What is a Privacy Notice?
A privacy notice is a statement that describes how St George’s University collects, uses, retains and discloses personal information. Personal information is any information that can be used to identify a living individual, directly or indirectly.
Please see the section ‘What personal information do we collect?’ for a description of the personal information we hold about you.
The law says that personal information should be processed fairly:
This means we are required to inform you of the following:
The UK’s data protection legislation covers the lawful processing of personal information. Please see the University’s Data Protection page for further details.
Data Protection Notification
St George’s, University of London, is the ‘Data Controller’(the organisation that determines the purposes for which and the manner in which any personal data are, or are to be, processed) under the UK data protection legislation and is registered with the Information Commissioner’s Office (ICO) under:
St George’s, University of London
London SW17 0RE
Our registration with ICO describes, very broadly, the purpose for processing personal information. This information is publicly available from:
Information Commissioner's Office
How to contact us?
If you have any questions about the privacy notice or how your personal information is used, then please contact the University’s Data Protection Officer:
Data Protection Officer: Ms Claire Morrissey
Telephone: 020 8725 0668
St George’s, University of London
London, SW17 0RE
What personal information do we collect about applicants?
The types of personal information we collect from you and from third party sources (eg UCAS, UKCAT, GAMSAT, your referees and the Student Loans Company) and use for the purposes set out below include, but are not limited to:
Names, addresses, telephone numbers, date of birth;
Responses to surveys;
Criminal convictions and offences;
Disclosure and Barring Service (DBS) and Occupational Health (OH) disclosures;
Whether you are in Local Authority Care or a Care Leaver
Some personal information is classed as “sensitive personal information”. This includes:
Your sensitive personal information will only be used for legitimate purposes. Please see the section below for more information.
How we use your personal information
We use your personal and sensitive personal information in connection with the provision of fulfilling our contractual obligations to you. In particular, your personal information may be used by us, our employees, service providers, and disclosed to third parties for the following purposes. For each of these purposes, we have set out the legal basis on which we use your personal information.
Why we need to process your personal information:
To process your application and assess your suitability as a candidate. We will keep you informed about your application and relevant activities and events. We will also prepare for the administration of loans and bursaries. Legal basis: To perform our contract with you.
To carry out money laundering and fraud checks. Legal basis: To comply with the law.
To produce statistics for reporting purposes. Legal basis: To fulfil public task/statutory responsibilities.
For research projects that aim to provide information to improve the quality of medical education both at the local and national level. Legal basis: To fulfil public task/statutory responsibilities.
If you are being sponsored by your employer we will share your applicant record with your employer where we have a contract with your employer which permits this. Legal basis: To comply with the law.
Why we need to process your sensitive personal information:
To provide you with support and services, for example, if you have declared a disability and have accepted an offer from us we will begin to assess your support needs in preparation for your registration. Legal basis: To perform our contract with you.
In case of a medical emergency Legal basis: To protect your vital interests.
To produce statistics for monitoring equal opportunities. Legal basis: For scientific and historical research or statistical purposes.
For research projects that aim to provide information to improve the quality of education both at the local and national level. Legal basis: For scientific and historical research or statistical purposes.
Protecting your interests
We may use your personal or sensitive personal information if it is necessary to protect your vital interests, such as in a medical emergency.
Criminal convictions and offences
Personal information related to criminal convictions and offences will only be used under the control of official authority or where processing is authorised by the law.
Who will we share your personal information with?
For applicants to medical courses
Research: We will share information about applicants and students which will help the GMC to conduct research into medical education, through the UK Medical Education Database (UKMED). This may include demographic data, attainment and exam data, and fitness to practise information. This information will not be used for other purposes by the GMC, will not be used to make decisions about you, and will not be published in a way which could identify you.
For all applicants
The categories of organisations we may share your personal information with include, but are not limited to:
Universities and Colleges Admissions Service (UCAS)
The Student Loan Company
The Medical Schools Council for its own research purposes
Service providers and professional advisors
The Home Office
Our Occupational Health service provider
External organisations processing information on behalf of St George’s, University of London under contract
The Skills Funding Agency
If you apply for a place in St George’s University Halls of Residence, Horton Halls, your information will be used to process your application and administer your contract.
Courses delivered in Collaboration and Partnership
Some programmes are delivered by St George’s in collaboration with other institutions: either other universities and colleges, such as Kingston University, or other types of institution such as NHS Trusts. In order to facilitate the management and delivery of these programmes and to enable easier student access to facilities we may share your personal data with these other institutions.
Where will we use your personal information?
Your personal information will not be transferred outside of the European Economic Area (EEA) unless that country or territory has an adequate level of protection for your rights and freedoms in relation to the processing of your personal information.
How long will we hold your personal information?
The University will only retain your personal information for as long as necessary. Please see our records management policies.
What are your rights to your personal information?
To exercise your rights to your personal information, please contact the university’s data protection officer: email@example.com
We are not obliged to comply with your request for erasure or fulfil your rights to your personal information in all circumstances. For example, where research requires the processing of your personal information for carrying out a task in the public interest, it may be exempt from your objections to processing. If we decide to continue using your personal information, then we will tell you why.
Accessing your personal information
You can contact us using the contact details provided in this privacy notice to find out what personal information we hold about you and how it is used, subject to certain exemptions.
Amending or correcting inaccurate personal information
If the personal information held by us are in any way inaccurate or incomplete, then you may contact us to correct the information.
Right to erasure of your personal information
You can request the University to erase your personal information if:
The processing of your personal information is no longer necessary in relation to the purposes for which they were collected or otherwise used;
The processing of your personal information is based on your consent, then you have the right to withdraw consent at any time but we will only erase the data if we have no other legal ground to hold it;
You have a legitimate objection to the way your personal information is being used;
The personal information has been used in an unlawful way; or
It is necessary to erase your personal information to comply with a legal obligation.
Restricting processing of your personal information
You may request the University to stop processing your personal information if:
You believe the information to be inaccurate and only for such period of time during which we verify the accuracy of your personal information;
The processing is unlawful and you oppose the erasure of your personal information and request that it is suspended instead;
Processing your personal information is no longer necessary for the purposes for which they were collected but the personal information is needed by you for the establishment, defence or exercise of legal rights; or
You have a legitimate objection to the way your personal information is being used and we are verifying whether our grounds for your use of the personal information override your objection.
Right of data portability
You have the right to obtain your personal information in a structured, commonly used and machine-readable format and for it to be transferred to another organisation, where it is technically feasible. This right only applies where the use of your personal information is based on consent or as part of a contract.
Objecting to the processing of your personal information
You have the right to object to the use of your personal information in certain circumstances. For example, where you have grounds relating to your particular situation and we use your personal information for our legitimate interests or for research purposes.
If you have any complaints about how we use your personal information, then please contact us. You can also lodge a complaint with the Information Commissioner’s Office.