Centre for Wellbeing privacy notice

The Centre for Wellbeing holds and processes personal data about students. The personal data we hold about you consists of 

• Name 
• Identification number (URN) 
• Date of birth 
• Contact details 
• Course details 
• Gender 
• Ethnicity 
• Health/wellbeing notes from your appointments with Centre for Wellbeing professionals 
• Completed questionnaires (CORE 10, PHQ9, GAD7) 
• Dates of appointments 
• Details of any follow up actions or referrals made 
• Relevant correspondence, emails and documents including those from 3^rd parties.  
• Consent to share forms, if any 

We only collect the data we need and keep that data up to date.   

We receive this data when you complete the Centre for Wellbeing’s registration form, ThriveWell assessment form, send in paperwork to us or you request our service in some way (for example emailing us before you start as a student).  

We also receive data such as such as your name, date of birth, contact details, gender, health details, and referral details, from third parties.  These third parties are (but not limited to)  

• Mental health services 
• Voluntary organisations  
• Medical practitioners 
• Previous education providers 
• Internal University of Surrey schools, departments and services such as Campus Safety 
• Police 
• Colleagues/peers/family members/friends 

We take our obligations for data handling very seriously and it is therefore important for you to know the lawful basis for us processing your information: 

• We process data to meet our contractual duties to you and provide you with the wellbeing services as laid out in our contract with you.   
• We also process data in the legitimate interests of the University of Surrey. These legitimate interests are determined through an assessment made by weighing our requirements against the impact of the processing on you. Our legitimate interests will never override your right to privacy and the freedoms that require the protection of your personal data. If you are interested in learning more about this legitimate interest assessment, please contact dataprotection@surrey.ac.uk.   
• We process data because you give us your consent, specifically for the purpose of providing you with counselling and/or mental health support  

We do not use the data we collect to make decisions about individuals or to analyse information at an individual level.  

The University processes personal data and special category data in accordance with data protection legislation and its own Data Protection Policy.   

We use wellbeing information to provide an efficient, expert and holistic service for the wellbeing support we give you. 

We may anonymously track activity to obtain information about the way you access our services to analyse the effectiveness of the service.   

Where collected we use special category data relating to ethnicity and disability which is shared anonymously University wide in accordance with the equality act, in addition we also share your attendance at CWB and at a statistical level to support the University's commitment to improving equality of opportunity for all students through the organisation's Access and Participation Plan. 

We monitor use of IT services to ensure adherence to the Acceptable Use Policy. 

We analyse the effectiveness of our service at an aggregate level so that no individuals are identified from the data.

We collate the responses you make to this survey so that we only use the data in a way that can’t identify individuals and do not use the individual responses you make to the survey.   

We will only share relevant items of your information where it is necessary to fulfil the purposes listed below. We will aim to do this with your consent (as set out in the Centre for Wellbeing Registration form) and in discussion with you first. Sharing will also follow professional ethical guidelines.  

Internally recipients of your personal data may include: 

• Academic and professional services staff (for example the Disability and Neurodiversity department, Campus Safety, your personal tutor) 
• Your Programme Leader, for example if your programme requires placement or work experience activities and you have a condition that impacts your practice 
• Office of Student Complaints, Appeals and Regulation (OSCAR)   

 
We do this in order to:

• Support your wellbeing and academic progress  
• To ensure your safety and the safety of others 
• Enable seamless transition of care/support/co-ordination  

We share your personal data externally with the following third parties … 

• NHS Trusts including Community Mental health Teams and hospitals that are involved in your care. 
• Other General Practitioners (GPs) or Primary Care Networks (which are groups of GP Practices). 
• Emergency Services
• Social Care Services. 
• Local Authorities. 
• Voluntary and private sector providers etc.   
• Your emergency trusted contact where there is an emergency or serious concerns raised as set out in the Trusted Contact Guidance. 

We do this in order to:

• Support and co-ordinate your wellbeing and academic progress 
• Appropriately refer into services 
• To ensure your safety and the safety of others 
• Enable seamless transition of care  

There may be occasions where we are unable to obtain your consent to share with a third party; we will only do this when required by law and/or if there is a serious risk of harm to yourself or others. In these circumstances we would do everything we reasonably could do to inform you and gain your consent and would only release information that was strictly relevant. 

We take our obligations for data handling very seriously and it is therefore important for you to know the lawful basis for us processing your information: 

• We process data to meet our contractual duties to you and provide you with the wellbeing services as laid out in our contract with you.  
• We also process data in the legitimate interests of the University of Surrey. These legitimate interests are determined through an assessment made by weighing our requirements against the impact of the processing on you. Our legitimate interests will never override your right to privacy and the freedoms that require the protection of your personal data. If you are interested in learning more about this legitimate interest assessment, please contact dataprotection@surrey.ac.uk.   
• We process data because you give us your consent, specifically for the purpose of providing you with counselling and/or mental health support.  

We do not use the data we collect to make decisions about individuals or to analyse information an individual level.  

We keep your personal data in accordance with the University’s retention schedules. This means that your data is kept for 6 + 1 years and then destroyed/deleted.   

As an individual whose data we process (a data subject), you have certain rights in relation to the processing.  You can find detailed information about your rights as a data subject on the University’s webpage.   

You have the right to: 

• Withdraw your consent for us to process your personal data by contacting Centre for Wellbeing. If you decide to do this, we will delete information such as your contact details and demographic information. However, we will need to keep the notes about your sessions together with your name for the reasons stated above 
• To ask us to confirm that your personal data is being processed and to access (i.e. have a copy) of that data as well as to be provided with supplemental information about the processing. 
• Request that we rectify any inaccuracies where the data we hold on you is inaccurate or incomplete 
• to have your data erased by us, although in certain circumstances we may not be able to do this.  The circumstances where this applies can be found in the data subject rights information on the University’s webpage 
• To restrict the processing of your personal data in certain ways 
• To obtain your personal data for reuse  
• To object to certain processing of your personal data 

To exercise any of these rights, please contact dataprotection@surrey.ac.uk.   

You also have the right to complain independently to the Information Commissioner’s Office about the way in which we process your personal data, if you are not satisfied with our response to your concerns.