Privacy Notice: DSA Needs Assessment Services

This privacy notice explains how Karen Morton/KM Support Consultancy collects, uses, stores, and protects your personal data, including sensitive health information, when you undergo a Disabled Students' Allowances (DSA) needs assessment.

As a sole trader, I am the Data Controller for your personal data. I am registered with the Information Commissioner's Office (ICO) under registration number ZC235827.

The Types of Personal Data Collected

To complete your DSA needs assessment report, I collect and process the following information:

  • Identity & Contact Data: Your full name, date of birth, phone number, email address, and home/term address.
  • Academic Data: Your university or college name, course title, year of study, and student reference numbers.

  • Special Category (Health) Data: Medical evidence, diagnostic reports (e.g., psychological assessments, consultant letters), details of your disability or health condition, and information you share during the interview about how your condition impacts your studies.

Why the Data is Processed & The Legal Basis

I process your data to deliver your independent DSA Needs Assessment Report and recommend appropriate equipment, software, and human support.

Under the UK GDPR, the legal reasons I rely on to process this data are:

  • Contractual Necessity: Processing your standard personal data is required to fulfil the service agreement you or your funding body signed with me.

  • Substantial Public Interest (Health Data): Because I process sensitive health data, I rely on UK GDPR Article 9(2)(g) along with Schedule 1, Part 2 of the Data Protection Act 2018 (Support for individuals with a particular disability). This allows me to process health data to ensure you receive the statutory educational funding and provisions you are entitled to under Scottish education frameworks.

How Data is Collected

Most of the personal data I hold is provided directly by you when you complete pre-assessment questionnaires, send me your medical evidence, or participate in the assessment interview. I may also receive data from your college/university disability service or your funding body if they refer you directly.

Who the Data is Shared With

To secure your funding and support, your completed DSA needs assessment report and relevant medical summaries will be securely shared with:

  • The Student Awards Agency Scotland (SAAS) (or your specific funding body, such as the Student Loans Company/Student Finance England, if applicable).
  • The Disability / Accessibility Team at your chosen college or university.
  • Approved Supplier Companies (only the specific equipment or non-medical personal support providers named in your report, to allow them to deliver your approved items).

I will not sell your data or share it with any other third parties unless legally required to do so, or in an exceptional situation where there is an immediate risk to your safety (safeguarding).

Data Security & Storage

Your privacy is treated with the highest level of security.

  • All digital records, reports, and emails are stored on secure, fully encrypted cloud storage servers and password-protected devices using multi-factor authentication (MFA).

  • Completed reports are transmitted to funding bodies and institutions via secure portals or password-protected files.
  • Any physical notes taken during the assessment are held in locked storage and securely shredded as soon as they are typed into your digital file.

 

Data Retention: How Long Records Are Kept

In line with standard professional body guidelines and audit requirements for Scottish educational grants, I retain your assessment files, medical evidence, and final report for 6 years after your assessment is completed. Once this period ends, all electronic files will be permanently deleted, and any remaining physical paperwork will be securely destroyed.

Your Data Protection Rights

Under UK data protection law, you have rights including:

  • Your right of access: You can ask for copies of your personal data and your final report at any time.
  • Your right to rectification: You can ask me to correct information you think is inaccurate or incomplete.
  • Your right to erasure: You can ask me to erase your personal data in certain circumstances (though this may be limited by my legal obligations to retain audit trails for funding bodies).

How to Complain or Ask Questions

If you have any questions about this privacy notice, or if you wish to exercise your data protection rights, please contact me directly:

If you remain unhappy with how your data has been handled, you have the right to lodge a formal complaint with the UK data protection authority: