How we use your personal information
This privacy notice outlines how Wolfson College (“we”, “the College”, “our” and “us”) manages and uses personal information for the purpose of providing healthcare services to our students; this includes monitoring the quality of care provided.
The controller for your personal data is Wolfson College, Barton Road, Cambridge CB3 9BB. Your primary contact for all data protection matters is the College Data Protection Lead: bursar@wolfson.cam.ac.uk This is the same address to contact if you wish to exercise any of your data protection rights, including requesting copies of personal data the College holds about you, or making a complaint about how the College has managed your personal data.
The designated Data Protection Officer appointed by the College under UK GDPR is Intercollegiate Services Limited (ISL), 64 Bridge Street, Cambridge, CB2 1UR; 01223 768745; dpo@isl.colleges.cam.ac.uk.
This statement forms part of the College’s compliance with data protection legislation in the UK.
Record retention
Health care professionals who provide you with care are required by law to maintain records about your health and any treatment or care you receive. These records help to provide you with the best possible healthcare and help to protect your safety. Your medical and welfare records will be kept for 8 years after you have left College, in line with the NHS England Records Management Code of Practice.
Details we collect about you
The records the College Nurse may hold about you include the following: your name, address and date of birth, emergency contact details, academic program, matriculation term and matriculation year. They may also contain sensitive information about your health, such as outcomes of your nursing assessment and contact you have with the College Nurse, such as appointments and consultations.
Notes, letters, reports, and emails relating to your care or about your health, details about your treatment and care, results of investigations and / or tests, and information from other health professionals are also held.
How your information is kept safe and confidential
The College Nurse is committed to protecting your privacy and will only use information collected lawfully, in accordance with applicable legislation:
- General Data Protection Regulation (EU) 2016/679 (GDPR)
- UK Data Protection Act 2018
- UK Human Rights Act 1998
- Common Law Duty of Confidentiality
The College Nurse uses electronic and paper health records. A combination of working practices and technology are used to ensure that your information is kept confidential and secure. Your records are backed up securely. The College Nurse ensures that information held is kept in secure locations protected by appropriate security and that access is restricted to the College Nurse. The external data processors used (Rushcliff) have their own security arrangements in place.
If you do not wish to have your records stored electronically, please make this request in writing to the College Nurse so that only paper health records stored in a locked filing cabinet can be kept for you instead.
The College Nurse will only ever pass on information about you, if it is reasonably believed that others involved in your care have a genuine need for it. Information will not be disclosed to any third party without your permission unless there are exceptional circumstances (such as risk of serious harm to yourself or others or where the law requires this information to be passed on).
You can object to your personal information being shared with other healthcare providers, but you should be aware that this may in some instances, affect your care, as important information about your health might not be available to healthcare staff in other organisations. If this limits the treatment that you can receive, this will be explained to at the time you object.
To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may also be used to help protect the health of the public and or other students, for instance during an outbreak of a communicable disease such as, but not limited to an outbreak of norovirus, Scarlet Fever and Meningitis. During such outbreaks, the College Nurse may consult the University Advisory Group on Communicable Diseases and or UK Health Security Agency or other statutory body.
Sharing Information in the interest of the College and the student
At the start of your time at Wolfson College, your consent will be sought to share your photo id and specific health information, if you carry an adrenalin auto injector or have a potentially serious medical condition. This information may be shared with the Porters’ Lodge and the Catering department so that during a first aid emergency you can be easily identified. You have the right not to consent, but you need to be aware that this may affect the First Aid care you receive.
Identifying Risk
Database searches are carried out at least annually to identify those affected by certain conditions and / or disabilities previously disclosed, via the electronic health questionnaire or College Nurse consultation. This is so the College Nurse can asses their condition and potential health needs whilst at Wolfson College, and provide the relevant health promotion advice.
Safeguarding
To ensure that safeguarding matters are managed appropriately, access to identifiable information will be shared in some limited circumstances where it is legally required for the safety of the individuals concerned. The College safeguarding policy and procedures will be followed.
Record retention
Your College Nurse records will be kept for 8 years after you have left College, in line with the NHS England Records Management Code of Practice 2021 recommendation for the retention of health records.
Access to your Information
You have the right to see or have a copy of your College Nurse Records, with some exceptions. You do not need to give a reason to see your data. Requests for access to your own data are made in witing. Under special circumstances, some information may be withheld. If you wish to have a copy of the information held about you, please contact the College Nurse in the first instance.
Change of details
It is important that you tell the College Nurse if any of your details, such as your name or address, have changed so that your records can be kept as accurate and up to date as possible.
Mobile telephone number
The College Nurse may use your mobile number to send you reminders about your appointments, to provide you with information or to check your condition if you are unwell. Please let the College Nurse know, if you do not wish to receive communication on your mobile.
Your rights
You have the right: to ask us for access to, rectification or erasure of your data; to restrict processing (pending correction or deletion); and to ask for the transfer of your data electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
If you have questions or concerns about your personal information, or how it is used, please speak to the Deputy Senior Tutor in the first instance. If you feel that the College has not met your expectations while handling your personal data, you have the right to make a complaint. Full details of the College’s data protection complaints procedure can be found at https://www.wolfson.cam.ac.uk/about/governance/data-protection
You retain the right at all times to lodge a complaint about our management of your personal information with the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/data-protection-complaints/
This is a live document which will be updated periodically. The most recent version will always be available on our website.
College Data Protection Lead
Last updated: June 2026
Further Information
NHS England Records management: code of practice for health and social care
Nursing & Midwifery Council The Code
Information Commissioner's Office Guide to the General Data Protection Regulation (GDPR)