THE CITY COLLEGE OF ACUPUNCTURE PRIVACY NOTICE FOR PATIENTS

 

When you supply your personal details to our clinics they are stored and processed for four reasons (the words in bold are the relevant terms used in the Data protection Act 2018, which includes the General Data Protection Regulation – ie the law):

​

1. We need to collect personal information about your health in order to provide you with the best possible treatment. Your requesting treatment and our agreement to provide that care constitutes a contract. You can, of course, refuse to provide the information, but if you were to do that we would not be able to provide treatment.

2. We have a “Legitimate Interest” in collecting that information, because without it we couldn’t do our job effectively and safely.

3. It is important that we can contact you in order to confirm your appointments with us or to update you on matters related to your medical care. This again constitutes “Legitimate Interest”, but this time it is your legitimate interest.

4. Provided we have your consent, we may occasionally send you general health information in the form of articles, advice or newsletters. You may withdraw this consent at any time – just let us know by any convenient method.

​

We have a legal obligation to retain your records for eight years after your most recent appointment (or age 25, if this is longer), but after this period you can ask us to delete your records if you wish. Otherwise, we will retain your records indefinitely in order that we can provide you with the best possible care should you need to see us at some future date.

​

Your records are stored on paper, in locked filing cabinets, and our clinic and offices are always locked and alarmed out of working hours.

​

Your contact details are also stored electronically on the City College’s hard-drive. Access to this data is password protected, backed up regularly, and the offices are locked and alarmed out of working hours.

​

We will never share your data with anyone who does not need access without your written consent. Only the following people/agencies will have routine access to your data:

​

• Your student and staff practitioner(s) in order that they can provide you with treatment

• Our reception staff, because they organise our practitioners’ diaries, and coordinate appointments and reminders (but they do not have access to your medical history or sensitive personal information)

​

We may contact you from time to time to keep you informed of current treatment availability and clinic hours.

​

You have the right to see what personal data of yours we hold, and you can also ask us to correct any factual errors. Provided the legal minimum period has elapsed, you can also ask us to erase your records.

​

We want you to be absolutely confident that we are treating your personal data responsibly, and that we are doing everything we can to make sure that the only people who can access that data have a genuine need to do so.

​

Of course, if you feel that we are mishandling your personal data in some way, you have the right to complain. The City College’s Data Protection Officer (DPO) is the Principal. Should you have any concerns about your personal data held by The City College, please contact the DPO by email via:privacy@citycollege.ac.uk

​

​

Privacy notice for current, former and prospective students 

​

1: Introduction 

​

Here at The City College of Acupuncture we are committed to respecting and protecting your privacy and personal information. ‘Personal information’ means any information which relates to or identifies you as an individual.

​

The City College of Acupuncture (CCA) is a trading name of Inter-Ed UK Ltd. Inter-Ed UK Ltd is a data controller in terms of the Data Protection Act 1998 and the General Data Protection Regulations (GDPR) which comes into effect on the 25th May 2018. Inter-Ed UK Ltd is registered with the Information Commissioners Office (ICO) with the registration number Z2115272.

​

CCA is a college of Higher Education based in the UK that delivers a range of programmes to UK and EU students. This privacy notice explains how CCA collects, uses, and shares your personal data, and your rights in relation to your personal data that CCA holds. This privacy notice concerns CCA’s processing of personal data for its current, former and prospective students.

​

2: How does The City College of Acupuncture collect your information?

​

Information about you will be collected by CCA in a number of ways:

​

• When you apply or register to study at CCA we will collect data to allow us to administer your studies, including through your application form. If you have applied through an agent they will share your information with us

• If you express an interest in CCA we will ask you to provide us with some information so we can communicate with you effectively

• In various other ways during the course of your studies, for example, when you interact with CCA administration department

• CCA may, at times, ask third parties for information about you, such as your previous place of learning or an employer.

​

3: What type of information does The City College of Acupuncture collect?

​

CCA may collect the following types of personal data about you:

​

• Your name and contact information such as address, email address and telephone number, as well as your date of birth and your passport number, country of domicile and nationality, and emergency contact details

• Information relating to your education and employment history, including where you have studied and your examination results, and where you have worked

• Information relating to assessment of your work, details of assignments, meetings with tutors and other staff, attendance records, and other information in your student record

• Sensitive personal data or special category data, including information required by Higher Education Statistics Agency: o Disability o Ethnicity o Gender Identity o Religion or belief o Sexual orientation.

​

4: How does The City College of Acupuncture use your information?  

​

CCA will process your personal information for a range of contractual, statutory or public interest purposes, including the following to:

​

• deliver and administer your education, record the details of your studies (including any work experience with external organisations), and determine/ confirm your academic achievements (eg. results, prizes)

• administer the financial aspects of your relationship with us and any funders, including the Student Loans Company

• deliver facilities to you (eg. IT, libraries, careers)

• provide student support services (eg. council tax reduction eligibility, opening a bank account, discount travel card eligibility, employability opportunities and use of the National Careers Service, or providing learning support)

• carry out legal duties, providing information to others (eg. local councils, Transport for London, or the Student Loans Company)

• enable your participation at events (eg. functions, ‘graduation’)

• communicate effectively with you by post, email, phone, and other electronic media, including the distribution of any relevant newsletters and circulars

• operate security (including CCTV), governance, disciplinary (including academic misconduct), complaint, audit and quality assurance processes and arrangements

• support your training, medical, safety, welfare and religious requirements as appropriate

• compile statistics and conduct research for internal and statutory reporting purposes

• fulfil and monitor our responsibilities under equalities, immigration and public safety legislation

• provide other activities within CCA’s business, including developing and maintaining our relationship with former students

• enable us to contact others in the event of an emergency (we will assume that you have checked with the individuals before you supply their contact details to us).

​

5: What is the legal basis for processing your information? 

 

The legal basis for processing your data is necessary for:

​

• Article 6 (1)(b): the performance of our contractual obligations with you (eg. to manage your student experience and welfare while studying)

• Article 6 (1)(c): compliance with legal obligations (eg. providing your information to Higher Education Statistics Agency)

• Article 6 (1)(d): the purpose protecting the vital interest of yourself or another (eg. in a medical emergency)

• Article 6 (1)(f): the pursuit of the legitimate interests of the college or an external organisation (eg. contact with former students or to enable your access to external services such as discounted travel from Transport for London) unless there is a good reason to protect your personal data which overrides those legitimate interests

• Article 9(2)(j): processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interestof the data subject [NB. Article 9(2)(j) relates specifically to the sensitive personal data or special category data that is collected and processed – see section 3 above].

​

The City College of Acupuncture does not share your information with any third party beyond the legitimate purposes referred to in this section. If we require your consent for any specific use of your personal information, we will collect it at the appropriate time and you can withdraw this at any time.

​

6: With whom might The City College of Acupuncture share your information?

​

Where necessary, CCA might share relevant items of your personal data with those outside the institution as set out below:

​

• The Higher Education Statistics Agency (see HESA’s statement about the uses made by them of your personal information published at: https://www.hesa.ac.uk/about/regulation/data–protection/notices)

• Your funders and/ or sponsors (eg. the Student Loans Company – this does not include third parties who may be paying for your studies but with whom no formal contract exists)

• Awarding Bodies that validate the qualifications studied, including External Examiners, Standards Verifiers, Academic Management Reviewers, and Test Inspectors

• Professional bodies (e.g. Health and Care Professions Council or the Nursing and Midwifery Council) for the purposes of confirming your qualifications and the accreditation of your course

• Work experience providers or other educational partners involved where this is necessary for the purposes of your study

• Relevant Government Departments (eg. Department for Education, Home Office, Foreign and Commonwealth Office, Department of Health)

• Relevant executive agencies or non-departmental public bodies (eg. UK Visas and Immigration, HM Revenue and Customs, the Health and Safety Executive)

• Relevant Higher Education bodies (eg. The Office for Students (OfS), the Office of the Independent Adjudicator (OIS), the Quality Assurance Agency (QAA), and the National Student Survey)

• Potential employers or providers of education whom you have approached for the purposes of confirming your qualifications or providing a reference

• Local authorities, (eg. for the purpose of validating your eligibility for Council Tax reduction)

• Transport for London for the purpose of validating your eligibility for discounted travel costs

• UK Agencies with duties relating to the prevention and detection of crime, apprehension and prosecution of offenders, collection of a tax or duty, or safeguarding national security. This may include, for example, Benefit or Tax Inspectors, the Police, or UK Visas and Immigration (UKVI), as necessary, and with consideration of your rights and freedoms.

​

CCA also employs the services of various suppliers and agents as data processers.  In each case your information will only be shared with these third parties in accordance with the data protection principles.

 

7: Data retention 

​

CCA retains personal information it collects from you where there is an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).  

​

When there is no ongoing legitimate business need to process your personal information, CCA will either delete or anonymise it.

Records are generally kept for a period of six years before being deleted or anonymised. However, some identifiable records (e.g. core records about when a student studied or the qualification achieved) justifiably need to be retained in the very long-term for ‘active’ purposes (e.g. the provision of references).

​

8: Your rights in relation to the data The City College of Acupuncture holds about you You have rights to your personal data held by CCA as set out in the GDPR.  These include:

​

• Rights to access your personal data to be provided by CCA within one calendar month.This is known as a Subject Access Request (Article 15) and details include: A description of your data, The Recipients of your data, A copy of your data

• Rights to rectification and erasure. You have the right to correct any inaccurate personal data held by CCA. Once information CCA has collected is no longer necessary for the purpose for which it was collected and processed, you sometimes have the right to have your data erased

• Rights to restriction of processing:

  • You sometimes have the right to restrict the processing of your personal data or object to the processing of your data

  • If you wish to withdraw consent for the processing of your personal data or otherwise restrict or object to the processing of your personal data, please contact the college Principal

• Rights to data portability. You have the right to receive the personal data CCA holds about you in a structured, commonly used and machine-readable format, and have the right to transmit that data to another controller without hindrance from CCA.

​

9: Will this privacy notice be changed?

 

CCA reserves the right to amend this privacy notice from time-to-time if deemed necessary, for example to remain compliant with UK law. If this happens, CCA will post notice of the change on its website and you will be deemed to have accepted such changes.

 

CCA encourages you to periodically review this notice to be informed of how the institution is protecting your privacy.

 

10: Who is The City College of Acupuncture’s Data Protection Officer?

​

CCA’s Data Protection Officer (DPO) is the Principal. Should you have any concerns about your personal data held by CCA, please contact the DPO by email using privacy@citycollege.ac.uk