This may include coordinating with colleagues throughout the University where additional support may be needed, for example, as part of your studies or other University processes
• to assess the impact and effectiveness of our service to you
• to monitor student needs and trends of students registered with The Disability and Mental Health Service and across the University
• to create a service report using pseudonymised data or anonymised data
• to provide / share your information with others where you request us to do so such as to your Named Advocate, medical professional – or where the University deem it necessary.

For a contract

We process some of your personal data because it is necessary for the performance of a contract with you or in order to take steps to enter into a contract. In this respect, we use your personal data to provide you with our services.

Other legal bases

We may also process your personal data where:

• we have your specific or, where necessary, explicit consent to do so (for example, when you use one of our wellbeing or student support services)
• it is necessary to protect your vital interests or those of another person

Special category data

Where we process special category data, including health data, we do so under the condition of substantial public interest - support for individuals with a particular disability or medical condition.

For the purposes referred to in this privacy notice and relying on the legal bases for processing, we may share your personal data with others within the University and certain third parties.

Note, under usual circumstances we do not share your personal data with a third party except when it has been anonymised, where your identity has been removed or where the third party are a supplier / service to the University and suitable contracts are in place to protect your information. We require third parties to respect the security of the data and to treat it in accordance with the law and in line with how the University holds it.

Third parties

We may share some of your personal data with:

• non-medical suppliers who work with us to deliver University funded, or government funded (DSA) non-medical support
• NHS trusts, NHS foundation trusts and Local Authorities for the purpose of information sharing relevant to your disability related needs and to make referrals for additional NHS or Local Authority support you may need
• Placement providers, if there are requirements for disclosure of personal data (you will be informed if this applies to you)

Information transferred overseas

Some of the personal data we process about you may be transferred to, and stored at, a destination outside the European Economic Area (EEA).

These processes include where the personal data is processed by our staff, contractors or suppliers who are based outside the EEA or who use storage facilities outside the EEA.

In these circumstances, your personal data will only be transferred where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (for example, standard data protection contract clauses).

We keep your personal data only as long as is necessary. For full details you can access the University retention schedule on the policies and regulations page on our website.

Data will be anonymised or securely destroyed at the end of its retention period.

Under the GDPR and the Data Protection Act 2018, you have certain rights:

• to access the personal data we hold about you
• to require us to correct the personal data we hold about you
• to require us to erase your personal data
• to require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
• to receive your personal data, which you provided to us, in a structured, commonly used and machine-readable format and the right to transmit that data to another controller
• to object to any of our particular processing activities where you feel this has a disproportionate impact on your rights
• to not be subject to a decision based solely on automated processing, including profiling, which has a legal effect on you

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

Right to withdraw consent

In the limited circumstances where consent is the only legal basis for the collection of personal information, you have the right to withdraw your consent for that specific processing at any time.

To withdraw your consent, please contact The Disability and Mental Health Service by email at disability@kingston.ac.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law – which will be explained to you and as explained above.

When considering your personal data, students should ensure the information provided to the University remains accurate and up to date.

You should inform the University as soon as possible if details, such as your address, change. 

When handling other people's personal data, students are required to maintain confidentiality and abide by the GDPR principles. These responsibilities are set out in our Data Protection Policy.

Please contact dataprotection@kingston.ac.uk or disability@kingston.ac.uk if you have any queries about this privacy notice or how we process your personal data.

If you then wish to exercise your rights as a data subject, please use the Data Subject Request form on our website under policies and regulations. 

If you are not satisfied, you can make a complaint to the Information Commissioner. You can find out more about your rights under data protection legislation from the Information Commissioner's Office website