Privacy statement

Our legal basis for collecting and processing personal data includes:

• Carrying out a public task in the public interest. This includes historical, statistical and research purposes.
• Carrying out duties to comply with the Equality Act 2010.
• Legitimate interests. This includes facilitating communications between MSC members and organisations involved in medical education, the higher education sector and higher education funding

The Medical Schools Council may share your information for several reasons. These include:

• Our obligations to comply with current legislation
• To comply with a court order
• The Medical Schools Council have received explicit consent from you for disclosure
• Your personal data will not be transferred outside of the European Union, to third countries or international organisations.

When you visit our website, we may store some information on your computer. This information will be in the form of a 'cookie' or similar file and can help us in many ways. With most browsers you can erase cookies from your computer hard drive, block all cookies or receive a warning before a cookie is stored.

The Medical Schools Council will retain the data for as long as it is necessary. Some data may be retained permanently for historical, statistical and research purposes, and will subject to regular review. This is in line with the General Data Protection Regulation (2018) as the information will not be used to make decisions about individuals.

The Medical Schools Council is a ‘data controller’ under the General Data Protection Regulation (2018). The Information Commissioner has been notified that we process personal data, and the details can be found on the Information Commission’s Office website.

Under data protection law you have rights in relation to your personal data, including the rights summarised below. However, please note that not all of these rights apply in each case and may be subject to applicable exceptions.

Your right of access - You have the right to ask us for copies of your personal information that is within our control and information about how we use it.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, then we will endeavour to respond to you within 1 month of receipt.

The Medical Schools Council privacy policy is regularly reviewed. Any updates to the privacy policy will be made available on this webpage.

If you have any questions or concerns about our use of your personal data, then please contact us at:

Email: admin@medschools.ac.uk

Address:

Medical Schools Council

Woburn House

20 Tavistock Square

London

WC1H 9HD

While we would always welcome the opportunity to resolve any complaints you might have in the first instance, you also have the right to complain to the Information Commissioners Office (ICO). The ICO can be contacted by telephone or in writing, using the contact information provided below.

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Every year, medical schools send some of the information held by them about clinical academic staff employed with a substantive university contract and an honorary NHS contract (you, your), to the Medical Schools Council (MSC, we, us, our).

The MSC is the data controller responsible for the database in which the personal data collected from medical schools is stored and the use of the personal data for the purposes set out in this Privacy Notice (e.g. to carry out analysis, produce aggregated statistics and publish the results of the survey containing those aggregated statistics).  The data is collected and used for legitimate and lawful purposes, including meeting the aims of the MSC. 

You have the right to object to your personal data being provided to the MSC and can exercise that right by contacting your medical school. 

We have taken steps to ensure that we comply with our obligations under applicable data protection laws (including the UK General Data Protection Regulation (UK GDPR)  and the Data Protection Act 2018) when collecting and further processing your personal data, as outlined in this Privacy Notice.

In this Privacy Notice, where we use the words personal data we use these words to describe information that is about you and which identifies you (see below for a description of the personal data that we will hold about you).

In relation to the personal data we use, we are also registered as a data controller with the Information Commissioner's Office (ICO) (registration number: ZA043047).

This Privacy Notice sets out how your personal data will be provided to us in connection with the Clinical Academic Staff Survey (the Survey), how it will be used by us and what your legal rights are.

Please note however that while we always aim to provide complete and transparent information about how we process your personal data, we reserve the right to update this notice from time to time in order to accurately reflect changed circumstances or new legal requirements. In the event that we make any changes to this Privacy Notice, where appropriate, we will give you reasonable notice of those changes.

The types of personal data we collect for purposes of the Survey include:

• Identity data: identification numbers, date of birth, nationality and gender; and
• Employment data: employment and contract information including details of Clinical Excellence Awards, salary, clinical specialty and academic grade held.

As part of the Survey, we may also collect limited amounts of “special category personal data” relating to your race or ethnic origin if this information is held by our Member (as defined below) and they are willing to provide such information to us. It is for each medical school to determine if they are permitted to share your personal data with us.

Please note that your personal data will be aggregated into statistical results and it is only this aggregated information which will be published online as part of the Survey results on our website. Whilst the aggregated information has been subject to anonymisation techniques, there is a low risk that this information may be used to identify you.  For more information on how and why your personal data is collected and how it will be processed by us for use in the Survey, please see below.

The personal data we collect is from information that you provide to your medical school(s) (our Member) or information that they otherwise hold about you and which our Members in turn provide to us.  The Member may not identify you by name when providing us with this personal data.  However, this will still constitute personal data as we may be able to identify you from that information as it is provided on an individual level. We do not collect personal data from you directly and will not obtain your personal data from any other third party sources (including publicly accessible sources).  A full list of our current Members can be found on our website.

We only collect your personal data in order to operate and administer the Survey. The main purpose for which your personal data is processed in connection with the Survey is set out below:

• Enabling national research on the clinical academic workforce;
• Monitoring trends in clinical academic staffing as a basis for partnership between the NHS and universities;
• Monitoring equality information relating to race, ethnicity and gender; and
• Promoting, maintaining and improving high quality education, research and clinical practice in the United Kingdom.

In the event that we intend to process your personal data for any purpose other than those listed above, we will notify you of that intended purpose in advance. Where this involves the provision of further privacy information as required under applicable data protection laws , then we will also provide you with that information prior to processing your data.

No decisions will be made about you, your role or status as a clinical academic as a result of information gathered as part of the Survey, whether by automated or manual means.

Under the UK GDPR, we are required to have a legal basis whenever we collect or use your personal data. Examples of where we have a legal basis to process your personal information, includes when:

• we have your consent;
• it is necessary to enter into or perform a contract we have with you (or to take steps at your request prior to entering into that contract);
• it is necessary to comply with a legal obligation;
• it is necessary in order to protect your vital interests; or
• it is in our legitimate interests to process your personal information.

For the purposes described above our legal basis for collecting and processing your personal data is that it is necessary for the purpose of pursuing legitimate interests. Those interests include the benefit to us in being able to conduct and share the results of meaningful research, but also to the wider public as taxpayers and users of national healthcare systems in terms of ensuring that there are sufficient Clinical Academics in post to carry out biomedical research.  This is important research from a public health perspective, without which it would be difficult to identify trends in Clinical Academics which could in turn lead to insufficient individuals within those roles. Such a failure would result in reduced advancement within the field of medical research, ultimately resulting in less favourable patient outcomes. In addition, the performance of statistical analysis enables equalities monitoring, assists central and local government with strategic planning, and provides Clinical Academics with greater transparency on the trends and opportunities within the sector.

We will only rely on this basis where we are confident that the interests pursued are not outweighed by the potential risks to you, taking into account the lack of available alternatives for achieving the same results. We have conducted a detailed assessment of those interests for this purpose which will be reviewed on an ongoing basis, as appropriate.

'Ethnicity' or 'race' data are the only special category data collected in the Survey for the purposes of the UK GDPR.  Where we process special category data relating to ethnicity or race, then we will do this relying on legitimate interests and the legal basis listed below.

'Ethnicity' or 'race' data is collected in the substantial public interest from an equal opportunities perspective so that MSC can identify or keep under review the existence or absence of equality of opportunity or treatment with a view to enabling or promoting equality and diversity. MSC relies on Article 9(2)(g) of the UK GDPR, the processing is in the substantial public interest, in conjunction with Paragraph 8 of Schedule 1, Part 2 of the Data Protection Act 2018. 

We will only retain your personal data for as long as is necessary in order to achieve the purposes of processing. Some data may be retained for longer periods for scientific or historical research purposes or statistical  purposes in which event technical and organisational measures will be put in place to protect that data and those measures along with the retention periods for that data will be subject to regular review.

We have implemented appropriate technical and organisational measures to protect your personal data from being accidentally lost, used, altered, disclosed or accessed in an unauthorised way. In addition, we limit access to your personal data to those employees, agents, contractors and service providers who have a business need to know.

In the event that we experience any intrusion of our information systems or otherwise suffer a breach of our data security, then we have in place specific procedures designed to deal with such a breach, including protecting the personal data within our control and, where we are legally obliged to do so, notifying you and the relevant authorities.

We may share the contents of Survey responses with third parties only to the extent this is necessary for those parties engaged to act on our behalf in providing or facilitating technical solutions or services (e.g. IT service providers) in connection with the purposes (for more information see 'Why do we collect your personal data?' above).

Otherwise, we may share your personal data with:

• The General Medical Council (GMC). We share your personal data, including any personal data we have collected about you to date in respect of the Survey, so that the GMC may link the contents of the Survey responses with other data that the GMC holds for inclusion in the UK Medical Education Database (UKMED). Your personal data will be pseudonymised before being made available in the UKMED (meaning that your identifying data (e.g. your name) will be removed before being included in the UKMED so that those who access the UKMED cannot readily identify you). The UKMED is not accessible to the general public. Those who wish to access the UKMED must pass an application process and access is limited to those who require access for research purposes. Controls are in place to restrict use of the data so that it should not be used by any individuals to: (i) identify you, (ii) reproduce the data in any form which would allow a third party to identify you, or (iii) enable you to be contacted.  Once your personal data is shared with the GMC, the GMC will be controller of your personal data and will process it in accordance with its privacy notice which can be located here: Privacy and cookies - GMC (gmc-uk.org); 
• Regulators and governmental authorities, pursuant to our obligations to comply with applicable legislation; and
• Courts and legal advisors, where necessary to comply with a court order or to bring or defend legal claims.

Your personal data will not be transferred outside of the UK, to the European Economic Area, third countries or international organisations.

Under data protection law you have rights in relation to your personal data, including the rights summarised below. However, please note that not all of these rights apply in each case and may be subject to applicable exceptions.

Your right of access - You have the right to ask us for copies of your personal information that is within our control and information about how we use it.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, then we will endeavour to respond to you within 1 month of receipt.

If you have any questions or concerns about our use of your personal data, then please contact us at:

Email: admin@medschools.ac.uk

Address:

Medical Schools Council

Woburn House

20 Tavistock Square

London

WC1H 9HD

While we would always welcome the opportunity to resolve any complaints you might have in the first instance, you also have the right to complain to the Information Commissioners Office (ICO). The ICO can be contacted by telephone or in writing, using the contact information provided below.

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Every year, medical schools send some of the information held by them about Outreach Activity applicants and attendees (you, your), to the Medical Schools Council (MSC, we, us, our).

The MSC is the data controller for the personal data collected by medical schools. MSC may also directly collect information about Outreach Activities that are we run. The use of the personal data for the purposes set out in this Privacy Notice (e.g. to carry out analysis, produce aggregated statistics and publish the results of the Activity evaluation containing those aggregated statistics).  The data is collected and used for legitimate and lawful purposes, including meeting the aims of the MSC. 

You have the right to object to your personal data being provided to the MSC and can exercise that right by contacting your medical school. 

We have taken steps to ensure that we comply with our obligations under applicable data protection laws (including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018) when collecting and further processing your personal data, as outlined in this Privacy Notice.

In this Privacy Notice, where we use the words personal data we use these words to describe information that is about you and which identifies you (see below for a description of the personal data that we will hold about you).

In relation to the personal data we use, we are also registered as a data controller with the Information Commissioner's Office (ICO) (registration number: ZA043047).

This Privacy Notice sets out how your personal data will be provided to us in connection with Outreach Activities (the Activity) that are funded through MSC and hosted by medical schools, as well as how it will be used by us and what your legal rights are.

Please note however that while we always aim to provide complete and transparent information about how we process your personal data, we reserve the right to update this notice from time to time in order to accurately reflect changed circumstances or new legal requirements. In the event that we make any changes to this Privacy Notice, where appropriate, we will give you reasonable notice of those changes.

The types of personal data we collect for purposes of the Activity include:

• First and last name, date of birth, sex, gender identity, ethnicity, home postcode, school name, disability status (yes/no), young carer status, free school meal eligibility, parental degree status, current or past local authority care status, asylum seeker or refugee status, and estranged student status.

As part of the Activity, we may also collect limited amounts of “special category personal data” relating to your race or ethnic origin, gender identity and disability if this information is held by our Member (as defined below) and they are willing to provide such information to us. It is for each medical school to determine if they are permitted to share your personal data with us.

Personal data will be aggregated into statistical results and may be published in a report or on our website. The aggregated information has been subject to anonymisation techniques, so this information can no longer be used to identify you. For more information on how and why your personal data is collected and how it will be processed by us, please see below.

The personal data we collect is from information that you provide to the medical school(s) hosting the Activity (our Member) or information that they otherwise hold about you and which our Members in turn provide to us. MSC may also directly collect information about Outreach Activities that are we run ourselves A full list of our current Members can be found on our website.

We only collect your personal data in order to operate, administer and evaluate the Activity. The main purpose for which your personal data is processed in connection with the Activity is set out below:

• Monitoring and evaluating the effectiveness and success of Outreach Activities;
• Evaluating and reporting the impact of Outreach Activities in recruiting those from underrepresented backgrounds into Medicine and other healthcare courses;
• Producing statistics, included participation numbers and outcomes; and
• Tracking future outcomes of event participants, including applications to higher education institutions.

In the event that we intend to process your personal data for any purpose other than those listed above, we will notify you of that intended purpose in advance. Where this involves the provision of further privacy information as required under applicable data protection laws, then we will also provide you with that information prior to processing your data.

While certain personal data will be used to assess eligibility for the Activity by the Activity’s host (whether by the Medical school or MSC), no decisions will be made about you as a result of information gathered as part of the evaluation and future research of the Activity, whether by automated or manual means.

Under the UK GDPR, we are required to have a legal basis whenever we collect or use your personal data. Examples of where we have a legal basis to process your personal information, includes when:

• we have your consent;
• it is necessary to enter into or perform a contract we have with you (or to take steps at your request prior to entering into that contract);
• it is necessary to comply with a legal obligation;
• it is necessary in order to protect your vital interests; or
• it is in our legitimate interests to process your personal information.

For the purposes described above our legal basis for collecting and processing your personal data is that it is necessary for the purpose of pursuing legitimate interests.

Those interests include the benefit to us in being able to conduct and share the results of meaningful research and evaluation, but also to those from disadvantaged backgrounds in terms of ensuring that outreach engagement is targeted.

This is important research, without which it would be difficult to identify whether the Activity has met its objectives and for identifying future targets. It will play an important role in monitoring and improving access to Medicine for individuals from disadvantaged backgrounds or areas of the UK where there few applicants to Medicine. Without this research, there would be less support for prospective medicine applicants from disadvantaged backgrounds, undermining efforts to build a more diverse and representative medical workforce that better reflects the community it serves.

We will only rely on this basis where we are confident that the interests pursued are not outweighed by the potential risks to you, taking into account the lack of available alternatives for achieving the same results. We have conducted a detailed assessment of those interests for this purpose which will be reviewed on an ongoing basis, as appropriate.

'Ethnicity' or 'race', ‘disability’ and ‘gender identity’ data are the only special category data collected in the Activity for the purposes of the UK GDPR.  Where we process special category data relating to ethnicity or race, disability’, and gender identity then we will do this relying on legitimate interests and the legal basis listed below.

'Ethnicity' or 'race', ‘disability’ and ‘gender identity’ data is collected in the substantial public interest from an equal opportunities perspective so that MSC can identify or keep under review the existence or absence of equality of opportunity or treatment with a view to enabling or promoting equality and diversity. MSC relies on Article 9(2)(g) of the UK GDPR, the processing is in the substantial public interest, in conjunction with Paragraph 8 of Schedule 1, Part 2 of the Data Protection Act 2018. 

We will only retain your personal data for as long as is necessary in order to achieve the purposes of processing. Some data may be retained for longer periods for scientific or historical research purposes or statistical purposes in which event technical and organisational measures will be put in place to protect that data and those measures along with the retention periods for that data will be subject to regular review.

We have implemented appropriate technical and organisational measures to protect your personal data from being accidentally lost, used, altered, disclosed or accessed in an unauthorised way. In addition, we limit access to your personal data to those employees, agents, contractors and service providers who have a business need to know.

In the event that we experience any intrusion of our information systems or otherwise suffer a breach of our data security, then we have in place specific procedures designed to deal with such a breach, including protecting the personal data within our control and, where we are legally obliged to do so, notifying you and the relevant authorities.

We may share the contents of Activity responses with third parties only to the extent this is necessary for those parties engaged to act on our behalf in providing or facilitating technical solutions or services (e.g. IT service providers) in connection with the purposes (for more information see 'Why do we collect your personal data?' above).

Otherwise, we may share your personal data with:

• Higher Education Access Tracker (HEAT). HEAT, which is managed and led by the University of Kent, is a non-profit service that enables us to securely store data and facilitates monitoring, evaluation and research. We will be using the HEAT system to receive your personal data from the Medical School hosting the Activity. Access to HEAT’s database is restricted to only HEAT members, and the system is used to monitor outreach activities preparing students for higher education and employment. In addition, HEAT will use certain shared personal data to link with HESA (Higher Education Statistics Agency) data to track whether participants of outreach activities move into Higher Education.

HESA and HEAT may share your data as detailed in their own privacy notices:

• Privacy notice for HEAT
• Privacy notice for HESA
• Regulators and governmental authorities, pursuant to our obligations to comply with applicable legislation; and
• Courts and legal advisors, where necessary to comply with a court order or to bring or defend legal claims.

Your personal data will not be transferred outside of the UK, to the European Economic Area, third countries or international organisations.

Under data protection law you have rights in relation to your personal data, including the rights summarised below. However, please note that not all of these rights apply in each case and may be subject to applicable exceptions.

Your right of access - You have the right to ask us for copies of your personal information that is within our control and information about how we use it.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, then we will endeavour to respond to you within 1 month of receipt.

If you have any questions or concerns about our use of your personal data, then please contact us at:

Email: admin@medschools.ac.uk

Address:

Medical Schools Council

Woburn House

20 Tavistock Square

London

WC1H 9HD

While we would always welcome the opportunity to resolve any complaints you might have in the first instance, you also have the right to complain to the Information Commissioners Office (ICO). The ICO can be contacted by telephone or in writing, using the contact information provided below.

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

We collect data on teachers and advisers (you, your) as a part of our Outreach and the Medical Schools Council (MSC, we, us, our) store this data for future communications.

The MSC is the data controller for the personal data collected and use of the personal data for the purposes set out in this Privacy Notice. The data is collected and used for legitimate and lawful purposes, including meeting the aims of the MSC. 

You have the right to withdrawal consent to your personal data being provided to the MSC and can exercise that right by contacting us. 

We have taken steps to ensure that we comply with our obligations under applicable data protection laws (including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018) when collecting and further processing your personal data, as outlined in this Privacy Notice.

In this Privacy Notice, where we use the words personal data we use these words to describe information that is about you and which identifies you (see below for a description of the personal data that we will hold about you).

In relation to the personal data we use, we are also registered as a data controller with the Information Commissioner's Office (ICO) (registration number: ZA043047).

This Privacy Notice sets out how your personal data will be provided to us.

Please note however that while we always aim to provide complete and transparent information about how we process your personal data, we reserve the right to update this notice from time to time in order to accurately reflect changed circumstances or new legal requirements. In the event that we make any changes to this Privacy Notice, where appropriate, we will give you reasonable notice of those changes.

We collect or use the following personal information so that we can keep you informed of outreach, access and admissions to medical and dental schools. 

• Names and contact details
• Name and address of the school, college or organisation you work for

No special category data are collected.

Under the UK GDPR, we are required to have a legal basis whenever we collect or use your personal data. Examples of where we have a legal basis to process your personal information, includes when:

• we have your consent;
• it is necessary to enter into or perform a contract we have with you (or to take steps at your request prior to entering into that contract);
• it is necessary to comply with a legal obligation;
• it is necessary in order to protect your vital interests; or
• it is in our legitimate interests to process your personal information.

For the purposes described above our legal basis for collecting and processing your personal data consent. We have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

We will only retain your personal data for as long as is necessary in order to achieve the purposes of processing. We will retain your personal data for a period of up to 5 years, after which we will request your renewed consent. If consent is not provided, your personal data will be permanently deleted.

We have implemented appropriate technical and organisational measures to protect your personal data from being accidentally lost, used, altered, disclosed or accessed in an unauthorised way. In addition, we limit access to your personal data to those employees, agents, contractors and service providers who have a business need to know.

In the event that we experience any intrusion of our information systems or otherwise suffer a breach of our data security, then we have in place specific procedures designed to deal with such a breach, including protecting the personal data within our control and, where we are legally obliged to do so, notifying you and the relevant authorities.

We may share your personal details with third parties only to the extent this is necessary for those parties engaged to act on our behalf in providing or facilitating technical solutions or services (e.g. IT service providers) in connection with the purposes (for more information see 'Why do we collect your personal data?' above).

Your personal data will not be transferred outside of the UK, to the European Economic Area, third countries or international organisations.

Under data protection law you have rights in relation to your personal data, including the rights summarised below. However, please note that not all of these rights apply in each case and may be

the right to ask us for copies of your personal information subject to applicable exceptions.

Your right of access - You have that is within our control and information about how we use it.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, then we will endeavour to respond to you within 1 month of receipt.

If you have any questions or concerns about our use of your personal data, then please contact us at:

Email: admin@medschools.ac.uk

Address:

Medical Schools Council

Woburn House

20 Tavistock Square

London

WC1H 9HD

While we would always welcome the opportunity to resolve any complaints you might have in the first instance, you also have the right to complain to the Information Commissioners Office (ICO). The ICO can be contacted by telephone or in writing, using the contact information provided below.

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk