1. Introduction
This privacy policy sets out how the Liverpool School of Tropical Medicine uses and protects information that you share with us.
LSTM is committed to ensuring that your privacy is protected and will only process personal data in accordance with the current data protection legislation and this privacy statement.
LSTM may amend this privacy notice from time to time and when we make any changes to the way we handle your personal data. You can view all our latest privacy notices on our website: https://www.lstmed.ac.uk/lstm-privacy-statement
2. Why do we collect your data?
As part of your application and education at LSTM we will need to collect and process information about you to provide teaching, learning and research as well as enable the necessary function of the institute to comply with its statutory obligations.
When you apply and accept an offer, you enter into a contract at LSTM and as part of this we need to use your personal information for administrative and educational purposes. Without processing your information, it will not be possible for you to continue or complete a programme of study.
It is essential that the information we hold about you is accurate and so we ask that you update your Faculty Office if you change your personal details such as your name or address.
3. What type of data do we collect?
LSTM collects a number of different types of personal data.
“Personal data” is any information relating to a living individual, and 'processing' is any activity carried out involving personal data, including holding and storing it. To process your application and, if accepted onto a course, manage the processes around award, LSTM will obtain, hold and process data pertinent to each stage of the process.
For example, at application stage we collect:
- Personal information (i.e. names, addresses, e-mail addresses, date of birth, etc.)
- Sensitive information (sexual orientation, racial and ethnic origin, biometric data, physical or mental health condition, etc.)
- Financial information
- Immigration information (for visas, UKVI)
Throughout your studies, we will hold data on your assessment marks, academic progress, and monitor your attendance.
LSTM collect special categories of data, e.g. racial and ethnic origin, religious or philosophical beliefs, biometric data and physical disability / mental health condition or learning disability, etc. This data is needed to comply with reporting requirements with the Higher Education Statistics Agency (HESA), which is now merged with the Joint Information Systems Committee (JISC) in October 2022. There will be other statutory bodies that we have to share data with and these will be included within updates to this Privacy Notice. Where possible and appropriate, data is anonymised.
Student personal data is collected and processed by LSTM as it is necessary for the performance of the contract under which we provide services to you. Some processing activities may also be carried out under a legal obligation (for example, disclosing personal data to external parties under statutory powers), where it is necessary to protect the vital interests of the student or another party (for example, disclosures to external parties, including your designated emergency contact, to ensure the safety and wellbeing of individuals), where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, including the authority of LSTM (for example, collecting or disclosing information in order to meet regulatory or statutory requirements). Where any of these legal bases do not apply, the consent of an individual to process their personal data will be sought.
Where special category data is collected and processed by LSTM, this will use an additional processing condition of explicit consent of the student, employment or social security/protection requirements, protecting the vital interests of the student or another party, the exercise or defense of a legal claim, reasons of substantial public interest, purposes of medical or health care, or where the information has been made public by the student.
Any processing will be proportionate and relate to the provision of services by LSTM. When this data is used for monitoring and reporting purposes it will be anonymised.
Only information required for the purposes of student recruitment, admission, registration, teaching and learning, examination, graduation, accommodation, student support, course evaluation and careers is collected and processed. Without it LSTM would not be able to provide its service to you.
4. Why is your information collected?
LSTM is collecting your information when you make your application to us to study via our online recruitment student information system (Salesforce). Salesforce is a US based cloud software company which is widely used worldwide and what LSTM use for their application and student/staff portals. Salesforce are registered on the US Data Privacy Framework as part of an approvals process for US companies to register to comply with standards of data protection legislation in the US that meets the adequacy requirements of EU and UK GDPR.
5. How do we collect your information?
We collect the data that you personally input into our student information system (Salesforce). Other information collected may include your references which can come to us direct, emails you have sent to us which are relevant to your application are also uploaded to your application so all information is stored in one place. You have the right to request sight of your references at any time. We may also transfer some of this information from Salesforce to our internal network systems for processing in relation to the course you are on.
LSTM have also engaged with QS QUACQUARELLI SYMONDS LIMITED to support our student recruitment campaigning for 2024. That data collection between potential students and this 3rd party will be carried out in line with a contract for data processing on our behalf and those involved will provide their consent to be contacted by QS who will ensure that the data collected will be entered onto the LSTM SIS. Find out more information on the QS Privacy Policy.
In March 2024, LSTM has installed a new finance system (Technology One) that will store your name and payment information. Find out more information on Technology One GDPR Cloud Compliance.
6. How do we use, store and protect your data?
LSTM uses student’s personal data to put in place support measures such as:
a) To contact you regarding your course, normally by email, but sometimes by telephone or postal letter. This may involve confidential matters, for example to allow our Student Support Team to discuss support for a disability you have declared,
b) To provide progress reports to sponsors (except relatives),
c) To provide references to education institutions and employers, with the consent of the student or graduate,
d) To publish of the names of graduates in the degree ceremony graduation programme,
e) To disclose information promoting LSTM, but only personally identifying you if you consent,
f) To support your academic studies and progress,
g) For the purposes of academic writing support and plagiarism prevention,
h) To supply personal and financial details to providers of financial services engaged by LSTM, for example for the payment of fees, refunds, loans and similar services,
i) To disclose information to external parties for safeguarding and duty of care purposes, for example to medical practitioners, your designated emergency contact and law enforcement agencies,
j) To produce degree certificates and transcripts,
k) To ensure graduates of LSTM can access our Alumni resources, and
l) Subject to review on a case-by-case basis, to provide contact details to third party companies and organisations formally engaged by LSTM to provide enhanced levels of service to support core activities.
The sole purpose of the information we collect is to process your application, and, if that is successful, to assist your progress through to completion of your studies. We ensure that our systems are secure, password protected and backed up regularly.
7. What is the lawful basis for processing personal data?
LSTM relies on several different legal basis depending on the processing being performed:
(Article 6(1)(a)), Consent – on specific occasions LSTM will only process certain data if you consent e.g. on registration you only need to provide certain “special categories” of data if you agree to that.
(Article 6 (1)(b)), necessary for the performance of your student contract – on many occasions LSTM will process your data to enable it to meet its commitments to you e.g. those relating to education and assessment.
(Article 6 (1)(c)), necessary to comply with a legal obligation – LSTM may have legal obligations to provide your personal data to others e.g. HESA.
(Article 6 (1)(d)), for the purpose of protecting the vital interest of yourself or another – sometimes in extreme circumstances LSTM will have to release information to protect your interests or the interests of others e.g. in medical emergencies.
(Article 6 (1)(e)), processing necessary for the performance of a task carried in the public interest – LSTM is an educational and research establishment and in particular its educational and research activity is conducted in a public interest (including your interest and the interest of others).
Article 6 (1)(f)), processing is necessary for the purposes of the legitimate interest of LSTM or a third party subject to overridden interests of the data subject – LSTM (and sometimes third parties) has a broad legitimate interest in activities that connect to the activities and education of students. Subject to those interests not being overridden by the interests of fundamental rights and freedoms of students, it will pursue those interests. A good example of this legitimate interest would be Alumni activities.
Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which it is collected.
8. Who is information shared with?
Within LSTM, access to your personal data is restricted. Only relevant personal data will be shared with teams and individuals, to enable them to deliver appropriate services. This will include:
IT Services
Technology Enhanced Learning Unit
Library
Academic and Support Staff
Data including your name, e-mail address and course enrolment data will be transferred to LSTM’s Technology Enhanced Learning systems, to provide you with access to the technologies, content and support you will use during your studies with LSTM. This will include:
Brightspace – online learning environment
Panopto – lecture capture technology
Turnitin – assessment submission, feedback management, originality checking and plagiarism prevention service
Ebsco – library catalogue and reading list system (see library privacy notice)
YouSeeU – virtual classroom tool
LSTM contracts with all our TEL systems suppliers to ensure they are obligated to act only on our instructions and in accordance with the latest data protection laws.
LSTM may disclose your personal data and special category data to external agencies to which it has obligations; for example for council tax, electoral registration, and visa and immigration purposes, and to other arms of central or local government, to the Office for Students, Higher Education Statistics Agency (HESA), Student Loans Company, NHS Bursaries, Office of the Independent Adjudicator for Higher Education, Research Councils, and potentially other such organisations for defined purposes. It may also disclose information to examining bodies, legal representatives, Police or security agencies, suppliers or service providers, survey and research organisations engaged by LSTM, and regulatory authorities. If you are in receipt of a scholarship, information may be shared such as a short student profile with donors. Disclosure of information may also be involved in our safeguarding processes such as the LSTM Prevent Strategy to prevent harm in line with the Counter-Terrorism and Security Act 2015.
If you have unpaid debts to LSTM at the end of their course, we may, at our discretion, pass this information to debt collecting agencies to pursue the debt.
LSTM requires all students to participate in its attendance monitoring system. For some student groups it is a statutory requirement that we monitor attendance (for example some international students) and there may be a requirement to report non-attendance to official bodies (e.g. UK Visas and Immigration, Student Loans Company). It also aids us in our duty of care and support provisions, as well as enabling the analysis of specific elements of service provision such as space management.
In some instances, LSTM may transfer your personal data to third parties located in other countries, including some that, like the UK where LSTM is based, are outside of the European Economic Area. Any such transfers will be strictly in relation to the delivery of LSTM’s core services, including to partner institutions abroad. IT services used by LSTM may involve the transfer or hosting of student personal data overseas. Personal data may be shared with international agents that LSTM uses for the delivery of services to overseas students. All instances of overseas transfers of personal data are subject to appropriate
technical safeguards and contractual provisions incorporating appropriate assurances to ensure the security of the data and full compliance with legislative and regulatory requirements.
Some sections of LSTM undertake processes involving applicant or student personal data that include elements of profiling. Examples are some parts of the Student Recruitment Office and Admissions Office, where these processes are employed to determine the nature of communications sent to individuals and to facilitate student recruitment and admissions procedures.
Your contact details may be passed to survey contractors to carry out the Postgraduate Taught Education Survey (PTES) and the Postgraduate Research Education Survey (PRES) by the Higher Education Academy (HEA) and surveys of student finances on behalf of some of the organisations listed in the Higher Education Statistics Agency (HESA) statement at the link below. These organisations and their contractors will use your details only for that purpose and will then delete them.
Within six months to eighteen months of graduation, LSTM may contact you to ask you to fill in the HESA ‘Graduate Outcomes’ survey. You may also be contacted as part of an audit to check that we have undertaken this survey properly.
You may also be included in longitudinal surveys of leavers in the years after you graduate. If so, we will pass your contact details to the organisation that has been contracted to carry out that survey. That organisation will use your details only for that purpose, and will then delete them.
There is no requirement for you to take part in any of these surveys but participation assists LSTM, as well as government and regulatory bodies, in performing their statutory, official and public duties. If you do not want to take part in any of these surveys please contact LSTM’s Data Protection Officer.
It is a statutory requirement for LSTM to send some of the information we hold about you to HESA (“your HESA information”). HESA is the official source of data about UK universities and higher education colleges. HESA collects, and is responsible for, the database in which your HESA information is stored. HESA is a registered charity and operates on a not-for-profit basis. HESA uses your HESA information itself for its own purposes. HESA also shares your HESA information with third parties for specified and lawful purposes. It may charge other organisations to whom it provides services and data. HESA’s use of your HESA information may include linking information from it to other data, as described in the HESA collection notice which also sets out the change of Controller to JISC. All uses of HESA information must comply with data protection law.
If you give us information about your disability status, ethnicity, sexual orientation, gender reassignment or religion these will be included in your HESA information and used to assist with monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act 2010, even when answers are ‘refused to answer’ or ‘preferred not to say’. Some other sensitive information is used to enable research into the provision of fair access to higher education, for example information as to whether you are a care leaver. If you are enrolled at a higher education provider in England regulated by the Higher Education Funding Council for England (HEFCE) your HESA information will include details of any financial support that you may receive. Your sensitive personal data/special category data will not be used to make decisions about you.
If you are registered, or supervised, at more than one institution (joint awards, partnerships), personal data will be shared between the organisations in order to facilitate your studies and to fulfil each organisations requirement for statutory reporting.
In some instances, LSTM may transfer your personal data to third parties located in other countries, including some outside of the European Economic Area. Any such transfers will be strictly in relation to the delivery of LSTM’s core services, including to partner institutions abroad. IT services used by LSTM may involve the transfer or hosting of student personal data overseas. Personal data may be shared with international agents that LSTM uses for the delivery of services to overseas students. All instances of overseas transfers of personal data are subject to appropriate technical safeguards and contractual provisions incorporating appropriate assurances to ensure the security of the data and full compliance with legislative and regulatory requirements.
For details of how we process details of your designated emergency contact, or if you wish any special exemptions to be put in place, for example regarding mental health, please contact mylstm@lstmed.ac.uk
LSTM Alumni – Once you have completed your studies, you will be invited to join our alumni association to keep in touch with LSTM news. You can opt-out, unsubscribe or change your preferences at any time.
9. Retention of data and updating your information
LSTM retain your data in line with our retention schedule, which follows JISC guidelines for Higher Education records management. You can request this information via our Data Protection Officer.
10. How will the collection of data affect you?
In certain circumstances, LSTM may monitor your usage of IT systems and access of information on its systems and networks. Any institutional monitoring or access will comply with UK legislation including the Regulation of Investigatory Powers Act 2000, Human Rights Act 1998, and the Data Protection Act 2018. Any access or monitoring will be justifiable, fair and proportionate in accordance with LSTM’s Acceptable Use of Computer and IT Facilities Policy.
11. Your rights and how to find out what information we hold about you
LSTM is the data controller for all personal data that it holds and processes, except where it is done in the capacity of a data processor on behalf of another data controller.
Individuals whose personal data and sensitive personal data/special category data is held by LSTM have the following rights regarding their data:
a) The right to request access to their personal data held by LSTM.
b) The right to have inaccurate or incomplete personal data rectified.
c) The right to erasure of personal data (also known as the right to be forgotten) – this only applies where there is no legitimate reason for LSTM to continue to process the personal data. Special category information will be removed.
d) The right to restrict the processing of personal data – individuals have the right to block the processing of their personal data by LSTM in specific situations.
e) The right to data portability – you can request some of your information (for example academic progress details) in digital form to provide it to other organisations.
f) The right to object – students can object to the processing of their personal data by LSTM in certain circumstances, including the sending and receipt of direct marketing material.
Where the processing of personal data or sensitive personal data/special category data is based on the consent of the student, they have the right to withdraw their consent at any time by contacting mylstm@lstmed.ac.uk or LSTM’s Data Protection Officer on the details below.
12. How to contact us
LSTM is a registered Data Controller with the Information Commissioner’s Office (ICO), Registration Reference Z4763134.
For further information, or to exercise any of your rights, including making a request to access your personal data, please contact:
email: dataprotection@lstmed.ac.uk
Phone: (+44) 0151 702 9323
Data Protection Officer
Liverpool School of Tropical Medicine
Pembroke Place
Liverpool
L3 5QA
United Kingdom
13. How to complain
If you are unhappy with how your personal data is being processed you may, in the first instance, complain to the Data Protection Officer using the contact details above.
If you continue to have concerns you have the right to contact the ICO:
Helpline: 0303 123 1113
Website: https://ico.org.uk/for-the-public/raising-concerns/
Privacy Policy Version Number: 4.0 Published: March 2024