Medical Skills Council Privacy Notice Relating To Excluded Students

This Privacy Policy explains how we use the personal information collected about you by UK relevant schools when you are subject to fitness to practise procedures and found unfit to practise.

This Privacy Policy supplements our other notices and privacy policies and is not intended to override them. This Privacy Policy describes:

• who is responsible for the personal information that we process about you;
• the personal information we process about you, including any personal information within the Database;
• how we will use it;
  who we may disclose it to; and
• your rights and choices in relation to your personal information.

This is to make sure you have a full picture of how we collect and use your personal information.

In this Privacy Policy where we use the words personal information, we use these words to describe information that is about you and other individuals you may tell us about and which identifies you or those individuals.

You have the right to object to our use of your personal information in certain circumstances.  A summary of your right to object (along with other rights under data protection law) and the details of who to contact if you want to exercise them can be found at paragraphs 11 and 12 below.

The majority of students are either 17, soon to be 18 or above the age of 18.  In all cases, students were previously on a course leading to a professional qualification and are now applying to join a course leading to a professional qualification.  We therefore consider, for the purposes of the UK GDPR, that applicants and students will have full capacity to understand both the nature of their application to a UK relevant school and consequences of having been subject to a previous fitness to practise procedure.

KEY TERMS

In this Privacy Policy:

• references to we, us, our or the MSC means the Medical Schools Council (a registered charity no 1155370 and a company limited by guarantee registered in England and Wales (company no 8817383));
• references to Group means any Company or entity within our corporate group including subsidiaries and affiliated entities;
• references to you, your or student means any individual who has been subject to and excluded as a result of fitness to practise procedures and subsequently made an application to a course which leads to entry to a registered profession in the UK;
• references to fitness to practise procedures means the processes, procedures and practices that UK relevant schools and universities have in place to make sure that any students who may not be fit to practise as a doctor are identified;
• references to the Database means the database operated by the MSC on behalf of UK relevant schools that contains personal data of students who have been the subject of fitness to practise procedures at a UK relevant school and subsequently excluded from that school as a result of those proceedings; and
• references to UK relevant schools includes the member schools of each of the Veterinary Schools Council, the Pharmacy Schools Council, the Pharmacy Schools Council and Physician Associates. 

Who is responsible for the personal information that we collect?
We dictate the purpose for which your personal information is used and how it is used.  This means that we are the controller of the personal information that we collect in connection with our operation of the Database. 

What personal information do we hold about you if you are on the database?
We process and use personal information about you.  This includes any information that you provide directly to us, as well as information that we obtain from third parties, including the UK relevant schools, the Veterinary Schools Council, the Dental Schools Council, the Pharmacy Schools Council, and the Physician Associates. 

The personal information we hold includes:

Information that you provide to us / we collect directly from you

The information that you provide to us / we collect, use, store and transfer from you may include the following:

Type of Personal Information	Examples
Contact details	Any phone number or email number used to contact the MSC about the Database, or social media handle used to connect with us via our social media accounts about the Database.
Online activity information (to the extent that it constitutes personal information)	Where you visit our website, we may collect the following information from you: Technical information, including the Internet Protocol (IP) address used to connect your computer to the Internet, your browser type and version, time zone setting, browser plug-in types and versions, operating system and platform. Information about your visit to our website, including the full Uniform Resource Locators (URL) clickstream to, through and from visiting our website (including date and time); page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.

This information will be provided:

• in the course of communications between you and us (including by phone, email or otherwise);
• when you visit our website;
• via our social media pages, other social media content, tools and applications; and
• when you give us feedback or contact us.

Information we receive / collect from other sources

We may receive the following personal information about you from third parties, including the UK relevant schools, the Veterinary Schools Council, the Dental Schools Council, the Pharmacy Schools Council, and the Physician Associates.

Type of Personal Information	Examples
Information included within the Database
If you are excluded from a UK relevant school as a result of a fitness to practise procedure, the UK relevant school will add information relating to your exclusion to the Database.	Name, date of birth, photograph, the UK relevant school that you attended, UCAS student ID, UK relevant school ID and confirmation that you have been excluded from a UK relevant school.
Supporting evidence provided by UK relevant schools
UK relevant schools will share supporting evidence with the MSC relating to your exclusion.  This may include an outcome letter, outcome report or fitness to practise report following the relevant fitness to practise procedure.	The supporting evidence will usually include: an explanation as to why you were excluded from a UK relevant school; health data about you where this is captured, referred to or inferred from the outcome letter itself; and details of relevant behaviour and criminal offences that have been committed by you (where applicable), together with confirmation as to why this is inconsistent with being a pharmacy student.

How do we use the personal information we collect about you?

We use your personal information for a variety of different purposes in connection with your application to a relevant pharmacy School.  The main purposes for which we use your personal information are set out below.  Under data protection law, we can only use your personal information if we have a legal basis to do so.  Examples of where we have a legal basis to process your personal information, includes when:

• we have your consent;
• it is necessary to enter into or perform a contract we have with you (or to take steps at your request prior to entering into that contract);
• it is necessary to comply with a legal obligation;
• it is necessary in order to protect your vital interests; or
• it is in our legitimate interests to process your personal information.

Data protection law provides extra protection to special categories of personal information (for example, information relating to your health or information revealing religious beliefs) and criminal offence data (for example, information about offenders or suspected offenders in the context of criminal activity or investigations).  Where we process special category personal data or criminal offence data relating to you, we need to satisfy extra conditions in addition to having a valid legal basis as set out above.  Examples of where we have a condition to process special category personal information or criminal offence data relating to you, includes when:

• we have your explicit consent;
• it is in the substantial public interest; or
• it is necessary in order to protect your vital interests.

We have set out the main purposes for using your personal information in the table below together with the applicable legal basis and, where applicable condition that we rely on for doing so.  Where we rely on our legitimate interests as a legal basis or substantial public interest as a condition, we have set out those interests in the table below. 

1.             Purpose	2.             Legal Basis
To operate the Database.	Legitimate interests: The purpose of the Database is to ensure the public is protected from harm as a result of individuals who have been the subject of fitness to practise proceedings being admitted to study on other courses that provide access to a regulated profession without the circumstances of those proceedings having been considered.  In terms of how this works in practice, UK relevant schools will search applicants who are applying to study at their school against the Database.  The UK relevant schools have all agreed to use the information contained within the Database only for the purposes of determining whether an applicant has been excluded by another UK relevant school so that it can consider this information alongside the applicant's application.
To share the supporting evidence relating to your exclusion with the relevant UK relevant school.	Legitimate interests:  If a UK relevant school's search identifies a positive response: the UK relevant school can request that we provide the supporting evidence held by the MSC in relation to that applicant; in response to such a request, the MSC will then make the relevant supporting evidence available to the relevant UK relevant school for them to download for a period of 48 hours; and once the supplementary evidence is downloaded, it is used by the relevant UK relevant school for its own purposes in connection with the consideration of the relevant application.  The above process enables the UK relevant school to consider the supporting evidence alongside the applicant's application. Protecting the public:  Where the supporting evidence includes or reveals special category personal information about you, including information about your health or religious activities, we rely on the protecting the public interest condition set out in Article 9(2)(g) of the UK GDPR and Schedule 1, Part 2, paragraph 8 of the Data Protection Act 2018.  Unlawful acts or acts of dishonesty:  Where the supporting evidence includes or reveals either (1) special category personal information about you that relates to your own unlawful acts, or acts of dishonesty, malpractice or other seriously improper conduct; or (2) criminal offence data, including details of criminal activity, allegations, investigations and proceedings, we rely on the unlawful acts or acts of dishonesty condition set out in Article 9(2)(g) of the UK GDPR and Schedule 1, Part 2, paragraph 12 of the Data Protection Act 2018.
To manage any complaints, feedback and queries you may have in relation to our administration of the Database.	Legitimate interests: We require your personal information in order to manage and respond to any such correspondence.
To comply with any legal or regulatory obligations (including in connection with a court order).	Necessary for compliance with a legal obligation to which we are subject.
To administer and protect our business and the underlying platform that we use to administer the Database (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data).	Legitimate interests: We require your personal information because it is necessary for us in relation to running our business, the provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise. Necessary to comply with a legal obligation.

Who may we disclose your personal information to?

We may share your personal information with:

• UK relevant schools;
• our business partners, service providers and sub-contractors for the performance of any contract we enter into with you (for example, our IT providers, security service providers, insurance providers and document storage providers);
• our professional advisors (including accountants, lawyers and auditors) that assist us in carrying out our business activities; and
• other companies and entities within the Group (which we are a member of).  For a list of these companies please contact us using the details below.     

For a full list of the third parties with whom your particular personal information may be shared, please contact us using the details  below. We will also disclose your personal information to other third parties, for example:

• in the event that we sell or buy any business or assets, we will disclose your personal information to the prospective seller or buyer of such business or assets;
• if we or substantially all of our assets are acquired by a third party, personal information held by us will be one of the transferred assets; and
• if we are under a duty to disclose or share your personal information in order to comply with any legal obligation.

Where will we transfer your personal information?

The MSC is based in the United Kingdom and operates the Database in the United Kingdom.  The MSC does not transfer any personal data outside of the United Kingdom and European Economic Area.

How long will we keep your personal information

We will retain your personal information for a period of 10 years following your entry being added to the Database.

DATA SECURITY

We have put in place appropriate security measures to guard against your personal information being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.  For further information about these measures, please contact us using the details below.

We have also put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Your rights

You have certain rights with respect to your personal information.  The rights will only apply in certain circumstances and are subject to certain exemptions.  Please see the table below for a summary of your rights.  Details of who to contact if you wish to exercise any of the rights set out below can be found in paragraph 12 below. 

	Summary of your rights
Right of access to your personal information	You have the right to receive a copy of your personal information that we hold about you and information about how we use it, subject to certain exemptions.
Right to rectify your personal information	You have the right to ask us to correct your personal information that we hold where it is incorrect or incomplete.
Right to erasure of your personal information	You have the right to ask that your personal information be deleted in certain circumstances.  For example: where your personal information is no longer necessary in relation to the purposes for which it was collected or otherwise used; if you withdraw your consent and there is no other legal ground for which we rely on for the continued use of your personal information; if you object to the use of your personal information (as set out below); if we have used your personal information unlawfully; or if your personal information needs to be erased to comply with a legal obligation.
Right to restrict the use of your personal information	You have the right to suspend our use of your personal information in certain circumstances.  For example: where you think your personal information is inaccurate but only for so long as is required for us to verify the accuracy of your personal information; the use of your personal information is unlawful and you oppose the erasure of your personal information and request that it is suspended instead; we no longer need your personal information, but your personal information is required by you for the establishment, exercise or defence of legal claims; or you have objected to the use of your personal information and we are verifying whether our grounds for the use of your personal information override your objection.
Right to data portability	You have the right to obtain your personal information in a structured, commonly used and machine-readable format and for it to be transferred to another organisation, where it is technically feasible. The right only applies: to personal information you provided to us; where we rely on the following legal bases: consent; or for the performance of a contract; and when the use of your personal information is carried out by automated (i.e. electronic) means.
Right to object to the use of your personal information	You have the right to object to the use of your personal information in certain circumstances and subject to certain exemptions. For example: where you have grounds relating to your particular situation and we use your personal information for our legitimate interests (or those of a third party); and if you object to the use of your personal information for direct marketing purposes.
Right to withdraw consent	You have the right to withdraw your consent at any time where we rely on consent to use your personal information.
Right to complain to the relevant data protection authority	If you think that we have processed your personal information in a manner that is not in accordance with data protection law, you can make a complaint to the Information Commissioner's Office (ICO) and they can be contacted on 0303 123 1113 or please see www.ico.org.uk.

Changes to our privacy policy

We keep our Privacy Policy under regular review. Any changes we make to this Privacy Policy in the future will be posted on this page and, where appropriate, we will give you reasonable notice of any changes.

Queries
If you have any questions regarding this Privacy Policy or the way we use your personal information, please contact us by email on the contact us page or post to Medical Schools Council, Woburn House, 20 Tavistock Square, London, WC1H 9HQ.

It is important that any personal information that we hold about you is accurate and current.  Please keep us informed if your personal information changes during your relationship with us. 

Page created: 12 May 2026