What is a Privacy Notice?
A privacy notice is a statement that describes how City St George’s University collects, uses, retains and discloses personal information. Personal information is any information that can be used to identify a living individual, directly or indirectly.
Please see the section ‘What personal information do we collect?’ for a description of the personal information we hold about you.
The law says that personal information should be processed fairly:
This means we are required to inform you of the following:
The UK’s data protection legislation covers the lawful processing of personal information. Please see the University’s Data Protection page for further details.
Data Protection Notification
City St George’s, University of London, is the ‘Data Controller’ (the organisation that determines the purposes for which and the manner in which any personal data are, or are to be, processed) under the UK data protection legislation and is registered with the Information Commissioner’s Office (ICO) under:
City St George’s, University of London
Northampton Square,
London,
EC1V 0HB
Our registration with ICO describes, very broadly, the purpose for processing personal information. This information is publicly available from:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
How to contact us?
If you have any questions about the privacy notice or how your personal information is used, then please contact the University’s Data Protection Officer:
Email: dataprotection@sgul.ac.uk
Telephone: 020 8725 0668
Address:
City St George’s, University of London
Cranmer Terrace
London, SW17 0RE
What personal information do we collect?
The types of personal information we collect from you and use for the purposes set out below include, but are not limited to:
-
Names, addresses, telephone numbers, date of birth;
-
Family details;
-
Financial details;
-
Registers of attendance a University and on placements;
-
Assessment scores and outcomes;
-
Your disciplinary record, any Fitness to Practice/Study or complaints processes you have been concerned in;
-
Photographs, voice recordings, video images recorded through CCTV;
-
Responses to surveys;
-
Criminal convictions and offences;
-
Disclosure and Barring Service (DBS) and Occupational Health (OH) disclosures;
-
Whether you are in Local Authority Care or a Care Leaver
Some personal information is classed as “sensitive personal information”. This includes:
Your sensitive personal information will only be used for legitimate purposes. Please see the section on ‘How do we use your personal information’ for more information.
How we use your personal information
We use your personal and sensitive personal information in connection with the provision of fulfilling our contractual obligations to you. In particular, your personal information may be used by us, our employees, service providers, and disclosed to third parties for the following purposes. For each of these purposes, we have set out the legal basis on which we use your personal information.
Why we need to process your personal information:
-
To provide you with education and training and support services, including administration of student loans. Legal basis: To perform our contract with you.
-
To carry out money laundering and fraud checks. Legal basis: To comply with the law.
-
To produce statistics for reporting purposes. Legal basis: To fulfil public task/statutory responsibilities.
-
For research projects that aim to provide information to improve the quality of medical education both at the local and national level. Legal basis: To fulfil public task/statutory responsibilities.
-
We share your data with some external organisations, including the Higher Education Statistics Agency (HESA), Professional Bodies, the Health and Care Professions Council. Legal basis: To comply with the law, to protect your vital interests and/or to fulfil public task/statutory responsibilities.
-
If you are sponsored by your employer we will share your attendance, achievement and disciplinary record with your employer where we have a contract with your employer which permits this. Legal basis: To comply with the law.
-
To administer Fitness to Study/Practice, appeals, complaints and disciplinary procedures. Legal basis: To perform our contract with you and to fulfil public task/statutory responsibilities.
Why we need to process your sensitive personal information:
-
To provide you with support and services. Legal basis: To perform our contract with you.
-
In case of a medical emergency Legal basis: To protect your vital interests.
-
To produce statistics for monitoring equal opportunities. Legal basis: For scientific and historical research or statistical purposes.
-
For research projects that aim to provide information to improve the quality of medical education both at the local and national level. Legal basis: For scientific and historical research or statistical purposes.
-
We share your data with some external organisations, including the Higher Education Statistics Agency (HESA). Legal basis: To comply with the law, to protect your vital interests, to fulfil public task/statutory responsibilities and/or for scientific and historical research or statistical purposes.
Protecting your interests
We may use your personal or sensitive personal information if it is necessary to protect your vital interests, such as in a medical emergency.
Criminal convictions and offences
Personal information related to criminal convictions and offences will only be used under the control of official authority or where processing is authorised by the law.
Who will we share your personal information with?
For students on our professionally accredited courses
We will share your data with your relevant professional body:
-
Registration: we will share your name, contact details and personal data including age, disability and ethnicity with the accrediting body if requested.
-
Graduation: we will share a list of students who completed their award with the accrediting body.
-
Graduation: we will share a list of graduating students with the Health and Care Professions Council. We may also be required to share and disciplinary or conduct issues which you have been subject to during your studies.
For students enrolled on medical courses
We will share data with the General Medical Council (GMC), the regulator for medical education. We will share your information with the GMC to register you after graduation to practise medicine. We will also share your information with the GMC in order to assist it in its statutory functions. This will include:
-
Registration: In your final year we will share information with the GMC to grant you provisional registration. This may include information about Fitness to Practise incidents which the university investigated while you were a student.
-
Research: We will share information about applicants and students which will help the GMC to conduct research into medical education, through the UK Medical Education Database (UKMED). This may include demographic data, attainment and exam data, and fitness to practise information. This information will not be used for other purposes by the GMC, will not be used to make decisions about you, and will not be published in a way which could identify you.
We will also share your data with the UK Foundation Programme Office (UKFPO), when specifically required for compliance with legislation, regulations and processes connected with post-graduation training. A list of MBBS graduates are provided to the Medical Protection Society (MPS), Wesleyan Medical Sickness, and the Medical Defence Union (MDU) which send congratulatory letters and badges to successful students.
For all students
The categories of organisations we may share your personal information with include, but are not limited to:
-
Statutory and Professional bodies, such as:
- The Higher Education Statistics Authority (HESA)
- The General Medical Council (GMC), The Nursing and Midwifery Council
- Universities and Colleges Admissions Service (UCAS)
- The Office for Students (OfS)
- The Student Loan Company
- The Health and Care Professions Council (HCPC)
- The Royal College of Occupational Therapists (RCOT)
- The Institute of Biomedical Science (IBMS)
- The Registration Council of Clinical Physiologists (RCCP)
- The Chartered Society of Physiotherapy
- The College of Radiographers
-
Employers, Placement providers and other educational providers
-
The Medical Schools Council for its own research purposes
-
Service providers and professional advisors, eg Occupational Health Service and Careers Service providers
-
The Home Office
-
External organisations processing information on behalf of City St George’s, University of London under contract
-
Debt collection agencies working on behalf the University
-
Transport for London to confirm the status of your registration for discounted travel
-
The Skills Funding Agency
Higher Education Statistics Agency
Some information held about you will be sent to the Higher Education Statistics Agency (HESA). This forms your HESA record, which contains mainly coded information including ethnicity, disability and other personal data. Your record, or parts of it, will be passed to those of the following bodies that require it to carry out their statutory functions in relation to the funding of education:
-
Department for Business, Innovation and Skills (BIS)
-
National Assembly for Wales (NAW),
-
Scottish Government (SG),
-
Department for Employment and
-
Learning, Northern Ireland (DEL(NI)),
-
Office for Students (OfS)
-
Higher Education Funding Council for Wales (HEFCW),
-
Scottish Funding Council (SFC),
-
Training and Development Agency for Schools (TDA),
-
Department of Health (DH),
-
Research Council (RCs).
The data in your record will be used in anonymised form, primarily for statistical analysis, by HESA and the above bodies. This use may result in the publication and release of data to other approved users, which may include academic researchers and commercial bodies. Your record will not be used by HESA or any of the above bodies in a way that would affect you individually.
You may wish to note that your contact details will not be made available to HESA and that precautions are taken to minimise the risk of identification of individuals from the published and released data. None of the above bodies will be able to use the data provided to HESA in order to contact you, with the exception of the National Student Survey and the Student Income and Expenditure Survey, further details of which are set out below. When you qualify, further data about you will be collected and information on how this will be used will be provided at that time.
The HESA Student Data Collection Notice can be found here.
Under UK data protection legislation you have the right to a copy of the data held about you by HESA. If you have any concerns about, or objections to, the use of data for these purposes please contact HESA, or by writing to:
95 Promenade, Cheltenham, GL50 1HZ.
Horton Halls
Where a student applies for a place in City St George’s University Halls of Residence, Horton Halls, your information will be used to process your application and administer your contract.
UKCAT (UK Clinical Aptitude Test)
As part of UKCAT process to validate and improve the UK Clinical Aptitude Test, medical and dental institutions are required to provide information as year on year overall performance, and outcome on the course of their medical and dental students. You may wish to note that your contact details will not be made available to UKCAT. Under data protection legislation you have the right to a copy of the data held about you by UKCAT.
Courses delivered in Collaboration and Partnership
Some programmes are delivered by City St George’s in collaboration with other institutions: either other universities and colleges, such as Kingston University, or other types of institution such as NHS Trusts. In order to facilitate the management and delivery of these programmes and to enable easier student access to facilities we may share your personal data with these other institutions.
Turnitin
The University makes use of the Turnitin® UK system to help assessors check students' work for improper citation and potential plagiarism. Students may therefore be required to provide a limited amount of personal data, for instance name, email address and course details and submissions, to Turnitin® when using the service. The Turnitin data is stored on servers in the US, under a 'safe harbour agreement'. This means the data will be managed to similar standards as required by UK data protection legislation. See for more information Turnitin's Privacy Policy.
National Student Survey
As part of the national arrangements for providing information on higher education for potential students, a national student survey will be conducted. The survey will be conducted by the Office for Students (OfS) or by an agency appointed by the Funding Council.
City St George’s will be required to pass on to the OfS or its appointed agent, details about some students (mostly final year students), including contact address, telephone number and email address. The OfS’s agent may contact you directly, using this information, in order that you can take part in a survey to provide feedback about the quality of your programme of study at St. George’s. The OfS may share this information with the Department of Health for NHS-funded students.
University of London Student Union
Data will also be provided to the Student Union, under a data sharing agreement, to facilitate the election of Union executives. These will include student number, name and course details. The University will share your details with the Student Union following your registration unless you object to the provision of this information to the Students’ Union which you can do at registration.
Voter Registration
Data will be provided to London Borough Councils to facilitate students' ability to vote in local and national elections. This will include name and contact information of students eligible to vote in UK elections. Data will be provided to council voter registration offices only.
Where will we use your personal information?
Your personal information will not be transferred outside of the European Economic Area (EEA) unless that country or territory has an adequate level of protection for your rights and freedoms in relation to the processing of your personal information.
How long will we hold your personal information?
The University will only retain your personal information for as long as necessary. Please see our records management policies.
What are the rights to your personal information?
To exercise your rights to your personal information, please contact the university’s data protection officer: dataprotection@sgul.ac.uk
We are not obliged to comply with your request for erasure or fulfil your rights to your personal information in all circumstances. For example, where research requires the processing of your personal information for carrying out a task in the public interest, it may be exempt from your objections to processing. If we decide to continue using your personal information, then we will tell you why.
Accessing your personal information
You can contact us using the contact details provided in this privacy notice to find out what personal information we hold about you and how it is used, subject to certain exemptions.
Amending or correcting inaccurate personal information
If the personal information held by us are in any way inaccurate or incomplete, then you may contact us to correct the information.
Right to erasure of your personal information
You can request the University to erase your personal information if:
-
The processing of your personal information is no longer necessary in relation to the purposes for which they were collected or otherwise used;
-
The processing of your personal information is based on your consent, then you have the right to withdraw consent at any time but we will only erase the data if we have no other legal ground to hold it;
-
You have a legitimate objection to the way your personal information is being used;
-
The personal information has been used in an unlawful way; or
-
It is necessary to erase your personal information to comply with a legal obligation.
Restricting processing of your personal information
You may request the University to stop processing your personal information if:
-
You believe the information to be inaccurate and only for such period of time during which we verify the accuracy of your personal information;
-
The processing is unlawful and you oppose the erasure of your personal information and request that it is suspended instead;
-
Processing your personal information is no longer necessary for the purposes for which they were collected but the personal information is needed by you for the establishment, defence or exercise of legal rights; or
-
You have a legitimate objection to the way your personal information is being used and we are verifying whether our grounds for your use of the personal information override your objection.
Right of data portability
You have the right to obtain your personal information in a structured, commonly used and machine-readable format and for it to be transferred to another organisation, where it is technically feasible. This right only applies where the use of your personal information is based on consent or as part of a contract.
Objecting to the processing of your personal information
You have the right to object to the use of your personal information in certain circumstances. For example, where you have grounds relating to your particular situation and we use your personal information for our legitimate interests or for research purposes.
Complaints
If you have any complaints about how we use your personal information, then please contact us. You can also lodge a complaint with the Information Commissioner’s Office.
Changes to our privacy policy
Any changes to our privacy policy will be posted on the City St George’s website, and where appropriate notified to you by email.