Student Wellbeing Confidentiality and Information Sharing Policy

The purpose of this policy is to ensure that information held by the Student Wellbeing service, is managed appropriately and consistently. Student Wellbeing is a confidential service. Staff within Student Wellbeing are committed to ensuring that your personal information is protected in line with this policy and GDPR regulations.

About our student records 

Students' personal data is held within our Student Wellbeing Service record system and can be accessed by staff, within the Student Wellbeing Service, as needed to carry out their duties. The Student Wellbeing Service record system may hold information provided by the student and/or third parties.

In addition, Student Wellbeing staff have access to information held in the University student record system. Further information on how the University handles student information can be found on our website

What does consent to share mean?

The sharing of identifiable, personal information about a student can only happen with their consent, unless there are exceptional circumstances, as outlined below.

A student can request for information to be shared through the completion of a Consent to Share Form, which can be requested by email

Following consent, the Student Wellbeing Service ensures that the information is shared in line with the Consent to Share form and that it is shared securely.

Internal information sharing

Information held within the Student Wellbeing Service may be discussed within the Student Wellbeing Service for purposes of supervision and coordinating support for students.

Student Wellbeing will not share information about a student with any other University of Derby Department or College without the student’s express permission. However, where permission cannot be gained and there is a cause for concern, then limited, factual, information may still be shared.

External information sharing 

Where possible we seek to gain a student’s permission before discussing their support with any external agency.

However, there may be occasions when we recognise that a student is in a health crisis and it is in their best interest for the external sharing of information to take place, even if permission cannot be gained.

Any disclosure of confidential information will be restricted to relevant information and conveyed only to appropriate people, for appropriate reasons as below:

Information sharing and suicide prevention

The University of Derby’s practice, in relation to data sharing, is in line with the Information Sharing and Suicide Prevention Consensus Statement and recognised best practice.

The Information Sharing and Suicide Prevention Consensus Statement states that ‘practitioners should disclose relevant confidential information to an appropriate person – including family or friends – or authority to protect a vulnerable person from risk of death or serious harm.’

We work jointly with individuals who are at risk of suicide, to identify those people or services that are best placed to support and keep them safe and when beneficial we support individuals to make contact themselves or seek consent to make contact on their behalf.

We will only contact people or services, without a person's consent, when there is a significant safety concern and it is believed that this action will protect the person from risk of death or serious harm. This action will only be taken if the person will not provide consent or they are assessed as not having mental capacity to consent.

This relies on effective clinical judgement, working with each individual person, to identify the appropriate service/person, who are best situated, to protect them from risk of death or serious harm.

The decision to share data, without consent, will only be made by a qualified and registered mental health professional and this decision would be made in consultation with a second mental health professional. 

How can I access my records? 

Students’ have a right to any information stored about them. The only exception to this is if the disclosure of information would be likely to cause serious harm to physical or mental health or which would breach the confidentiality of another person. If the decision is made to withhold information a justified reason will be recorded.

If a student wishes to have access to the information stored about them or they wish us to share information with a third person they should discuss this with a member of Student Wellbeing. To request a copy of your own personal data you can contact gdpr@derby.ac.uk. Further information and time scales can be found on our website.

In some circumstances, records can only be accessed with an appropriate member of staff present.

We will not provide access to our records if requested by other parties unless directed to by a court order.

Retention of records 

All records will be retained for seven years from the end of the academic year a student had contact with the service. At the end of this time, records are deleted securely. If a student wishes to withdraw consent to their records being stored, this can be done by contacting gdpr@derby.ac.uk.

Further information on how we handle students’ information can be found here on our website