Student Health and Wellbeing Service Privacy Notice

Who is collecting the information?

Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

Edinburgh College’s Wellbeing team members will usually be the only people involved in the collection of your data (however, if you are being referred to the Wellbeing Service for a counselling referral, your Learning Development Tutor (LDT) or another member of Student Experience staff may collect your data in the first instance).

Suppose you are provided with access to any additional services that may be working in partnership with Edinburgh College. In that case, the external organisation providing the service may collect further data.

Why are we collecting it, and what are we doing with it (Purpose)?

The Wellbeing Service collects different types of information for the purpose of providing wellbeing support to the students of Edinburgh College:

We collect basic information that helps us get to know you
We collect your campus, course, email address, and phone number so we can contact you and make appropriate arrangements to meet with you. It will also help the college to identify trends in access to the service.
We collect your email address to send you the Wellbeing services fortnightly newsletter, to which you have signed up to receive.
We keep a record of meetings: this will be a basic record of what has been recommended for your support, and to help with reviewing at future meetings.
We collect presenting issues related to mental health to help us guide you to the best self-management approaches and resources, and this will be done in consultation with you.
Where you participate in a session run by a partner organisation such as Penumbra, we will share your personal information, such as name and contact details, with them to enable them to contact you where appropriate.

What personal data do we collect?

Personal data

Forename and surname
Date of birth
Email address
Phone number
Course
Campus of study

Special Category Personal Data

Health (including mental health/anxiety information)
Any other sensitive information you decide to share in connection with using our service (we will not ask for it). (For example, religion, gender identity, sexual orientation, racial or ethnic origin).

How are we collecting this information? What is the source?

We collect this information directly from you when you use our service (only where you choose to supply it).

The lawful basis for the processing

The College’s lawful basis for processing (and sharing) your personal data is UK GDPR Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” and 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.” The Post-16 Education (Scotland) Act 2013, the Further and Higher Education (Scotland) Acts 1992 and 2005, and the Equality Act 2010, Part 6, Chapter 2, provide the legal framework and the duty of care the college has in delivering wellbeing support to students.

Where special category personal data is collected, the lawful basis is UK GDPR Article 9(2)(g) (“processing is necessary for reasons of substantial public interest”) and the Data Protection Act 2018 (DPA) Schedule 1, Part 2 (6) Statutory etc and government purposes.

Who we share the information with

Your data will be shared only as necessary with colleagues in the college, such as counsellors, lecturers, LDTs, Curriculum Managers and Learning Support Advisers on a need-to-know basis. In addition, data may be shared with partner organisations, such as Penumbra, a mental health support provider, if you have asked for specific support.

We may have to share your personal information if we are legally required to do so, if you, or anyone you tell us about, is at risk of harm, or if we believe there is a risk of terrorism.

How long do we hold the personal data?

Your data will be retained for two academic years after you finish your studies at Edinburgh College, and then securely disposed of in accordance with College procedures.

Individuals’ rights in relation to this processing

Under data protection law, you have a number of rights; some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing, and the College would be required to process your request within one month.

The rights that apply to this particular processing are:

Right to be Informed – i.e. a privacy notice.
Right of Access – this means you have the right to access your personal information.
Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request that your personal data be deleted.
Right to Data Portability – this means you have the right to request your information in a machine-readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
Right to Restriction – this means you can restrict the processing of your information and links with some of the other rights.
Right to Object – this means you can object to how your data is used.
Right to be informed of automated individual decision-making (including profiling) – we do not use this for OH purposes, and therefore this does not apply.

Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time, and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

Complaints to the UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance, please contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome, then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO guides on the ICO website.

You can email them at casework@ico.org.uk, call them on 0303-123-113, or you can send a letter to them at the following address:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF