The Hull York Medical School has adapted from the Privacy Notice of the University of York, which has granted the Hull York Medical School permission to use the notice for the purposes of the Medical School’s Report and Support Tool.
Overview
The Medical School ("we", "us", or "our") respects your privacy and is committed to protecting your personal data.
Please read this Privacy Notice carefully, as it describes how and why we collect and use personal data obtained through Report and Support, and provides you with information about your rights.
This Privacy Notice applies to personal data provided through Report and Support by individuals themselves or third parties.
What is "personal data"?
"Personal data" means any information which is about or identifies an individual. It may include a name, but also information such as date of birth, nationality and gender, which, when combined, identify an individual.
It does not include information which does not relate to an identified or identifiable individual, or to personal data rendered anonymous in such a manner that the individual is not, or is no longer, identifiable.
"Sensitive personal data" or "special category of personal data" such as information about racial or ethnic origin, political opinions, religious beliefs or other similar beliefs, trade union membership, physical or mental health and sexual life, are given a high level of protection under data protection law. Personal data relating to criminal convictions and offences are also treated as requiring additional protections.
The Medical School’s data protection obligations
Under data protection laws, the Medical School is a controller, as we determine the purposes for which, and the manner in which, any personal data is, or is likely to be, processed. This means that we are legally responsible for the personal data we collect and hold.
One of our responsibilities is to tell individuals about the different ways in which we use personal data – what information we collect (and our legal basis for doing so), why we collect it, where we collect it from and whether (and with whom) we will share it. We also need to tell people about their rights in relation to the information we hold about them. This notice provides further details about all of these issues in respect of the Report and Support tool.
About the Report and Support tool at the Medical School
The Report and Support tool at the Medical School provides a means to make a report and also seek support in respect of issues including harassment and sexual misconduct.
Reports may be made (a) on an anonymous basis, whereby no names or other information that could be used to identify the individual making the report or a third party are provided; or (b) including names and contact details.
Further detail on the data collected and how we will use that data in each of the above circumstances is set out below.
Please note that where you make a report through the Report and Support tool, the Medical School will usually disclose information to a limited number of relevant staff members on a need to know basis only.
We will not generally take steps such as investigating the report, initiating disciplinary proceedings or passing information on to third parties in order to take the report further unless: (a) you have made a named report; and (b) you agree to this action.
However, there are certain circumstances in which the Medical School may take steps such as those listed above even where: (a) an anonymous report is received (in which case action will be taken on a 'no names' basis); or (b) you have made a named report but you do not wish to take your report further. This is usually where there are concerns for your safety or another person’s safety. Please see our Duty of Care Guidance and Confidentiality Guidance for further information on this point.
How we process the report you submit
Anonymous reports
If you choose to make an anonymous report, the Report and Support tool is set up so that we do not know who has made the report and you will be instructed as part of the tool when making your report not to provide any personal data such as names or contact details relating to you or to any third parties. This means that anonymous reports should not include any information that could be reasonably used by us to identify someone.
Named reports
If you choose to make a named (rather than an anonymous report), we may collect, use, store and transfer different kinds of personal data about you.
This may include:
- Your name, contact details and other information about you (e.g. your age);
- 'Special category' personal data about you (e.g. your health, race or ethnicity, sexual orientation, etc.); and
- Detail regarding your experience of the issue you are reporting and its effect on you.
We will also process the names and other details about third parties who are involved in the issues you have chosen to report.
Purposes for which we process your personal data and the legal basis for processing
The main purposes for which we process your personal data when you make a named report are set out in more detail below.
Data protection laws require us to meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a "legal basis" for the processing. Where we process special category personal data or criminal convictions information, we are required to establish an additional legal basis for processing that data. We take our responsibilities under data protection laws extremely seriously, including meeting these conditions.
The Medical School needs to review and process reports submitted through Report and Support as described in this privacy notice and keep records of the actions it takes in relation to any person identified.
Typically, data will be processed:
- on the grounds of contractual requirements with students and staff and any applicable regulations;
- because it is necessary for the performance of a task carried out in the public interest;
- because you have given us your consent or, in the case of special category data, your explicit consent;
- to allow us to comply with our legal obligations;
- to protect your or another person’s vital interests;
- to monitor equality and diversity.
Third parties with whom we may share details from your report
This section applies to both anonymous and named reports.
NHS Partners
For the purposes of assisting with investigations e.g., where an allegation has been made against an NHS employee.
University of Hull and/or University of York
For the purposes of assisting with investigations e.g., where an allegation has been made against a Hull and/or York student or employee.
The police/social care services/local authorities/other similar bodies
There are certain circumstances in which the Medical School may provide information about the matters raised in a report, including personal data, to third parties such as the police and social care services. This may include providing personal data about you without your prior knowledge or consent.
These circumstances include:
- An allegation about behaviour by a staff member or student towards a student who is under the age of 18;
- An allegation about behaviour by a staff member or student towards an adult at risk;
- An allegation about behaviour by a staff member or student towards another staff member or student over the age of 18; or
- An allegation about behaviour by a staff member or student towards anyone else who is under the age of 18.
Courts
In the event that a report results in legal proceedings being issued, the Medical School may share personal data with the relevant courts.
Further information
Note that the list of third parties in this section is not exhaustive – data may also be shared in accordance with the privacy policies listed at section 1 above, as applicable.
Please see our separate Duty of Care Guidance for further information on the third parties with whom information may be shared in the above circumstances, including the police and/or social care services (as appropriate).
Please also see the Confidentiality Guidance for further information on the circumstances in which the Medical School may be required to share your information with third parties.
Transfers outside the European Economic Area
In certain circumstances, it is necessary to transfer your Personal Data (including Special Category Data) outside the European Economic Area. In respect of such transfers, the Medical School will comply with our obligations under Data Protection Law and ensure an adequate level of protection for all transferred data.
Information security
The Medical School takes information security extremely seriously and has implemented appropriate technical and organisational measures to protect personal data and special category data. Access to information is restricted on a need-to-know basis and security arrangements are regularly reviewed to ensure their continued suitability.
Retention periods
The Medical School will retain your data in line with legal requirements or where there is a business need. Retention time frames will be determined in line with our Records Retention Schedule.
We may retain some anonymised information in order to monitor our work in this area but you will not be identifiable from this information.
Your rights
Under the General Data Protection Regulation, you have a right of access to your data, a right to rectification, erasure (in certain circumstances), restriction, objection or portability (in certain circumstances). You also have a right to withdraw consent. If you wish to exercise any of the above rights, please email governance@hyms.ac.uk.
Automated processing
The Medical School does not use automated processing and decision making without manual intervention. This includes in relation to data received in the context of the Report and Support tool.
Who do I contact about the use of my personal information?
If you have any questions about this privacy notice or concerns about how your data is being processed, please contact the Medical School's Governance Coordinator at governance@hyms.ac.uk.
If you are unhappy with the way in which the Medical School has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern, visit the Information Commissioner's Office website.