ATU Student Counselling Service

ATU Student Health & Wellbeing Student Privacy Notice

General

When you engage the ATU Student Counselling Service (SCS) and/or the ATU Student Health Service (SHS), your personal information will be gathered and used in the process of providing a service. This is called your personal data and will include your name, address, date of birth, background history, medical and/or mental health history etc

When you provide this information to the SCS or SHS for the purposes of providing counselling or health services, the SCS and/or SHS will act as a data controller in respect of that personal data which essentially means it will be responsible for how that personal data is processed and stored.

Your personal data will not be processed by SCS or SHS for any purpose other than the provision of the Services.

Due to the sensitive nature of your personal health data it is defined as “special category data” under data protection legislation.

On what basis is your personal data is processed?

The legal bases for processing your personal data and special category data are Article 6(1) and Article 9 of the GDPR and Sections 51, 52, 53 & 54 of the Data Protection Act 2018. For more details see the paragraph Further Information below.

Who will have access to your personal data?

Your privacy is protected by the SCS and SHS and the Services are provided on a confidential basis.

With regards to the SCS, the counsellor, the head of student health, wellbeing & counselling and the may health & wellbeing administrator may process your personal data in the course of the provision of the Services. This is undertaken on the basis of their employment contracts with ATU which requires that a duty of confidentiality is maintained by each party at all times both to the counsellor and the student. In addition, Health & Wellbeing Administrators sign an additional confidentiality agreement. Professional Counsellors, Psychotherapists and Psychologists are ethically bound to maintain client privacy and confidentiality as per the Code of Ethics of their respective registering bodies (e.g. PSI, IACP etc).

With regards to the SHS, the nursing team, medical team and the student health & wellbeing administrator may process your personal data in the course of the provision of the Services. This is undertaken on the basis of either their employment contracts with ATU or the medical services agreement which requires that a duty of confidentiality is maintained by each party at all times. In addition, Health & Wellbeing Administrators sign an additional confidentiality agreement. Nurses and medical doctors are ethically bound to maintain patient privacy and confidentiality as per the Code of Ethics of their respective registering bodies (e.g. INMB, IMO etc).

Where will your personal data be stored?

With regard to the SCS your data will be stored on the CoreNet Electronic Case Management System. With regard to the SHS your data will be stored on the Socrates Practice Management system.

Sharing Non-personal data – Student Counselling Service

The student counselling service will seek your specific consent to share anonymised information with Irish National Student Counselling Services database which is managed by researchers in University College Dublin. The information is sent once annually based on the collated information from all students who consent to sharing their information.

In terms of the processing of other non-personal data, please note that counsellors may discuss a sample of their caseload with an external clinical supervisor, but this is done without disclosing the identities of the students concerned.

Furthermore, anonymised information may be processed for statistical and research purposes such as to provide information regarding usage levels of the service in annual reports, etc. but you will not be identifiable by this data.

Sharing your personal information with others

The counsellor, nurse or GP may share your information if you were to be referred onto another service for assessment or treatment, e.g. HSE services or your own GP, but this would be discussed with you in advance and your specific consent sought for this purpose.

In exceptional circumstances, it may be necessary to share your personal information without your consent for example:-

– Where your counsellor, nurse or SHS GP is concerned that you are at immediate risk of serious harm to yourself or others; or

– Where there is a legal requirement to share information for e.g. if you make a disclosure regarding a child at risk.

In these circumstances, your counsellor will make every effort to discuss the situation with you but that may not always be possible. In such circumstances, the minimum amount of information would be shared, e.g. name, contact details and the nature of the current concern.

How long will we retain your personal data?

Your personal data will be retained for up to eight years by the SCS and SHS and in some exceptional circumstances, may be retained for longer where we believe we have a justifiable basis for doing so for e.g. if a child protection referral has been made to TUSLA.

Your rights in relation to your personal data

Under data protection law, you have a number of rights in relation to your personal data which can be generally summarised as follows:-

– The right to rectify data processed by the SCS and/or SHS ;

– The right to erasure of data processed by the SCS /SHS i.e. the right to be forgotten;

– The right to restrict and/or object to the processing of data processed by the SCS/SHS;

– The right to data portability; and

– The right to a copy of the personal data processed by the SCS /SHS i.e. the right to make a data access request.

Please note that in certain limited circumstances we may have a lawful basis for not complying with your request however, we will discuss this with you further should the need arise.

International Transfers

The SCS will not process your personal data outside of European Economic Area (“EEA”). In the unlikely event that we are required to transfer your personal data outside of the EEA, we confirm that such processing will be carried out in accordance with our legal obligations under the General Data Protection Regulation (GDPR) (EU) 2016/679.

Further information

For any further information or in the event you wish to raise any concerns in respect of the processing of your personal data by the SCS/SHS, please contact maura.finnegan@atu.ie

Where you believe that your personal data has not been fairly or lawfully processed or where you have any other issue with how the SCS/SHS processes your personal data, please contact dataprotection@atu.ie. Alternatively, you have a right to make a complaint directly to the Data Protection Commission at info@dataprotection.ie