Skip to main content

BU Privacy Notice: Student personal data relating to Covid-19 vaccination, testing & self-isolation

In the context of the pandemic, BU may need to carry out additional processing of your information for the purposes of public health and to safeguard vulnerable people.

This notice only relates to processing of information by BU: it does not cover processing which may be undertaken by third parties such as accommodation providers or Chartwells, our catering providers, except for the sharing of information between accommodation providers and BU as described below.

Disclosure to NHS Test and Trace and public health authorities

BU expects students to comply with their individual responsibilities under the NHS Test and Trace process, as set out here

We will disclose information about you to the NHS Test and Trace service and/or public health authorities if they request it or have told us that they require it for the purposes of the test and trace process to help minimise transmission of Covid-19. This disclosure would usually be limited to your name, contact phone number, any information we’ve recorded about your presence on BU premises (please see below for details of when we may record this information) and details of your accommodation arrangements if you are living in accommodation which was booked through the BU Accommodation Portal (see further for details of data sharing between accommodation providers and BU).

We need to disclose information to NHS Test and Trace and/or public health authorities if:

  • Someone who has reported Covid-19 symptoms or tested positive for Covid-19 has indicated to NHS Test and Trace that they may recently have been in close contact with you at BU. The person may have identified you individually but not have your contact details, or they may have provided information that they were at BU but not known the names of all the people present in the location at the same time; or
  • BU has notified public health authorities that there have been multiple Covid-19 infections at BU (as we’re required to do under government guidance).

Disclosed information will be used by NHS Test and Trace to contact you if they think you need to self-isolate, and to enable public health authorities to assess and manage any possibility of a local outbreak of Covid-19.

Covid vaccination status: students undertaking mandatory placements in health and social care settings (from November 2021 onwards)

In November 2021 the government announced that there would be a legal requirement for personnel undertaking activity in NHS and Social Care settings to have received their Covid 19 Vaccinations by 01.04.2022.  This requirement applies to students undertaking placements as part of university courses leading to registration in the health and social care professions:  if by 01.04.2022 students on these courses are not able to provide the required evidence either of full vaccination or medical exemption from vaccination they will not be able to undertake placement activity in these settings.

BU therefore needs to support placement providers by providing required information and assurance about every student’s vaccine status: this is required to enable BU to plan and manage placements and meet the information and assurance requirements of placement providers.

For these purposes BU is collecting and holding information about the type and date of the vaccinations received by relevant students and will need to share such information with placement providers.  Some providers only require an assurance that each student is “fully vaccinated” in accordance with the new requirements, whereas others may require details as to the date(s) of vaccination and type of vaccine. 

BU also needs to collect, hold and share information about students’ medical exemptions from vaccination.  This is necessary for the same purposes, and to enable BU, its occupational health services provider and placement providers to undertake appropriate risk assessments of and in connection with medically exempt students before making placement arrangements for them.

The Faculty of Health and Social Sciences is providing students affected by these requirements with guidance on steps to take and further information about processing of their information.   

Covid-19 home test kits 2021

The Department of Health and Social Care (DHSC) has asked universities to support distribution of home test kits to staff and students. BU is working closely with AUB in managing this exercise to support both sets of staff and students.

Prior to 1 September 2021

For health and safety reasons, DHSC needs to be able to trace the end user of a home test kit. To enable this BU is obliged, under its arrangements with DHSC, to set-up and keep a log of those issued with home test kits. This log will cover your first name, surname and contact telephone number, linked to the particular test kit.

The information will be collected by BU staff, or others on BU’s behalf – such as AUB or agency staff, acting as a processor for DHSC.

This information will only be passed to DHSC if they request to see it for health and safety reasons, such as a batch recall, adverse incident investigation or providing a safety notice. BU will not use the information other than to respond to a DHSC request. BU will not hold this information for longer than 12 months after the test kit is provided.

A DSHC privacy notice specific to this processing will be displayed at the point of collection.

As of September 2021

BU, is no longer required to record your name, surname and contract telephone number. BU is still required to provide any assistance reasonably requested by DHSC to identify the location of any testing kits impacted by a product recall. Any existing logs currently held by BU in relation to testing prior to September 2021 will be retained, in accordance with the existing agreements with the DHSC, but for no longer than 12 months from the date on which the relevant data is collected, unless DHSC instructs BU to delete or destroy those logs.

Asymptomatic testing (January – June 2021)

At the request of the government BU is participating in the national asymptomatic testing of students on your return to university after the 2020 Christmas holiday period, which will take place over January and February 2021.  BU’s processing of your personal data for these purposes is limited to the processing required to make arrangements for the testing and to notify you of appointment times and of any changes to appointments or arrangements. For this testing period if you wish to take a test we are asking you to make an individual test appointment through Eventbrite (click here to book)and you will need to provide your name, faculty, course and BU email address.  This data will be deleted after the end of the testing period and will not be used for any purpose other than booking and managing your appointment and communicating with you about it.  

All other processing of personal data for the purposes of this testing is carried out by NHS Test and Trace on behalf of the NHS and the Department for Health & Social Care.  

On arrival at the BU test facility we will need to check that you are a BU student: you will be asked to show your student card or, if you do not have it with you, provide your name so that we can check the student records system and confirm your status as a student and your appointment details.  However we will not make any record of your attendance or of the personal details we see at this point.

After your status has been confirmed you will be provided with a test kit and card and asked to register with the NHS Test portal. You will be notified directly by the NHS of your test result via SMS or to the email you provide when you register with the NHS portal. The University will not have access to any of the registration data you put into the portal and will not see your test results.  The portal and the systems used for tracking and communicating test results are managed by NHS Test and Trace and the Department for Health and Social Care.  Information about how they process your personal data can be found here

If you test positive for Covid-19 in this process, please contact AskBU in the same way as for any other positive test (see below).

Data sharing between accommodation providers and BU

This paragraph relates to BU’s accommodation partners i.e. companies who have a contract with BU for the provision of accommodation and whose accommodation can be booked by BU students through BU’s accommodation portal.  Where a student living in their accommodation notifies the accommodation provider that they have tested positive for  Covid-19, these accommodation providers will share this information with BU.  BU (rather than the accommodation provider) will then share this information with NHS Test & Trace/public health authorities as described in the section above.  This avoids duplication of reporting to public health authorities, which could cause confusion, and supports Test & Trace/public health authorities in making quick and fully informed assessments of the infection control situation at BU and any additional steps required to control public health risks.  This data sharing is covered by existing data sharing agreements between BU and these accommodation providers, which provide for appropriate management of personal data in compliance with the data protection legislation.

Aside from this data sharing, processing of personal data of students in connection with Covid-19 by accommodation providers (whether or not they are BU accommodation partners) is not covered by this notice.  The accommodation providers will separately notify their student residents about how they process this information.

Use of the Library and other campus facilities

Specific legal requirements in relation to Test and Trace apply where you use certain facilities on campus (if and when they are available), such as BU’s library facilities, the SportBU gym and the prayer room within the Faith and Reflection centre, or where you take part in certain activities such as team sports.

You will need to provide information about yourself in order to book a library study space or use of a library computer during the day and when ordering a library book for collection. As well as using this information to manage your booking, unless you ask us not to BU will also hold it for the purposes of the NHS Test and Trace process. Similar arrangements apply to your use of the SportBU gym and participation in team sports activities, including both training sessions and any fixtures.  If you are using library or study facilities in the Bournemouth Gateway Building during the evening period, we ask you to check in with your student card using the card-reader at the entrance to the library area. This collection and processing of your information is necessary to comply with the legal requirements which apply to specific services and facilities, as explained here:

You may be asked to book and/or provide contact details in order to use other campus facilities as well, including the prayer room in the Faith and Reflection centre: this will be notified to you appropriately in advance or when you are entering the facilities.

Information recorded in this way will be used for Test and Trace purposes as described in the previous section, e.g. if somebody who tests positive for Covid-19 tells NHS Test and Trace that they were in the library shortly before or after they started to experience Covid-19 symptoms. NHS Test and Trace will work with BU to ensure that appropriate action is taken to manage risks to staff and other users of the relevant facilities. We may contact you for these purposes, and on request from NHS Test and Trace we will disclose to them the information in your booking and the mobile phone number in your student record, so that they can contact you if they think it is necessary. We will keep information for these purposes only for 21 days after the date of your use of facilities.

If you don’t want us to use booking information for these purposes, you need to tell us either by email in advance ( or by telling a member of staff when you arrive at the relevant place/activity.  For evening use of the BGB library, if you don’t want us to hold your data for Test and Trace purposes then you should not check in with your student card as described above

Managing information within BU: self-isolation and positive Covid-19 test results

We ask you to contact AskBU to let us know if:

  • You test positive for Covid-19
  • You need to self-isolate or quarantine for any reason under the terms of government guidance.

We will use this information to:

  • Consider your welfare and ensure you can access support you need to manage your health and wellbeing (further information about support available in these circumstances is on the BU website:
  • Ensure you are appropriately supported to manage any impact on your studies
  • Identify any steps we should take to help ensure a safe environment for staff and other students. These might include additional cleaning, further risk assessment of particular activities and notifying students and/or staff that they have been in contact with someone who has tested positive.

BU Student Services has published information about how students and staff should manage self-isolation.

For these purposes, if you notify us that you have tested positive for Covid-19 and/or you are self-isolating or in quarantine for Covid-19 purposes:

  • We will inform your Faculty programme support team. They will process this information in the same way as any other notification of a health-related or personal matter which may affect your studies and may contact you to offer support and discuss how to manage the impact;
  • If we have any concerns about your welfare as a result of your notification, we will pass your details to the Student Support and Engagement Team within Student Services. They will contact you to offer appropriate support; and
  • If you are in BU portfolio accommodation, we may share your information with your accommodation provider (although we will also ask you to notify the accommodation provider direct) so that they are able to offer you support and take any action required to safeguard you and others.

In some circumstances, BU may seek assistance from third-party charitable organisations to help provide practical support to students who are self-isolating/in quarantine, e.g. delivery of food and medicines, and this will require us to share some of your information with the charity. We will let you know if this is relevant to you.

If you tell us that you have received a positive Covid-19 test, we will not disclose information about your Covid-19 status to any external organisation (other than your accommodation provider as stated above) unless required by law or guidance, such as if we receive a request from NHS Test and Trace or public health authorities for information required perform their public health and safety roles (see section above). It is for individuals to provide this information to NHS Test and Trace as required under the government guidance, and we will not routinely do so. We will, however, use this information within BU on a confidential basis for the purposes of managing risks to the health and safety of students and staff.

We will use data we hold about dates and times when you were on BU premises to decide whether we need to contact you to tell you that you may have been in contact with someone who has tested positive for Covid-19. Please see below for details of when we may record this information.

Information about your Covid-19 status and the fact that you are self-isolating/in quarantine will be processed in accordance with the BU Data Protection policy. We will only share your information in identifiable form where this is necessary for the purposes outlined in this notice.

Recording information about your presence on BU premises

While the pandemic continues we may record some additional data about dates and times when you have been on BU premises, where this can reasonably be recorded. BU does not have the facility to record information about your presence on BU premises generally, e.g. your entry to or exit from BU campuses or specific BU buildings. BU is not planning to use tracking technology to record individuals’ presence on BU premises. We will record information about your physical use of Library, the gym and certain other on-campus facilities (as legally required for Test and Trace as described above). We may record attendance at timetabled teaching and learning sessions or other pre-arranged meetings with BU staff (in addition to any recording of attendance data usually undertaken in accordance with BU’s Engagement Monitoring and Withdrawal Procedure (3K) (pdf 299kb)). Such information will only be kept for 21 days and we will use it only for the purposes described above. For these purposes we may also use timetabling information (where relevant) to identify when you were on BU premises.

Legal basis under data protection law

Under the data protection legislation we need to identify and explain the legal basis for the processing of your personal data. For the uses of your data described above we consider this to be:

  • For disclosure as part of NHS Test and Trace and wider public health measures, necessary for the performance of a public task: the public task of the NHS and public health authorities in controlling the spread of Covid-19;
  • Necessary for the performance of our public task as a university, which includes providing a safe learning and teaching environment and supporting you in your studies;
  • Necessary for compliance with legal obligations on BU, i.e. where there is a legal requirement under the Covid-19 legislation to record staff and/or service-user data for Test and Trace purposes;
  • Necessary for legitimate interests, i.e. ensuring health and safety within the university environment. We consider that the scope of data being processed and the way in which we will process it means that our approach is proportionate and the legitimate interests are not outweighed by damage to the rights of the individuals.

Where you tell us that you are experiencing Covid-19 symptoms or that you have tested positive for Covid-19, this is “special category data” which requires an additional legal basis. This is that it is necessary for carrying out BU’s health and safety obligations as an employer and social protection in respect of both staff and students (Article 9(2)(b) GDPR and paragraph 1 of Schedule 1 to the Data Protection Act 2018); and safeguarding of individuals at risk (Article 9(2)(g) GDPR and paragraph 18 of Schedule 1 to the Data Protection Act 2018).  When we process information about your Covid vaccinations or medical exemption from Covid vaccination requirements, the additional legal bases of “necessary for reasons of public interest in the area of public health” (Article 9(2)(i) GDPR) and “necessary for the purposes of preventive or occupational medicine…or the management of health or social care systems and services on the basis of [UK] law” are also relevant.