Privacy Policy

This policy establishes the principles and procedures governing the collection, processing, storage, use, sharing, retention, and disposal of personal data by Asheville Medical Training College.

This policy applies to:

• All students and prospective students
• Academic and non-academic staff
• Board members and consultants
• Parents, guardians, sponsors, and next of kin
• Contractors, service providers, and partners
• Visitors to the College website and digital platforms

The College shall ensure that personal data is:

• Processed lawfully, fairly, and transparently — in accordance with the Data Protection Act, 2019
• Collected for explicit, specified, and legitimate purposes
• Adequate, relevant, and limited to what is necessary
• Accurate and kept up to date
• Retained only for as long as necessary
• Protected against unauthorized access, loss, destruction, or disclosure
• Processed in a manner that respects the rights and freedoms of data subjects

The College may collect:

• Full names, date of birth, gender, and identification details
• Contact information including telephone numbers, email addresses, and physical addresses
• Academic records, certificates, transcripts, and examination results
• Parent, guardian, sponsor, and next-of-kin details
• Financial information required for fee administration
• Health information where necessary for student welfare, clinical placements, or emergency medical care
• Photographs and biometric information where required for identification and security purposes
• Information submitted through websites, online application portals, and social media platforms

Personal data shall be processed for:

• Admission, registration, and enrolment purposes
• Delivery of educational and training services
• Examination administration and certification
• Clinical placement, internship, and attachment coordination
• Student support and welfare services
• Financial management and fee administration
• Communication of institutional information
• Security and access control
• Compliance with legal, regulatory, accreditation, and reporting requirements

The College shall process personal data based on:

• Consent of the data subject
• Contractual obligation
• Legal obligation
• Vital interests of the data subject
• Legitimate interests pursued by the College

The College shall implement appropriate security measures including:

• Password-protected information systems
• Restricted access to personal data
• Secure storage of physical records
• Staff confidentiality obligations
• Regular monitoring and review of data security controls
• Secure disposal of records that are no longer required

Personal data may be disclosed only:

• With the consent of the data subject
• To regulatory bodies and government agencies where legally required
• To examination and accreditation bodies
• To hospitals, healthcare facilities, and training institutions for educational and clinical placement purposes
• To authorized service providers operating under confidentiality agreements
• Pursuant to a lawful court order or legal obligation

Data subjects have the right to:

• Be informed about the use of their personal data
• Access their personal data
• Request correction of inaccurate or incomplete information
• Object to processing under certain circumstances
• Request deletion of personal data where legally permissible
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Office of the Data Protection Commissioner

Questions, requests, concerns, or complaints regarding the collection, processing, access to, correction of, or use of personal data may be directed to: