University of Bath MPharm student privacy notice

This statement explains how and why the University of Plymouth collects, uses and shares your personal data and your rights in relation to that data

The University (“Plymouth” “We” or “us”) is the Data Controller of the information detailed in this document and is registered with the Information Commissioner’s Office under registration number Z7546246. Its Data Protection Officer can be contacted at dpo@plymouth.ac.uk.

The University of Bath MPharm student privacy notice covers the following

?Why do we collect your data?
@What type of data do we collect?
?When and how do we collect your data?
@How do we use your data?
?What is the lawful basis for processing personal data?
@How long do we keep your data?
?Who do we share your data with?
@What rights do you have?
?Changes to this notice

1. Why do we collect your data?

The MPharm pharmacy programme is delivered by the University of Bath on Plymouth’s campus. Plymouth therefore needs to collect and process University of Bath MPharm students’ personal data in order to provide facilities, learning and research to the University of Bath and the University of Bath MPharm students, as well as to enable the necessary function of Plymouth in order for it to comply with its statutory obligations.

2. What type of data do we collect?

The University collects a number of different types of personal data.

The following are examples of personal data (not exhaustive) which may be collected, stored and used:

name, address and contact details (including personal email address)
date of birth
dates of enrolment
exam and assessment results
predicted and final grades
next of kin/emergency contact
guardians
ethnicity
communications
gender
your image
marital and family details
complaints and disciplinary records including Fitness to Practice
visa and immigration information (including visa and passport details)
appeals
educational background
CCTV footage
bank and financial information
disability information and assessments
accommodation issues
Care Leaver status.

In certain circumstances special category personal data may be collected. These are more sensitive categories of identifying information including:

data concerning your health
your ethnicity
political opinions
trade union membership
religion or belief
genetic or biometric data
data concerning someone’s sex life or sexual orientation
criminal convictions and allegations.

Data relating to criminal convictions and allegations of criminal activity also require similar legal controls to special categories of data and are processed on the same grounds as detailed below.

3. When and how do we collect your data?

Plymouth will collect your information in different ways during its relationship with you. These will include:

information you provide directly to us during your period of study at the University of Bath including from your communications, use of University resources, services and systems and other interactions with Plymouth
we may also obtain your personal data from third parties including, for example, the University of Bath, other students, references, third party regulatory and enforcement bodies, information from your sponsor, placement provider, or from previous educational establishments.

4. How do we use your data?

Plymouth will use your personal data to administer and provide services to you and the University of Bath in relation to the MPharm Pharmacy programme and your attendance and use of the facilities on Plymouth’s campus. These may include:

administration of your financial relationship with Plymouth and any relevant funders or sponsors such as the assessment and collection of fees due to the University (for example, in relation to accommodation)
management of your use of and access to facilities and enabling participation in events, for example production of an access card, provision of IT services and accommodation
communicating with you such as in relation to campus and facilities issues
promotion of Plymouth (for example, providing information about programmes that may be of interest to you, summer schools and events hosted, co-hosted or supported by the University on and off-campus)
operation of security, disciplinary, complaint and quality assurance processes and arrangements including campus-wide CCTV images
providing you with services and support such as accommodation, access to the library and computer facilities
provision of student accommodation
support of health, safety and wellbeing requirements, production of statistics and research for internal and statutory reporting purposes
dealing with complaints or conduct matters handled under Plymouth’s policies
delivery of any programme modules on behalf of the University of Bath.

The University also processes more sensitive personal data (special category data) in the following ways:

your race, national or ethnic origin, religious, disability, philosophical or religious beliefs, health or gender and your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting
information about allegations of criminal activity or criminal convictions
information about physical or mental health or disability status to ensure your health and safety and to assess your fitness to study, travel, take part in placements, provide appropriate reasonable adjustments and where you request it, to make decisions relating to applications for extenuating circumstances
where you choose to provide the University with sensitive information about yourself for the purposes of student wellbeing support we will use this to work with you and provide the support requested
production of non-identifiable statistical data for analysis to fulfil its commitment to equality monitoring and to provide a more targeted response to improving the student experience.

5. What is the lawful basis for processing personal data?

Plymouth must have a lawful basis in order to process personal data. For the processing of University of Bath students’ data these have been identified as follows:

where it is necessary to perform any contract we have entered into with you;
where it is necessary for the performance of a task in the public interest;
where it is necessary to comply with a legal obligation; and/or
where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

Plymouth may also use your data, typically in an emergency, where this is necessary to protect your vital interests, or someone else’s vital interests as permitted by law. In a small number of cases where other lawful bases do not apply, we will process your data on the basis of your consent. Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

In relation to more sensitive personal data as listed above (special category data) the additional legal bases for these are:

where we need to carry out our legal obligations,
where you have made the data public,
where it is necessary in the substantial public interest, in particular: where necessary for the purposes of the prevention or detection of an unlawful act and must be carried out without your consent so as not to prejudice those purposes; or for equal opportunities monitoring; or regulatory requirements relating to unlawful acts and dishonesty etc.,
where it is necessary to protect your vital interests or those of another person and where you/they are physically or legally incapable of giving consent. This would be in an emergency situation where a person’s health, wellbeing or welfare was at risk,
where processing is necessary for the establishment, exercise or defence of legal claims,
where we have your consent to do so,
where it is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

Where consent is required for any additional uses of your personal information, including your image and more sensitive personal information we will collect it at the appropriate time and explain this to you. Where Plymouth is processing your data on the basis of your consent, you can withdraw your consent at any time. We will not use your personal information to carry out any wholly automated decision-making that affects you.

Should you seek support from the teams in the Student Hub (which include Disability Services and Student Wellbeing Services) they will also collect special category data from you for the purposes of providing you with their support services.

6. How long do we keep your data?

Details of the timeframes for the University to keep your personal data are available in the University's Records Retention Schedule.

7. Who do we share your data with?

Where there is a legitimate need or statutory obligations the University will disclose necessary personal data to third parties. These may include the following:

University of Bath in order to support the delivery of the MPharm programme and support students to comply with their contractual obligations and University of Bath policies while undertaking their course and in ensuring that students are held to a suitable standard expected of people training to enter the pharmacy profession. This will include situations where allegations of misconduct or potential breaches of the law, dishonesty, malpractice or serious improper conduct are raised about University of Bath students, to share information about the progress of an allegation, complaint or accusation against you or where Plymouth needs to take steps to protect you in certain circumstances where you are at risk.
To inform individuals who report an allegation or complaint about you that you are a student at the University of Bath.
Relevant Higher Education bodies (e.g. Office for Students, UK Research and Innovation, Universities and Colleges Admissions Service, Office of the Independent Adjudicator for Higher Education, the organisation(s) running the National Student Survey and other student and surveys).
Any other relevant professional or statutory regulatory bodies including GPhC and/or apprenticeship programmes integrated End Point Assessment Organisations.
To third party student accommodation providers operating under contract on behalf of the University.
On occasion and where necessary, Plymouth City Council, the police and other law enforcement agencies for the purposes of prevention or detection of crime including anti-social behaviour issues.
Where necessary the emergency services and your designated emergency contact where there is an urgent requirement to share information e.g. illness, serious injury, bereavement or the suspicion/risk of this.
University's professional advisors, solicitors, accountants, insurers and auditors and, where required, other statutory bodies acting in an audit capacity.
Third party providers providing specific services to, or on behalf of, the University under contract for the purposes of teaching, learning, research and administration.
To our supplier of banking services for the purposes of complying with anti-money laundering regulations and to agencies engaged on our behalf for the collection of unpaid debts.

Data transfers to third party countries

On occasion, the above types of sharing may involve the transfer of your personal information outside of the UK to the European Economic Area or outside of the European Economic Area such as the United States. These are carried out with appropriate safeguards in place to ensure the confidentiality and security of your personal information.

Other than as set out above, the University will not normally publish or disclose any personal information about you to other external enquirers or organisations, including parents, family members, guardians and friends unless you have requested it or consented to it, or unless it is in accordance with data protection law (e.g. in an emergency situation).

8. What rights do I have?

As a data subject you have a number of rights in relation to your personal data. You can:

access and obtain a copy of your data on request
require the University to amend incorrect or incomplete data
require the University to stop processing your data in certain circumstances, for example where the data is no longer necessary for the purposes of processing
object to the processing of your data where the University is relying only on its legitimate interests as the legal ground for processing
require us to erase your personal data in certain circumstances
require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller.

Please note that the above rights are not absolute, and the University may be entitled to refuse requests where exceptions apply.

For further information or if you wish to exercise any of these rights or if you have a complaint about the way you believe your data is being processed by the University of Plymouth, in the first instance, please see your information rights or email: dpo@plymouth.ac.uk.

If you have a complaint and you remain dissatisfied with how your complaint has been dealt with you can take your complaint to the Information Commissioner’s Office (ICO) for a review. They can be contacted at casework@ico.org.uk.

Any concerns or queries about the manner in which the University of Bath processes your personal data should be addressed directly with the University of Bath.

9. Changes to this notice

This privacy notice is reviewed annually or when required to ensure compliance with data protection legislation. If significant changes are made to this notice and the way we treat your personal information we will make this clear and may seek to communicate this directly to you.

August 2024.