Privacy Policy

This portal is provided by the University of South Wales to give students and staff secure access to referrals, assessment status, and reports. It is designed to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This notice explains how the portal processes your personal data and your rights under data protection law.

What data the portal collects

When you use the portal, the following types of data are processed:

  • Login information: your USW email address and sign-in activity through Microsoft Entra Single Sign-On (SSO).
  • Referrals and assessments: details about your referral, case status, and outcomes, provided securely by the OHIO system.
  • Reports: assessment reports made available to you by the OHIO system (normally in English). The portal does not alter their content.
  • Audit logs: records of sign-ins, report views, and status changes, including IP address and timestamp, to maintain a secure record of activity.

The portal does not collect or use your data for advertising or marketing purposes.

Legal basis

Personal data is processed to provide educational disability assessment services, in line with the University’s public task and contractual obligations. Audit logging is required to maintain system security, meet compliance requirements, and evidence service standards.

How long data is kept

  • Audit logs are kept for 3 years.
  • Reports and referral records are kept in line with service requirements and may be exported to USW on request or at contract exit.
  • Login session data is deleted automatically when you sign out.

Who controls the data

The University of South Wales is the Data Controller for all data held within this portal. Some information originates from the OHIO system, which provides the source data for reports and referrals.

How data is protected

  • All data is stored and processed within the UK/EEA.
  • Data is encrypted at rest and in transit.
  • Access is restricted to authenticated users only.
  • Logs are retained securely and monitored for unusual activity.

Your rights

You have the right to:

  • Request a copy of the personal data held about you in the portal.
  • Request correction if any information is inaccurate.
  • Raise concerns or complaints about the handling of your data.

To exercise these rights, please contact the University’s Data Protection Officer (DPO) via the Contact page.

Last updated: August 2025