NMH Privacy Notice

Last updated: 12 October 2026 · Next review: October 2027

This notice is for students who receive Non-Medical Help (NMH) from us, funded by Disabled Students' Allowance (DSA). Our general website privacy policy covers everything else.

Who we are

Neurodivergent Minds, 47 Bengal Street, Ancoats, Manchester, M4 6BB, is the data controller. Contact: nmh@neurodivergentminds.com.

What we hold

• Your name, contact details, date of birth and Student Finance Customer Reference Number (CRN).
• Your university, course and course end date.
• Your DSA2 entitlement letter: the type of support, hours and rate approved.
• Relevant information about your disability and support needs, from your needs assessment report or from you. This is "special category" data.
• Session records: dates, times, how support was delivered, brief notes on what was covered, your work/learning plan, and your confirmation that each session took place.
• When you confirm a session online: the time, the email address the link was sent to, and the network (IP) address and browser you used. This is evidence that you, and not someone else, confirmed it.
• Emails and messages between us, and records of any complaints or safeguarding concerns.

Why we use it and our legal basis

Purpose	Legal basis
Arranging and delivering your support	Contract / steps at your request; for health information, Article 9(2)(h) (provision of health or social care) and your explicit consent
Timesheets and invoicing Student Finance England	Contract, and legal obligation (financial records)
Responding to DfE / SLC audits	Legal obligation and legitimate interests (meeting the NMH Register membership standards)
Safeguarding	Vital interests, and substantial public interest (safeguarding of individuals at risk)

Who we share it with

• Student Finance England / Student Loans Company and DfE: invoices, timesheets and session confirmations, and records requested in an audit.
• Your university disability team: your work plan and support records, only with your consent, or without it if there is a safeguarding concern.
• Your Needs Assessor: if you ask us to, for example when you need more hours.
• Services we use to run things: our secure web server (UK/EU hosting), Resend (to send session confirmation emails), Microsoft Teams (video sessions), and our business email provider. They only process data on our instructions.
• Emergency services or other agencies, if someone is at serious risk (see our Safeguarding Policy).

We never sell your data and never use it for marketing.

How long we keep it

Student Finance England requires NMH providers to keep records for at least 6 years from your last session. We keep them for 6 years from the end of the academic year of your last session, then securely delete them. We keep only what is needed to meet our obligations; session notes are brief and factual.

How we keep it safe

Records are stored on password-protected, encrypted systems with access limited to people who need it. Session confirmation links are unique to each session and stop working once used or replaced. We don't keep paper records except signed timesheets, which are stored securely and scanned.

Your rights

You can ask for a copy of your information, ask us to correct it, restrict or object to how we use it, or withdraw consent (this won't affect the lawfulness of what we did before). Some records, such as timesheets, must be kept for 6 years even if you ask us to delete them, because the law and DSA funding rules require it. Email nmh@neurodivergentminds.com; we'll respond within one month. You can complain to the ICO at ico.org.uk or on 0303 123 1113.

Questions about this policy

Email nmh@neurodivergentminds.com. You can ask for this policy in another format (large print, plain text, or read through together in a session).

← All NMH policies