The following policy applies to all users of LifeLab’s learning platform "LifeLabOnline.org", which will be abbreviated as “Learning Platform”. In this policy "we" refers to LifeLab and "you" refers to the user of the Learning Platform.
What this policy does not cover - please note we have separate privacy notices for teachers and students who take part in scientific research studies conducted by LifeLab.
1. Purpose – what is the Learning Platform and what can it be used for?
LifeLab is a unique initiative created by the University of Southampton in collaboration with the National Institute for Health Research, Southampton Biomedical Research Centre and University Hospital Southampton. Our programmes include on-site educational experiences at the LifeLab education centre, work experience, research studies, teacher professional development, opportunities for scientists to train and take part in our programmes and fully resourced educational programmes provided for in-school delivery.
LifeLab's mission is to empower children and young people, through scientific discovery, to make positive lifestyle choices for their health, wellbeing and resilience and for that of children they may have in the future.
The Learning Platform is a free educational platform developed by LifeLab for teachers, students, parents and carers, and researchers through which we share LifeLab programmes and resources across the UK and wider afield, ultimately to educate and empower children and young people for lifelong health.
The Learning Platform provides programmes (courses) which are broken down into modules (lessons) and activities. The Learning Platform hosts LifeLab resources which are available to view or download (such as PowerPoints, videos and PDFs) and online learning modules for interactive learning (e.g. self-directed learning for students). Depending on how the programme is structured, resources are open access (available for all to view and use), password protected (we will provide you with the details) or for registered users only.
1.1 Data collection
We collect data to improve the user experience, provide programmes and resources to specific cohorts and track student progress. For example, some programmes are for registered users only which enables us to limit / target the students taking part in the programme to meet the programme's objectives.
2. Data protection
We comply with the Data Protection Legislation and its principles, which means that your data will be:
- Used lawfully, fairly and in a transparent way
- Collected only for valid purposes that we have clearly explained to you and not used in any other way that is incompatible with those stated purposes
- Used in a way that is relevant to the purposes we have told you about and limited in usage only to those purposes
- Kept only as long as necessary for the purposes we have told you about
- Kept securely
The basis for processing personal data is in particular the EU General Data Protection Regulation (GDPR). The collected data will be processed for the purpose described in Section 1.1. The information provided, such as progress in the course, completion, e-mail address, name and other aggregated data, is processed exclusively for the purpose described under Section 1.2 and for the continuous technical improvement of the system operation by the operator of the Learning Platform (see Section 5). The intention is not to use the data for purposes other than those mentioned above. If the data are to be used for other purposes in the future, e.g. for scientific research purposes, we will request consent in advance.
There is no profiling in the sense of the EU General Data Protection Regulation. Tests are evaluated automatically and anonymously. The test questions for each individual course are professionally compiled by people. In the following, we will describe the personal data processed. Other personal data may only be collected and processed on the Learning Platform in accordance with the legal requirements if there is an appropriate legal basis.
2.1 Registration on the learning platform
At the time of registration, the following data will be collected:
- Surname
- First name
- User Group e.g. student, teacher, parent / carer, researcher / scientist, other
- Name of school, college or educational establishment (mandatory for students; optional for other groups e.g. teacher, researcher / scientist)
- Email address
2.2 What data are stored?
Master data consists of information such as your name and e-mail address (as described in Section 2.1). Engagement data includes the programmes and modules that you use and what you have done in these modules and when (e.g. which pages you have accessed). The data will be stored in the database of the Learning Platform. This is located on servers operated by the Clinical Informatics Research Unit (CIRU), an applied research and enterprise unit within the Faculty of Medicine at the University of Southampton.
The Learning Platform also generates log files on your usage. The following data are stored: IP address of the accessing end device; date and time of access; requested resource; status code of the responding web server; website from which the delivered resource was requested (“referrer”); browser type identification; error message issued by the web server in case of an error.
The engagement data stored by the Learning Platform are recorded exclusively for technical or statistical purposes. The data transfers required for this are secured.
2.3 Cookies
Cookies (short text information) are used by the Learning Platform in several ways:
Session cookie: This cookie is necessary so that the Learning Platform can identify you when you access multiple pages without requiring you to authenticate yourself each time you switch pages. The cookie is stored the first time you access the Learning Platform and remains until you log off the Learning Platform or close your browser (the latter can be prevented by local browser settings, if necessary).
Usability cookies: Individual components of the Learning Platform use cookies to increase user friendliness – for example, to save the status of visible or hidden website elements when multiple pages are accessed.
The other cookie is for convenience and is called MoodleID by default. This cookie stores the login name in the web browser and remains there even after you log out. When you log in the next time, your login name is already entered. You can prevent this cookie from being set, but then you will have to enter your login name each time you log in.
2.4 Who has access to what?
The platform consists of “programmes” that are divided into “modules.”
LifeLab Educators are employees of the University of Southampton. They have access rights to a programme that they are in charge of. They are able to set content and activities, while also controlling access to the programme and the roles and rights within the programme. For the management of participants, they can access the list of participants and thus the master data of all programme participants. For the activation of participants, they can access the given name, surname and e-mail address of all users. In addition to this, they have access to all content that users create in the course.
Administrators are the persons entrusted with the administration of the Learning Platform and have access rights for the entire system. They can access all data of the Learning Platform as well as the engagement data collected by the Learning Platform. These rights are only granted to a few employees assigned to those responsible for the Learning Platform.
CIRU has access to the Learning Platform source and content files and the server that hosts the Learning Platform. They will monitor and use the platform performance data to ensure an optimal server environment for the Learning Platform.
2.5 Support and inquiries
Please use our e-mail address: lifelab@soton.ac.uk if you need to contact us directly. Your e-mail address will only be used for correspondence with you. When you communicate with us via e-mail, it is assumed that you also wish to receive a reply by e-mail, unless you express the desire to communicate in another form. If necessary, your e-mail will be forwarded to the responsible member of the team at LifeLab or the appropriate department at the University for further processing.
2.6 Erasure
The data in your user profile are stored until the user profile is erased. User profiles are erased from the system as soon as they are no longer required for the purpose of collection, or if you request for us to erase your profile.
Your programme engagement data will be stored until the programme is erased. Results from tests, learning packages and tasks as well as data on the completion of the programme and the overall assessment are stored at most until the expiration of statutory retention obligations.
2.7 Your rights
If the legal requirements are met, you have various rights with regard to the controller in terms of the data stored on you. Your rights include:
Information (Art. 15 GDPR): You have the right to receive information on the data stored on you from the controller (see Section 5).
Right to rectification (Art. 16 GDPR): If incorrect data are stored, you can rectify them in part yourself (profile data you entered) or ask the controller to do so. The controller will comply with the request if the rectification is justified and appropriate (Art. 16 GDPR).
Right to erasure (Art. 17 GDPR): You have a right to have data (master data) erased if such data are actually incorrect or if the controller has no further purpose for them. There is no right to erase data if the controller is obligated to store the data for statutory reasons or due to other obligations (proof of instruction, proof of quality assurance, copyright usage rights, an audit right). The obligation to retain data may also apply after the end of participation in the programme. There is also no right to erasure if information has been entered by you yourself and such information appears in a context with the information provided by other users (e.g. forum posts).
Right to restriction of processing (Art. 18 GDPR): The controller will ensure that data, if restricted, are only accessible to those persons who absolutely must view the data. For this purpose, they may use pseudonymization and anonymisation.
Right to object (Art. 21 GDPR): You can object to the further use of your data (master data). This can only be effective for the future. The right to object is not an automatic obligation for the controller to erase the data. If the controller has storage obligations for other reasons, he or she will weigh these against the request and inform you.
Data portability (Art. 20 GDPR): You have a right to receive data entered by you yourself in an electronic format that can be used elsewhere. The right is limited to data processed on the basis of consent or a contract and not subject to a trade secret or other obligations to preserve confidentiality, and therefore may not be transferred to other bodies, or where the data relate to the rights of others, e.g. copyright.
Right of withdrawal (Art. 7 GDPR): You have the right to withdraw your consent to the processing of your data at any time. The withdrawal can lead to the fact that you will no longer be able to access the Learning Platform or participate in a programme. Withdrawal does not affect the lawfulness of data processing up to the time of withdrawal.
In the event of a breach of statutory provisions for the protection of the data stored on you, you can contact a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for LifeLab can be found under Section 5. Please start by contacting the controller or the official data protection officer (see Section 5). In most cases, it is possible to clarify questions and resolve complaints in this way.
In the event of erasure, restriction or withdrawal, further use of the Learning Platform and access to the learning content stored there as well as participation in the activities and functions available there are no longer guaranteed with immediate effect.
3. Amendment of this policy
LifeLab reserves the right to extend or amend this policy. The valid policy is published on the Learning Platform.
4. Responsaible bodies
Programme and module administration, programme support, programme content:
The employees of LifeLab are responsible for the content and operation of the programmes, modules and activities on the Learning Platform.
Learning Platform Support:
Claire Colbain
LifeLabOnline Administrator
LifeLab
Level D, Room LD150
Mailpoint 847
University Hospital Southampton
SO16 6YD
lifelab@soton.ac.uk
Responsible Data Controller:
Kath Woods-Townsend
LifeLab Programme Manager and Director
LifeLab
Level D, Room LD150
Mailpoint 847
University Hospital Southampton
SO16 6YD
lifelab@soton.ac.uk
5. Official Data Protection Officer of the University of Southampton
The Data Protection Officer
Legal Services
University of Southampton, Highfield
Southampton
SO17 1BJ
data.protection@soton.ac.uk
6. Use of webpage analysis tools
We currently do not use any additional web analytics tools (e.g. google analytics, or open-source-software tools). We will update this section if / when any additional tools are introduced.