Data privacy notice – Study psychologist services
Data Controller
University of Oulu
Pentti Kaiterankatu 1
P. O. Box 8000, 90014 OULU
Tel. +358 294 48 0000
Unit in charge of the processing:
Learning Support and Wellbeing Centre
Director Kauko Keskisärkkä, opiskeluntuki(at)oulu.fi
Contact details of study psychologist services: opintopsykologi(at)oulu.fi
University Data Protection Officer: dpo(at)oulu.fi
Purpose of processing personal data and legal basis for processing personal data
At the University of Oulu, the purpose of study psychologist services is to support students in challenges related to their studies and to promote overall wellbeing and academic capability. Study psychologists do not provide clinical or therapeutic services.
The personal data collected during the appointment booking process is used to identify the student and for any necessary communications related to the appointment.
Personal data stored in the study psychologists’ client register is processed for the management of client relationships and in connection with individual study arrangements. Maintaining a client register and documenting appointments is in the best interest of the client. The data is used solely for the planning and implementation of guidance provided by study psychologists.
Pseudonymised personal data is processed for statistical purposes. The statistical analysis is conducted to support the development of services within Learning Support and Wellbeing Centre at the University of Oulu.
In individual guidance sessions, the legal basis for processing personal data is a statutory obligation. The University of Oulu is not a healthcare provider, and records of appointments do not constitute as medical records (based on a separate decision regarding the legal basis for processing personal data in study psychologist services at the University of Oulu, dated 2 December 2024). However, study psychologists are licensed healthcare professionals and are required to comply with the Act on Health Care Professionals when conducting psychological work involving individuals.
When preparing recommendations for individual study arrangements, personal data provided by the data subject—such as health-related information or other justifications—may be processed. These data may include special categories of personal data, for which the legal basis for processing is a statutory obligation under the Universities Act (Sections 43 b – 43 d).
Personal data to be processed
The following personal data is processed from clients receiving guidance:
- First name, last name
- Phone number
- Email address
- Faculty and degree programme
- Year of commencement of studies
- Number of completed credits
- Reasons for seeking guidance
- Records of appointments
- Certificates of attendance upon client request
- Additional information voluntarily provided by the client
- Possible study-related health consultation organized by the Finnish Student Health Service (FSHS)
Study psychologists maintain a client register for individual guidance sessions and document the sessions in Diarium client information system. This practice is based on the fact that study psychologists are licensed healthcare professionals and are required to comply with the Act on Health Care Professionals in their psychological work with individuals.
When preparing recommendations for individual study arrangements, the following personal data may be processed:
- Student ID number
- Last name and first names
- Address
- Email address
- Phone number
- Faculty and degree programme
- Health-related information or other justifications provided by the data subject in support of the recommendation
(based on the Universities Act, Sections 43 b – 43 d)
The origin of personal data (when it is not provided by the data subject)
We receive personal data from the following sources:
- Information provided and submitted by the client
- Data generated during guidance sessions
Recipients or categories of recipients of personal data
Personal data may be disclosed with the client’s consent to an authority that has a legal right to access the data, upon receipt of a written request from the authority specifying the legal basis for the right of access. Without the client’s consent, data may be disclosed only if the disclosure or the right to access the data is explicitly provided by law.
Collected statistical data may be shared and used, for example, in reports and presentations concerning the nature and scope of individual study arrangements. Pseudonymised statistical data is always anonymised prior to disclosure.
Transfers of personal data to third countries or international organizations
Regarding Diarium client information system, the data controller does not transfer personal data outside the European Union or the European Economic Area.
Vihta appointment booking system uses Data Privacy Framework certified Cloudflare service, which enables data transfers outside the EU/EEA to the United States under the same conditions as within the EU. The following personal data is stored in Vihta when booking an appointment: first name, last name, email address and phone number.
Data storage time
Personal data processed in study psychologist services may include special categories of personal data. In such cases, the retention period is determined in accordance with Section 45 b of the Universities Act, and the data is retained for four (4) years after the conclusion of the guidance relationship.
In Vihta appointment booking system, data is deleted once per academic year.
Data Subject Rights
As a data subject has the following rights:
- Right of access to your personal data
- Right to rectify inaccurate or incomplete data
- Right to erase personal data ("right to be forgotten")
- Right to restriction of processing
- Right to object to processing
- Right to data portability (transfer of data from one system to another)
Please note that the rights mentioned above will be considered case by case in accordance with the European Data Protection Regulation. Also note that in all occations you do not have the rights mentioned above.
If you have questions concerning your rights, you can contact the data protection officer or faculty’s contact person.
How can you exercise your rights?
If you wish to exercise your rights mentioned above, please send your request to: kirjaamo(at)oulu.fi. You will get a reply with necessary instructions.
Right of appeal to the supervisory authority
In addition to the rights mentioned above, you have the right to file a complaint about the processing of your personal data with the Office of the Data Protection Ombudsman as the supervisory authority. The contact details and opening hours can be found on the website of the Data Protection Ombudsman.
General description of the technical and organisational protection measures
As the data controller, the University of Oulu applies appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, as well as against accidental loss, destruction, or damage.
The data processed is confidential. Study psychologists are licensed healthcare professionals and are subject to professional confidentiality obligations under health sector legislation. Personal data may only be processed by study psychologists and study psychologist trainees.
The data consists of electronic appointment booking information and electronic records of guidance sessions. In Vihta appointment booking system, data is retained for one academic year. Study psychologists transfer essential information to the electronic client information system.
Records of guidance sessions are retained in the electronic client information system for four (4) years after the conclusion of the guidance relationship.